Edit tour

Windows Analysis Report
2UoXCbfNSl.msi

Overview

General Information

Sample Name:	2UoXCbfNSl.msi
Original Sample Name:	cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a.msi
Analysis ID:	876164
MD5:	82ff84cb9924f0855a894e75b5d3edb2
SHA1:	df89381239f8a8ececeb697a6a35a573203bac09
SHA256:	cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a
Tags:	gozimsi
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic

Drops executables to the windows directory (C:\Windows) and starts them

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Deletes files inside the Windows folder

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Contains functionality to launch a program with higher privileges

Queries the current domain controller via net

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 5424 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\2UoXCbfNSl.msi" MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 6800 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 6924 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding EA13B634406DD4E4E1EC4CF54DDC47D4 MD5: 12C17B5A5C2A7B97342C362CA467E9A2)

MSI2A38.tmp (PID: 2888 cmdline: "C:\Windows\Installer\MSI2A38.tmp" /DontWait C:\Windows\System32\rundll32.exe C:\Users\user\AppData\Roaming\MSTX340\ini.dll,vips MD5: 0007940F5479831428131F029D3BD8F7)

MSI2E51.tmp (PID: 5228 cmdline: "C:\Windows\Installer\MSI2E51.tmp" "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" file://C:\Users\user\AppData\Roaming\MSTX340/Information_psw.pdf MD5: 0007940F5479831428131F029D3BD8F7)

cmd.exe (PID: 6936 cmdline: cmd /c "net group "domain computers" /domain" >> C:\Users\user\AppData\Local\Temp\4505.tmp MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 7020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

net.exe (PID: 6948 cmdline: net group "domain computers" /domain MD5: 15534275EDAABC58159DD0F8607A71E5)

net1.exe (PID: 6676 cmdline: C:\Windows\system32\net1 group "domain computers" /domain MD5: AF569DE92AB6C1B9C681AF1E799F9983)

cmd.exe (PID: 2184 cmdline: cmd /c "nltest /dclist:" >> C:\Users\user\AppData\Local\Temp\158A.tmp MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nltest.exe (PID: 5828 cmdline: nltest /dclist: MD5: 3198EC1CA24B6CB75D597CEE39D71E58)

cleanup

Snort Signatures

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.5 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.58.8.8.865323532023883 05/26/23-11:41:10.481245
SID:	2023883
Source Port:	65323
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.5 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.58.8.8.858581532023883 05/26/23-11:43:55.578387
SID:	2023883
Source Port:	58581
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.5 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.58.8.8.863446532023883 05/26/23-11:42:04.741109
SID:	2023883
Source Port:	63446
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.5 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.58.8.8.860975532023883 05/26/23-11:42:44.239811
SID:	2023883
Source Port:	60975
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.5 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.58.8.8.856687532023883 05/26/23-11:44:33.716234
SID:	2023883
Source Port:	56687
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.5 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.58.8.8.856682532023883 05/26/23-11:43:20.455009
SID:	2023883
Source Port:	56682
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.5 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.58.8.8.861344532023883 05/26/23-11:45:10.193356
SID:	2023883
Source Port:	61344
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: MSI2A38.tmp, 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmp, MSI2A38.tmp, 00000003.00000000.382068467.000000000136D000.00000002.00000001.01000000.00000003.sdmp, MSI2E51.tmp, 00000005.00000000.384252501.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 2UoXCbfNSl.msi, 51235f.msi.1.dr, MSI2A38.tmp.1.dr, 51235e.rbs.1.dr, 51235c.msi.1.dr, MSI29DA.tmp.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: 2UoXCbfNSl.msi, MSI26B8.tmp.1.dr, 51235f.msi.1.dr, 51235c.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSI2A38.tmp, 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmp, MSI2A38.tmp, 00000003.00000000.382068467.000000000136D000.00000002.00000001.01000000.00000003.sdmp, MSI2E51.tmp, 00000005.00000000.384252501.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 2UoXCbfNSl.msi, 51235f.msi.1.dr, MSI2A38.tmp.1.dr, 51235e.rbs.1.dr, 51235c.msi.1.dr, MSI29DA.tmp.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_013605E9 FindFirstFileExW,

3_2_013605E9

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:65323 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:63446 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:60975 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:56682 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:58581 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:56687 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:61344 -> 8.8.8.8:53

Source: unknown

DNS traffic detected: query: sumarno.top replaycode: Server failure (2)

Source: 51235e.rbs.1.dr, MSI29DA.tmp.1.dr	String found in binary or memory: https://sectigo.com
Source: 2UoXCbfNSl.msi, 51235f.msi.1.dr, 51235c.msi.1.dr	String found in binary or memory: https://sectigo.comButtonText_Yes&YesARPCOMMENTSThis

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI26B8.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\51235c.msi

Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_01356078	3_2_01356078
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0132D060	3_2_0132D060
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0135B336	3_2_0135B336
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_01349730	3_2_01349730
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0134F700	3_2_0134F700
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_01364609	3_2_01364609
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0135E919	3_2_0135E919
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_013538A0	3_2_013538A0
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_013518EF	3_2_013518EF
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0135DB30	3_2_0135DB30
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0134FA8E	3_2_0134FA8E
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0134ADD9	3_2_0134ADD9
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_01330E90	3_2_01330E90
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_01362EC5	3_2_01362EC5

Source: C:\Windows\Installer\MSI2A38.tmp	Code function: String function: 013485D0 appears 39 times
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: String function: 01348246 appears 69 times
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: String function: 01348213 appears 97 times

Source: 2UoXCbfNSl.msi	Binary or memory string: OriginalFilenameviewer.exeF vs 2UoXCbfNSl.msi
Source: 2UoXCbfNSl.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs 2UoXCbfNSl.msi

Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\2UoXCbfNSl.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding EA13B634406DD4E4E1EC4CF54DDC47D4
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI2A38.tmp "C:\Windows\Installer\MSI2A38.tmp" /DontWait C:\Windows\System32\rundll32.exe C:\Users\user\AppData\Roaming\MSTX340\ini.dll,vips
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI2E51.tmp "C:\Windows\Installer\MSI2E51.tmp" "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" file://C:\Users\user\AppData\Roaming\MSTX340/Information_psw.pdf
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c "net group "domain computers" /domain" >> C:\Users\user\AppData\Local\Temp\4505.tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "domain computers" /domain
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 group "domain computers" /domain
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /c "nltest /dclist:" >> C:\Users\user\AppData\Local\Temp\158A.tmp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding EA13B634406DD4E4E1EC4CF54DDC47D4	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI2A38.tmp "C:\Windows\Installer\MSI2A38.tmp" /DontWait C:\Windows\System32\rundll32.exe C:\Users\user\AppData\Roaming\MSTX340\ini.dll,vips	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI2E51.tmp "C:\Windows\Installer\MSI2E51.tmp" "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" file://C:\Users\user\AppData\Roaming\MSTX340/Information_psw.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "domain computers" /domain	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 group "domain computers" /domain	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:	Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\MultiPlast

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF96E1B63E07A25412.TMP

Jump to behavior

Source: classification engine

Classification label: mal52.evad.winMSI@18/31@0/0

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_01326EE0 CoInitialize,CoCreateInstance,VariantInit,VariantClear,IUnknown_QueryService,IUnknown_QueryInterface_Proxy,IUnknown_QueryInterface_Proxy,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,SysAllocString,VariantInit,LocalFree,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

3_2_01326EE0

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_013261D0 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,CloseHandle,Process32NextW,CloseHandle,

3_2_013261D0

Source: 2UoXCbfNSl.msi

Static file information: TRID: Microsoft Windows Installer (77509/1) 52.18%

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7020:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2820:120:WilError_01

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_01321D70 LoadResource,LockResource,SizeofResource,

3_2_01321D70

Source: 2UoXCbfNSl.msi

Static file information: File size 6096508 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbC source: MSI2A38.tmp, 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmp, MSI2A38.tmp, 00000003.00000000.382068467.000000000136D000.00000002.00000001.01000000.00000003.sdmp, MSI2E51.tmp, 00000005.00000000.384252501.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 2UoXCbfNSl.msi, 51235f.msi.1.dr, MSI2A38.tmp.1.dr, 51235e.rbs.1.dr, 51235c.msi.1.dr, MSI29DA.tmp.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: 2UoXCbfNSl.msi, MSI26B8.tmp.1.dr, 51235f.msi.1.dr, 51235c.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSI2A38.tmp, 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmp, MSI2A38.tmp, 00000003.00000000.382068467.000000000136D000.00000002.00000001.01000000.00000003.sdmp, MSI2E51.tmp, 00000005.00000000.384252501.00000000011CD000.00000002.00000001.01000000.00000005.sdmp, 2UoXCbfNSl.msi, 51235f.msi.1.dr, MSI2A38.tmp.1.dr, 51235e.rbs.1.dr, 51235c.msi.1.dr, MSI29DA.tmp.1.dr

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_013481F0 push ecx; ret

3_2_01348203

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSI2E51.tmp			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Executable created and started: C:\Windows\Installer\MSI2A38.tmp			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI28B0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\MSTX340\ini.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2841.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI26B8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI27A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2A38.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2E51.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI27E3.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI28B0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2841.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI26B8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI27A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2A38.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2E51.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI27E3.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI28B0.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\MSTX340\ini.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2841.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI27A3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI27E3.tmp	Jump to dropped file

Source: C:\Windows\Installer\MSI2A38.tmp

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_3-35231

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "domain computers" /domain
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "domain computers" /domain			Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp

API coverage: 5.4 %

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_013605E9 FindFirstFileExW,

3_2_013605E9

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_0134C3B6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0134C3B6

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_01361533 GetProcessHeap,

3_2_01361533

Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_013603E8 mov eax, dword ptr fs:[00000030h]		3_2_013603E8
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0135843F mov ecx, dword ptr fs:[00000030h]		3_2_0135843F

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSI2A38.tmp "C:\Windows\Installer\MSI2A38.tmp" /DontWait C:\Windows\System32\rundll32.exe C:\Users\user\AppData\Roaming\MSTX340\ini.dll,vips

Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_01348553 SetUnhandledExceptionFilter,	3_2_01348553
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_0134C3B6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0134C3B6
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_013483BD IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_013483BD
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: 3_2_01347B9C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_01347B9C

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_01327660 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,GetWindowThreadProcessId,GetWindowLongW,

3_2_01327660

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net group "domain computers" /domain	Jump to behavior
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 group "domain computers" /domain	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\nltest.exe nltest /dclist:	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_01332161
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetLocaleInfoEx,	3_2_013471C1
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_01363414
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: EnumSystemLocalesW,	3_2_01363701
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: EnumSystemLocalesW,	3_2_0135C7A2
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: EnumSystemLocalesW,	3_2_0136379C
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: EnumSystemLocalesW,	3_2_013636B6
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_01363827
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_01363BA3
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetLocaleInfoW,	3_2_01363A7A
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetLocaleInfoW,	3_2_0135CD1F
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_01363D78
Source: C:\Windows\Installer\MSI2A38.tmp	Code function: GetLocaleInfoW,	3_2_01363CA9

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_0134801C cpuid

3_2_0134801C

Source: C:\Windows\System32\nltest.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_01348615 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_01348615

Source: C:\Windows\Installer\MSI2A38.tmp

Code function: 3_2_0135D192 GetTimeZoneInformation,

3_2_0135D192

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	121 Masquerading	OS Credential Dumping	2 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	34 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 File Deletion	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2UoXCbfNSl.msi	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Roaming\MSTX340\ini.dll	0%	ReversingLabs
C:\Windows\Installer\MSI26B8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI27A3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI27E3.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI2841.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI28B0.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI2A38.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI2E51.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://sectigo.comButtonText_Yes&YesARPCOMMENTSThis	0%	Avira URL Cloud	safe
https://sectigo.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sectigo.com	51235e.rbs.1.dr, MSI29DA.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.comButtonText_Yes&YesARPCOMMENTSThis	2UoXCbfNSl.msi, 51235f.msi.1.dr, 51235c.msi.1.dr	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	876164
Start date and time:	2023-05-26 11:40:14 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	2UoXCbfNSl.msi
Original Sample Name:	cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a.msi
Detection:	MAL
Classification:	mal52.evad.winMSI@18/31@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.8% (good quality ratio 93%) Quality average: 67.1% Quality standard deviation: 29.7%
HCA Information:	Successful, ratio: 97% Number of executed functions: 8 Number of non-executed functions: 147
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, rundll32.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): sumarno.top, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: 2UoXCbfNSl.msi

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Installer\MSI26B8.tmp	a.msi	Get hash	malicious	Unknown	Browse
	Impedit.one	Get hash	malicious	Unknown	Browse
	https://howtosocial.it/cx/etrepellendus.php	Get hash	malicious	Unknown	Browse
	https://swift-topup.com/iu/sednihil.php	Get hash	malicious	Unknown	Browse
	Neque.one	Get hash	malicious	Unknown	Browse
	I.one	Get hash	malicious	Unknown	Browse
	Udqw.one	Get hash	malicious	Unknown	Browse
	Ihcs.one	Get hash	malicious	Unknown	Browse
	2.msi	Get hash	malicious	Unknown	Browse
	rX-fve7qv51Lg47BPvLJEMXS7j7K5DQxnhVnwu8fQLo.bin.msi	Get hash	malicious	Qbot	Browse
	mevacuno.msi	Get hash	malicious	Unknown	Browse
	n_f_f_3_3_l_3_t_r_0_n_1_k_4_2144325345.msi	Get hash	malicious	Unknown	Browse
	Pedido_Faturar.HWXBU.msi	Get hash	malicious	Unknown	Browse
	f_4_T_u_r_4_34536_45645_3345_wo.msi	Get hash	malicious	Unknown	Browse
	n_f_3_e_l_3_t_r_0_n_1_k_4_00545.msi	Get hash	malicious	Unknown	Browse
	n_f_3_f_1_s_k_4_l.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Config.Msi\51235e.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	433224
Entropy (8bit):	6.567843589414793
Encrypted:	false
SSDEEP:	12288:1/ePEitwJH6g7scgFzMzMHf7hM53l6hEFMI:1/EEimJH6g7scSzMQDC51fCI
MD5:	5019AEEF7A712537257F5D833CB69E8E
SHA1:	78E1A5D7A41B0984F9C16F90F887473754ED11F7
SHA-256:	D76A49FAB64EC85290B2524B3C0CFEA2613D80C366C85440B982BF77F08B285E
SHA-512:	E61EE3DA78611724D22617D1A75F9C33B4681B207860A4B0B34737890EBACCFAFD8639F3C14FDF6FF2775C90E40EBC80816CA00464ACCF1A2B3CFE4240CA8739
Malicious:	false
Preview:	...@IXOS.@.....@%].V.@.....@.....@.....@.....@.....@......&.{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}..WinStore..2UoXCbfNSl.msi.@.....@.. ..@.....@........&.{B4B73A8E-7CF9-43FC-9AD7-95DE9F858356}.....@.....@.....@.....@.......@.....@.....@.......@......WinStore......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{00A54C1D-61AC-4347-84F4-40773BC436D4}&.{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}.@......&.{43A22BE9-40D1-42CF-AB41-12C0C42E4C16}&.{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}.@......&.{AB6062B9-9B29-4646-B6E6-7DE312E5AD91}&.{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}.@......&.{92907D8E-DBA9-48A2-A3CB-F9F91EE0E4CE}&.{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}.@........CreateFolders..Creating folders..Folder: [1]#.4.C:\Users\user\AppData\Roaming\MultiPlast\WinStore\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..(.C:\Users\user\AppData\Roaming\MSTX340\..../.C:\Users\alf

C:\Users\user\AppData\Local\Temp\158A.tmp

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	36
Entropy (8bit):	4.030493056757482
Encrypted:	false
SSDEEP:	3:XT5LzdUA2AGN8y:XtLxUANGN8y
MD5:	C58986635C266E6C06609B908580BEDE
SHA1:	4672DCE03D3DD9560CF74035AFF3D9AEBB7201E4
SHA-256:	A2F1BB2817F976E129974B003E3EC12FB8A644C1952BB667116317FD26416042
SHA-512:	36241E4BDA8AD7E4137624BBFBB999C643D34A2095BA078F9886D92F4726913BDB9DC1E1F44141A6738C1E4D9042B802E49F774C0F1C6901735F4B069834449F
Malicious:	false
Preview:	The command completed successfully..

C:\Users\user\AppData\Local\Temp\4505.tmp

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	78
Entropy (8bit):	4.53413189515719
Encrypted:	false
SSDEEP:	3:GAJzRRljFEOIlAEXrkVBiqV9yyn:5zRRl5KAEXoriqX
MD5:	AAEC14B2DE8E2FDAF8427672122AF65C
SHA1:	CA953EFAD669C93AF85B968D747BAA544D4465FB
SHA-256:	14C94C44D0EB89A820D96E1791F4B754C87EE778B5F4478289DF0FB22E1C3DA1
SHA-512:	A5CBAD3DE5070FDCD6AA7F3F5EDA42B69FAEF44A431CF48E20CA1F4F42C648EE80BD5F1D9B981624AE6B39E2435B4278C9FD1E97491E3B244A2BBA7D629021A8
Malicious:	false
Preview:	The request will be processed at a domain controller for domain WORKGROUP.....

C:\Users\user\AppData\Roaming\MSTX340\Information_psw.pdf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PDF document, version 1.5 (zip deflate encoded)
Category:	dropped
Size (bytes):	5025958
Entropy (8bit):	7.900777436536752
Encrypted:	false
SSDEEP:	98304:a4+lkYcmmDre6c12gCZ14CMrCQt+v0UO3KibbbbbbwVukcRVILLleuCQf4RD8:4MmmjBgY10bt+MUOTbbbbbbwZcRVILh9
MD5:	3926092166AE5C4C0366277EF094B9E2
SHA1:	225F6AAD4A6AD7F66B674ED40A0CD67B6FBB6F38
SHA-256:	CD30DA7E64DD8C7FD2F707E54C68BD874AAABC48D2B191C2C7E0AEE9C32888CB
SHA-512:	FB077BDEECC571D631F016DAF7091C2BF440BE5819637825B5D89ED361BF76773F615BD1DEC92BE4207679A83817FC4A1A53ED0AE1A5BB4719B6FD4E8421780B
Malicious:	false
Preview:	%PDF-1.5.%......2444 0 obj.<</Linearized 1/L 5025958/O 2446/E 57616/N 84/T 5024216/H [ 474 1159]>>.endobj. ..2452 0 obj.<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/ID[<7C60734995C6624C9AEEF51DA7B6A81D><D430149DEEA1D1468BAE56DDABC60FC4>]/Index[2444 17]/Info 2443 0 R/Length 59/Prev 5024217/Root 2445 0 R/Size 2461/Type/XRef/W[1 2 1]>>stream..h.bbd.``b`..........`............."...9.A...q...x...0......endstream.endobj.startxref..0..%%EOF.. ..2460 0 obj.<</C 1427/Filter/FlateDecode/I 1450/Length 1058/O 1411/S 1259>>stream..h..T.O.u..G.\..\[tu.[.*c."..IL......`B..P.....V..X....m.(...&.8E.(..=..#Z.........bP...]....{..}.}...w....".4.. ..z.....5.k.`.;,....q..A0.9..-;+RR..f.a.......l6s.T..i.UI..>....Z.W..U.ol.>..o.....<.:[.iM.........1sz>S.d.6..8..s......,..J....\.k..?.....`.r......v.O~.>x.W.W.M....y.....f.rD.........}..........Z...eM.K.R;.....}..{.?.a......w...j...+.xuk...\|...].u.@kn.[].L....1..1..f..j..a...[.@PL......1.(G..%BG.tOA.,oe..n.&6&

C:\Users\user\AppData\Roaming\MSTX340\ini.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	294400
Entropy (8bit):	6.630880578475371
Encrypted:	false
SSDEEP:	6144:YwqnlTIaNrhtD+Cqdoazww2X/4TFEX0Ia:5qln1Y2MTGkI
MD5:	D0584EDCC980EF43E697629ADE83C54B
SHA1:	A68DEEA2D4F40BEF60C7F605BC2AAE9698259E69
SHA-256:	E33A713B96B45E2B2E0DA350C0FDAAF865139607066AADFF3B67B0CED82CA8BC
SHA-512:	917F8206777512BA537C3B67D4E1A31CBF86C690986EF617D5EE34A7818CE09C23067CAAE3D22A9E1FF7DBA0FDF17322F33B579CA0827F19EF0CBABE2F486B5E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........X..@X..@X..@Qf.@^..@.v~AZ..@.vzAR..@.v{AP..@.v\|A[..@=xyAY..@=x~A\..@.w~A]..@X.~@...@.w{AW..@.w.AY..@.w.@Y..@.w}AY..@RichX..@........PE..d....ITb.........." ......... ............................................................`.........................................0O.......[...................#..................P...............................p................................................text............................... ..`.rdata..............................@..@.data................~..............@....pdata...#.......$..................@..@.rsrc...............................@..@.reloc...............\|..............@..B........................................................................................................................................................................................................................................

C:\Windows\Installer\51235c.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {B4B73A8E-7CF9-43FC-9AD7-95DE9F858356}, Number of Words: 10, Subject: WinStore, Author: MultiPlast, Name of Creating Application: WinStore, Template: ;1033, Comments: This installer database contains the logic and data required to install WinStore., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Apr 25 16:36:21 2023, Number of Pages: 200
Category:	dropped
Size (bytes):	6096508
Entropy (8bit):	7.8151534308811135
Encrypted:	false
SSDEEP:	98304:ajJzMUpQ/2zKN5DmsQPKEvia5Zld9l4jH43ZnzgB1wLhQNHFRaFUDAQQHk8iQdvk:M5NzKNgsKKE6UZD9l4IZnzgLwLhQNHFd
MD5:	82FF84CB9924F0855A894E75B5D3EDB2
SHA1:	DF89381239F8A8ECECEB697A6A35A573203BAC09
SHA-256:	CD8393350F7CFC0762E09EE3B0A98002A1B9ABF362CAF5F210E717E1D4EBE53A
SHA-512:	416DB643CBFDA60B26BB3EAC8B6A94B148B506BC016D562BC51E085F765400C56412462B42E2E29DCC44FA621349781C1C225081804C528A0A7FD1822663597B
Malicious:	false
Preview:	......................>...................^...................................E.......b.......t...............................N...O...P...Q...R...S...T...U...V............................................................................................................................................................................................!...!...!...!...#...#...#...#...%...%...%...%...'...'...'...'...)...)...)...)...+...+...+...+...-...-..........................................................................<...........!...5............................................................................................... ...+..."...#...$...%...&...'...(...)...*...2...,...-......./...0...1...6...3...4...=...?...7...8...9...:...;.......,...>.......@...A...B...C...D...........G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\51235f.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {B4B73A8E-7CF9-43FC-9AD7-95DE9F858356}, Number of Words: 10, Subject: WinStore, Author: MultiPlast, Name of Creating Application: WinStore, Template: ;1033, Comments: This installer database contains the logic and data required to install WinStore., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Apr 25 16:36:21 2023, Number of Pages: 200
Category:	dropped
Size (bytes):	6096508
Entropy (8bit):	7.8151534308811135
Encrypted:	false
SSDEEP:	98304:ajJzMUpQ/2zKN5DmsQPKEvia5Zld9l4jH43ZnzgB1wLhQNHFRaFUDAQQHk8iQdvk:M5NzKNgsKKE6UZD9l4IZnzgLwLhQNHFd
MD5:	82FF84CB9924F0855A894E75B5D3EDB2
SHA1:	DF89381239F8A8ECECEB697A6A35A573203BAC09
SHA-256:	CD8393350F7CFC0762E09EE3B0A98002A1B9ABF362CAF5F210E717E1D4EBE53A
SHA-512:	416DB643CBFDA60B26BB3EAC8B6A94B148B506BC016D562BC51E085F765400C56412462B42E2E29DCC44FA621349781C1C225081804C528A0A7FD1822663597B
Malicious:	false
Preview:	......................>...................^...................................E.......b.......t...............................N...O...P...Q...R...S...T...U...V............................................................................................................................................................................................!...!...!...!...#...#...#...#...%...%...%...%...'...'...'...'...)...)...)...)...+...+...+...+...-...-..........................................................................<...........!...5............................................................................................... ...+..."...#...$...%...&...'...(...)...*...2...,...-......./...0...1...6...3...4...=...?...7...8...9...:...;.......,...>.......@...A...B...C...D...........G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI26B8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	598840
Entropy (8bit):	6.4742572330426045
Encrypted:	false
SSDEEP:	12288:JTjOV8EDRaQsUDE2dYu8z5fN8HcsvwaqN:hjOeEMQNLS5W8svwaqN
MD5:	8E565FD81CA10A65CC02E7901A78C95B
SHA1:	1BCA3979C233321AE527D4508CFE9B3BA825DBD3
SHA-256:	7B64112C2C534203BB59CE1A9B7D5390448C045DDA424FB3CFD5878EDB262016
SHA-512:	144BDE89EBA469B32B59F30E7F4D451329C541ED7B556BC60D118C9E2E5CDF148C2275CCA51C4B9355686AEFA16A4B86A26D4C8FE0DD2CF318B979863109592E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: a.msi, Detection: malicious, Browse Filename: Impedit.one, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Neque.one, Detection: malicious, Browse Filename: I.one, Detection: malicious, Browse Filename: Udqw.one, Detection: malicious, Browse Filename: Ihcs.one, Detection: malicious, Browse Filename: 2.msi, Detection: malicious, Browse Filename: rX-fve7qv51Lg47BPvLJEMXS7j7K5DQxnhVnwu8fQLo.bin.msi, Detection: malicious, Browse Filename: mevacuno.msi, Detection: malicious, Browse Filename: n_f_f_3_3_l_3_t_r_0_n_1_k_4_2144325345.msi, Detection: malicious, Browse Filename: Pedido_Faturar.HWXBU.msi, Detection: malicious, Browse Filename: f_4_T_u_r_4_34536_45645_3345_wo.msi, Detection: malicious, Browse Filename: n_f_3_e_l_3_t_r_0_n_1_k_4_00545.msi, Detection: malicious, Browse Filename: n_f_3_f_1_s_k_4_l.msi, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)..)..)......$...........8.....>.....c......0......(.........)........A......(....U.(..).=.(......(..Rich)..................PE..L...W.%d.........."!...#.6...........S.......P...............................0............@..........................W..(...8`..,.......................8=.......g..x...p...............................@............P..P............................text....5.......6.................. ..`.rdata...+...P...,...:..............@..@.data... %...........f..............@....rsrc................v..............@..@.reloc...g.......h...~..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI27A3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	598840
Entropy (8bit):	6.4742572330426045
Encrypted:	false
SSDEEP:	12288:JTjOV8EDRaQsUDE2dYu8z5fN8HcsvwaqN:hjOeEMQNLS5W8svwaqN
MD5:	8E565FD81CA10A65CC02E7901A78C95B
SHA1:	1BCA3979C233321AE527D4508CFE9B3BA825DBD3
SHA-256:	7B64112C2C534203BB59CE1A9B7D5390448C045DDA424FB3CFD5878EDB262016
SHA-512:	144BDE89EBA469B32B59F30E7F4D451329C541ED7B556BC60D118C9E2E5CDF148C2275CCA51C4B9355686AEFA16A4B86A26D4C8FE0DD2CF318B979863109592E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)..)..)......$...........8.....>.....c......0......(.........)........A......(....U.(..).=.(......(..Rich)..................PE..L...W.%d.........."!...#.6...........S.......P...............................0............@..........................W..(...8`..,.......................8=.......g..x...p...............................@............P..P............................text....5.......6.................. ..`.rdata...+...P...,...:..............@..@.data... %...........f..............@....rsrc................v..............@..@.reloc...g.......h...~..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI27E3.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	598840
Entropy (8bit):	6.4742572330426045
Encrypted:	false
SSDEEP:	12288:JTjOV8EDRaQsUDE2dYu8z5fN8HcsvwaqN:hjOeEMQNLS5W8svwaqN
MD5:	8E565FD81CA10A65CC02E7901A78C95B
SHA1:	1BCA3979C233321AE527D4508CFE9B3BA825DBD3
SHA-256:	7B64112C2C534203BB59CE1A9B7D5390448C045DDA424FB3CFD5878EDB262016
SHA-512:	144BDE89EBA469B32B59F30E7F4D451329C541ED7B556BC60D118C9E2E5CDF148C2275CCA51C4B9355686AEFA16A4B86A26D4C8FE0DD2CF318B979863109592E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)..)..)......$...........8.....>.....c......0......(.........)........A......(....U.(..).=.(......(..Rich)..................PE..L...W.%d.........."!...#.6...........S.......P...............................0............@..........................W..(...8`..,.......................8=.......g..x...p...............................@............P..P............................text....5.......6.................. ..`.rdata...+...P...,...:..............@..@.data... %...........f..............@....rsrc................v..............@..@.reloc...g.......h...~..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2841.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	598840
Entropy (8bit):	6.4742572330426045
Encrypted:	false
SSDEEP:	12288:JTjOV8EDRaQsUDE2dYu8z5fN8HcsvwaqN:hjOeEMQNLS5W8svwaqN
MD5:	8E565FD81CA10A65CC02E7901A78C95B
SHA1:	1BCA3979C233321AE527D4508CFE9B3BA825DBD3
SHA-256:	7B64112C2C534203BB59CE1A9B7D5390448C045DDA424FB3CFD5878EDB262016
SHA-512:	144BDE89EBA469B32B59F30E7F4D451329C541ED7B556BC60D118C9E2E5CDF148C2275CCA51C4B9355686AEFA16A4B86A26D4C8FE0DD2CF318B979863109592E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)..)..)......$...........8.....>.....c......0......(.........)........A......(....U.(..).=.(......(..Rich)..................PE..L...W.%d.........."!...#.6...........S.......P...............................0............@..........................W..(...8`..,.......................8=.......g..x...p...............................@............P..P............................text....5.......6.................. ..`.rdata...+...P...,...:..............@..@.data... %...........f..............@....rsrc................v..............@..@.reloc...g.......h...~..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI28B0.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	598840
Entropy (8bit):	6.4742572330426045
Encrypted:	false
SSDEEP:	12288:JTjOV8EDRaQsUDE2dYu8z5fN8HcsvwaqN:hjOeEMQNLS5W8svwaqN
MD5:	8E565FD81CA10A65CC02E7901A78C95B
SHA1:	1BCA3979C233321AE527D4508CFE9B3BA825DBD3
SHA-256:	7B64112C2C534203BB59CE1A9B7D5390448C045DDA424FB3CFD5878EDB262016
SHA-512:	144BDE89EBA469B32B59F30E7F4D451329C541ED7B556BC60D118C9E2E5CDF148C2275CCA51C4B9355686AEFA16A4B86A26D4C8FE0DD2CF318B979863109592E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)..)..)......$...........8.....>.....c......0......(.........)........A......(....U.(..).=.(......(..Rich)..................PE..L...W.%d.........."!...#.6...........S.......P...............................0............@..........................W..(...8`..,.......................8=.......g..x...p...............................@............P..P............................text....5.......6.................. ..`.rdata...+...P...,...:..............@..@.data... %...........f..............@....rsrc................v..............@..@.reloc...g.......h...~..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI29DA.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	426852
Entropy (8bit):	6.559397164118567
Encrypted:	false
SSDEEP:	12288:1/ePEitwJH6g7scgFzMzMHf7hM53l6hEFMF:1/EEimJH6g7scSzMQDC51fCF
MD5:	0CB5A74785F2E7579793EE98BC1F6C73
SHA1:	3A4B62BC783F4078C2ECEC6FBC73544846BFB5C5
SHA-256:	CC788E81F0089BCE361227390954CD673EC2C54D8C645C4904F7F2EC422FA008
SHA-512:	966A73C53D9EE2CB1BD00BC4282BE5021645A80E495F91A8648557431EB4C09A92463FDE08999F9F8628D6688F60F14FFA50DEAEABA528BE917EA214FE349808
Malicious:	false
Preview:	...@IXOS.@.....@%].V.@.....@.....@.....@.....@.....@......&.{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}..WinStore..2UoXCbfNSl.msi.@.....@.. ..@.....@........&.{B4B73A8E-7CF9-43FC-9AD7-95DE9F858356}.....@.....@.....@.....@.......@.....@.....@.......@......WinStore......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{00A54C1D-61AC-4347-84F4-40773BC436D4}4.C:\Users\user\AppData\Roaming\MultiPlast\WinStore\.@.......@.....@.....@......&.{43A22BE9-40D1-42CF-AB41-12C0C42E4C16}(.01:\Software\MultiPlast\WinStore\Version.@.......@.....@.....@......&.{AB6062B9-9B29-4646-B6E6-7DE312E5AD91}/.C:\Users\user\AppData\Roaming\MSTX340\ini.dll.@.......@.....@.....@......&.{92907D8E-DBA9-48A2-A3CB-F9F91EE0E4CE};.C:\Users\user\AppData\Roaming\MSTX340\Information_psw.pdf.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]".4.C:\Users\user\AppData\Roaming\M

C:\Windows\Installer\MSI2A38.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	423936
Entropy (8bit):	6.554120162469703
Encrypted:	false
SSDEEP:	12288:A/ePEitwJH6g7scgFzMzMHf7hM53l6hEFM:A/EEimJH6g7scSzMQDC51fC
MD5:	0007940F5479831428131F029D3BD8F7
SHA1:	8DED66ACBD836388C1414512025BD9004C90903B
SHA-256:	340B6EECEB447FB9C8393DDAAA896C9D7013333E2D5587C7A580E56BEB232320
SHA-512:	C4F75C939ACF139F85ABFFC0264DE0279EF35914121E132C0BC22B3EA0080A9573665080F5C8AE5DB3B620341AACC871D094EF52BC7B6963275112572A490BDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.5..g[..g[..g[...X.rg[...^..g[..._.lg[...X.hg[...^./g[..._.hg[...].~g[...Z.fg[..gZ..g[...R.eg[.....~g[..g.~g[...Y.~g[.Rich.g[.........................PE..L...q.%d.........."....#..........................@.................................SL....@..........................................p..8........................:..(...p...........................h...@...............l............................text.............................. ..`.rdata...R.......T..................@..@.data....7...0......................@....rsrc...8....p.......0..............@..@.reloc...:.......<...<..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2E51.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	423936
Entropy (8bit):	6.554120162469703
Encrypted:	false
SSDEEP:	12288:A/ePEitwJH6g7scgFzMzMHf7hM53l6hEFM:A/EEimJH6g7scSzMQDC51fC
MD5:	0007940F5479831428131F029D3BD8F7
SHA1:	8DED66ACBD836388C1414512025BD9004C90903B
SHA-256:	340B6EECEB447FB9C8393DDAAA896C9D7013333E2D5587C7A580E56BEB232320
SHA-512:	C4F75C939ACF139F85ABFFC0264DE0279EF35914121E132C0BC22B3EA0080A9573665080F5C8AE5DB3B620341AACC871D094EF52BC7B6963275112572A490BDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.5..g[..g[..g[...X.rg[...^..g[..._.lg[...X.hg[...^./g[..._.hg[...].~g[...Z.fg[..gZ..g[...R.eg[.....~g[..g.~g[...Y.~g[.Rich.g[.........................PE..L...q.%d.........."....#..........................@.................................SL....@..........................................p..8........................:..(...p...........................h...@...............l............................text.............................. ..`.rdata...R.......T..................@..@.data....7...0......................@....rsrc...8....p.......0..............@..@.reloc...:.......<...<..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1643312877601788
Encrypted:	false
SSDEEP:	12:JSbX72Fj6UAGiLIlHVRpZh/7777777777777777777777777vDHFXEcNuit/l0i5:J7QI5tx3iF
MD5:	EFB3328B4DE134D0E78A76334A84596D
SHA1:	7995922AEB32005BEB2E17E21E85A654A19B8593
SHA-256:	D1E96F12D9544F06CBCE473F6F1F90A484B1BD59BA5DC50E05133B93B04920CA
SHA-512:	74FACAA1185467BC7516B2969D39062AB7CA1BC3F7AF0E356588B778D8E58F4E96A223C47FBAC7B9303D65BAE7EB0A1A53F798170CC4A227E91B4F01879B8139
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5303886579335395
Encrypted:	false
SSDEEP:	48:k8PhquRc06WXJWFT5JBFrSZFAErCykxrSZZThIH:7hq1tFT3BFr4OwCdr4E
MD5:	5A26ADF205D266FD71C7F863D5E2938D
SHA1:	434D819B840D50770E6E85EEE5AC251D12F5439D
SHA-256:	4CAC64CE59CBD07DA3FB8E10E533EF264A2E231B05EDB2089793D9C88F976286
SHA-512:	FFA27B08779C87E6D54FF98D6805EE10E7EAEFAB04E0C86FBCEEB7A64F8254CF436851250B288B82B2F4FDBA8F63BD9D9B4A595ADFA0B6AABD38AB2C70A3CC88
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	81287
Entropy (8bit):	5.298770088687002
Encrypted:	false
SSDEEP:	192:XL/vcrZZDZo/ZrXczaIcO/gcMH5elWSLK:XDvsDZGrkaIcO/Y5XuK
MD5:	E84CEBF763C0BF4948BC6B99286B5479
SHA1:	EFB268A1C5DC2CAA1F2EB69747025E50F46765CA
SHA-256:	53EE78262CD145E9EEAFCBE8DA3DB5DAE242A6DF75832F431DE2D5AB538D5489
SHA-512:	26B52EE7A321FA084B239E0B1FB81BB9B163C4EF0ADC11C60D33D33663F661D85C73987AF4AB6BE0D25A9360527DD845C76CCFFAE3D305A03C368F643CDE5176
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..07/23/2020 10:38:04.497 [4552]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 10:38:04.513 [4552]: ngen returning 0x00000000..07/23/2020 10:38:04.559 [4480]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 10:38:04.559 [4480]: ngen returning 0x00000000..07/23/2020 10:38:04.622 [4256]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 10:38:04.622 [

C:\Windows\Temp\~DF10D2DAB67DA41C8A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2299014095130887
Encrypted:	false
SSDEEP:	48:73iuPO+CFXJXT5xBFrSZFAErCykxrSZZThIH:jif/TPBFr4OwCdr4E
MD5:	A7BC4B3A3E89C185686F43FA605B9B8D
SHA1:	6BC073D16D83BF863862C3B86F052AC5929F0AB3
SHA-256:	B3D5B044FD2DD2F081E8E52EAB1FA572EC181A1D0DA30622449289F5C1307DE7
SHA-512:	AB9C4C66EF8128B642E86B4C98A1897804D8B2992DB389E22A7A56BBF73A8FA4DBA8724E422C8EFE06DBC04D573C80FA6889F60BA672CA335D8D43238A62BD25
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF1227C6BDFAEB717C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5303886579335395
Encrypted:	false
SSDEEP:	48:k8PhquRc06WXJWFT5JBFrSZFAErCykxrSZZThIH:7hq1tFT3BFr4OwCdr4E
MD5:	5A26ADF205D266FD71C7F863D5E2938D
SHA1:	434D819B840D50770E6E85EEE5AC251D12F5439D
SHA-256:	4CAC64CE59CBD07DA3FB8E10E533EF264A2E231B05EDB2089793D9C88F976286
SHA-512:	FFA27B08779C87E6D54FF98D6805EE10E7EAEFAB04E0C86FBCEEB7A64F8254CF436851250B288B82B2F4FDBA8F63BD9D9B4A595ADFA0B6AABD38AB2C70A3CC88
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF68D74EC899244EDA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7FE13E1A7726FEE7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2299014095130887
Encrypted:	false
SSDEEP:	48:73iuPO+CFXJXT5xBFrSZFAErCykxrSZZThIH:jif/TPBFr4OwCdr4E
MD5:	A7BC4B3A3E89C185686F43FA605B9B8D
SHA1:	6BC073D16D83BF863862C3B86F052AC5929F0AB3
SHA-256:	B3D5B044FD2DD2F081E8E52EAB1FA572EC181A1D0DA30622449289F5C1307DE7
SHA-512:	AB9C4C66EF8128B642E86B4C98A1897804D8B2992DB389E22A7A56BBF73A8FA4DBA8724E422C8EFE06DBC04D573C80FA6889F60BA672CA335D8D43238A62BD25
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8512FFC219F00200.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07172138949471873
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOXEcNVfgVky6lit/:2F0i8n0itFzDHFXEcNBit/
MD5:	2A4834F747E9222F78EE8405FD0997E1
SHA1:	4BF2D081A93F6B6B3613D7A51CD425ACB4984DB9
SHA-256:	FA9E61F246D4781A93A9F597C06F7F8DE30E7E6990984A852A5C5BD2DC7B5E4A
SHA-512:	7C98D68920BB69CF3B0BEB63380C84F331B93158AE723B5DA05175CB5F23FD90357FC33B13FEC95F4B51B057BE3685492F21CB77F494597DD1CBBD8AFF6528CE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF95C513D54DE54DBD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF96E1B63E07A25412.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.12531497003687206
Encrypted:	false
SSDEEP:	24:wAYnXLAMTx0EDripV0EDF0EDripV0EDFAEV0yjCykVQwGBVyR+suC:wHkMTNrSZprSZFAErCyk1I
MD5:	203268CF52A6C032ED29188A6BA2F596
SHA1:	41027384693A91DB4DB44A9FEE45B06042C58E78
SHA-256:	1E6F61F2E3C54149C55EF47F1C9464A0B1FD7AE7AE5655E063F6389652AF29BE
SHA-512:	D868CD9BADE8C235320CA52ACA0B874BD565EAE2A89E83822EAB8A8A4FBB0F5C5D86C211A36F6472CCA1B0BE8AD212D7726F1D65FB0707FDA96B13EB2A31EF5D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB2AA96E7FD83FBD9.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5303886579335395
Encrypted:	false
SSDEEP:	48:k8PhquRc06WXJWFT5JBFrSZFAErCykxrSZZThIH:7hq1tFT3BFr4OwCdr4E
MD5:	5A26ADF205D266FD71C7F863D5E2938D
SHA1:	434D819B840D50770E6E85EEE5AC251D12F5439D
SHA-256:	4CAC64CE59CBD07DA3FB8E10E533EF264A2E231B05EDB2089793D9C88F976286
SHA-512:	FFA27B08779C87E6D54FF98D6805EE10E7EAEFAB04E0C86FBCEEB7A64F8254CF436851250B288B82B2F4FDBA8F63BD9D9B4A595ADFA0B6AABD38AB2C70A3CC88
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB34D19DFF552AF61.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBED5ECD771A438C3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDDFB5948BDA3D3DB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE5C2C184C7DA67D2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2299014095130887
Encrypted:	false
SSDEEP:	48:73iuPO+CFXJXT5xBFrSZFAErCykxrSZZThIH:jif/TPBFr4OwCdr4E
MD5:	A7BC4B3A3E89C185686F43FA605B9B8D
SHA1:	6BC073D16D83BF863862C3B86F052AC5929F0AB3
SHA-256:	B3D5B044FD2DD2F081E8E52EAB1FA572EC181A1D0DA30622449289F5C1307DE7
SHA-512:	AB9C4C66EF8128B642E86B4C98A1897804D8B2992DB389E22A7A56BBF73A8FA4DBA8724E422C8EFE06DBC04D573C80FA6889F60BA672CA335D8D43238A62BD25
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\System32\nltest.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.8791536144029335
Encrypted:	false
SSDEEP:	3:YaHNFdAmER2fQsKKrqyav:YQNs92Sfv
MD5:	45B19A8643D9F754F189A9B397DF3722
SHA1:	4A9C4C1A875E5C98353DA157493ED0B4C0A653B5
SHA-256:	BEA3B5810B84EE81FB257645355539BC9BEFA02E457EC4E359BEC21C2BEEB042
SHA-512:	A676AD5D35BE590BC52613499CE6E00452D64C2681E3C23A831BD886350C8EF54BE74FE78A7C6C7ED4984EFFC92F8F7E86B1FD564759156D5A7B288A5754BF38
Malicious:	false
Preview:	Cannot find DC to get DC list from.Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN..

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {B4B73A8E-7CF9-43FC-9AD7-95DE9F858356}, Number of Words: 10, Subject: WinStore, Author: MultiPlast, Name of Creating Application: WinStore, Template: ;1033, Comments: This installer database contains the logic and data required to install WinStore., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Tue Apr 25 16:36:21 2023, Number of Pages: 200
Entropy (8bit):	7.8151534308811135
TrID:	Microsoft Windows Installer (77509/1) 52.18% Windows SDK Setup Transform Script (63028/2) 42.43% Generic OLE2 / Multistream Compound File (8008/1) 5.39%
File name:	2UoXCbfNSl.msi
File size:	6096508
MD5:	82ff84cb9924f0855a894e75b5d3edb2
SHA1:	df89381239f8a8ececeb697a6a35a573203bac09
SHA256:	cd8393350f7cfc0762e09ee3b0a98002a1b9abf362caf5f210e717e1d4ebe53a
SHA512:	416db643cbfda60b26bb3eac8b6a94b148b506bc016d562bc51e085f765400c56412462b42e2e29dcc44fa621349781c1c225081804c528a0a7fd1822663597b
SSDEEP:	98304:ajJzMUpQ/2zKN5DmsQPKEvia5Zld9l4jH43ZnzgB1wLhQNHFRaFUDAQQHk8iQdvk:M5NzKNgsKKE6UZD9l4IZnzgLwLhQNHFd
TLSH:	36561222B2C3C532C55D0277E968FE5E0539BE73473101E777E9396E99B48C1A27AB02
File Content Preview:	........................>...................^...................................E.......b.......t...............................N...O...P...Q...R...S...T...U...V..............................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 26, 2023 11:41:12.081121922 CEST	53	65323	8.8.8.8	192.168.2.5
May 26, 2023 11:42:19.971673965 CEST	53	56751	8.8.8.8	192.168.2.5
May 26, 2023 11:42:20.961313963 CEST	53	56751	8.8.8.8	192.168.2.5
May 26, 2023 11:42:45.269511938 CEST	53	60975	8.8.8.8	192.168.2.5
May 26, 2023 11:43:10.349685907 CEST	53	55068	8.8.8.8	192.168.2.5
May 26, 2023 11:43:11.648736954 CEST	53	55068	8.8.8.8	192.168.2.5
May 26, 2023 11:43:21.521276951 CEST	53	56682	8.8.8.8	192.168.2.5
May 26, 2023 11:43:23.114259005 CEST	53	56682	8.8.8.8	192.168.2.5
May 26, 2023 11:43:32.659657955 CEST	53	58532	8.8.8.8	192.168.2.5
May 26, 2023 11:43:56.697468042 CEST	53	58581	8.8.8.8	192.168.2.5
May 26, 2023 11:43:57.602169991 CEST	53	58581	8.8.8.8	192.168.2.5
May 26, 2023 11:44:34.737889051 CEST	53	56687	8.8.8.8	192.168.2.5
May 26, 2023 11:44:46.149173021 CEST	53	64419	8.8.8.8	192.168.2.5
May 26, 2023 11:45:11.309842110 CEST	53	61344	8.8.8.8	192.168.2.5

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 26, 2023 11:41:12.081121922 CEST	8.8.8.8	192.168.2.5	0x2b56	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:42:19.971673965 CEST	8.8.8.8	192.168.2.5	0x698c	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:42:20.961313963 CEST	8.8.8.8	192.168.2.5	0x698c	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:42:45.269511938 CEST	8.8.8.8	192.168.2.5	0xb958	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:43:10.349685907 CEST	8.8.8.8	192.168.2.5	0x66ae	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:43:11.648736954 CEST	8.8.8.8	192.168.2.5	0x66ae	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:43:21.521276951 CEST	8.8.8.8	192.168.2.5	0xe540	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:43:23.114259005 CEST	8.8.8.8	192.168.2.5	0xe540	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:43:32.659657955 CEST	8.8.8.8	192.168.2.5	0x8abb	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:43:56.697468042 CEST	8.8.8.8	192.168.2.5	0xd13c	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:43:57.602169991 CEST	8.8.8.8	192.168.2.5	0xd13c	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:44:34.737889051 CEST	8.8.8.8	192.168.2.5	0x769	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:44:46.149173021 CEST	8.8.8.8	192.168.2.5	0x54ff	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false
May 26, 2023 11:45:11.309842110 CEST	8.8.8.8	192.168.2.5	0xab75	Server failure (2)	sumarno.top	none	none	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: msiexec.exePID: 5424, Parent PID: 3324

General

Target ID:	0
Start time:	11:41:06
Start date:	26/05/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\2UoXCbfNSl.msi"
Imagebase:	0x7ff79d900000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 6800, Parent PID: 564

General

Target ID:	1
Start time:	11:41:06
Start date:	26/05/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff79d900000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 6924, Parent PID: 6800

General

Target ID:	2
Start time:	11:41:08
Start date:	26/05/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding EA13B634406DD4E4E1EC4CF54DDC47D4
Imagebase:	0x11f0000
File size:	59904 bytes
MD5 hash:	12C17B5A5C2A7B97342C362CA467E9A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: MSI2A38.tmpPID: 2888, Parent PID: 6800

General

Target ID:	3
Start time:	11:41:09
Start date:	26/05/2023
Path:	C:\Windows\Installer\MSI2A38.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSI2A38.tmp" /DontWait C:\Windows\System32\rundll32.exe C:\Users\user\AppData\Roaming\MSTX340\ini.dll,vips
Imagebase:	0x1320000
File size:	423936 bytes
MD5 hash:	0007940F5479831428131F029D3BD8F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: MSI2E51.tmpPID: 5228, Parent PID: 6800

General

Target ID:	5
Start time:	11:41:10
Start date:	26/05/2023
Path:	C:\Windows\Installer\MSI2E51.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSI2E51.tmp" "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" file://C:\Users\user\AppData\Roaming\MSTX340/Information_psw.pdf
Imagebase:	0x1180000
File size:	423936 bytes
MD5 hash:	0007940F5479831428131F029D3BD8F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6936, Parent PID: 5260

General

Target ID:	8
Start time:	11:41:55
Start date:	26/05/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c "net group "domain computers" /domain" >> C:\Users\user\AppData\Local\Temp\4505.tmp
Imagebase:	0x7ff627730000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7020, Parent PID: 6936

General

Target ID:	9
Start time:	11:41:55
Start date:	26/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: net.exePID: 6948, Parent PID: 6936

General

Target ID:	10
Start time:	11:41:55
Start date:	26/05/2023
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net group "domain computers" /domain
Imagebase:	0x7ff737ac0000
File size:	56832 bytes
MD5 hash:	15534275EDAABC58159DD0F8607A71E5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: net1.exePID: 6676, Parent PID: 6948

General

Target ID:	11
Start time:	11:41:55
Start date:	26/05/2023
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 group "domain computers" /domain
Imagebase:	0x7ff734b00000
File size:	175104 bytes
MD5 hash:	AF569DE92AB6C1B9C681AF1E799F9983
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 2184, Parent PID: 5260

General

Target ID:	12
Start time:	11:42:09
Start date:	26/05/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c "nltest /dclist:" >> C:\Users\user\AppData\Local\Temp\158A.tmp
Imagebase:	0x7ff627730000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2820, Parent PID: 2184

General

Target ID:	13
Start time:	11:42:09
Start date:	26/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: nltest.exePID: 5828, Parent PID: 2184

General

Target ID:	14
Start time:	11:42:09
Start date:	26/05/2023
Path:	C:\Windows\System32\nltest.exe
Wow64 process (32bit):	false
Commandline:	nltest /dclist:
Imagebase:	0x7ff6e1400000
File size:	514048 bytes
MD5 hash:	3198EC1CA24B6CB75D597CEE39D71E58
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: MSI2A38.tmpPID: 2888, Parent PID: 6800COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	24.1%
Total number of Nodes:	370
Total number of Limit Nodes:	6

Executed Functions

Function 01326EE0 Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 519
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E01326EE0(void* __ebx, void** __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, DWORD* _a4, intOrPtr* _a8, signed int _a12, char _a16) {
				long _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				int _v28;
				void* _v44;
				char _v68;
				char _v69;
				char _v70;
				void* _v76;
				intOrPtr* _v80;
				signed int _v84;
				int _v88;
				void** _v92;
				int _v96;
				int _v100;
				int _v104;
				int _v108;
				int _v112;
				int _v116;
				int _v120;
				DWORD* _v124;
				int _v128;
				int _v132;
				int _v136;
				int _v140;
				void* _v144;
				int _v148;
				int _v152;
				intOrPtr _v156;
				int _v160;
				intOrPtr _v168;
				char _v176;
				void* _v184;
				char _v192;
				void* _v200;
				char _v208;
				char _v224;
				char _v240;
				long _v404;
				char _v412;
				void** _v416;
				void* __ebp;
				signed int _t194;
				signed int _t195;
				void* _t198;
				void* _t199;
				intOrPtr* _t201;
				void* _t202;
				void* _t203;
				intOrPtr* _t204;
				void* _t205;
				intOrPtr* _t206;
				void* _t207;
				intOrPtr* _t208;
				void* _t209;
				intOrPtr* _t210;
				void* _t211;
				intOrPtr* _t212;
				void* _t213;
				void* _t214;
				signed int _t218;
				char* _t220;
				void _t223;
				void* _t224;
				intOrPtr _t226;
				void* _t227;
				intOrPtr* _t232;
				void* _t233;
				void* _t242;
				void* _t243;
				void* _t244;
				void* _t245;
				void* _t246;
				void* _t247;
				void* _t248;
				void* _t251;
				intOrPtr _t252;
				void* _t264;
				intOrPtr _t266;
				signed int _t269;
				DWORD* _t284;
				long* _t287;
				void** _t302;
				void* _t303;
				intOrPtr _t307;
				void* _t324;
				int _t329;
				long* _t332;
				void* _t333;
				void* _t334;
				char* _t339;
				void* _t347;
				intOrPtr* _t349;
				intOrPtr* _t350;
				intOrPtr* _t351;
				void* _t352;
				void* _t353;
				void* _t356;
				void* _t357;
				signed int _t358;
				void* _t360;
				signed int _t361;
				void* _t365;
				int _t366;

				_t294 = __ebx;
				_push(0xffffffff);
				_push(0x1369f1c);
				_push( *[fs:0x0]);
				_t361 = _t360 - 0xe0;
				_t194 =  *0x1383020; // 0xc9209188
				_t195 = _t194 ^ _t358;
				_v20 = _t195;
				_push(__esi);
				_push(__edi);
				_push(_t195);
				 *[fs:0x0] =  &_v16;
				_v76 = __edx;
				_v92 = __ecx;
				_t349 = _a8;
				_v124 = _a4;
				_v80 = _t349;
				_v84 = 0;
				_t198 = E01325F90();
				_push(0);
				_t369 = _t198;
				if(_t198 != 0) {
					__imp__CoInitialize(); // executed
					__eflags = _t198;
					_v70 = _t198 == 0;
					_v8 = 0;
					_v120 = 0;
					_v8 = 2;
					_t199 =  &_v120;
					__imp__CoCreateInstance(0x136d310, 0, 4, 0x137b320, _t199); // executed
					__eflags = _t199;
					if(_t199 >= 0) {
						_v140 = 0;
						__imp__#8( &_v224);
						_v8 = 4;
						_v116 = 0;
						_v8 = 6;
						_t201 = _v120;
						_t339 =  &_v224;
						_t202 =  *((intOrPtr*)( *_t201 + 0x3c))(_t201, _t339, _t339, 8,  &_v140, 1,  &_v116);
						_t350 = __imp__#9;
						__eflags = _t202;
						if(_t202 >= 0) {
							_v112 = 0;
							_v8 = 0xa;
							_t203 =  &_v112;
							__imp__#176(_v116, 0x136d300, 0x137b310, _t203); // executed
							__eflags = _t203;
							if(_t203 >= 0) {
								_v108 = 0;
								_v8 = 0xf;
								_t204 = _v112;
								_t205 =  *((intOrPtr*)( *_t204 + 0x3c))(_t204,  &_v108);
								__eflags = _t205;
								if(_t205 >= 0) {
									_v104 = 0;
									_v8 = 0x15;
									_t206 = _v108;
									_t207 =  *((intOrPtr*)( *_t206 + 0x3c))(_t206, 0, 0x137b300,  &_v104);
									__eflags = _t207;
									if(_t207 >= 0) {
										_v100 = 0;
										_v8 = 0x1c;
										_t208 = _v104;
										_t209 =  *((intOrPtr*)( *_t208))(_t208, 0x137b2f0,  &_v100); // executed
										__eflags = _t209;
										if(_t209 >= 0) {
											_v96 = 0;
											_v8 = 0x24;
											_t210 = _v100;
											_t211 =  *((intOrPtr*)( *_t210 + 0x1c))(_t210,  &_v96);
											__eflags = _t211;
											if(_t211 >= 0) {
												_v88 = 0;
												_v8 = 0x2d;
												_t344 =  &_v88;
												_t212 = _v96;
												_t213 =  *((intOrPtr*)( *_t212))(_t212, 0x137b2e0,  &_v88); // executed
												__eflags = _t213;
												if(_t213 >= 0) {
													__imp__CoAllowSetForegroundWindow(_v88, 0);
													_t302 = _v92;
													_t351 = __imp__#2;
													_t214 =  *_t302;
													__eflags = _t214;
													if(_t214 != 0) {
														_t356 =  *_t351(_t214);
														_v144 = _t356;
														__eflags = _t356;
														if(_t356 == 0) {
															goto L80;
														} else {
															goto L20;
														}
													} else {
														_t356 = 0;
														__eflags = 0;
														_v144 = 0;
														L20:
														_v8 = 0x36;
														_t302 = 8;
														_v208 = 8;
														_t223 =  *_v76;
														_v76 = _t223;
														_t224 =  *_t351(_t223);
														_v200 = _t224;
														__eflags = _t224;
														if(_t224 != 0) {
															L22:
															_v8 = 0x37;
															_t302 = 8;
															_v192 = 8;
															_t226 =  *_v80;
															_v80 = _t226;
															_t227 =  *_t351(_t226);
															_v184 = _t227;
															__eflags = _t227;
															if(_t227 != 0) {
																L27:
																_v8 = 0x38;
																__imp__#8( &_v240);
																_v8 = 0x39;
																_v176 = 0x16;
																__eflags = _a12;
																_t231 =  !=  ? 0 : 5;
																_v168 =  !=  ? 0 : 5;
																_v8 = 0x3a;
																_t232 = _v88;
																asm("movups xmm0, [ebp-0xac]");
																_t307 =  *_t232;
																_t344 =  *(_t307 + 0x7c);
																asm("movups [ecx], xmm0");
																asm("movups xmm0, [ebp-0xec]");
																asm("movups [ecx], xmm0");
																_t365 = _t361 - 0xffffffffffffffe0;
																asm("movups xmm0, [ebp-0xbc]");
																asm("movups [ecx], xmm0");
																asm("movups xmm0, [ebp-0xcc]");
																asm("movups [ecx], xmm0");
																_t233 =  *( *(_t307 + 0x7c))(_t232, _t356);
																__eflags = _t233;
																if(_t233 >= 0) {
																	__eflags = _a16;
																	if(_a16 == 0) {
																		L55:
																		_v69 = 1;
																		goto L56;
																	} else {
																		_t353 = 0;
																		__eflags = 0;
																		do {
																			asm("xorps xmm0, xmm0");
																			asm("movups [ebp-0x28], xmm0");
																			_v28 = 0;
																			_v24 = 0;
																			_t345 =  *_v92;
																			_t324 =  *_v92;
																			_v80 = _t324 + 2;
																			do {
																				_t264 =  *_t324;
																				_t324 = _t324 + 2;
																				__eflags = _t264;
																			} while (_t264 != 0);
																			_push(_t324 - _v80 >> 1);
																			E01323B40(_t294,  &_v44, _t353);
																			_v8 = 0x43;
																			_t266 = E013240A0(_t294,  &_v68,  &_v44, _t353, _t356, __eflags, _t345);
																			_v8 = 0x45;
																			_t366 = _t365 - 0x28;
																			_t329 = _t366;
																			_v160 = _t366;
																			_v148 = _t329;
																			 *(_t329 + 0x24) = 0;
																			_v8 = 0x46;
																			 *_t329 = 0x137b2c4;
																			 *((intOrPtr*)(_t329 + 4)) = _t266;
																			 *(_t329 + 0x24) = _t329;
																			_v8 = 0x47;
																			_v8 = 0x45;
																			E013261D0(_t294,  &_v136, _t353);
																			_v84 = _v84 | 0x00000001;
																			_t365 = _t366 + 0x28;
																			_v8 = 0x48;
																			E01323CC0( &_v68);
																			_v8 = 0x49;
																			_t269 = _v24;
																			__eflags = _t269 - 8;
																			if(_t269 < 8) {
																				L38:
																				_t332 = _v136;
																				_t344 = _v132;
																				_v28 = 0;
																				_v24 = 7;
																				_v44 = 0;
																				__eflags = _t332 - _t344;
																				if(_t332 != _t344) {
																					_v76 = 0x258;
																				} else {
																					_v76 = _t353;
																				}
																				__eflags = _t332 - _t344;
																				if(_t332 != _t344) {
																					__eflags = (_t344 - _t332 & 0xfffffffc) - 4;
																					if((_t344 - _t332 & 0xfffffffc) != 4) {
																						_push(_v148);
																						_t287 = E01326A60(_t332, _t344);
																						_t365 = _t365 + 4;
																						_t332 = _t287;
																					}
																					_t353 = OpenProcess(0x100400, 0,  *_t332);
																					_v156 = 0x1379700;
																					_v152 = _t353;
																					_v8 = 0x4a;
																					WaitForSingleObject(_t353, 0xffffffff);
																					_t284 = _v124;
																					__eflags = _t284;
																					if(_t284 != 0) {
																						GetExitCodeProcess(_t353, _t284);
																					}
																					_v8 = 0x49;
																					_v156 = 0x1379700;
																					__eflags = _t353;
																					if(_t353 != 0) {
																						CloseHandle(_t353);
																						_v152 = 0;
																					}
																				}
																				_v84 = _v84 & 0xfffffffe;
																				_v8 = 0x3a;
																				_t333 = _v136;
																				__eflags = _t333;
																				if(_t333 == 0) {
																					goto L54;
																				} else {
																					_t344 = _t333;
																					__eflags = (_v128 - _t333 & 0xfffffffc) - 0x1000;
																					if((_v128 - _t333 & 0xfffffffc) < 0x1000) {
																						L51:
																						__eflags = _t333;
																						if(_t333 != 0) {
																							LocalFree(_t333);
																						}
																						_v136 = 0;
																						_v132 = 0;
																						_v128 = 0;
																						goto L54;
																					} else {
																						_t302 =  *(_t344 - 4);
																						_t344 = _t344 - _t302;
																						__eflags = _t344 - 4 - 0x1f;
																						if(_t344 - 4 > 0x1f) {
																							goto L78;
																						} else {
																							goto L51;
																						}
																					}
																				}
																			} else {
																				_t334 = _v44;
																				_t347 = _t334;
																				__eflags = 2 + _t269 * 2 - 0x1000;
																				if(2 + _t269 * 2 < 0x1000) {
																					L36:
																					__eflags = _t334;
																					if(_t334 != 0) {
																						LocalFree(_t334);
																					}
																					goto L38;
																				} else {
																					_t302 =  *(_t347 - 4);
																					_t344 = _t347 - _t302;
																					__eflags = _t344 - 4 - 0x1f;
																					if(_t344 - 4 > 0x1f) {
																						L78:
																						E0134C5C2(_t294, _t302, _t344, _t353);
																						goto L79;
																					} else {
																						goto L36;
																					}
																				}
																			}
																			goto L84;
																			L54:
																			_t353 = _v76;
																			__eflags = _t353 - 0x258;
																		} while (_t353 < 0x258);
																		goto L55;
																	}
																} else {
																	_v69 = 0;
																	L56:
																	_v8 = 0x39;
																	_t350 = __imp__#9;
																	 *_t350( &_v176);
																	_v8 = 0x38;
																	 *_t350( &_v240);
																	_v8 = 0x37;
																	 *_t350( &_v192);
																	_v8 = 0x36;
																	 *_t350( &_v208);
																	_v8 = 0x2d;
																	__imp__#6(_t356);
																	goto L57;
																}
															} else {
																__eflags = _v80 - _t227;
																if(_v80 != _t227) {
																	goto L79;
																} else {
																	goto L27;
																}
															}
														} else {
															__eflags = _v76 - _t224;
															if(_v76 != _t224) {
																L79:
																E01331CB0(0x8007000e);
																L80:
																E01321910(0x8007000e);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t358);
																_push(0xffffffff);
																_push(0x1369f5d);
																_push( *[fs:0x0]);
																_push(_t302);
																_t218 =  *0x1383020; // 0xc9209188
																_push(_t218 ^ _t361);
																_t220 =  &_v412;
																 *[fs:0x0] = _t220;
																_v416 = _t302;
																_v404 = 0xffffffff;
																_t303 =  *_t302;
																__eflags = _t303;
																if(_t303 != 0) {
																	_t220 =  *((intOrPtr*)(8 +  *_t303))(_t303);
																}
																 *[fs:0x0] = _v20;
																return _t220;
															} else {
																goto L22;
															}
														}
													}
												} else {
													_v69 = 0;
													L57:
													_v8 = 0x24;
													_t242 = _v88;
													__eflags = _t242;
													if(_t242 != 0) {
														 *((intOrPtr*)(8 +  *_t242))(_t242);
													}
													goto L59;
												}
											} else {
												_v69 = 0;
												L59:
												_v8 = 0x1c;
												_t243 = _v96;
												__eflags = _t243;
												if(_t243 != 0) {
													 *((intOrPtr*)(8 +  *_t243))(_t243);
												}
												goto L61;
											}
										} else {
											_v69 = 0;
											L61:
											_v8 = 0x15;
											_t244 = _v100;
											__eflags = _t244;
											if(_t244 != 0) {
												 *((intOrPtr*)(8 +  *_t244))(_t244);
											}
											goto L63;
										}
									} else {
										_v69 = 0;
										L63:
										_v8 = 0xf;
										_t245 = _v104;
										__eflags = _t245;
										if(_t245 != 0) {
											 *((intOrPtr*)(8 +  *_t245))(_t245);
										}
										goto L65;
									}
								} else {
									_v69 = 0;
									L65:
									_v8 = 0xa;
									_t246 = _v108;
									__eflags = _t246;
									if(_t246 != 0) {
										 *((intOrPtr*)(8 +  *_t246))(_t246);
									}
									goto L67;
								}
							} else {
								_v69 = 0;
								L67:
								_v8 = 6;
								_t247 = _v112;
								__eflags = _t247;
								if(_t247 != 0) {
									 *((intOrPtr*)(8 +  *_t247))(_t247);
								}
								goto L69;
							}
						} else {
							_v69 = 0;
							L69:
							_v8 = 4;
							_t248 = _v116;
							__eflags = _t248;
							if(_t248 != 0) {
								 *((intOrPtr*)(8 +  *_t248))(_t248);
							}
							_v8 = 2;
							 *_t350( &_v224);
							goto L72;
						}
					} else {
						_v69 = 0;
						L72:
						_v8 = 0;
						_t251 = _v120;
						__eflags = _t251;
						if(_t251 != 0) {
							 *((intOrPtr*)(8 +  *_t251))(_t251);
						}
						_v8 = 0xffffffff;
						__eflags = _v70;
						if(_v70 != 0) {
							__imp__CoUninitialize(); // executed
						}
						_t252 = _v69;
						goto L77;
					}
				} else {
					_push(_v124);
					_t344 = __edx;
					_push(0);
					_push((_a12 & 0x000000ff ^ 0x00000001) + (_a12 & 0x000000ff ^ 0x00000001));
					_push(_t349);
					_t252 = E01327660(__ebx, _v92, __edx, _t349, _t369);
					L77:
					 *[fs:0x0] = _v16;
					_pop(_t352);
					_pop(_t357);
					return E01347708(_t252, _t294, _v20 ^ _t358, _t344, _t352, _t357);
				}
				L84:
			}

0x01326ee0
0x01326ee3
0x01326ee5
0x01326ef0
0x01326ef1
0x01326ef7
0x01326efc
0x01326efe
0x01326f01
0x01326f02
0x01326f03
0x01326f07
0x01326f0f
0x01326f12
0x01326f18
0x01326f1b
0x01326f1e
0x01326f21
0x01326f28
0x01326f2d
0x01326f2f
0x01326f31
0x01326f55
0x01326f5b
0x01326f5d
0x01326f61
0x01326f68
0x01326f6f
0x01326f73
0x01326f85
0x01326f8b
0x01326f8d
0x01326f9e
0x01326fa9
0x01326faf
0x01326fb3
0x01326fba
0x01326fc1
0x01326fd2
0x01326fdb
0x01326fde
0x01326fe4
0x01326fe6
0x01326ff1
0x01326ff8
0x01326ffc
0x0132700d
0x01327013
0x01327015
0x01327020
0x01327027
0x0132702e
0x01327035
0x01327038
0x0132703a
0x01327045
0x0132704c
0x01327053
0x01327061
0x01327064
0x01327066
0x01327071
0x01327078
0x0132707f
0x0132708b
0x0132708d
0x0132708f
0x0132709a
0x013270a1
0x013270a8
0x013270af
0x013270b2
0x013270b4
0x013270bf
0x013270c6
0x013270ca
0x013270cd
0x013270d9
0x013270db
0x013270dd
0x013270ed
0x013270f3
0x013270f6
0x013270fc
0x013270fe
0x01327100
0x0132716b
0x0132716d
0x01327173
0x01327175
0x00000000
0x0132717b
0x00000000
0x0132717b
0x01327102
0x01327102
0x01327102
0x01327104
0x0132710a
0x0132710a
0x0132710e
0x01327116
0x0132711d
0x01327120
0x01327123
0x01327125
0x0132712b
0x0132712d
0x01327138
0x01327138
0x0132713c
0x01327144
0x0132714b
0x0132714e
0x01327151
0x01327153
0x01327159
0x0132715b
0x0132717d
0x0132717d
0x01327188
0x0132718e
0x01327199
0x013271a0
0x013271a8
0x013271ab
0x013271b1
0x013271b8
0x013271bb
0x013271c2
0x013271c4
0x013271cc
0x013271d4
0x013271db
0x013271e0
0x013271e3
0x013271ea
0x013271ef
0x013271f8
0x013271fb
0x013271fd
0x013271ff
0x0132720a
0x0132720e
0x0132740b
0x0132740b
0x00000000
0x01327214
0x01327214
0x01327214
0x01327216
0x01327219
0x0132721c
0x01327220
0x01327227
0x0132722e
0x01327230
0x01327235
0x01327240
0x01327240
0x01327243
0x01327246
0x01327246
0x01327250
0x01327255
0x0132725a
0x01327264
0x01327269
0x0132726d
0x01327270
0x01327272
0x01327278
0x0132727e
0x01327285
0x01327289
0x0132728f
0x01327292
0x01327295
0x01327299
0x013272a3
0x013272a8
0x013272ac
0x013272af
0x013272b6
0x013272bb
0x013272bf
0x013272c2
0x013272c5
0x013272f6
0x013272f6
0x013272fe
0x01327301
0x01327308
0x0132730f
0x01327313
0x01327315
0x0132731d
0x01327317
0x01327318
0x01327318
0x01327324
0x01327326
0x0132732f
0x01327332
0x01327334
0x0132733a
0x0132733f
0x01327342
0x01327342
0x01327354
0x01327356
0x01327360
0x01327366
0x0132736d
0x01327373
0x01327376
0x01327378
0x0132737c
0x0132737c
0x01327382
0x01327386
0x01327390
0x01327392
0x01327395
0x0132739b
0x0132739b
0x01327392
0x013273a5
0x013273a9
0x013273ad
0x013273b3
0x013273b5
0x00000000
0x013273b7
0x013273ba
0x013273c1
0x013273c6
0x013273d9
0x013273d9
0x013273db
0x013273de
0x013273de
0x013273e4
0x013273ee
0x013273f5
0x00000000
0x013273c8
0x013273c8
0x013273cb
0x013273d0
0x013273d3
0x00000000
0x00000000
0x00000000
0x00000000
0x013273d3
0x013273c6
0x013272c7
0x013272c7
0x013272d1
0x013272d3
0x013272d8
0x013272eb
0x013272eb
0x013272ed
0x013272f0
0x013272f0
0x00000000
0x013272da
0x013272da
0x013272dd
0x013272e2
0x013272e5
0x0132751a
0x0132751a
0x00000000
0x00000000
0x00000000
0x00000000
0x013272e5
0x013272d8
0x00000000
0x013273fc
0x013273fc
0x013273ff
0x013273ff
0x00000000
0x01327216
0x01327201
0x01327201
0x0132740f
0x0132740f
0x01327419
0x01327420
0x01327422
0x0132742d
0x0132742f
0x0132743a
0x0132743c
0x01327447
0x01327449
0x0132744e
0x00000000
0x0132744e
0x0132715d
0x0132715d
0x01327160
0x00000000
0x01327166
0x00000000
0x01327166
0x01327160
0x0132712f
0x0132712f
0x01327132
0x0132751f
0x01327524
0x01327529
0x0132752e
0x01327533
0x01327534
0x01327535
0x01327536
0x01327537
0x01327538
0x01327539
0x0132753a
0x0132753b
0x0132753c
0x0132753d
0x0132753e
0x0132753f
0x01327540
0x01327543
0x01327545
0x01327550
0x01327551
0x01327552
0x01327559
0x0132755a
0x0132755d
0x01327563
0x01327566
0x0132756d
0x0132756f
0x01327571
0x01327576
0x01327576
0x0132757c
0x01327587
0x00000000
0x00000000
0x00000000
0x01327132
0x0132712d
0x013270df
0x013270df
0x01327454
0x01327454
0x01327458
0x0132745b
0x0132745d
0x01327462
0x01327462
0x00000000
0x0132745d
0x013270b6
0x013270b6
0x01327465
0x01327465
0x01327469
0x0132746c
0x0132746e
0x01327473
0x01327473
0x00000000
0x0132746e
0x01327091
0x01327091
0x01327476
0x01327476
0x0132747a
0x0132747d
0x0132747f
0x01327484
0x01327484
0x00000000
0x0132747f
0x01327068
0x01327068
0x01327487
0x01327487
0x0132748b
0x0132748e
0x01327490
0x01327495
0x01327495
0x00000000
0x01327490
0x0132703c
0x0132703c
0x01327498
0x01327498
0x0132749c
0x0132749f
0x013274a1
0x013274a6
0x013274a6
0x00000000
0x013274a1
0x01327017
0x01327017
0x013274a9
0x013274a9
0x013274ad
0x013274b0
0x013274b2
0x013274b7
0x013274b7
0x00000000
0x013274b2
0x01326fe8
0x01326fe8
0x013274ba
0x013274ba
0x013274be
0x013274c1
0x013274c3
0x013274c8
0x013274c8
0x013274cb
0x013274d6
0x00000000
0x013274d6
0x01326f8f
0x01326f8f
0x013274d8
0x013274d8
0x013274dc
0x013274df
0x013274e1
0x013274e6
0x013274e6
0x013274e9
0x013274f0
0x013274f4
0x013274f6
0x013274f6
0x013274fc
0x00000000
0x013274fc
0x01326f33
0x01326f33
0x01326f3a
0x01326f42
0x01326f46
0x01326f47
0x01326f48
0x013274ff
0x01327502
0x0132750a
0x0132750b
0x01327519
0x01327519
0x00000000

APIs

Part of subcall function 01325F90: GetCurrentProcess.KERNEL32(00000008,?,C9209188), ref: 01325FA0
Part of subcall function 01325F90: OpenProcessToken.ADVAPI32(00000000), ref: 01325FA7

CoInitialize.OLE32(00000000), ref: 01326F55
CoCreateInstance.OLE32(0136D310,00000000,00000004,0137B320,00000000,?), ref: 01326F85
CoUninitialize.OLE32 ref: 013274F6
_com_issue_error.COMSUPP ref: 01327524

Part of subcall function 01321910: LocalFree.KERNEL32(?,C9209188,?,00000000,013692C0,000000FF,?,?,01381348,00000000,013216D0,80004005), ref: 0132195C

Strings

$, xrefs: 01327454

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Process$CreateCurrentFreeInitializeInstanceLocalOpenTokenUninitialize_com_issue_error
String ID: $
API String ID: 2507920217-3993045852
Opcode ID: 36573915fc372cf617800ac3b0e63a69d35ba1c5aa01df43ba55ab15223084e7
Instruction ID: 6ad4e3d693aeeab394e62713e5ef8a854220250b1e17c8fc84fca427871b5eb2
Opcode Fuzzy Hash: 36573915fc372cf617800ac3b0e63a69d35ba1c5aa01df43ba55ab15223084e7
Instruction Fuzzy Hash: 9422CF70A04398DFEB21DFA8C848BADBFB8BF55308F14819DE445EB281D7759A49CB11

Uniqueness

Uniqueness Score: -1.00%

Function 01348553 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01348553() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E0134855F); // executed
				return _t1;
			}

0x01348558
0x0134855e

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0002855F,01347E51), ref: 01348558

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2d8cf29c502ccebf5c95ef342fe9a436c0831363fbddbfe82df2873d8ad69422
Instruction ID: 0be869cf017c7670af459157ae81bdc2d694e174f35020bf69ddb6753eb81ab0
Opcode Fuzzy Hash: 2d8cf29c502ccebf5c95ef342fe9a436c0831363fbddbfe82df2873d8ad69422
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 01347769 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E01347769(_Unknown_base(*)()* __edi, void* __esi) {
				struct HINSTANCE__* _t2;
				void* _t4;
				void* _t7;
				void* _t10;
				struct HINSTANCE__* _t14;

				_t11 = __edi;
				_push(__edi);
				InitializeCriticalSectionAndSpinCount(0x1384af8, 0xfa0);
				_t2 = GetModuleHandleW(L"api-ms-win-core-synch-l1-2-0.dll"); // executed
				_t14 = _t2;
				if(_t14 != 0) {
					L2:
					_t11 = GetProcAddress(_t14, "SleepConditionVariableCS");
					_t4 = GetProcAddress(_t14, "WakeAllConditionVariable");
					if(_t11 == 0 || _t4 == 0) {
						_t4 = CreateEventW(0, 1, 0, 0);
						 *0x1384af4 = _t4;
						if(_t4 != 0) {
							goto L5;
						} else {
							goto L7;
						}
					} else {
						 *0x1384b10 = _t11;
						 *0x1384b14 = _t4;
						L5:
						return _t4;
					}
				} else {
					_t14 = GetModuleHandleW(L"kernel32.dll");
					if(_t14 == 0) {
						L7:
						E013483BD(_t10, _t11, _t14, 7);
						asm("int3");
						DeleteCriticalSection(0x1384af8);
						_t7 =  *0x1384af4; // 0x0
						if(_t7 != 0) {
							return CloseHandle(_t7);
						}
						return _t7;
					} else {
						goto L2;
					}
				}
			}

0x01347769
0x0134776a
0x01347775
0x01347780
0x01347786
0x0134778a
0x0134779d
0x013477af
0x013477b1
0x013477b9
0x013477d4
0x013477da
0x013477e1
0x00000000
0x00000000
0x00000000
0x00000000
0x013477bf
0x013477bf
0x013477c5
0x013477ca
0x013477cc
0x013477cc
0x0134778c
0x01347797
0x0134779b
0x013477e3
0x013477e5
0x013477ea
0x013477f0
0x013477f6
0x013477fd
0x00000000
0x01347800
0x01347806
0x00000000
0x00000000
0x00000000
0x0134779b

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(01384AF8,00000FA0,?,?,01347747), ref: 01347775
GetModuleHandleW.KERNELBASE(api-ms-win-core-synch-l1-2-0.dll,?,?,01347747), ref: 01347780
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,01347747), ref: 01347791
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 013477A3
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 013477B1
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,01347747), ref: 013477D4
DeleteCriticalSection.KERNEL32(01384AF8,00000007,?,?,01347747), ref: 013477F0
CloseHandle.KERNEL32(00000000,?,?,01347747), ref: 01347800

Strings

WakeAllConditionVariable, xrefs: 013477A9
kernel32.dll, xrefs: 0134778C
SleepConditionVariableCS, xrefs: 0134779D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0134777B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 32d9540edf576d66ba052dcc886832d496d1a6f160e4620a946a2d1e258771bd
Instruction ID: c0f4b14ad7b2453c0f7b2bf8962acc6180d239229478201054f4484dd2f3438d
Opcode Fuzzy Hash: 32d9540edf576d66ba052dcc886832d496d1a6f160e4620a946a2d1e258771bd
Instruction Fuzzy Hash: DD01B135740312ABE7319BB9AC08F2A7EDCAF45B49F058029F945EA618DBB494008764

Uniqueness

Uniqueness Score: -1.00%

Function 01325F90 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01325F90() {
				long _v4;
				void _v8;
				void* _v12;
				void* _v16;
				int _t15;
				signed int _t20;

				_v12 = 0;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v12) != 0) {
					_v8 = 0;
					_v4 = 0;
					_t20 = 0; // executed
					_t15 = GetTokenInformation(_v12, 0x14,  &_v8, 4,  &_v4); // executed
					if(_t15 != 0) {
						_t20 = 0 | _v12 != 0x00000000;
					}
					CloseHandle(_v16);
					return _t20;
				} else {
					return 0;
				}
			}

0x01325f96
0x01325faf
0x01325fbc
0x01325fcb
0x01325fda
0x01325fdc
0x01325fe4
0x01325feb
0x01325feb
0x01325ff2
0x01325ffe
0x01325fb1
0x01325fb6
0x01325fb6

APIs

GetCurrentProcess.KERNEL32(00000008,?,C9209188), ref: 01325FA0
OpenProcessToken.ADVAPI32(00000000), ref: 01325FA7
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 01325FDC
CloseHandle.KERNEL32(?), ref: 01325FF2

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 15ff71d22035251c7d8161a6ac92323ddd547529e5e65475c1d322dad25175ae
Instruction ID: 763add065998a3ad2f8036a40003ea54f6349f3ab18bd555501a6c55984b2fd7
Opcode Fuzzy Hash: 15ff71d22035251c7d8161a6ac92323ddd547529e5e65475c1d322dad25175ae
Instruction Fuzzy Hash: 1DF01274145301EBEB109F54EC45B9ABBECBB44744F508819F9C4C2160D379D61DDB67

Uniqueness

Uniqueness Score: -1.00%

Function 01331A20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E01331A20() {
				char _v8;
				char _v16;
				signed int _v20;
				char _v540;
				char _v564;
				char _v588;
				char _v612;
				char _v613;
				void* _v620;
				char _v628;
				intOrPtr _v652;
				char _v656;
				char _v664;
				char _v672;
				signed int _t50;
				signed int _t51;
				WCHAR* _t53;
				signed char _t56;
				short* _t60;
				void* _t61;
				intOrPtr* _t70;
				void* _t72;
				int _t76;
				void* _t84;
				short* _t94;
				int _t128;
				signed int _t129;
				void* _t135;
				void* _t138;

				_push(0xffffffff);
				_push(0x136b8b7);
				_push( *[fs:0x0]);
				_t50 =  *0x1383020; // 0xc9209188
				_t51 = _t50 ^ _t129;
				_v20 = _t51;
				_push(_t51);
				 *[fs:0x0] =  &_v16;
				_t53 = GetCommandLineW();
				E01324C60( &_v628);
				_v8 = 0;
				E01324EC0( &_v628, _t135, 0x1000);
				_t56 = E013242A0( &_v628);
				_t121 = _t56;
				_v620 = _t56;
				E01328630(_t56, L"Full command line:", _t53, 0);
				_t11 = E01328720(_t53) + 2; // 0x2
				_t12 = E01328600(_t11, 0x00000020 + (0 |  *_t58 == 0x00000022) * 0x00000002 & 0x0000ffff) + 2; // 0x2
				_t60 = E01328720(_t12);
				_t126 = _t60;
				_t94 = _t60;
				_t61 = E01328BA0(_t84, _t94, _t56);
				_t137 = _t61;
				if(_t61 == 0) {
					_push(_t94);
					E01330B70();
					_v8 = 1;
					_push( &_v540);
					E01330E90(_t126,  &_v656);
					E013229D0( &_v564, _v656);
					_v8 = 2;
					E01329110( &_v588,  &_v564);
					_v8 = 4;
					L01323D50( &_v564);
					_t70 = E01324460(0x13857a4,  &_v664);
					_t72 = E013295A0( &_v612);
					_v8 = 5;
					_v613 = E0132AE00(_t84, 0,  *_t70,  *((intOrPtr*)(_t70 + 4)),  *((intOrPtr*)(E01324460(_t72,  &_v672))),  *((intOrPtr*)(_t73 + 4)),  *_t70,  *((intOrPtr*)(_t70 + 4)));
					_v8 = 4;
					L01323D50( &_v612);
					__eflags = _v613;
					if(_v613 == 0) {
						L4:
						_t123 = _v620;
						_t76 = E01328E20( &_v656, _v620); // executed
						__eflags = _v540;
						_t128 = _t76;
						if(_v540 != 0) {
							E01331400(_t123,  &_v540);
						}
						L6:
						_v8 = 1;
						E01324000();
						_v8 = 0;
						E01331C30();
						goto L7;
					}
					E013229D0( &_v564, _v652);
					_v8 = 6;
					_t128 = L01331750(_t84,  &_v564,  &_v656, __eflags, _t138);
					_v8 = 4;
					L01323D50( &_v564);
					__eflags = _t128 - 0xffff;
					if(_t128 == 0xffff) {
						goto L6;
					}
					goto L4;
				} else {
					_t128 = E01328790(_t126, _t121, _t137, _t138);
					L7:
					ExitProcess(_t128);
				}
			}

0x01331a23
0x01331a25
0x01331a30
0x01331a37
0x01331a3c
0x01331a3e
0x01331a43
0x01331a47
0x01331a4d
0x01331a5b
0x01331a60
0x01331a6c
0x01331a77
0x01331a7c
0x01331a88
0x01331a8e
0x01331ab0
0x01331ab8
0x01331abb
0x01331ac0
0x01331ac2
0x01331ac4
0x01331ac9
0x01331acb
0x01331add
0x01331ae4
0x01331ae9
0x01331af3
0x01331afc
0x01331b10
0x01331b15
0x01331b26
0x01331b2b
0x01331b35
0x01331b46
0x01331b5d
0x01331b62
0x01331b85
0x01331b8b
0x01331b95
0x01331b9a
0x01331ba1
0x01331bdc
0x01331bdc
0x01331bea
0x01331bef
0x01331bf7
0x01331bf9
0x01331c03
0x01331c03
0x01331c08
0x01331c08
0x01331c12
0x01331c17
0x01331c21
0x00000000
0x01331c21
0x01331baf
0x01331bb4
0x01331bc3
0x01331bc5
0x01331bcf
0x01331bd4
0x01331bda
0x00000000
0x00000000
0x00000000
0x01331acd
0x01331ad6
0x01331c26
0x01331c27
0x01331c27

APIs

GetCommandLineW.KERNEL32(C9209188,?,0000FFFF), ref: 01331A4D

Part of subcall function 01324EC0: LocalAlloc.KERNELBASE(00000040,00000000,?,?,?,?,00000000,00000000,?,?), ref: 01324EDD

ExitProcess.KERNEL32 ref: 01331C27

Part of subcall function 01328790: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0132880D

Strings

Full command line:, xrefs: 01331A7E

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: dab7b81f7ff4cfecaf5c526c76969affedfb3e5f340e1bfe645f0ae53694c222
Instruction ID: fee0103feda2c6a5718531633a641f7f63840a9ca42c58fe76b92ec3e9c5f612
Opcode Fuzzy Hash: dab7b81f7ff4cfecaf5c526c76969affedfb3e5f340e1bfe645f0ae53694c222
Instruction Fuzzy Hash: 1C5180309101699BCF25FB68CC58BEEBBB5AF64348F1481D8D009672A0EF745F49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01327FD0 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E01327FD0(void** __ecx, void* __edx) {
				void* _v8;
				char _v16;
				long _v20;
				union _TOKEN_INFORMATION_CLASS _v24;
				void* _v28;
				void** _v32;
				void* __ebx;
				void* __edi;
				signed int _t24;
				int _t28;
				void* _t36;
				void* _t40;
				void* _t46;
				void* _t49;
				long _t52;
				void* _t53;
				void** _t55;
				signed int _t57;

				_push(0xffffffff);
				_push(0x136a13e);
				_push( *[fs:0x0]);
				_t24 =  *0x1383020; // 0xc9209188
				_push(_t24 ^ _t57);
				 *[fs:0x0] =  &_v16;
				_v28 = __edx;
				_t55 = __ecx;
				_v32 = __ecx;
				_v8 = 0;
				_v24 = 0;
				 *__ecx = 0;
				__ecx[1] = 0;
				__ecx[2] = 0;
				_v8 = 0;
				_v24 = 1;
				_v20 = 0;
				_t28 = GetTokenInformation(__edx, 1, 0, 0,  &_v20); // executed
				if(_t28 == 0 && GetLastError() == 0x7a) {
					_t40 = _t55[1];
					_t49 =  *_t55;
					_t46 = _t40 - _t49;
					_t52 = _v20;
					if(_t52 >= _t46) {
						if(__eflags > 0) {
							__eflags = _t52 - _t55[2] - _t49;
							if(_t52 <= _t55[2] - _t49) {
								_t53 = _t52 - _t46;
								__eflags = _t53;
								E01348E90(_t53, _t40, 0, _t53);
								_t36 = _t53 + _t40;
								_t52 = _v20;
								goto L8;
							} else {
								E01328260(_t40, _t55, _t52, _t52, _t46);
								_t52 = _v20;
							}
						}
					} else {
						_t36 = _t49 + _t52;
						L8:
						_t55[1] = _t36;
					}
					GetTokenInformation(_v28, 1,  *_t55, _t52,  &_v20); // executed
				}
				 *[fs:0x0] = _v16;
				return _t55;
			}

0x01327fd3
0x01327fd5
0x01327fe0
0x01327fe7
0x01327fee
0x01327ff2
0x01327ffa
0x01327ffd
0x01327fff
0x01328002
0x01328009
0x01328010
0x01328016
0x0132801d
0x01328024
0x01328036
0x0132803d
0x01328044
0x0132804c
0x01328059
0x0132805e
0x01328060
0x01328062
0x01328067
0x0132806e
0x01328075
0x01328077
0x01328087
0x01328087
0x0132808d
0x01328092
0x01328098
0x00000000
0x01328079
0x0132807d
0x01328082
0x01328082
0x01328077
0x01328069
0x01328069
0x0132809b
0x0132809b
0x0132809b
0x013280aa
0x013280aa
0x013280b5
0x013280c3

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,01327FA8,C9209188), ref: 01328044
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,01327FA8,C9209188), ref: 0132804E
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,01327FA8,C9209188), ref: 013280AA

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 663ce8bef49c4158869dfdb4c0f0f205664fd19ce92585e144290537eabcaf44
Instruction ID: 111503dddddd4fb1902029706f4259795fffdb33ad28b6d9fca259a18da54202
Opcode Fuzzy Hash: 663ce8bef49c4158869dfdb4c0f0f205664fd19ce92585e144290537eabcaf44
Instruction Fuzzy Hash: C7317171A00215EFD720DFA9CC44BAFFBF9FB44B14F10856DE515A7280D7B5A9058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0135C72B Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0135C72B(signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x13856ec, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E0135A8B7();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E0134C6B0())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E013615F6(__eflags, _t19);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x0135c731
0x0135c736
0x0135c744
0x0135c744
0x0135c74a
0x0135c74c
0x0135c74c
0x0135c763
0x0135c76c
0x0135c774
0x00000000
0x00000000
0x0135c754
0x0135c756
0x0135c778
0x0135c77d
0x0135c783
0x00000000
0x0135c783
0x0135c759
0x0135c75f
0x0135c761
0x00000000
0x00000000
0x0135c761
0x00000000
0x0135c763
0x0135c73c
0x0135c742
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,0135AFDA,00000001,00000364,?,00000006,000000FF,?,0134C282,?,?,?), ref: 0135C76C

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 39401775a5c2edc2a2b1ec7e5bc77035fee0263d3bb9f5ae247b3c596b55a997
Instruction ID: 205315e103b566175038f9262a583e239b4181ca4f2f5a9f8d91e76bec8e6cfb
Opcode Fuzzy Hash: 39401775a5c2edc2a2b1ec7e5bc77035fee0263d3bb9f5ae247b3c596b55a997
Instruction Fuzzy Hash: B6F0E931641329AFFBB15A6D9844E5B3FCCDF51F7CB18A211EE14A6A80DF20E40186E0

Uniqueness

Uniqueness Score: -1.00%

Function 01324EC0 Relevance: 1.3, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01324EC0(signed int* __ecx, void* __eflags, signed int _a4) {
				signed int _t13;
				signed int* _t22;
				signed int _t23;

				_t23 = _a4;
				_t22 = __ecx;
				_t13 = LocalAlloc(0x40,  ~(0 | __eflags > 0x00000000) | _t23 * 0x00000002); // executed
				_t22[1] = _t13;
				 *_t22 = _t23;
				return _t13 & 0xffffff00 | _t13 != 0x00000000;
			}

0x01324ec1
0x01324ecb
0x01324edd
0x01324ee3
0x01324ee8
0x01324eef

APIs

LocalAlloc.KERNELBASE(00000040,00000000,?,?,?,?,00000000,00000000,?,?), ref: 01324EDD

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 0fd754d0f697c9d49489ee3835c3e564e3616983dfad567a23f6991dcd8b37b9
Instruction ID: 8fcc644819eab95980c0e5a3b6afea24cae8a38cdbbb07446efe01c89c1be58f
Opcode Fuzzy Hash: 0fd754d0f697c9d49489ee3835c3e564e3616983dfad567a23f6991dcd8b37b9
Instruction Fuzzy Hash: 7CD05B723012125FD7444B6CD807B57E6989F94760F05C13FF545D72D8DA70DC514750

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01327660 Relevance: 42.4, APIs: 16, Strings: 8, Instructions: 384
libraryloadersleepCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E01327660(void* __ebx, struct HWND__* __ecx, intOrPtr* __edx, void* __edi, void* __eflags) {
				void* __esi;
				signed int _t114;
				void* _t127;
				signed int _t133;
				void* _t141;
				signed int _t143;
				int _t157;
				DWORD* _t160;
				_Unknown_base(*)()* _t178;
				_Unknown_base(*)()* _t181;
				struct HWND__* _t186;
				intOrPtr _t188;
				int _t190;
				signed int _t195;
				signed int _t196;
				signed int _t206;
				signed int _t207;
				short _t212;
				void* _t213;
				signed int _t214;
				void* _t216;
				void* _t217;
				signed int _t223;
				intOrPtr* _t224;
				void* _t237;
				intOrPtr* _t250;
				intOrPtr* _t251;
				signed int _t255;
				intOrPtr* _t260;
				intOrPtr* _t263;
				void* _t267;
				void* _t268;
				intOrPtr _t269;
				intOrPtr _t270;
				intOrPtr* _t272;
				intOrPtr _t273;
				intOrPtr* _t274;
				void* _t275;
				void* _t276;
				signed int _t277;
				signed int _t278;
				struct HWND__* _t279;
				signed int _t282;
				intOrPtr* _t283;
				void* _t284;
				WCHAR* _t286;
				void* _t288;
				void* _t291;

				_t286 = _t288 - 0x20c;
				_push(0xffffffff);
				_push(0x1369fe5);
				_push( *[fs:0x0]);
				_t114 =  *0x1383020; // 0xc9209188
				_t286[0x104] = _t114 ^ _t286;
				_push(__ebx);
				 *[fs:0x0] = _t286 - 0xc;
				_t272 = __edx;
				 *((intOrPtr*)(_t286 - 0x34)) = __edx;
				_t277 = __ecx;
				 *(_t286 - 0x28) = __ecx;
				_t212 = _t286[0x112];
				 *(_t286 - 0x14) = _t286[0x10a];
				 *((char*)(_t286 - 0xd)) = _t286[0x10e];
				 *(_t286 - 0x24) = _t286[0x110];
				E01328530(_t286 - 0x70, 0x3c, 0);
				 *(_t286 - 0x70) = 0x3c;
				 *(_t286 - 0x6c) = 0x440;
				 *((intOrPtr*)(_t286 - 0x18)) = E01322100(_t212,  *_t277 - 0x10, _t272, _t277, _t114 ^ _t286) + 0x10;
				 *(_t286 - 4) = 1;
				_t18 = E01322100(_t212,  *_t272 - 0x10, _t272, _t277, __edi) + 0x10; // 0x10
				_t273 = _t18;
				 *((intOrPtr*)(_t286 - 0x20)) = _t273;
				 *(_t286 - 4) = 3;
				_t291 = _t288 - 0x19c + 8;
				_t223 = _t277;
				_t255 = E01327DB0(_t212, _t273, _t277, _t286 - 0x30, _t276);
				 *(_t286 - 0x1c) = _t255;
				 *(_t286 - 4) = 4;
				_t127 =  *_t255;
				_t278 =  *(_t127 - 0xc);
				if(_t278 < 0) {
					L54:
					E01321910(0x80070057);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t223);
					_push(_t278);
					_t279 =  *(_t291 + 0xc);
					GetWindowThreadProcessId(_t279, _t291 + 4);
					_t224 =  *((intOrPtr*)(_t291 + 0x10));
					if( *_t224 !=  *(_t291 + 4)) {
						return 1;
					} else {
						 *(_t224 + 4) = _t279;
						_t133 = GetWindowLongW(_t279, 0xfffffff0);
						asm("bt eax, 0x1c");
						return (_t133 & 0xc00000 | (_t133 & 0x00c00000) - 0x00c00000 > 0x00000000) & 0x000000ff & (0 | (_t133 & 0x00c00000) == 0x00c00000) ^ 0x00000001;
					}
				} else {
					if((0x00000001 -  *((intOrPtr*)(_t127 - 4)) |  *((intOrPtr*)(_t127 - 8)) - _t278) < 0) {
						E01322750(_t255, _t255, _t278);
						_t255 =  *(_t286 - 0x1c);
					}
					E01350D39( *_t255, _t278 + 1);
					_t223 =  *(_t286 - 0x1c);
					_t291 = _t291 + 8;
					_t141 =  *_t223;
					if(_t278 >  *((intOrPtr*)(_t141 - 8))) {
						goto L54;
					} else {
						 *(_t141 - 0xc) = _t278;
						 *((short*)( *_t223 + _t278 * 2)) = 0;
						_t143 = E01322100(_t212,  *_t223 - 0x10, _t273, _t278);
						_t34 = _t143 + 0x10; // 0x10
						_t282 = _t34;
						 *(_t286 - 0x1c) = _t282;
						 *(_t286 - 4) = 7;
						_t260 =  *((intOrPtr*)(_t286 - 0x30)) + 0xfffffff0;
						asm("lock xadd [edx+0xc], eax");
						if((_t143 | 0xffffffff) - 1 <= 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t260)) + 4))(_t260);
						}
						if( *((char*)(_t286 - 0xd)) != 0) {
							_t250 = L".bat";
							_t195 = _t282;
							while(1) {
								_t267 =  *_t195;
								if(_t267 !=  *_t250) {
									break;
								}
								if(_t267 == 0) {
									L12:
									_t196 = 0;
								} else {
									_t270 =  *((intOrPtr*)(_t195 + 2));
									if(_t270 !=  *((intOrPtr*)(_t250 + 2))) {
										break;
									} else {
										_t195 = _t195 + 4;
										_t250 = _t250 + 4;
										if(_t270 != 0) {
											continue;
										} else {
											goto L12;
										}
									}
								}
								L14:
								if(_t196 == 0) {
									L23:
									GetWindowsDirectoryW(_t286, 0x104);
									E01321980(_t286 - 0x18, L"%s\\System32\\cmd.exe", _t286);
									_push( *((intOrPtr*)( *((intOrPtr*)(_t286 - 0x34)))));
									E01321980(_t286 - 0x20, L"/C \"\"%s\" %s\"",  *( *(_t286 - 0x28)));
									_t273 =  *((intOrPtr*)(_t286 - 0x20));
									_t291 = _t291 + 0x1c;
								} else {
									_t251 = L".cmd";
									_t206 = _t282;
									while(1) {
										_t268 =  *_t206;
										if(_t268 !=  *_t251) {
											break;
										}
										if(_t268 == 0) {
											L20:
											_t207 = 0;
										} else {
											_t269 =  *((intOrPtr*)(_t206 + 2));
											if(_t269 !=  *((intOrPtr*)(_t251 + 2))) {
												break;
											} else {
												_t206 = _t206 + 4;
												_t251 = _t251 + 4;
												if(_t269 != 0) {
													continue;
												} else {
													goto L20;
												}
											}
										}
										L22:
										if(_t207 == 0) {
											goto L23;
										}
										goto L24;
									}
									asm("sbb eax, eax");
									_t207 = _t206 | 0x00000001;
									goto L22;
								}
								goto L24;
							}
							asm("sbb eax, eax");
							_t196 = _t195 | 0x00000001;
							goto L14;
						}
						L24:
						 *((intOrPtr*)(_t286 - 0x60)) =  *((intOrPtr*)(_t286 - 0x18));
						asm("sbb eax, eax");
						 *(_t286 - 0x54) =  ~(_t286[0x10c]) & 0x00000005;
						_t151 =  ==  ? L"open" : L"runas";
						 *(_t286 - 0x64) =  ==  ? L"open" : L"runas";
						_t237 =  *( *(_t286 - 0x14));
						_t153 =  !=  ? _t237 :  *((intOrPtr*)(_t286 - 0x58));
						 *((intOrPtr*)(_t286 - 0x58)) =  !=  ? _t237 :  *((intOrPtr*)(_t286 - 0x58));
						_t155 =  !=  ? _t273 :  *((intOrPtr*)(_t286 - 0x5c));
						 *((intOrPtr*)(_t286 - 0x5c)) =  !=  ? _t273 :  *((intOrPtr*)(_t286 - 0x5c));
						if( *((char*)(_t286 - 0xd)) != 0) {
							 *((intOrPtr*)(_t286 - 0x68)) = GetForegroundWindow();
						}
						if(_t212 != 0) {
							_t212 = E01327AF0(_t286 - 0x70, _t212);
						}
						_t157 = ShellExecuteExW(_t286 - 0x70);
						 *(_t286 - 0x14) = _t157;
						if(_t212 != 0) {
							_t212 = E01327C30(_t157, _t212);
							_t157 =  *(_t286 - 0x14);
						}
						if(_t157 == 0) {
							_t188 =  *((intOrPtr*)(_t286 - 0x50));
							if(_t188 == 0x1f || _t188 == 0x1b) {
								 *(_t286 - 0x6c) =  *(_t286 - 0x6c) & 0xfffffbff;
								 *(_t286 - 0x64) = 0;
								_t190 = ShellExecuteExW(_t286 - 0x70);
								if(_t212 != 0) {
									E01327C30(_t190, _t212);
								}
							}
						}
						 *(_t286 - 0x14) = _t286 - 0x70;
						_push( *(_t286 - 0x14));
						E01327EF0(_t286 - 0x7c, _t286 - 0x14);
						 *(_t286 - 4) = 9;
						_t213 =  *(_t286 - 0x38);
						if(_t213 != 0) {
							_t178 = GetProcAddress(GetModuleHandleW(L"Kernel32.dll"), "GetProcessId");
							__imp__AllowSetForegroundWindow( *_t178(_t213));
							_t213 =  *(_t286 - 0x38);
							if(_t213 != 0 && _t286[0x10c] == 2) {
								_t181 = GetProcAddress(GetModuleHandleW(L"Kernel32.dll"), "GetProcessId");
								if(_t181 != 0) {
									 *(_t286 - 0x14) =  *_t181(_t213);
									_t217 = 0;
									while(_t217 < 0x14) {
										Sleep(0x64);
										 *(_t286 - 0x2c) =  *(_t286 - 0x14);
										 *(_t286 - 0x28) = 0;
										EnumWindows(0x1327a90, _t286 - 0x2c);
										_t186 =  *(_t286 - 0x28);
										_t217 = _t217 + 1;
										if(_t186 == 0) {
											continue;
										} else {
											BringWindowToTop(_t186);
										}
										goto L43;
									}
								}
								L43:
								_t213 =  *(_t286 - 0x38);
							}
						}
						_t160 =  *(_t286 - 0x24);
						if(_t160 != 0) {
							 *_t160 = 0xffffffff;
							if(_t213 != 0) {
								WaitForSingleObject(_t213, 0xffffffff);
								GetExitCodeProcess( *(_t286 - 0x38),  *(_t286 - 0x24));
							}
						}
						 *(_t286 - 4) = 7;
						E01327D30(_t286 - 0x7c);
						 *(_t286 - 4) = 3;
						_t214 = _t213 | 0xffffffff;
						_t283 = _t282 + 0xfffffff0;
						asm("lock xadd [esi+0xc], eax");
						if(_t214 - 1 <= 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t283)) + 4))(_t283);
						}
						 *(_t286 - 4) = 1;
						_t274 = _t273 + 0xfffffff0;
						asm("lock xadd [edi+0xc], eax");
						if(_t214 - 1 <= 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t274)) + 4))(_t274);
						}
						 *(_t286 - 4) = 0xffffffff;
						_t263 =  *((intOrPtr*)(_t286 - 0x18)) + 0xfffffff0;
						asm("lock xadd [edx+0xc], ebx");
						if(_t214 - 1 <= 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t263)) + 4))(_t263);
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t286 - 0xc));
						_pop(_t275);
						_pop(_t284);
						_pop(_t216);
						return E01347708(1, _t216, _t286[0x104] ^ _t286, _t263, _t275, _t284);
					}
				}
			}

0x01327661
0x0132766e
0x01327670
0x0132767b
0x0132767f
0x01327686
0x0132768c
0x01327693
0x01327699
0x0132769b
0x0132769e
0x013276a0
0x013276a9
0x013276af
0x013276b8
0x013276c3
0x013276cc
0x013276d6
0x013276dd
0x013276ec
0x013276ef
0x01327700
0x01327700
0x01327703
0x01327706
0x0132770a
0x01327710
0x01327718
0x0132771a
0x0132771d
0x01327721
0x01327723
0x01327728
0x01327a7b
0x01327a80
0x01327a85
0x01327a86
0x01327a87
0x01327a88
0x01327a89
0x01327a8a
0x01327a8b
0x01327a8c
0x01327a8d
0x01327a8e
0x01327a8f
0x01327a90
0x01327a91
0x01327a92
0x01327a9c
0x01327aa2
0x01327aac
0x01327ae8
0x01327aae
0x01327ab1
0x01327ab4
0x01327ace
0x01327ade
0x01327ade
0x0132772e
0x0132773d
0x01327742
0x01327747
0x01327747
0x01327750
0x01327755
0x01327758
0x0132775b
0x01327760
0x00000000
0x01327766
0x01327766
0x0132776d
0x01327776
0x0132777b
0x0132777b
0x0132777e
0x01327781
0x0132778b
0x0132778e
0x01327796
0x0132779d
0x0132779d
0x013277a4
0x013277aa
0x013277af
0x013277b1
0x013277b1
0x013277b7
0x00000000
0x00000000
0x013277bc
0x013277d3
0x013277d3
0x013277be
0x013277be
0x013277c6
0x00000000
0x013277c8
0x013277c8
0x013277cb
0x013277d1
0x00000000
0x00000000
0x00000000
0x00000000
0x013277d1
0x013277c6
0x013277dc
0x013277de
0x01327816
0x0132781f
0x01327832
0x0132783a
0x0132784a
0x0132784f
0x01327852
0x013277e0
0x013277e0
0x013277e5
0x013277e7
0x013277e7
0x013277ed
0x00000000
0x00000000
0x013277f2
0x01327809
0x01327809
0x013277f4
0x013277f4
0x013277fc
0x00000000
0x013277fe
0x013277fe
0x01327801
0x01327807
0x00000000
0x00000000
0x00000000
0x00000000
0x01327807
0x013277fc
0x01327812
0x01327814
0x00000000
0x00000000
0x00000000
0x01327814
0x0132780d
0x0132780f
0x00000000
0x0132780f
0x00000000
0x013277de
0x013277d7
0x013277d9
0x00000000
0x013277d9
0x01327855
0x0132785d
0x01327868
0x01327871
0x01327879
0x0132787f
0x01327885
0x0132788b
0x0132788e
0x01327898
0x0132789f
0x013278a2
0x013278aa
0x013278aa
0x013278af
0x013278bb
0x013278bb
0x013278c1
0x013278c7
0x013278cc
0x013278d7
0x013278d9
0x013278d9
0x013278de
0x013278e0
0x013278e6
0x013278ed
0x013278f8
0x013278ff
0x01327907
0x0132790d
0x0132790d
0x01327907
0x013278e6
0x01327915
0x0132791b
0x01327921
0x01327929
0x0132792d
0x01327932
0x01327949
0x01327953
0x01327959
0x0132795e
0x0132797a
0x01327982
0x01327987
0x0132798a
0x01327990
0x01327997
0x013279a0
0x013279ac
0x013279b3
0x013279b9
0x013279bc
0x013279bf
0x00000000
0x013279c1
0x013279c2
0x013279c2
0x00000000
0x013279bf
0x01327990
0x013279c8
0x013279c8
0x013279c8
0x0132795e
0x013279cb
0x013279d0
0x013279d2
0x013279da
0x013279df
0x013279ec
0x013279ec
0x013279da
0x013279f2
0x013279f9
0x013279fe
0x01327a02
0x01327a05
0x01327a0a
0x01327a12
0x01327a19
0x01327a19
0x01327a1c
0x01327a20
0x01327a25
0x01327a2d
0x01327a34
0x01327a34
0x01327a37
0x01327a41
0x01327a44
0x01327a4c
0x01327a53
0x01327a53
0x01327a5b
0x01327a63
0x01327a64
0x01327a65
0x01327a7a
0x01327a7a
0x01327760

APIs

GetWindowsDirectoryW.KERNEL32(00000010,00000104,?,?), ref: 0132781F
GetForegroundWindow.USER32(?,?), ref: 013278A4
ShellExecuteExW.SHELL32(?), ref: 013278C1
ShellExecuteExW.SHELL32(?), ref: 013278FF
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?), ref: 01327942
GetProcAddress.KERNEL32(00000000), ref: 01327949
AllowSetForegroundWindow.USER32(00000000), ref: 01327953
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?), ref: 01327973
GetProcAddress.KERNEL32(00000000), ref: 0132797A
Sleep.KERNEL32(00000064,?,?,?), ref: 01327997
EnumWindows.USER32(01327A90,?), ref: 013279B3
BringWindowToTop.USER32(?), ref: 013279C2
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 013279DF
GetExitCodeProcess.KERNEL32 ref: 013279EC

Part of subcall function 01327D30: CloseHandle.KERNEL32(?,C9209188,00000010,00000010,?,?), ref: 01327D72

GetWindowThreadProcessId.USER32(?,?), ref: 01327A9C
GetWindowLongW.USER32(?,000000F0), ref: 01327AB4

Strings

open, xrefs: 01327858
.bat, xrefs: 013277AA
GetProcessId, xrefs: 01327938, 01327969
/C ""%s" %s", xrefs: 01327844
.cmd, xrefs: 013277E0
runas, xrefs: 01327874
Kernel32.dll, xrefs: 0132793D, 0132796E
%s\System32\cmd.exe, xrefs: 0132782C

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Window$Handle$AddressExecuteForegroundModuleProcProcessShellWindows$AllowBringCloseCodeDirectoryEnumExitLongObjectSingleSleepThreadWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$GetProcessId$Kernel32.dll$open$runas
API String ID: 1023610922-986041216
Opcode ID: 89f33b66d603aa6dc179e5f6b6bcc215fa68af11d40f31f2ed0e54a937a75cea
Instruction ID: a4f5f4957eb2595e78a623df6c5bb878070e4984d3983b26dbc23d43045b3bc0
Opcode Fuzzy Hash: 89f33b66d603aa6dc179e5f6b6bcc215fa68af11d40f31f2ed0e54a937a75cea
Instruction Fuzzy Hash: B3E1A471A00215DFDB10EFECC888AAEBBF9FF24318F148169E515EB291DB759905CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0132D060 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 472
COMMONCrypto

Download Yara Rule

C-Code - Quality: 54%

			E0132D060(void* __ebx, intOrPtr __ecx, void* __fp0, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				intOrPtr _v0;
				char _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				void* _v32;
				void* _v36;
				char _v40;
				void* _v52;
				void* _v56;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v92;
				char _v104;
				char _v112;
				signed int _v116;
				void* _v128;
				char _v132;
				char _v148;
				signed int _v156;
				intOrPtr _v160;
				void* _v164;
				intOrPtr _v176;
				intOrPtr _v188;
				signed int _v200;
				char _v268;
				char _v274;
				signed int _v275;
				char _v276;
				void* _v280;
				void _v284;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t165;
				signed int _t166;
				signed int _t168;
				signed int _t169;
				signed int _t170;
				void* _t175;
				void* _t176;
				void* _t178;
				signed int _t186;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				void* _t196;
				void* _t197;
				void* _t199;
				signed int _t206;
				signed int _t211;
				signed int _t232;
				signed int _t246;
				void* _t247;
				void* _t248;
				void* _t249;
				signed int _t252;
				void* _t253;
				void* _t263;
				signed int _t265;
				char _t266;
				void* _t276;
				signed char _t277;
				signed int _t281;
				intOrPtr _t286;
				void* _t287;
				intOrPtr _t288;
				void* _t289;
				signed int _t293;
				void* _t298;
				intOrPtr _t299;
				void* _t300;
				void* _t302;
				signed int _t303;
				void* _t304;
				intOrPtr _t305;
				void* _t306;
				signed int _t308;
				void* _t309;
				signed int _t311;
				void* _t312;
				signed int _t313;
				intOrPtr _t314;
				intOrPtr _t316;
				void* _t317;
				intOrPtr _t318;
				void* _t319;
				void* _t322;
				void* _t325;
				signed int _t326;
				signed int _t327;
				void* _t329;
				void* _t330;
				signed int _t332;
				void* _t333;
				signed int _t335;
				signed int _t337;
				void* _t352;

				_t352 = __fp0;
				_t247 = __ebx;
				_push(0xffffffff);
				_push(0x136ae1d);
				_push( *[fs:0x0]);
				_t330 = _t329 - 0x3c;
				_t165 =  *0x1383020; // 0xc9209188
				_t166 = _t165 ^ _t326;
				_v20 = _t166;
				_push(_t166);
				 *[fs:0x0] =  &_v16;
				_v68 = __ecx;
				_t168 = _a4;
				asm("xorps xmm0, xmm0");
				_t286 = _a16;
				asm("movups [ebp-0x30], xmm0");
				_v36 = 0;
				_v32 = 0;
				_v60 = _t168;
				_v64 = _t286;
				_v36 = 0;
				_v32 = 0xf;
				_v52 = 0;
				_v8 = 0;
				_t252 =  *(_t286 + 0x14) & 0x00003000;
				if(_t252 != 0x3000) {
					_t169 =  *(_t286 + 0x18);
					_t287 =  *(_t286 + 0x1c);
					_v56 = _t169;
					__eflags = _t287;
					if(__eflags < 0) {
						L6:
						_t170 = _t169 | _t287;
						__eflags = _t170;
						if(_t170 != 0) {
							_t308 = 6;
							goto L11;
						} else {
							__eflags = _t252;
							if(_t252 != 0) {
								_t308 = 0;
								goto L11;
							} else {
								_t308 = _t170 + 1;
							}
						}
					} else {
						if(__eflags > 0) {
							L5:
							_t308 = _t169;
							L11:
							__eflags = _t252 - 0x2000;
							if(__eflags == 0) {
								asm("movsd xmm1, [ebp+0x1c]");
								asm("movaps xmm0, xmm1");
								asm("andps xmm0, [0x137b940]");
								asm("comisd xmm0, [0x137b930]");
								if(__eflags > 0) {
									_push( &_v72);
									asm("movsd [esp], xmm1");
									E013568F4(_t252, _t287);
									_t330 = _t330 - 8 + 0xc;
									asm("cdq");
									st0 = _t352;
									_t308 = _t308 + _t287 + (_t287 >> 0x1f);
									__eflags = _t308;
								}
							}
						} else {
							__eflags = _t169;
							if(_t169 == 0) {
								goto L6;
							} else {
								goto L5;
							}
						}
					}
				} else {
					_t246 = _t168 | 0xffffffff;
					_v56 = _t246;
					_v72 = _t246;
					_t308 = _t246 + 0xe;
				}
				_t253 = _v36;
				_t309 = _t308 + 0x32;
				if(_t309 > _t253) {
					_t287 = _v32;
					_t298 = _t309 - _t253;
					__eflags = _t298 - _t287 - _t253;
					if(_t298 > _t287 - _t253) {
						_push(0);
						_push(_t298);
						E0132EEB0(_t247, _t298, _v60);
					} else {
						_v36 = _t309;
						__eflags = _t287 - 0x10;
						_t324 =  >=  ? _v52 :  &_v52;
						_t325 = ( >=  ? _v52 :  &_v52) + _t253;
						E01348E90(_t298, _t325, 0, _t298);
						_t330 = _t330 + 0xc;
						 *((char*)(_t325 + _t298)) = 0;
					}
				} else {
					_v36 = _t309;
					_t235 =  >=  ? _v52 :  &_v52;
					 *((char*)(( >=  ? _v52 :  &_v52) + _t309)) = 0;
				}
				_t299 = _v68;
				_push( *((intOrPtr*)(_v64 + 0x14)));
				_t175 = E0132E810(_t299,  &_v28, 0x4c);
				asm("movsd xmm0, [ebp+0x1c]");
				_t256 =  >=  ? _v52 :  &_v52;
				asm("movsd [esp], xmm0");
				_t176 = E0132FCF0( >=  ? _v52 :  &_v52, _v36, _t175, _v56);
				_t258 =  >=  ? _v52 :  &_v52;
				_t311 = _v60;
				E0132E350(_t247, _t299, _t299, _t311, _a8, _a12, _v64, _a20,  >=  ? _v52 :  &_v52, _t176);
				_t332 = _t330 + 0x40;
				_v8 = 0xffffffff;
				_t178 = _v32;
				if(_t178 < 0x10) {
					L24:
					_v36 = 0;
					_v32 = 0xf;
					_v52 = 0;
					 *[fs:0x0] = _v16;
					_pop(_t300);
					_pop(_t312);
					return E01347708(_t311, _t247, _v20 ^ _t326, _t287, _t300, _t312);
				} else {
					_t263 = _v52;
					_t287 = _t263;
					if(_t178 + 1 < 0x1000) {
						L22:
						if(_t263 != 0) {
							LocalFree(_t263);
						}
						goto L24;
					} else {
						_t263 =  *(_t287 - 4);
						_t61 = _t287 - 4; // -4
						if(_t61 > 0x1f) {
							E0134C5C2(_t247, _t263, _t287, _t299);
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t326);
							_t327 = _t332;
							_push(0xffffffff);
							_push(0x136ae1d);
							_push( *[fs:0x0]);
							_t333 = _t332 - 0x3c;
							_t186 =  *0x1383020; // 0xc9209188
							_t187 = _t186 ^ _t327;
							_v116 = _t187;
							_push(_t311);
							_push(_t299);
							_push(_t187);
							 *[fs:0x0] =  &_v112;
							_v164 = _t263;
							_t189 = _v92;
							asm("xorps xmm0, xmm0");
							_t288 = _v80;
							asm("movups [ebp-0x30], xmm0");
							_v132 = 0;
							_v128 = 0;
							_v156 = _t189;
							_v160 = _t288;
							_v132 = 0;
							_v128 = 0xf;
							_v148 = 0;
							_v104 = 0;
							_t265 =  *(_t288 + 0x14) & 0x00003000;
							__eflags = _t265 - 0x3000;
							if(_t265 != 0x3000) {
								_t190 =  *(_t288 + 0x18);
								_t289 =  *(_t288 + 0x1c);
								_v60 = _t190;
								__eflags = _t289;
								if(__eflags < 0) {
									L31:
									_t191 = _t190 | _t289;
									__eflags = _t191;
									if(_t191 != 0) {
										_t313 = 6;
										goto L36;
									} else {
										__eflags = _t265;
										if(_t265 != 0) {
											_t313 = 0;
											goto L36;
										} else {
											_t313 = _t191 + 1;
										}
									}
								} else {
									if(__eflags > 0) {
										L30:
										_t313 = _t190;
										L36:
										__eflags = _t265 - 0x2000;
										if(__eflags == 0) {
											asm("movsd xmm1, [ebp+0x1c]");
											asm("movaps xmm0, xmm1");
											asm("andps xmm0, [0x137b940]");
											asm("comisd xmm0, [0x137b930]");
											if(__eflags > 0) {
												_push( &_v76);
												asm("movsd [esp], xmm1");
												E013568F4(_t265, _t289);
												_t333 = _t333 - 8 + 0xc;
												asm("cdq");
												st0 = _t352;
												_t313 = _t313 + _t289 + (_t289 >> 0x1f);
												__eflags = _t313;
											}
										}
									} else {
										__eflags = _t190;
										if(_t190 == 0) {
											goto L31;
										} else {
											goto L30;
										}
									}
								}
							} else {
								_t232 = _t189 | 0xffffffff;
								_v60 = _t232;
								_v76 = _t232;
								_t313 = _t232 + 0xe;
							}
							_t266 = _v40;
							_t314 = _t313 + 0x32;
							__eflags = _t314 - _t266;
							if(_t314 > _t266) {
								_t289 = _v36;
								_t302 = _t314 - _t266;
								__eflags = _t302 - _t289 - _t266;
								if(_t302 > _t289 - _t266) {
									_push(0);
									_push(_t302);
									E0132EEB0(_t247, _t302, _v64);
								} else {
									_v40 = _t314;
									__eflags = _t289 - 0x10;
									_t321 =  >=  ? _v56 :  &_v56;
									_t322 = ( >=  ? _v56 :  &_v56) + _t266;
									E01348E90(_t302, _t322, 0, _t302);
									_t333 = _t333 + 0xc;
									 *((char*)(_t322 + _t302)) = 0;
								}
							} else {
								__eflags = _v36 - 0x10;
								_v40 = _t314;
								_t221 =  >=  ? _v56 :  &_v56;
								 *((char*)(( >=  ? _v56 :  &_v56) + _t314)) = 0;
							}
							_t303 = _v72;
							_push( *((intOrPtr*)(_v68 + 0x14)));
							_t196 = E0132E810(_t303,  &_v32, 0);
							__eflags = _v36 - 0x10;
							asm("movsd xmm0, [ebp+0x1c]");
							_t269 =  >=  ? _v56 :  &_v56;
							asm("movsd [esp], xmm0");
							_t197 = E0132FCF0( >=  ? _v56 :  &_v56, _v40, _t196, _v60);
							__eflags = _v36 - 0x10;
							_t271 =  >=  ? _v56 :  &_v56;
							_t316 = _v64;
							E0132E350(_t247, _t303, _t303, _t316, _a4, _a8, _v68, _a16,  >=  ? _v56 :  &_v56, _t197);
							_t335 = _t333 + 0x40;
							_v12 = 0xffffffff;
							_t199 = _v36;
							__eflags = _t199 - 0x10;
							if(_t199 < 0x10) {
								L49:
								_v40 = 0;
								_v36 = 0xf;
								_v56 = 0;
								 *[fs:0x0] = _v20;
								_pop(_t304);
								_pop(_t317);
								__eflags = _v24 ^ _t327;
								return E01347708(_t316, _t247, _v24 ^ _t327, _t289, _t304, _t317);
							} else {
								_t276 = _v56;
								_t289 = _t276;
								__eflags = _t199 + 1 - 0x1000;
								if(_t199 + 1 < 0x1000) {
									L47:
									__eflags = _t276;
									if(_t276 != 0) {
										LocalFree(_t276);
									}
									goto L49;
								} else {
									_t276 =  *(_t289 - 4);
									_t127 = _t289 - 4; // -4
									__eflags = _t127 - 0x1f;
									if(_t127 > 0x1f) {
										E0134C5C2(_t247, _t276, _t289, _t303);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t327);
										_t337 = (_t335 & 0xfffffff8) - 0x5c;
										_t206 =  *0x1383020; // 0xc9209188
										_v200 = _t206 ^ _t337;
										_push(_t247);
										_push(_t316);
										_t318 = _v176;
										_v280 = _t276;
										_t248 = _v280;
										_v284 = 0x2b;
										_t277 =  *(_t318 + 0x14);
										__eflags = _t277 & 0x00000020;
										_v276 = 0x25;
										_push(_t303);
										_t209 =  !=  ? _v284 : _v275 & 0x000000ff;
										__eflags = _t277 & 0x00000020;
										_t305 = _v188;
										_v275 =  !=  ? _v284 : _v275 & 0x000000ff;
										_t211 =  !=  ?  &_v274 :  &_v275;
										__eflags = _t277 & 0x00000008;
										if((_t277 & 0x00000008) != 0) {
											 *_t211 = 0x23;
											_t211 = _t211 + 1;
											__eflags = _t211;
										}
										 *_t211 = 0x3649;
										_t293 = _t277 & 0x00000e00;
										 *((char*)(_t211 + 2)) = 0x34;
										__eflags = _t293 - 0x400;
										if(_t293 != 0x400) {
											__eflags = _t293 - 0x800;
											if(_t293 == 0x800) {
												_t281 =  !(_t277 << 3) & 0x00000020 | 0x00000058;
												__eflags = _t281;
											} else {
												_t281 = 0x75;
											}
										} else {
											_t281 = 0x6f;
										}
										_push(_a20);
										 *(_t211 + 3) = _t281;
										 *((char*)(_t211 + 4)) = 0;
										_push(E0132FCF0( &_v268, 0x40,  &_v276, _a16));
										_push( &_v268);
										_push(_a12);
										_push(_t318);
										_push(_a4);
										_push(_v0);
										E0132DED0(_t248, _t305, _t248);
										_t306 = _t305;
										_pop(_t319);
										_pop(_t249);
										__eflags = _v200 ^ _t337 + 0x34;
										return E01347708(_t305, _t249, _v200 ^ _t337 + 0x34, _t293, _t306, _t319);
									} else {
										goto L47;
									}
								}
							}
						} else {
							goto L22;
						}
					}
				}
			}

0x0132d060
0x0132d060
0x0132d063
0x0132d065
0x0132d070
0x0132d071
0x0132d074
0x0132d079
0x0132d07b
0x0132d080
0x0132d084
0x0132d08a
0x0132d08d
0x0132d090
0x0132d093
0x0132d096
0x0132d09a
0x0132d0a1
0x0132d0a8
0x0132d0ab
0x0132d0ae
0x0132d0b5
0x0132d0bc
0x0132d0c0
0x0132d0ca
0x0132d0d6
0x0132d0e9
0x0132d0ec
0x0132d0ef
0x0132d0f2
0x0132d0f4
0x0132d100
0x0132d100
0x0132d100
0x0132d102
0x0132d111
0x00000000
0x0132d104
0x0132d104
0x0132d106
0x0132d10d
0x00000000
0x0132d108
0x0132d108
0x0132d108
0x0132d106
0x0132d0f6
0x0132d0f6
0x0132d0fc
0x0132d0fc
0x0132d116
0x0132d116
0x0132d11c
0x0132d11e
0x0132d123
0x0132d126
0x0132d12d
0x0132d135
0x0132d13a
0x0132d13e
0x0132d143
0x0132d14b
0x0132d14e
0x0132d14f
0x0132d16c
0x0132d16c
0x0132d16c
0x0132d135
0x0132d0f8
0x0132d0f8
0x0132d0fa
0x00000000
0x00000000
0x00000000
0x00000000
0x0132d0fa
0x0132d0f6
0x0132d0d8
0x0132d0d8
0x0132d0db
0x0132d0de
0x0132d0e1
0x0132d0e1
0x0132d16e
0x0132d171
0x0132d176
0x0132d18c
0x0132d193
0x0132d197
0x0132d199
0x0132d1bc
0x0132d1be
0x0132d1c6
0x0132d19b
0x0132d19b
0x0132d19e
0x0132d1a4
0x0132d1a9
0x0132d1ae
0x0132d1b3
0x0132d1b6
0x0132d1b6
0x0132d178
0x0132d17f
0x0132d182
0x0132d186
0x0132d186
0x0132d1d1
0x0132d1d4
0x0132d1db
0x0132d1e7
0x0132d1ec
0x0132d1f3
0x0132d200
0x0132d20d
0x0132d219
0x0132d221
0x0132d226
0x0132d229
0x0132d230
0x0132d236
0x0132d25d
0x0132d25d
0x0132d266
0x0132d26d
0x0132d274
0x0132d27c
0x0132d27d
0x0132d28b
0x0132d238
0x0132d238
0x0132d23c
0x0132d243
0x0132d252
0x0132d254
0x0132d257
0x0132d257
0x00000000
0x0132d245
0x0132d245
0x0132d24a
0x0132d250
0x0132d28e
0x0132d293
0x0132d294
0x0132d295
0x0132d296
0x0132d297
0x0132d298
0x0132d299
0x0132d29a
0x0132d29b
0x0132d29c
0x0132d29d
0x0132d29e
0x0132d29f
0x0132d2a0
0x0132d2a1
0x0132d2a3
0x0132d2a5
0x0132d2b0
0x0132d2b1
0x0132d2b4
0x0132d2b9
0x0132d2bb
0x0132d2be
0x0132d2bf
0x0132d2c0
0x0132d2c4
0x0132d2ca
0x0132d2cd
0x0132d2d0
0x0132d2d3
0x0132d2d6
0x0132d2da
0x0132d2e1
0x0132d2e8
0x0132d2eb
0x0132d2ee
0x0132d2f5
0x0132d2fc
0x0132d300
0x0132d30a
0x0132d310
0x0132d316
0x0132d329
0x0132d32c
0x0132d32f
0x0132d332
0x0132d334
0x0132d340
0x0132d340
0x0132d340
0x0132d342
0x0132d351
0x00000000
0x0132d344
0x0132d344
0x0132d346
0x0132d34d
0x00000000
0x0132d348
0x0132d348
0x0132d348
0x0132d346
0x0132d336
0x0132d336
0x0132d33c
0x0132d33c
0x0132d356
0x0132d356
0x0132d35c
0x0132d35e
0x0132d363
0x0132d366
0x0132d36d
0x0132d375
0x0132d37a
0x0132d37e
0x0132d383
0x0132d38b
0x0132d38e
0x0132d38f
0x0132d3ac
0x0132d3ac
0x0132d3ac
0x0132d375
0x0132d338
0x0132d338
0x0132d33a
0x00000000
0x00000000
0x00000000
0x00000000
0x0132d33a
0x0132d336
0x0132d318
0x0132d318
0x0132d31b
0x0132d31e
0x0132d321
0x0132d321
0x0132d3ae
0x0132d3b1
0x0132d3b4
0x0132d3b6
0x0132d3cc
0x0132d3d3
0x0132d3d7
0x0132d3d9
0x0132d3fc
0x0132d3fe
0x0132d406
0x0132d3db
0x0132d3db
0x0132d3de
0x0132d3e4
0x0132d3e9
0x0132d3ee
0x0132d3f3
0x0132d3f6
0x0132d3f6
0x0132d3b8
0x0132d3b8
0x0132d3bf
0x0132d3c2
0x0132d3c6
0x0132d3c6
0x0132d411
0x0132d414
0x0132d41b
0x0132d420
0x0132d427
0x0132d42c
0x0132d433
0x0132d440
0x0132d445
0x0132d44d
0x0132d459
0x0132d461
0x0132d466
0x0132d469
0x0132d470
0x0132d473
0x0132d476
0x0132d49d
0x0132d49d
0x0132d4a6
0x0132d4ad
0x0132d4b4
0x0132d4bc
0x0132d4bd
0x0132d4c1
0x0132d4cb
0x0132d478
0x0132d478
0x0132d47c
0x0132d47e
0x0132d483
0x0132d492
0x0132d492
0x0132d494
0x0132d497
0x0132d497
0x00000000
0x0132d485
0x0132d485
0x0132d48a
0x0132d48d
0x0132d490
0x0132d4ce
0x0132d4d3
0x0132d4d4
0x0132d4d5
0x0132d4d6
0x0132d4d7
0x0132d4d8
0x0132d4d9
0x0132d4da
0x0132d4db
0x0132d4dc
0x0132d4dd
0x0132d4de
0x0132d4df
0x0132d4e0
0x0132d4e6
0x0132d4e9
0x0132d4f0
0x0132d4f9
0x0132d4fa
0x0132d4fb
0x0132d4fe
0x0132d502
0x0132d506
0x0132d50e
0x0132d513
0x0132d519
0x0132d51e
0x0132d51f
0x0132d524
0x0132d52a
0x0132d531
0x0132d539
0x0132d53c
0x0132d53f
0x0132d541
0x0132d544
0x0132d544
0x0132d544
0x0132d547
0x0132d54c
0x0132d552
0x0132d556
0x0132d55c
0x0132d562
0x0132d568
0x0132d576
0x0132d576
0x0132d56a
0x0132d56a
0x0132d56a
0x0132d55e
0x0132d55e
0x0132d55e
0x0132d579
0x0132d57c
0x0132d582
0x0132d59a
0x0132d59f
0x0132d5a0
0x0132d5a3
0x0132d5a4
0x0132d5a7
0x0132d5ac
0x0132d5bd
0x0132d5be
0x0132d5bf
0x0132d5c0
0x0132d5ca
0x00000000
0x00000000
0x00000000
0x0132d490
0x0132d483
0x00000000
0x00000000
0x00000000
0x0132d250
0x0132d243

APIs

_swprintf.LIBCMT ref: 0132D200
LocalFree.KERNEL32(00000000), ref: 0132D257
_swprintf.LIBCMT ref: 0132D440
LocalFree.KERNEL32(00000000), ref: 0132D497
_swprintf.LIBCMT ref: 0132D592

Strings

%, xrefs: 0132D519
+, xrefs: 0132D506

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID: %$+
API String ID: 2429749586-2626897407
Opcode ID: 7899baea1e1254b035b10c02f83d24bd4009b6b08505e478517110faf7dce4f7
Instruction ID: 34721d6547d9fa2677ba96a09d3d92689215e2fb4267a7e097ae4fe3cfb00099
Opcode Fuzzy Hash: 7899baea1e1254b035b10c02f83d24bd4009b6b08505e478517110faf7dce4f7
Instruction Fuzzy Hash: C202D271E10229DFDB15DFA8DC40BAEBBB9FF49304F148629E911AB281D734E941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01330E90 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 455
registryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E01330E90(char* __ecx, intOrPtr __edx) {
				intOrPtr _t63;
				char* _t68;
				short* _t69;
				char* _t72;
				char* _t75;
				short* _t76;
				signed int _t79;
				signed short _t80;
				signed int _t81;
				short* _t82;
				short* _t83;
				signed short _t84;
				short* _t85;
				signed int _t86;
				signed int _t89;
				signed int _t91;
				signed short _t92;
				signed int _t93;
				long _t96;
				signed int _t100;
				intOrPtr* _t101;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t109;
				signed int _t112;
				char* _t115;
				signed int _t116;
				signed short* _t120;
				char* _t121;
				char* _t122;
				signed short* _t123;
				signed short* _t124;
				signed int _t127;
				short* _t128;
				char* _t129;
				short* _t132;
				short* _t134;
				signed int _t135;
				char* _t136;
				signed int _t140;
				signed int _t142;
				short** _t143;
				signed int _t144;
				signed int _t145;
				signed int _t148;
				char* _t149;
				signed short _t150;
				signed int* _t151;
				short** _t152;
				short** _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				signed short* _t158;
				char* _t159;
				char* _t160;
				signed int _t161;
				signed short* _t162;
				char* _t164;
				char* _t165;
				short* _t166;
				signed int _t170;
				signed int _t172;
				signed int _t174;
				signed int _t176;
				char* _t179;
				char* _t180;
				char* _t181;
				char* _t182;
				short* _t185;
				void* _t190;
				void* _t192;
				char _t194;
				char* _t195;
				char* _t196;
				char* _t198;
				void** _t199;
				void* _t200;
				intOrPtr* _t203;

				_t129 = __ecx;
				_t63 = __edx;
				 *_t203 = __ecx;
				 *((intOrPtr*)(_t203 + 4)) = __edx;
				if(__edx == 0 ||  *__ecx == 0) {
					return _t63;
				} else {
					_t194 = L"/EnforcedRunAsAdmin "; // 0x2f
					_t120 = __ecx;
					_t179 = L"/EnforcedRunAsAdmin ";
					if(_t194 != 0) {
						_t162 = __ecx;
						while(1) {
							_t176 =  *_t162 & 0x0000ffff;
							if(_t176 == 0) {
								goto L9;
							} else {
								_t162 =  &(_t162[1]);
								if((_t176 | 0x00000020) == ( *_t179 | 0x00000020)) {
									_t179 =  &(_t179[2]);
									__eflags = _t179;
								} else {
									_t120 = _t162;
									_t179 = L"/EnforcedRunAsAdmin ";
								}
							}
							if( *_t179 != 0) {
								continue;
							}
							goto L9;
						}
					}
					L9:
					_t65 =  !=  ? _t120 : 0;
					_t211 = ( !=  ? _t120 : 0) - _t129;
					if(( !=  ? _t120 : 0) == _t129) {
						_t161 = 0;
						_t115 = L"/EnforcedRunAsAdmin ";
						if(_t194 != 0) {
							do {
								_t115 =  &(_t115[2]);
								_t161 = _t161 + 1;
							} while ( *_t115 != 0);
						}
						_t129 = _t129 + _t161 * 2;
						if(_t129 != 0) {
							while(1) {
								_t116 =  *_t129 & 0x0000ffff;
								if(_t116 == 0 || _t116 > 0x20) {
									goto L17;
								}
								_t129 =  &(_t129[2]);
								if(_t129 != 0) {
									continue;
								}
								goto L17;
							}
						}
						L17:
						 *(_t203 + 0x10) = _t129;
					}
					_t195 = L"/DontWait "; // 0x2f
					_t121 = _t129;
					_t180 = L"/DontWait ";
					if(_t195 != 0) {
						_t160 = _t121;
						while(1) {
							_t174 =  *_t160 & 0x0000ffff;
							if(_t174 == 0) {
								goto L25;
							}
							_t160 =  &(_t160[2]);
							if((_t174 | 0x00000020) == ( *_t180 | 0x00000020)) {
								_t180 =  &(_t180[2]);
								__eflags = _t180;
							} else {
								_t121 = _t160;
								_t180 = L"/DontWait ";
							}
							if( *_t180 != 0) {
								continue;
							}
							goto L25;
						}
					}
					L25:
					_t67 =  !=  ? _t121 : 0;
					_t223 = ( !=  ? _t121 : 0) - _t129;
					if(( !=  ? _t121 : 0) == _t129) {
						_t142 = 0;
						_t68 = L"/DontWait ";
						__eflags = _t195;
						if(_t195 != 0) {
							do {
								_t68 =  &(_t68[2]);
								_t142 = _t142 + 1;
								__eflags =  *_t68;
							} while ( *_t68 != 0);
						}
						_t129 = _t129 + _t142 * 2;
						__eflags = _t129;
						if(_t129 != 0) {
							while(1) {
								_t112 =  *_t129 & 0x0000ffff;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L34;
								}
								__eflags = _t112 - 0x20;
								if(_t112 <= 0x20) {
									_t129 =  &(_t129[2]);
									__eflags = _t129;
									if(_t129 != 0) {
										continue;
									}
								}
								goto L34;
							}
						}
						L34:
						 *(_t203 + 0x10) = _t129;
						_t69 = 0;
						__eflags = 0;
					} else {
						_t69 = 1;
					}
					_t143 =  *(_t203 + 0x14);
					_t122 = _t129;
					_t181 = L"/RunAsAdmin ";
					_t143[6] = _t69;
					_t196 =  &(_t143[6]);
					_t164 = L"/RunAsAdmin "; // 0x2f
					if(_t164 != 0) {
						_t159 = _t122;
						while(1) {
							_t172 =  *_t159 & 0x0000ffff;
							if(_t172 == 0) {
								break;
							}
							_t159 =  &(_t159[2]);
							if((_t172 | 0x00000020) == ( *_t181 | 0x00000020)) {
								_t181 =  &(_t181[2]);
								__eflags = _t181;
							} else {
								_t122 = _t159;
								_t181 = L"/RunAsAdmin ";
							}
							if( *_t181 != 0) {
								continue;
							}
							break;
						}
						_t164 = L"/RunAsAdmin "; // 0x2f
					}
					_t71 =  !=  ? _t122 : 0;
					_t229 = ( !=  ? _t122 : 0) - _t129;
					if(( !=  ? _t122 : 0) == _t129) {
						_t144 = 0;
						_t72 = L"/RunAsAdmin ";
						__eflags = _t164;
						if(_t164 != 0) {
							do {
								_t72 =  &(_t72[2]);
								_t144 = _t144 + 1;
								__eflags =  *_t72;
							} while ( *_t72 != 0);
						}
						_t129 = _t129 + _t144 * 2;
						__eflags = _t129;
						if(_t129 != 0) {
							while(1) {
								_t109 =  *_t129 & 0x0000ffff;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L53;
								}
								__eflags = _t109 - 0x20;
								if(_t109 <= 0x20) {
									_t129 =  &(_t129[2]);
									__eflags = _t129;
									if(_t129 != 0) {
										continue;
									}
								}
								goto L53;
							}
						}
						L53:
						 *(_t203 + 0x10) = _t129;
						__eflags = _t196;
						if(__eflags != 0) {
							 *_t196 = 1;
						}
					} else {
						if(_t196 != 0) {
							 *_t196 = 0;
						}
					}
					_t123 = _t129;
					_t165 = L"/HideWindow"; // 0x2f
					_t198 =  &(( *(_t203 + 0x14))[6]);
					_t182 = L"/HideWindow";
					if(_t165 != 0) {
						_t158 = _t123;
						while(1) {
							_t170 =  *_t158 & 0x0000ffff;
							if(_t170 == 0) {
								break;
							}
							_t158 =  &(_t158[1]);
							if((_t170 | 0x00000020) == ( *_t182 | 0x00000020)) {
								_t182 =  &(_t182[2]);
								__eflags = _t182;
							} else {
								_t123 = _t158;
								_t182 = L"/HideWindow";
							}
							if( *_t182 != 0) {
								continue;
							}
							break;
						}
						_t165 = L"/HideWindow"; // 0x2f
					}
					_t74 =  !=  ? _t123 : 0;
					_t236 = ( !=  ? _t123 : 0) - _t129;
					if(( !=  ? _t123 : 0) == _t129) {
						_t145 = 0;
						_t75 = L"/HideWindow";
						__eflags = _t165;
						if(_t165 != 0) {
							do {
								_t75 =  &(_t75[2]);
								_t145 = _t145 + 1;
								__eflags =  *_t75;
							} while ( *_t75 != 0);
						}
						_t76 = _t129 + _t145 * 2;
						__eflags = _t76;
						if(_t76 != 0) {
							while(1) {
								_t140 =  *_t76 & 0x0000ffff;
								__eflags = _t140;
								if(_t140 == 0) {
									goto L72;
								}
								__eflags = _t140 - 0x20;
								if(_t140 <= 0x20) {
									_t76 =  &(_t76[1]);
									__eflags = _t76;
									if(_t76 != 0) {
										continue;
									}
								}
								goto L72;
							}
						}
						L72:
						 *(_t203 + 0x10) = _t76;
						__eflags = _t198;
						if(__eflags != 0) {
							 *_t198 = 1;
						}
					} else {
						_t237 = _t198;
						if(_t198 != 0) {
							 *_t198 = 0;
						}
					}
					E01330C30(_t203 + 0x10,  *(_t203 + 0x14), _t237);
					E01330D40(_t203 + 0x10,  *((intOrPtr*)(_t203 + 0x2c)));
					_t166 =  *(_t203 + 0x10);
					_t79 =  *_t166 & 0x0000ffff;
					_t148 = _t79;
					if(_t79 != 0x22) {
						_t132 = _t166;
						__eflags = _t148;
						if(_t148 == 0) {
							goto L79;
						} else {
							while(1) {
								__eflags = _t148 - 0x20;
								if(_t148 == 0x20) {
									goto L107;
								}
								_t104 = _t132[1] & 0x0000ffff;
								_t132 =  &(_t132[1]);
								_t148 = _t104;
								__eflags = _t104;
								if(_t104 != 0) {
									continue;
								} else {
									goto L79;
								}
								goto L121;
							}
							goto L107;
						}
						L121:
						_t86 =  *_t166 & 0x0000ffff;
						_t185 = _t166;
						if(_t86 != 0) {
							_t127 = _t86;
							do {
								 *_t151 = _t127;
								_t55 =  &(_t185[1]); // 0x0
								_t185 = _t55;
								_t89 =  *_t185 & 0x0000ffff;
								_t151 =  &(_t151[0]);
								_t127 = _t89;
							} while (_t89 != 0);
						}
						 *_t151 = 0;
						_t85 = ( *(_t203 + 0x14))[3];
						if(_t151 < _t85) {
							L138:
							_t152 =  *(_t203 + 0x14);
							 *_t152 = _t166;
							_t152[1] = _t136;
							return _t85;
						}
						asm("o16 nop [eax+eax]");
						while( *_t151 != 0x5c) {
							_t151 = _t151 - 2;
							if(_t151 >= _t85) {
								continue;
							}
							L128:
							_t153 =  *(_t203 + 0x14);
							 *_t153 = _t166;
							_t153[1] = _t136;
							return _t85;
							goto L140;
						}
						_t85 = 0;
						__eflags = 0;
						 *_t151 = 0;
						goto L138;
					} else {
						_t105 = _t166[1] & 0x0000ffff;
						_t166 =  &(_t166[1]);
						_t132 = _t166;
						if(_t105 == 0) {
							L79:
						} else {
							_t157 = _t105;
							while(_t157 != 0x22) {
								_t106 = _t132[1] & 0x0000ffff;
								_t132 =  &(_t132[1]);
								_t157 = _t106;
								if(_t106 != 0) {
									continue;
								} else {
									goto L79;
								}
								goto L80;
							}
							L107:
							__eflags = _t132;
							if(_t132 != 0) {
								__eflags =  *_t132;
								if( *_t132 != 0) {
									 *_t132 = 0;
									_t136 =  &(_t132[1]);
								}
							}
						}
					}
					L80:
					_t149 = L"HK";
					if(L"HK" == 0) {
						L85:
						 *(_t203 + 0x18) = 0x800;
						_t199 = 0x1379620;
						while(1) {
							_t30 =  &(_t199[1]); // 0x137b868
							_t124 =  *_t30;
							_t134 = _t166;
							 *(_t203 + 0x24) =  *_t199;
							_t80 =  *_t124 & 0x0000ffff;
							_t150 = _t80;
							 *(_t203 + 0x1c) = _t150;
							if(_t80 == 0) {
								break;
							}
							_t156 = _t150 & 0x0000ffff;
							_t190 = _t124 - _t166;
							while(_t134 != 0 &&  *_t134 == _t156) {
								_t34 =  &(_t134[1]); // 0x5f004b
								_t100 =  *(_t190 + _t34) & 0x0000ffff;
								_t134 =  &(_t134[1]);
								_t156 = _t100;
								if(_t100 != 0) {
									continue;
								} else {
									_t150 =  *(_t203 + 0x1c);
									goto L92;
								}
								L96:
								_t135 = 0;
								_t82 = _t166;
								if( *_t166 != 0) {
									do {
										_t82 =  &(_t82[1]);
										_t135 = _t135 + 1;
									} while ( *_t82 != 0);
								}
								_t83 =  &(_t166[_t135]);
								if(_t83 >= _t166) {
									while( *_t83 != 0x5c) {
										_t83 = _t83 - 2;
										if(_t83 >= _t166) {
											continue;
										} else {
										}
										goto L114;
									}
									_t44 =  &(_t83[1]); // 0x0
									_t128 = _t44;
									 *_t83 = 0;
									__eflags = E013283E0();
									_t188 =  !=  ? 0x101 : 1;
									_t96 = RegOpenKeyExW(_t200, _t166, 0,  !=  ? 0x101 : 1, _t203 + 0x24);
									__eflags = _t96;
									if(_t96 == 0) {
										RegQueryValueExW( *(_t203 + 0x38), _t128, 0, 0, 0x13857c0, _t203 + 0x18);
										__eflags = 0;
										 *((short*)(0x13857c0 +  *(_t203 + 0x18) * 2)) = 0;
									}
								}
								L114:
								_t84 =  *0x13857c0; // 0x0
								if(_t84 != 0x22) {
									_t166 = 0x13857c0;
									_t136 = 0x13857c0;
									__eflags = _t84;
									if(_t84 == 0) {
										goto L119;
									} else {
										_t154 = _t84 & 0x0000ffff;
										while(1) {
											__eflags = _t154 - 0x20;
											if(_t154 == 0x20) {
												goto L134;
											}
											_t60 =  &(_t136[2]); // 0x0
											_t91 =  *_t60 & 0x0000ffff;
											_t136 =  &(_t136[2]);
											_t154 = _t91;
											__eflags = _t91;
											if(_t91 != 0) {
												continue;
											} else {
												goto L119;
											}
											goto L128;
										}
										goto L134;
									}
									goto L128;
								} else {
									_t92 =  *0x13857c2; // 0x0
									_t166 = 0x13857c2;
									_t136 = 0x13857c2;
									if(_t92 == 0) {
										L119:
										_t136 = 0;
									} else {
										_t155 = _t92 & 0x0000ffff;
										asm("o16 nop [eax+eax]");
										while(_t155 != 0x22) {
											_t52 =  &(_t136[2]); // 0x0
											_t93 =  *_t52 & 0x0000ffff;
											_t136 =  &(_t136[2]);
											_t155 = _t93;
											if(_t93 != 0) {
												continue;
											} else {
												goto L119;
											}
											goto L120;
										}
										L134:
										__eflags = _t136;
										if(_t136 != 0) {
											__eflags =  *_t136;
											if( *_t136 != 0) {
												 *_t136 = 0;
												_t136 =  &(_t136[2]);
											}
										}
									}
								}
								goto L120;
							}
							_t199 =  &(_t199[2]);
							__eflags = _t199 - 0x1379650;
							if(_t199 != 0x1379650) {
								continue;
							} else {
								_t200 = 0;
								goto L96;
							}
							goto L114;
						}
						L92:
						_t81 = 0;
						if(_t150 != 0) {
							do {
								_t36 =  &(_t124[1]); // 0x5f004b
								_t124 = _t36;
								_t81 = _t81 + 1;
							} while ( *_t124 != 0);
						}
						_t200 =  *(_t203 + 0x24);
						_t166 =  &(( &(_t166[_t81]))[1]);
						goto L96;
					} else {
						_t192 = _t166 - _t149;
						while(1) {
							_t101 = _t192 + _t149;
							if(_t101 == 0 ||  *_t101 !=  *_t149) {
								goto L120;
							}
							_t149 =  &(_t149[2]);
							if( *_t149 != 0) {
								continue;
							} else {
								goto L85;
							}
							goto L120;
						}
					}
					L120:
					_t85 =  *(_t203 + 0x14);
					_t151 = _t85[6];
					if( *_t151 != 0) {
						goto L138;
					}
					goto L121;
				}
				L140:
			}

0x01330e90
0x01330e93
0x01330e95
0x01330e98
0x01330e9e
0x013313fd
0x01330eae
0x01330eb0
0x01330eb7
0x01330eba
0x01330ec3
0x01330ec5
0x01330ec7
0x01330ec7
0x01330ecd
0x00000000
0x01330ecf
0x01330ed9
0x01330edf
0x01330eea
0x01330eea
0x01330ee1
0x01330ee1
0x01330ee3
0x01330ee3
0x01330edf
0x01330ef1
0x00000000
0x00000000
0x00000000
0x01330ef1
0x01330ec7
0x01330ef3
0x01330ef8
0x01330efb
0x01330efd
0x01330eff
0x01330f01
0x01330f09
0x01330f10
0x01330f10
0x01330f13
0x01330f14
0x01330f10
0x01330f1a
0x01330f1f
0x01330f21
0x01330f21
0x01330f27
0x00000000
0x00000000
0x01330f2e
0x01330f31
0x00000000
0x00000000
0x00000000
0x01330f31
0x01330f21
0x01330f33
0x01330f33
0x01330f33
0x01330f37
0x01330f3e
0x01330f40
0x01330f48
0x01330f4a
0x01330f50
0x01330f50
0x01330f56
0x00000000
0x00000000
0x01330f62
0x01330f68
0x01330f73
0x01330f73
0x01330f6a
0x01330f6a
0x01330f6c
0x01330f6c
0x01330f7a
0x00000000
0x00000000
0x00000000
0x01330f7a
0x01330f50
0x01330f7c
0x01330f81
0x01330f84
0x01330f86
0x01330f8c
0x01330f8e
0x01330f93
0x01330f96
0x01330f98
0x01330f98
0x01330f9b
0x01330f9c
0x01330f9c
0x01330f98
0x01330fa2
0x01330fa5
0x01330fa7
0x01330fb0
0x01330fb0
0x01330fb3
0x01330fb6
0x00000000
0x00000000
0x01330fb8
0x01330fbb
0x01330fbd
0x01330fbd
0x01330fc0
0x00000000
0x00000000
0x01330fc0
0x00000000
0x01330fbb
0x01330fb0
0x01330fc2
0x01330fc2
0x01330fc6
0x01330fc6
0x01330f88
0x01330f88
0x01330f88
0x01330fc8
0x01330fcc
0x01330fce
0x01330fd3
0x01330fd6
0x01330fd9
0x01330fe3
0x01330fe5
0x01330fe7
0x01330fe7
0x01330fed
0x00000000
0x00000000
0x01330ff9
0x01330fff
0x0133100a
0x0133100a
0x01331001
0x01331001
0x01331003
0x01331003
0x01331011
0x00000000
0x00000000
0x00000000
0x01331011
0x01331013
0x01331013
0x0133101f
0x01331022
0x01331024
0x01331030
0x01331032
0x01331037
0x0133103a
0x01331040
0x01331040
0x01331043
0x01331044
0x01331044
0x01331040
0x0133104a
0x0133104d
0x0133104f
0x01331051
0x01331051
0x01331054
0x01331057
0x00000000
0x00000000
0x01331059
0x0133105c
0x0133105e
0x0133105e
0x01331061
0x00000000
0x00000000
0x01331061
0x00000000
0x0133105c
0x01331051
0x01331063
0x01331063
0x01331067
0x01331069
0x0133106b
0x0133106b
0x01331026
0x01331028
0x0133102a
0x0133102a
0x01331028
0x01331073
0x01331075
0x0133107c
0x0133107f
0x01331087
0x01331089
0x01331090
0x01331090
0x01331096
0x00000000
0x00000000
0x013310a2
0x013310a8
0x013310b3
0x013310b3
0x013310aa
0x013310aa
0x013310ac
0x013310ac
0x013310ba
0x00000000
0x00000000
0x00000000
0x013310ba
0x013310bc
0x013310bc
0x013310c8
0x013310cb
0x013310cd
0x013310d9
0x013310db
0x013310e0
0x013310e3
0x013310e5
0x013310e5
0x013310e8
0x013310e9
0x013310e9
0x013310e5
0x013310ef
0x013310f2
0x013310f4
0x013310f6
0x013310f6
0x013310f9
0x013310fc
0x00000000
0x00000000
0x013310fe
0x01331101
0x01331103
0x01331103
0x01331106
0x00000000
0x00000000
0x01331106
0x00000000
0x01331101
0x013310f6
0x01331108
0x01331108
0x0133110c
0x0133110e
0x01331110
0x01331110
0x013310cf
0x013310cf
0x013310d1
0x013310d3
0x013310d3
0x013310d1
0x0133111c
0x01331129
0x0133112e
0x01331132
0x01331135
0x0133113a
0x01331247
0x01331249
0x0133124c
0x00000000
0x01331252
0x01331252
0x01331252
0x01331256
0x00000000
0x00000000
0x01331258
0x0133125c
0x0133125f
0x01331261
0x01331264
0x00000000
0x01331266
0x00000000
0x01331266
0x00000000
0x01331264
0x00000000
0x01331252
0x0133134b
0x0133134b
0x0133134e
0x01331353
0x01331355
0x01331357
0x01331357
0x0133135a
0x0133135a
0x0133135d
0x01331360
0x01331363
0x01331365
0x01331357
0x0133136c
0x01331373
0x01331378
0x013313ed
0x013313ed
0x013313f1
0x013313f6
0x00000000
0x013313f9
0x0133137a
0x01331380
0x01331386
0x0133138b
0x00000000
0x00000000
0x0133138d
0x0133138d
0x01331391
0x01331396
0x0133139d
0x00000000
0x0133139d
0x013313e8
0x013313e8
0x013313ea
0x00000000
0x01331140
0x01331140
0x01331144
0x01331147
0x0133114c
0x01331168
0x0133114e
0x0133114e
0x01331150
0x0133115a
0x0133115e
0x01331161
0x01331166
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01331166
0x0133126b
0x0133126b
0x0133126d
0x01331273
0x01331277
0x0133127f
0x01331282
0x01331282
0x01331277
0x0133126d
0x0133114c
0x0133116a
0x01331172
0x01331177
0x013311a0
0x013311a0
0x013311a8
0x013311b0
0x013311b0
0x013311b0
0x013311b3
0x013311b8
0x013311bc
0x013311bf
0x013311c1
0x013311c8
0x00000000
0x00000000
0x013311cc
0x013311cf
0x013311d1
0x013311e2
0x013311e2
0x013311e7
0x013311ea
0x013311ef
0x00000000
0x013311f1
0x013311f1
0x00000000
0x013311f1
0x01331214
0x01331214
0x01331216
0x0133121b
0x01331220
0x01331220
0x01331223
0x01331224
0x01331220
0x0133122a
0x0133122f
0x01331235
0x0133123b
0x01331240
0x00000000
0x00000000
0x01331242
0x00000000
0x01331240
0x013312a2
0x013312a2
0x013312a5
0x013312b0
0x013312bc
0x013312c4
0x013312ca
0x013312cc
0x013312e1
0x013312eb
0x013312ed
0x013312ed
0x013312cc
0x013312f5
0x013312f5
0x013312ff
0x0133139e
0x013313a3
0x013313a5
0x013313a8
0x00000000
0x013313aa
0x013313aa
0x013313b0
0x013313b0
0x013313b4
0x00000000
0x00000000
0x013313b6
0x013313b6
0x013313ba
0x013313bd
0x013313bf
0x013313c2
0x00000000
0x013313c4
0x00000000
0x013313c4
0x00000000
0x013313c2
0x00000000
0x013313b0
0x00000000
0x01331305
0x01331305
0x0133130b
0x01331310
0x01331315
0x01331338
0x01331338
0x01331317
0x01331317
0x0133131a
0x01331320
0x0133132a
0x0133132a
0x0133132e
0x01331331
0x01331336
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01331336
0x013313c9
0x013313c9
0x013313cb
0x013313d1
0x013313d5
0x013313dd
0x013313e0
0x013313e0
0x013313d5
0x013313cb
0x01331315
0x00000000
0x013312ff
0x0133128a
0x0133128d
0x01331293
0x00000000
0x01331299
0x01331299
0x00000000
0x01331299
0x00000000
0x01331293
0x013311f5
0x013311f5
0x013311fa
0x01331200
0x01331200
0x01331200
0x01331203
0x01331204
0x01331200
0x0133120a
0x01331211
0x00000000
0x01331179
0x0133117b
0x01331180
0x01331180
0x01331185
0x00000000
0x00000000
0x01331197
0x0133119e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0133119e
0x01331180
0x0133133a
0x0133133a
0x0133133e
0x01331345
0x00000000
0x00000000
0x00000000
0x01331345
0x00000000

APIs

RegOpenKeyExW.ADVAPI32(?,-00000002,00000000,00000001,?), ref: 013312C4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,013857C0,00000800), ref: 013312E1

Strings

/DontWait , xrefs: 01330F37, 01330F40, 01330F6C, 01330F8E
/EnforcedRunAsAdmin , xrefs: 01330EB0, 01330EBA, 01330EE3, 01330F01
/RunAsAdmin , xrefs: 01330FCE, 01330FD9, 01331003, 01331013, 01331032
/HideWindow, xrefs: 01331075, 0133107F, 013310AC, 013310BC, 013310DB

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DontWait $/EnforcedRunAsAdmin $/HideWindow$/RunAsAdmin
API String ID: 4153817207-1914306501
Opcode ID: 8905a4ec9d3343a58e4ddd1f9b8469660b3020cb474de61dda0ba85edf1a6842
Instruction ID: 232580f756cc03eebfff297279af386c7d6e9b4781b2580f664766be948efa95
Opcode Fuzzy Hash: 8905a4ec9d3343a58e4ddd1f9b8469660b3020cb474de61dda0ba85edf1a6842
Instruction Fuzzy Hash: E1E12624A043528AEB399F18C8402B6F7F1FFC475CF4D8469E985CB255E771C886C3A9

Uniqueness

Uniqueness Score: -1.00%

Function 013261D0 Relevance: 10.7, APIs: 7, Instructions: 234
processCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E013261D0(void* __ebx, int* __ecx, void* __edi, void* _a4, int _a40) {
				void* _v8;
				signed int _v16;
				signed int _v20;
				char _v540;
				char _v552;
				long _v568;
				char _v572;
				void* _v576;
				char _v577;
				int _v584;
				int* _v588;
				int _v592;
				intOrPtr _v596;
				int _v600;
				intOrPtr _v604;
				char _v608;
				char _v612;
				int* _v616;
				int _v620;
				int _v624;
				char _v640;
				char _v664;
				intOrPtr _v700;
				char _v708;
				void* _v712;
				void* __esi;
				void* __ebp;
				signed int _t94;
				signed int _t95;
				void* _t97;
				void* _t101;
				void* _t107;
				intOrPtr* _t109;
				signed int _t118;
				signed int _t120;
				int _t129;
				void* _t139;
				void* _t141;
				void* _t147;
				void* _t149;
				void* _t150;
				long* _t155;
				intOrPtr* _t157;
				void* _t161;
				int* _t167;
				void* _t168;
				void* _t170;
				void* _t171;
				void* _t173;
				void* _t174;
				signed int _t176;
				void* _t178;
				void* _t179;
				signed int _t180;

				_t139 = __ebx;
				_push(0xffffffff);
				_push(0x1369c21);
				_push( *[fs:0x0]);
				_t179 = _t178 - 0x288;
				_t94 =  *0x1383020; // 0xc9209188
				_t95 = _t94 ^ _t176;
				_v20 = _t95;
				_push(__edi);
				_push(_t95);
				 *[fs:0x0] =  &_v16;
				_t167 = __ecx;
				_v588 = __ecx;
				_v616 = __ecx;
				_v584 = 1;
				_v8 = 0;
				 *__ecx = 0;
				__ecx[1] = 0;
				__ecx[2] = 0;
				_v8 = 1;
				_v584 = 1;
				_t97 = CreateToolhelp32Snapshot(2, 0);
				_t170 = _t97;
				_v604 = 0x1379700;
				_v588 = _t170;
				_v600 = _t170;
				_v8 = 2;
				if(_t170 != 0xffffffff) {
					E01348E90(_t167,  &_v572, 0, 0x228);
					_t180 = _t179 + 0xc;
					_v576 = 0x22c;
					_push( &_v576);
					_t101 = Process32FirstW(_t170);
					__eflags = _t101;
					if(_t101 == 0) {
						L18:
						_v584 = 0;
						_v8 = 1;
						_v604 = 0x1379700;
						__eflags = _t170;
						if(_t170 != 0) {
							CloseHandle(_t170);
							_v600 = 0;
						}
						_v8 = 0xffffffff;
						_t141 = _a40;
						__eflags = _t141;
						if(_t141 != 0) {
							__eflags = _t141 -  &_a4;
							_t79 = _t141 !=  &_a4;
							__eflags = _t79;
							 *((intOrPtr*)( *_t141 + 0x10))(_t158);
							goto L22;
						}
						goto L23;
					} else {
						do {
							_t107 = OpenProcess(0x410, 0, _v568);
							_t173 = _t107;
							_v596 = 0x1379700;
							_v592 = _t173;
							_v8 = 4;
							__eflags = _t173 - 0xffffffff;
							if(__eflags != 0) {
								E013265B0(_t139,  &_v664, _t173, _t167, __eflags);
								_v8 = 5;
								asm("xorps xmm0, xmm0");
								_t109 =  &_v540;
								_v624 = 0;
								asm("movups [ebp-0x27c], xmm0");
								_v620 = 0;
								_t161 = _t109 + 2;
								asm("o16 nop [eax+eax]");
								do {
									_t147 =  *_t109;
									_t109 = _t109 + 2;
									__eflags = _t147;
								} while (_t147 != 0);
								_push(_t109 - _t161 >> 1);
								_push( &_v540);
								E01323B40(_t139,  &_v640, _t167);
								_v8 = 6;
								_v608 = _v552;
								_v612 = _v568;
								_v8 = 8;
								_t149 = _a40;
								__eflags = _t149;
								if(__eflags == 0) {
									E01332073(__eflags);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t176);
									_push(0xffffffff);
									_push(0x1369c5d);
									_push( *[fs:0x0]);
									_push(_t149);
									_push(_t173);
									_t118 =  *0x1383020; // 0xc9209188
									_push(_t118 ^ _t180);
									_t120 =  &_v708;
									 *[fs:0x0] = _t120;
									_t174 = _t149;
									_v712 = _t174;
									_v700 = 0xffffffff;
									_t150 =  *(_t174 + 0x24);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t150 - _t174;
										_t89 = _t150 != _t174;
										__eflags = _t89;
										_t120 =  *((intOrPtr*)( *_t150 + 0x10))((_t120 & 0xffffff00 | _t89) & 0x000000ff);
										 *(_t174 + 0x24) = 0;
									}
									 *[fs:0x0] = _v20;
									return _t120;
								} else {
									_t158 =  &_v612;
									_v577 =  *((intOrPtr*)( *((intOrPtr*)( *_t149 + 8))))(_t158,  &_v608,  &_v640,  &_v664);
									_v8 = 7;
									E01323CC0( &_v640);
									_v8 = 4;
									E01323CC0( &_v664);
									__eflags = _v577;
									if(_v577 != 0) {
										_t155 =  *(_t167 + 4);
										__eflags = _t155 -  *((intOrPtr*)(_t167 + 8));
										if(_t155 ==  *((intOrPtr*)(_t167 + 8))) {
											_push( &_v568);
											E01326C20(_t139, _t167, _t167, _t173, _t155);
										} else {
											 *_t155 = _v568;
											 *(_t167 + 4) =  &(( *(_t167 + 4))[1]);
										}
									}
									_v8 = 2;
									_v596 = 0x1379700;
									__eflags = _t173;
									if(_t173 != 0) {
										CloseHandle(_t173);
										goto L16;
									}
									goto L17;
								}
							} else {
								_v8 = 2;
								_v596 = 0x1379700;
								CloseHandle(_t107);
								L16:
								_v592 = 0;
								goto L17;
							}
							goto L28;
							L17:
							_t170 = _v588;
							_t129 = Process32NextW(_t170,  &_v576);
							__eflags = _t129;
						} while (_t129 != 0);
						goto L18;
					}
				} else {
					_v584 = 0;
					_v8 = 1;
					_v604 = 0x1379700;
					CloseHandle(_t97);
					_v600 = 0;
					_v8 = _t170;
					_t157 = _a40;
					if(_t157 != 0) {
						_t158 =  *_t157;
						 *((intOrPtr*)( *_t157 + 0x10))(( &_a4 & 0xffffff00 | _t157 !=  &_a4) & 0x000000ff);
						L22:
						_a40 = 0;
					}
					L23:
					 *[fs:0x0] = _v16;
					_pop(_t168);
					_pop(_t171);
					return E01347708(_t167, _t139, _v20 ^ _t176, _t158, _t168, _t171);
				}
				L28:
			}

0x013261d0
0x013261d3
0x013261d5
0x013261e0
0x013261e1
0x013261e7
0x013261ec
0x013261ee
0x013261f2
0x013261f3
0x013261f7
0x013261fd
0x013261ff
0x01326205
0x0132620b
0x01326215
0x0132621c
0x01326222
0x01326229
0x01326230
0x01326238
0x01326242
0x01326248
0x0132624a
0x01326254
0x0132625a
0x01326260
0x0132626a
0x013262c7
0x013262cc
0x013262cf
0x013262df
0x013262e1
0x013262e7
0x013262e9
0x01326471
0x01326471
0x0132647b
0x0132647f
0x01326489
0x0132648b
0x0132648e
0x01326494
0x01326494
0x0132649e
0x013264a5
0x013264a8
0x013264aa
0x013264b1
0x013264b3
0x013264b3
0x013264ba
0x00000000
0x013264ba
0x00000000
0x013262f0
0x013262f0
0x013262fd
0x01326303
0x01326305
0x0132630f
0x01326315
0x01326319
0x0132631c
0x0132633a
0x0132633f
0x01326343
0x01326346
0x0132634c
0x01326356
0x0132635d
0x01326367
0x0132636a
0x01326370
0x01326370
0x01326373
0x01326376
0x01326376
0x01326385
0x0132638c
0x0132638d
0x01326392
0x0132639c
0x013263a8
0x013263ae
0x013263b2
0x013263b5
0x013263b7
0x013264e1
0x013264e6
0x013264e7
0x013264e8
0x013264e9
0x013264ea
0x013264eb
0x013264ec
0x013264ed
0x013264ee
0x013264ef
0x013264f0
0x013264f3
0x013264f5
0x01326500
0x01326501
0x01326502
0x01326503
0x0132650a
0x0132650b
0x0132650e
0x01326514
0x01326516
0x01326519
0x01326520
0x01326523
0x01326525
0x01326529
0x0132652b
0x0132652b
0x01326532
0x01326535
0x01326535
0x0132653f
0x0132654b
0x013263bd
0x013263d7
0x013263e0
0x013263e6
0x013263f0
0x013263f5
0x013263ff
0x01326404
0x0132640b
0x0132640d
0x01326410
0x01326413
0x01326429
0x0132642d
0x01326415
0x0132641b
0x0132641d
0x0132641d
0x01326413
0x01326432
0x01326436
0x01326440
0x01326442
0x01326445
0x00000000
0x01326445
0x00000000
0x01326442
0x0132631e
0x0132631e
0x01326322
0x01326445
0x01326445
0x0132644b
0x00000000
0x0132644b
0x00000000
0x01326455
0x01326455
0x01326463
0x01326469
0x01326469
0x00000000
0x013262f0
0x0132626c
0x0132626c
0x01326276
0x0132627b
0x01326285
0x0132628b
0x01326295
0x01326298
0x0132629d
0x013262a3
0x013262b1
0x013264bd
0x013264bd
0x013264bd
0x013264c4
0x013264c9
0x013264d1
0x013264d2
0x013264e0
0x013264e0
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 01326242
CloseHandle.KERNEL32(00000000), ref: 01326285
Process32FirstW.KERNEL32(00000000,0000022C), ref: 013262E1
OpenProcess.KERNEL32(00000410,00000000,?), ref: 013262FD
CloseHandle.KERNEL32(00000000), ref: 01326445
Process32NextW.KERNEL32(?,0000022C), ref: 01326463
CloseHandle.KERNEL32(00000000), ref: 0132648E

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: 50cfd6b4c45fef23e9632dac06f315b7138f533b4ab8cb99c4dc7a877a90d6fa
Instruction ID: 4138a90f9da75841c4fe2bdef2f455779b7a493005e5375b615aba9e4ddc8517
Opcode Fuzzy Hash: 50cfd6b4c45fef23e9632dac06f315b7138f533b4ab8cb99c4dc7a877a90d6fa
Instruction Fuzzy Hash: 66A183B0905269DFDB20DF68C948BDDBBB9FF44718F1082D9E859A7280D7785A84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01364609 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 70%

			E01364609(signed int __edx, void* __edi, void* __eflags, signed char _a4, signed int _a8, intOrPtr _a12, signed int _a16, signed int _a20, signed int _a24, intOrPtr _a28) {
				signed int _v8;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1868;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				char _v1881;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				signed int _v1900;
				signed int _v1904;
				signed int _v1908;
				intOrPtr _v1912;
				signed int* _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				signed int _v1932;
				signed int _v1936;
				char _v1944;
				signed int _v1952;
				signed int _v1956;
				char _v2416;
				signed int _v2420;
				signed int _v2448;
				void* __ebx;
				void* __esi;
				signed int _t802;
				intOrPtr _t812;
				signed int _t819;
				signed int _t825;
				void* _t829;
				signed int _t830;
				intOrPtr _t836;
				void* _t837;
				signed int _t843;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t853;
				signed int _t855;
				signed int _t857;
				signed int _t858;
				signed int _t863;
				signed int _t864;
				signed int _t869;
				signed int _t871;
				signed int _t872;
				signed int _t879;
				signed int _t880;
				signed int _t888;
				signed int _t891;
				signed int _t896;
				signed int* _t899;
				signed int _t903;
				signed int _t914;
				signed int _t915;
				signed int _t917;
				signed int _t918;
				char* _t919;
				signed int _t922;
				signed int _t928;
				signed int _t930;
				signed int _t934;
				signed int _t942;
				signed int _t945;
				signed int _t948;
				signed int _t951;
				signed int _t960;
				signed int _t961;
				signed int _t964;
				signed int _t977;
				signed int _t978;
				signed int _t980;
				signed int _t981;
				signed int* _t982;
				signed int _t985;
				signed int* _t988;
				signed int _t991;
				signed int _t993;
				signed int _t998;
				signed int _t1006;
				signed int _t1009;
				signed int _t1013;
				signed int _t1016;
				signed int _t1025;
				intOrPtr _t1030;
				signed int _t1031;
				signed int _t1037;
				void* _t1045;
				signed int _t1046;
				signed int _t1047;
				signed int _t1048;
				signed int* _t1051;
				signed int _t1059;
				signed int _t1063;
				signed int _t1065;
				signed int _t1070;
				void* _t1076;
				signed int _t1077;
				signed int _t1078;
				signed int _t1079;
				signed int _t1082;
				signed int _t1087;
				signed int _t1088;
				signed int _t1092;
				signed int _t1094;
				signed int _t1099;
				signed int _t1101;
				signed int _t1102;
				void* _t1105;
				signed char _t1106;
				signed int _t1112;
				signed int _t1113;
				signed int _t1115;
				signed int _t1122;
				void* _t1127;
				signed char _t1133;
				intOrPtr* _t1136;
				signed int _t1141;
				signed int _t1142;
				void* _t1144;
				signed int _t1147;
				signed int _t1149;
				signed int _t1150;
				signed int _t1151;
				signed int _t1158;
				signed int _t1162;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				signed int _t1167;
				signed int* _t1169;
				signed int _t1170;
				signed int _t1174;
				signed int _t1175;
				signed int _t1176;
				signed int _t1177;
				signed int _t1179;
				signed int _t1181;
				signed int _t1182;
				signed int _t1186;
				signed int _t1187;
				unsigned int _t1188;
				unsigned int _t1192;
				unsigned int _t1195;
				signed int _t1196;
				signed int _t1199;
				signed int* _t1202;
				signed int _t1205;
				void* _t1207;
				unsigned int _t1208;
				signed int _t1209;
				signed int _t1212;
				signed int* _t1215;
				signed int _t1218;
				signed char _t1220;
				signed int _t1227;
				signed int _t1228;
				signed int _t1229;
				signed int _t1230;
				signed int _t1233;
				signed int _t1235;
				signed int _t1237;
				char _t1240;
				signed int _t1242;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				void* _t1255;
				signed int _t1256;
				signed int _t1258;
				signed int _t1263;
				signed int _t1267;
				void* _t1268;
				intOrPtr _t1269;
				void* _t1272;
				unsigned int _t1275;
				signed int _t1276;
				void* _t1277;
				signed int _t1279;
				signed int _t1280;
				signed int _t1281;
				signed int _t1282;
				signed int _t1285;
				signed int _t1286;
				signed int _t1287;
				signed int _t1288;
				signed int _t1289;
				signed int _t1292;
				signed int _t1293;
				signed int _t1294;
				signed int _t1295;
				void* _t1296;
				void* _t1299;
				signed int _t1301;
				signed int _t1305;
				signed int* _t1307;
				signed int _t1311;
				signed int _t1312;
				signed int _t1315;
				signed int _t1317;
				signed int _t1318;
				signed int _t1320;
				void* _t1323;
				void* _t1324;
				signed int _t1326;
				signed int _t1327;
				signed int _t1328;
				signed int _t1330;
				signed int _t1331;
				signed int _t1332;
				signed int _t1334;
				signed int _t1344;
				void* _t1346;
				signed char* _t1347;
				signed char* _t1348;
				signed int _t1352;
				signed char _t1360;

				_t1268 = __edi;
				_t1227 = __edx;
				_t802 =  *0x1383020; // 0xc9209188
				_v8 = _t802 ^ _t1344;
				_v1932 = _a20;
				_v1888 = _a24;
				E01367E41(__eflags,  &_v1952);
				_t1122 = 1;
				if((_v1952 & 0x0000001f) != 0x1f) {
					E01367EA9(__eflags,  &_v1952);
					_v1944 = 1;
				} else {
					_v1944 = 0;
				}
				_t1315 = _a8;
				_push(_t1268);
				_t1269 = 0x20;
				_t1352 = _t1315;
				if(_t1352 > 0 || _t1352 >= 0 && _a4 >= 0) {
					_t812 = _t1269;
				} else {
					_t812 = 0x2d;
				}
				_t1136 = _v1932;
				 *_t1136 = _t812;
				 *((intOrPtr*)(_t1136 + 8)) = _v1888;
				E0135A8F3( &_v1956, 0, 0);
				_t1347 = _t1346 + 0xc;
				if((_t1315 & 0x7ff00000) != 0) {
					L12:
					_t819 = E0135B231( &_a4);
					__eflags = _t819;
					if(_t819 == 0) {
						L24:
						_v1936 = _v1936 & 0x00000000;
						_a8 = _t1315 & 0x7fffffff;
						_t1360 = _a4;
						asm("fst qword [ebp-0x774]");
						_t1317 = _v1908;
						_v1928 = _a12 + 1;
						_t1141 = _t1317 >> 0x14;
						_t825 = _t1141 & 0x000007ff;
						__eflags = _t825;
						if(_t825 != 0) {
							_t825 = 0;
							_t1228 = 0x100000;
							_t41 =  &_v1868;
							 *_t41 = _v1868 & 0;
							__eflags =  *_t41;
						} else {
							_t1228 = 0;
							_v1868 = _t1122;
						}
						_t1318 = _t1317 & 0x000fffff;
						_v1924 = _v1912 + _t825;
						asm("adc esi, edx");
						_t1142 = _t1141 & 0x000007ff;
						_v1872 = _v1868 + _t1142;
						E01367F00(_t1142, _t1360);
						_push(_t1142);
						 *_t1347 = _t1360;
						_t829 = E01368010(_t1142);
						_t1144 = _t1142;
						_t830 = L01368FE0(_t829, _t1122, _t1144, _t1228);
						_v1904 = _t830;
						_t1272 = 0x20;
						__eflags = _t830 - 0x7fffffff;
						if(_t830 == 0x7fffffff) {
							L29:
							__eflags = 0;
							_v1904 = 0;
						} else {
							__eflags = _t830 - 0x80000000;
							if(_t830 == 0x80000000) {
								goto L29;
							}
						}
						_t1229 = _v1872;
						__eflags = _t1318;
						_v468 = _v1924;
						_v464 = _t1318;
						_t1147 = (0 | _t1318 != 0x00000000) + 1;
						_v1868 = _t1147;
						_v472 = _t1147;
						__eflags = _t1229 - 0x433;
						if(_t1229 < 0x433) {
							__eflags = _t1229 - 0x35;
							if(_t1229 == 0x35) {
								L100:
								__eflags = _t1318;
								_t211 =  &_v1908;
								 *_t211 = _v1908 & 0x00000000;
								__eflags =  *_t211;
								_t836 =  *((intOrPtr*)(_t1344 + 4 + (0 | _t1318 != 0x00000000) * 4 - 0x1d4));
								asm("bsr eax, eax");
								if( *_t211 == 0) {
									_t837 = 0;
									__eflags = 0;
								} else {
									_t837 = _t836 + 1;
								}
								__eflags = _t1272 - _t837 - _t1122;
								asm("sbb esi, esi");
								_t1320 =  ~_t1318 + _t1147;
								__eflags = _t1320 - 0x73;
								if(_t1320 <= 0x73) {
									_t1230 = _t1320 - 1;
									__eflags = _t1230 - 0xffffffff;
									if(_t1230 != 0xffffffff) {
										_t1296 = _t1230 - 1;
										while(1) {
											__eflags = _t1230 - _t1147;
											if(_t1230 >= _t1147) {
												_t1025 = 0;
												__eflags = 0;
											} else {
												_t1025 =  *(_t1344 + _t1230 * 4 - 0x1d0);
											}
											__eflags = _t1296 - _t1147;
											if(_t1296 >= _t1147) {
												_t1188 = 0;
												__eflags = 0;
											} else {
												_t1188 =  *(_t1344 + _t1230 * 4 - 0x1d4);
											}
											 *(_t1344 + _t1230 * 4 - 0x1d0) = _t1188 >> 0x0000001f | _t1025 + _t1025;
											_t1230 = _t1230 - 1;
											_t1296 = _t1296 - 1;
											__eflags = _t1230 - 0xffffffff;
											if(_t1230 == 0xffffffff) {
												goto L115;
											}
											_t1147 = _v472;
										}
									}
									L115:
									_v472 = _t1320;
								} else {
									_v1400 = _v1400 & 0x00000000;
									_v472 = _v472 & 0x00000000;
									E01353D96( &_v468, 0x1cc,  &_v1396, 0);
									_t1347 =  &(_t1347[0x10]);
								}
								_t1275 = 0x434 >> 5;
								E01348E90(0x434 >> 5,  &_v1396, 0, 0x434);
								__eflags = 1;
								 *(_t1344 + 0xbad63d) = 1 << (0x00000434 - _v1872 & 0x0000001f);
							} else {
								_v1396 = _v1396 & 0x00000000;
								_v1392 = 0x100000;
								_v1400 = 2;
								__eflags = _t1318;
								if(_t1318 != 0) {
									_t1255 = 0;
									__eflags = 0;
									while(1) {
										_t1030 =  *((intOrPtr*)(_t1344 + _t1255 - 0x570));
										__eflags = _t1030 -  *((intOrPtr*)(_t1344 + _t1255 - 0x1d0));
										if(_t1030 !=  *((intOrPtr*)(_t1344 + _t1255 - 0x1d0))) {
											goto L100;
										}
										_t1255 = _t1255 + 4;
										__eflags = _t1255 - 8;
										if(_t1255 != 8) {
											continue;
										} else {
											__eflags = 0;
											asm("bsr eax, esi");
											_v1908 = 0;
											if(0 == 0) {
												_t1031 = 0;
											} else {
												_t1031 = _t1030 + 1;
											}
											__eflags = _t1272 - _t1031 - 2;
											asm("sbb esi, esi");
											_t1334 =  ~_t1318 + _t1147;
											__eflags = _t1334 - 0x73;
											if(_t1334 <= 0x73) {
												_t1256 = _t1334 - 1;
												__eflags = _t1256 - 0xffffffff;
												if(_t1256 != 0xffffffff) {
													_t1299 = _t1256 - 1;
													while(1) {
														__eflags = _t1256 - _t1147;
														if(_t1256 >= _t1147) {
															_t1037 = 0;
														} else {
															_t1037 =  *(_t1344 + _t1256 * 4 - 0x1d0);
														}
														__eflags = _t1299 - _t1147;
														if(_t1299 >= _t1147) {
															_t1192 = 0;
														} else {
															_t1192 =  *(_t1344 + _t1256 * 4 - 0x1d4);
														}
														 *(_t1344 + _t1256 * 4 - 0x1d0) = _t1192 >> 0x0000001e | _t1037 << 0x00000002;
														_t1256 = _t1256 - 1;
														_t1299 = _t1299 - 1;
														__eflags = _t1256 - 0xffffffff;
														if(_t1256 == 0xffffffff) {
															goto L98;
														}
														_t1147 = _v472;
													}
												}
												L98:
												_v472 = _t1334;
											} else {
												_v1400 = 0;
												_v472 = 0;
												E01353D96( &_v468, 0x1cc,  &_v1396, 0);
												_t1347 =  &(_t1347[0x10]);
											}
											_t1275 = 0x435 >> 5;
											E01348E90(0x435 >> 5,  &_v1396, 0, 0x435);
											 *(_t1344 + 0xbad63d) = 1 << (0x00000435 - _v1872 & 0x0000001f);
										}
										goto L117;
									}
								}
								goto L100;
							}
							L117:
							_t843 = _t1275 + 1;
							_t1323 = 0x1cc;
							_v1400 = _t843;
							_v936 = _t843;
							E01353D96( &_v932, 0x1cc,  &_v1396, _t843 << 2);
							_t1348 =  &(_t1347[0x1c]);
							_t1122 = 1;
							__eflags = 1;
						} else {
							_v1396 = _v1396 & 0x00000000;
							_v1392 = 0x100000;
							_v1400 = 2;
							__eflags = _t1318;
							if(_t1318 == 0) {
								L57:
								_t1195 = _t1229 - 0x432;
								_t1196 = _t1195 & 0x0000001f;
								_v1880 = _t1195 >> 5;
								_v1896 = _t1196;
								_v1924 = _t1272 - _t1196;
								_t1045 = E01368EC0(_t1122, _t1272 - _t1196, 0);
								_t1258 = _v1868;
								_t1046 = _t1045 - 1;
								_t130 =  &_v1908;
								 *_t130 = _v1908 & 0x00000000;
								__eflags =  *_t130;
								_v1876 = _t1046;
								_t1047 =  !_t1046;
								_v1920 = _t1047;
								asm("bsr eax, ecx");
								if( *_t130 == 0) {
									_t138 =  &_v1868;
									 *_t138 = _v1868 & 0x00000000;
									__eflags =  *_t138;
								} else {
									_v1868 = _t1047 + 1;
								}
								_t1199 = _v1880;
								_t1323 = 0x1cc;
								_t1048 = _t1199 + _t1258;
								__eflags = _t1048 - 0x73;
								if(_t1048 <= 0x73) {
									__eflags = _t1272 - _v1868 - _v1896;
									asm("sbb eax, eax");
									_t1051 =  ~_t1048 + _t1199 + _t1258;
									_v1916 = _t1051;
									__eflags = _t1051 - 0x73;
									if(_t1051 > 0x73) {
										goto L61;
									} else {
										_t1301 = _t1199 - 1;
										_t1059 = _t1051 - 1;
										_v1900 = _t1301;
										_v1872 = _t1059;
										__eflags = _t1059 - _t1301;
										if(_t1059 != _t1301) {
											_t1305 = _t1059 - _t1199;
											__eflags = _t1305;
											_t1202 =  &(( &_v472)[_t1305]);
											_v1892 = _t1202;
											while(1) {
												__eflags = _t1305 - _t1258;
												if(_t1305 >= _t1258) {
													_t1063 = 0;
													__eflags = 0;
												} else {
													_t1063 = _t1202[1];
												}
												_v1868 = _t1063;
												_t158 = _t1305 - 1; // -4
												__eflags = _t158 - _t1258;
												if(_t158 >= _t1258) {
													_t1065 = 0;
													__eflags = 0;
												} else {
													_t1065 =  *_t1202;
												}
												_t1205 = _v1872;
												 *(_t1344 + _t1205 * 4 - 0x1d0) = (_t1065 & _v1920) >> _v1924 | (_v1868 & _v1876) << _v1896;
												_t1070 = _t1205 - 1;
												_t1202 = _v1892 - 4;
												_v1872 = _t1070;
												_t1305 = _t1305 - 1;
												_v1892 = _t1202;
												__eflags = _t1070 - _v1900;
												if(_t1070 == _v1900) {
													break;
												}
												_t1258 = _v472;
											}
											_t1199 = _v1880;
										}
										__eflags = _t1199;
										if(_t1199 != 0) {
											__eflags = 0;
											memset( &_v468, 0, _t1199 << 2);
											_t1347 =  &(_t1347[0xc]);
										}
										_v472 = _v1916;
									}
								} else {
									L61:
									_v1400 = 0;
									_v472 = 0;
									E01353D96( &_v468, _t1323,  &_v1396, 0);
									_t1347 =  &(_t1347[0x10]);
								}
								_v1396 = 2;
								_push(4);
							} else {
								_t1207 = 0;
								__eflags = 0;
								while(1) {
									__eflags =  *((intOrPtr*)(_t1344 + _t1207 - 0x570)) -  *((intOrPtr*)(_t1344 + _t1207 - 0x1d0));
									if( *((intOrPtr*)(_t1344 + _t1207 - 0x570)) !=  *((intOrPtr*)(_t1344 + _t1207 - 0x1d0))) {
										goto L57;
									}
									_t1207 = _t1207 + 4;
									__eflags = _t1207 - 8;
									if(_t1207 != 8) {
										continue;
									} else {
										_t1208 = _t1229 - 0x431;
										_t1209 = _t1208 & 0x0000001f;
										_v1880 = _t1208 >> 5;
										_v1896 = _t1209;
										_v1876 = _t1272 - _t1209;
										_t1076 = E01368EC0(_t1122, _t1272 - _t1209, 0);
										_t1263 = _v1868;
										_t1077 = _t1076 - 1;
										_t70 =  &_v1908;
										 *_t70 = _v1908 & 0x00000000;
										__eflags =  *_t70;
										_v1900 = _t1077;
										_t1078 =  !_t1077;
										_v1924 = _t1078;
										asm("bsr eax, ecx");
										if( *_t70 == 0) {
											_t78 =  &_v1868;
											 *_t78 = _v1868 & 0x00000000;
											__eflags =  *_t78;
										} else {
											_v1868 = _t1078 + 1;
										}
										_t1212 = _v1880;
										_t1323 = 0x1cc;
										_t1079 = _t1212 + _t1263;
										__eflags = _t1079 - 0x73;
										if(_t1079 <= 0x73) {
											__eflags = _t1272 - _v1868 - _v1896;
											asm("sbb eax, eax");
											_t1082 =  ~_t1079 + _t1212 + _t1263;
											_v1920 = _t1082;
											__eflags = _t1082 - 0x73;
											if(_t1082 > 0x73) {
												goto L39;
											} else {
												_t1307 = _t1212 - 1;
												_t1088 = _t1082 - 1;
												_v1916 = _t1307;
												_v1872 = _t1088;
												__eflags = _t1088 - _t1307;
												if(_t1088 != _t1307) {
													_t1311 = _t1088 - _t1212;
													__eflags = _t1311;
													_t1215 =  &(( &_v472)[_t1311]);
													_v1892 = _t1215;
													while(1) {
														__eflags = _t1311 - _t1263;
														if(_t1311 >= _t1263) {
															_t1092 = 0;
															__eflags = 0;
														} else {
															_t1092 = _t1215[1];
														}
														_v1868 = _t1092;
														_t98 = _t1311 - 1; // -4
														__eflags = _t98 - _t1263;
														if(_t98 >= _t1263) {
															_t1094 = 0;
															__eflags = 0;
														} else {
															_t1094 =  *_t1215;
														}
														_t1218 = _v1872;
														 *(_t1344 + _t1218 * 4 - 0x1d0) = (_t1094 & _v1924) >> _v1876 | (_v1868 & _v1900) << _v1896;
														_t1099 = _t1218 - 1;
														_t1215 = _v1892 - 4;
														_v1872 = _t1099;
														_t1311 = _t1311 - 1;
														_v1892 = _t1215;
														__eflags = _t1099 - _v1916;
														if(_t1099 == _v1916) {
															break;
														}
														_t1263 = _v472;
													}
													_t1212 = _v1880;
												}
												__eflags = _t1212;
												if(_t1212 != 0) {
													__eflags = 0;
													memset( &_v468, 0, _t1212 << 2);
													_t1347 =  &(_t1347[0xc]);
												}
												_v472 = _v1920;
											}
										} else {
											L39:
											_v1400 = 0;
											_v472 = 0;
											E01353D96( &_v468, _t1323,  &_v1396, 0);
											_t1347 =  &(_t1347[0x10]);
										}
										_t1087 = 4;
										_v1396 = _t1087;
										_push(_t1087);
									}
									goto L56;
								}
								goto L57;
							}
							L56:
							_v1392 = _v1392 & 0x00000000;
							_push( &_v1396);
							_v936 = _t1122;
							_push(_t1323);
							_push( &_v932);
							_v1400 = _t1122;
							E01353D96();
							_t1348 =  &(_t1347[0x10]);
						}
						_t848 = _v1904;
						_t1149 = 0xa;
						_v1924 = _t1149;
						__eflags = _t848;
						if(_t848 < 0) {
							_t849 =  ~_t848;
							_t850 = _t849 / _t1149;
							_v1916 = _t850;
							_t1150 = _t849 % _t1149;
							_v1908 = _t1150;
							__eflags = _t850;
							if(_t850 == 0) {
								L250:
								__eflags = _t1150;
								if(_t1150 != 0) {
									_t896 =  *(0x137066c + _t1150 * 4);
									_v1908 = _t896;
									__eflags = _t896;
									if(_t896 == 0) {
										L262:
										__eflags = 0;
										_push(0);
										_v472 = 0;
										_v2420 = 0;
										goto L263;
									} else {
										__eflags = _t896 - _t1122;
										if(_t896 != _t1122) {
											_t1165 = _v472;
											__eflags = _t1165;
											if(_t1165 != 0) {
												_v1876 = _v1876 & 0x00000000;
												_t1282 = 0;
												__eflags = 0;
												do {
													_t1244 = _t896 *  *(_t1344 + _t1282 * 4 - 0x1d0) >> 0x20;
													 *(_t1344 + _t1282 * 4 - 0x1d0) = _t896 *  *(_t1344 + _t1282 * 4 - 0x1d0) + _v1876;
													_t896 = _v1908;
													asm("adc edx, 0x0");
													_t1282 = _t1282 + 1;
													_v1876 = _t1244;
													__eflags = _t1282 - _t1165;
												} while (_t1282 != _t1165);
												__eflags = _t1244;
												if(_t1244 != 0) {
													_t903 = _v472;
													__eflags = _t903 - 0x73;
													if(_t903 >= 0x73) {
														goto L262;
													} else {
														 *(_t1344 + _t903 * 4 - 0x1d0) = _t1244;
														_v472 = _v472 + 1;
													}
												}
											}
										}
									}
								}
							} else {
								do {
									__eflags = _t850 - 0x26;
									if(_t850 > 0x26) {
										_t850 = 0x26;
									}
									_t1166 =  *(0x13705d6 + _t850 * 4) & 0x000000ff;
									_v1880 = _t850;
									_v1400 = ( *(0x13705d7 + _t850 * 4) & 0x000000ff) + ( *(0x13705d6 + _t850 * 4) & 0x000000ff);
									E01348E90(_t1166 << 2,  &_v1396, 0, _t1166 << 2);
									_t914 = E01348FF0( &(( &_v1396)[_t1166]), 0x136fcd0 + ( *(0x13705d4 + _v1880 * 4) & 0x0000ffff) * 4, ( *(0x13705d7 + _t850 * 4) & 0x000000ff) << 2);
									_t1245 = _v1400;
									_t1348 =  &(_t1348[0x18]);
									_v1872 = _t1245;
									__eflags = _t1245 - _t1122;
									if(_t1245 > _t1122) {
										__eflags = _v472 - _t1122;
										if(_v472 > _t1122) {
											__eflags = _t1245 - _v472;
											_t1326 =  &_v1396;
											_t547 = _t1245 - _v472 > 0;
											__eflags = _t547;
											_t915 = _t914 & 0xffffff00 | _t547;
											if(_t547 >= 0) {
												_t1326 =  &_v468;
											}
											_v1892 = _t1326;
											__eflags = _t915;
											if(_t915 == 0) {
												_v1896 = _t1245;
												_t1245 = _v472;
												_v1872 = _t1245;
												_v1876 =  &_v1396;
											} else {
												_v1896 = _v472;
												_v1876 =  &_v468;
											}
											_t917 = 0;
											_t1285 = 0;
											_v1864 = 0;
											__eflags = _t1245;
											if(_t1245 == 0) {
												L244:
												_v472 = _t917;
												_t1323 = 0x1cc;
												_t918 = _t917 << 2;
												__eflags = _t918;
												_push(_t918);
												_t919 =  &_v1860;
												goto L245;
											} else {
												do {
													__eflags =  *(_t1326 + _t1285 * 4);
													if( *(_t1326 + _t1285 * 4) != 0) {
														_t1167 = 0;
														_t1327 = _t1285;
														_v1868 = 0;
														_v1900 = 0;
														__eflags = _v1896;
														if(_v1896 != 0) {
															_t1246 = 0;
															while(1) {
																__eflags = _t1327 - 0x73;
																if(_t1327 == 0x73) {
																	break;
																}
																__eflags = _t1327 - _t917;
																if(_t1327 == _t917) {
																	 *(_t1344 + _t1327 * 4 - 0x740) =  *(_t1344 + _t1327 * 4 - 0x740) & 0x00000000;
																	_t579 = _t1285 + 1; // 0x1
																	_t934 = _t579 + _t1167;
																	__eflags = _t934;
																	_v1864 = _t934;
																}
																_t930 =  *(_v1876 + _t1167 * 4);
																_t1170 = _v1892;
																_t1246 = _t930 *  *(_t1170 + _t1285 * 4) >> 0x20;
																asm("adc edx, 0x0");
																 *(_t1344 + _t1327 * 4 - 0x740) =  *(_t1344 + _t1327 * 4 - 0x740) + _t930 *  *(_t1170 + _t1285 * 4) + _v1868;
																_t917 = _v1864;
																asm("adc edx, 0x0");
																_t1167 = _v1900 + 1;
																_t1327 = _t1327 + 1;
																_v1868 = _t1246;
																_v1900 = _t1167;
																__eflags = _t1167 - _v1896;
																if(_t1167 != _v1896) {
																	continue;
																}
																break;
															}
															__eflags = _t1246;
															if(_t1246 != 0) {
																_t1169 =  &_v1860 + _t1327 * 4;
																_v1868 = _t1169;
																while(1) {
																	__eflags = _t1327 - 0x73;
																	if(_t1327 == 0x73) {
																		goto L240;
																	}
																	__eflags = _t1327 - _t917;
																	if(_t1327 == _t917) {
																		 *_t1169 =  *_t1169 & 0x00000000;
																		__eflags =  *_t1169;
																		_t609 = _t1327 + 1; // 0x1
																		_v1864 = _t609;
																	}
																	_v1868 = _v1868 + 4;
																	_t928 = _t1246;
																	_t1327 = _t1327 + 1;
																	_t1246 = 0;
																	 *_t1169 =  *_t1169 + _t928;
																	__eflags =  *_t1169;
																	_t917 = _v1864;
																	asm("adc edx, edx");
																	if( *_t1169 != 0) {
																		_t1169 = _v1868;
																		continue;
																	}
																	goto L240;
																}
															}
															L240:
															_t1245 = _v1872;
														}
														__eflags = _t1327 - 0x73;
														if(_t1327 == 0x73) {
															_t1323 = 0x1cc;
															goto L260;
														} else {
															_t1326 = _v1892;
															goto L243;
														}
													} else {
														__eflags = _t1285 - _t917;
														if(_t1285 == _t917) {
															 *(_t1344 + _t1285 * 4 - 0x740) =  *(_t1344 + _t1285 * 4 - 0x740) & 0x00000000;
															_t568 = _t1285 + 1; // 0x1
															_t917 = _t568;
															_v1864 = _t917;
														}
														goto L243;
													}
													goto L247;
													L243:
													_t1285 = _t1285 + 1;
													__eflags = _t1285 - _t1245;
												} while (_t1285 != _t1245);
												goto L244;
											}
										} else {
											_t1286 = _v468;
											_t1323 = 0x1cc;
											_v1936 = _t1286;
											_v472 = _t1245;
											E01353D96( &_v468, 0x1cc,  &_v1396, _t1245 << 2);
											_t1348 =  &(_t1348[0x10]);
											__eflags = _t1286;
											if(_t1286 != 0) {
												__eflags = _t1286 - _t1122;
												if(_t1286 == _t1122) {
													goto L246;
												} else {
													__eflags = _v472;
													if(_v472 == 0) {
														goto L246;
													} else {
														_t1174 = 0;
														_v1920 = _v472;
														_t1287 = 0;
														__eflags = 0;
														do {
															_t942 = _v1936;
															_t1247 = _t942 *  *(_t1344 + _t1287 * 4 - 0x1d0) >> 0x20;
															 *(_t1344 + _t1287 * 4 - 0x1d0) = _t942 *  *(_t1344 + _t1287 * 4 - 0x1d0) + _t1174;
															asm("adc edx, 0x0");
															_t1287 = _t1287 + 1;
															_t1174 = _t1247;
															__eflags = _t1287 - _v1920;
														} while (_t1287 != _v1920);
														__eflags = _t1174;
														if(_t1174 == 0) {
															goto L246;
														} else {
															_t945 = _v472;
															__eflags = _t945 - 0x73;
															if(_t945 >= 0x73) {
																L260:
																_v2420 = 0;
																_v472 = 0;
																E01353D96( &_v468, _t1323,  &_v2416, 0);
																_t1348 =  &(_t1348[0x10]);
																_t922 = 0;
															} else {
																 *(_t1344 + _t945 * 4 - 0x1d0) = _t1174;
																_v472 = _v472 + 1;
																goto L246;
															}
														}
													}
												}
											} else {
												_v2420 = 0;
												_v472 = 0;
												_push(0);
												_t919 =  &_v2416;
												L245:
												_push(_t919);
												_push(_t1323);
												_push( &_v468);
												E01353D96();
												_t1348 =  &(_t1348[0x10]);
												L246:
												_t922 = _t1122;
											}
										}
									} else {
										_t1288 = _v1396;
										__eflags = _t1288;
										if(_t1288 != 0) {
											__eflags = _t1288 - _t1122;
											if(_t1288 == _t1122) {
												goto L198;
											} else {
												__eflags = _v472;
												if(_v472 == 0) {
													goto L198;
												} else {
													_t1175 = 0;
													_v1936 = _v472;
													_t1328 = 0;
													__eflags = 0;
													do {
														_t948 = _t1288;
														_t1248 = _t948 *  *(_t1344 + _t1328 * 4 - 0x1d0) >> 0x20;
														 *(_t1344 + _t1328 * 4 - 0x1d0) = _t948 *  *(_t1344 + _t1328 * 4 - 0x1d0) + _t1175;
														asm("adc edx, 0x0");
														_t1328 = _t1328 + 1;
														_t1175 = _t1248;
														__eflags = _t1328 - _v1936;
													} while (_t1328 != _v1936);
													__eflags = _t1175;
													if(_t1175 == 0) {
														goto L198;
													} else {
														_t951 = _v472;
														__eflags = _t951 - 0x73;
														if(_t951 >= 0x73) {
															_v2420 = 0;
															_v472 = 0;
															E01353D96( &_v468, 0x1cc,  &_v2416, 0);
															_t1348 =  &(_t1348[0x10]);
															_t922 = 0;
															goto L199;
														} else {
															 *(_t1344 + _t951 * 4 - 0x1d0) = _t1175;
															_v472 = _v472 + 1;
															goto L198;
														}
													}
												}
											}
											goto L265;
										} else {
											__eflags = 0;
											_v2420 = 0;
											_v472 = 0;
											E01353D96( &_v468, 0x1cc,  &_v2416, 0);
											_t1348 =  &(_t1348[0x10]);
											L198:
											_t922 = _t1122;
										}
										L199:
										_t1323 = 0x1cc;
									}
									L247:
									__eflags = _t922;
									if(_t922 == 0) {
										_v2420 = _v2420 & 0x00000000;
										_v472 = _v472 & 0x00000000;
										_push(0);
										L263:
										_push( &_v2416);
										_t899 =  &_v468;
										goto L264;
									} else {
										goto L248;
									}
									goto L265;
									L248:
									_t850 = _v1916 - _v1880;
									__eflags = _t850;
									_v1916 = _t850;
								} while (_t850 != 0);
								_t1150 = _v1908;
								goto L250;
							}
						} else {
							_t960 = _t848 / _t1149;
							_v1876 = _t960;
							_t1176 = _t848 % _t1149;
							_v1936 = _t1176;
							__eflags = _t960;
							if(_t960 == 0) {
								L178:
								__eflags = _t1176;
								if(_t1176 != 0) {
									_t961 =  *(0x137066c + _t1176 * 4);
									_v1936 = _t961;
									__eflags = _t961;
									if(_t961 != 0) {
										__eflags = _t961 - _t1122;
										if(_t961 != _t1122) {
											_t1177 = _v936;
											__eflags = _t1177;
											if(_t1177 != 0) {
												_v1876 = _v1876 & 0x00000000;
												_t1289 = 0;
												__eflags = 0;
												do {
													_t1250 = _t961 *  *(_t1344 + _t1289 * 4 - 0x3a0) >> 0x20;
													 *(_t1344 + _t1289 * 4 - 0x3a0) = _t961 *  *(_t1344 + _t1289 * 4 - 0x3a0) + _v1876;
													_t961 = _v1936;
													asm("adc edx, 0x0");
													_t1289 = _t1289 + 1;
													_v1876 = _t1250;
													__eflags = _t1289 - _t1177;
												} while (_t1289 != _t1177);
												__eflags = _t1250;
												if(_t1250 != 0) {
													_t964 = _v936;
													__eflags = _t964 - 0x73;
													if(_t964 >= 0x73) {
														goto L180;
													} else {
														 *(_t1344 + _t964 * 4 - 0x3a0) = _t1250;
														_v936 = _v936 + 1;
													}
												}
											}
										}
									} else {
										L180:
										_v2420 = 0;
										_v936 = 0;
										_push(0);
										goto L184;
									}
								}
							} else {
								do {
									__eflags = _t960 - 0x26;
									if(_t960 > 0x26) {
										_t960 = 0x26;
									}
									_t1178 =  *(0x13705d6 + _t960 * 4) & 0x000000ff;
									_v1868 = _t960;
									_v1400 = ( *(0x13705d7 + _t960 * 4) & 0x000000ff) + ( *(0x13705d6 + _t960 * 4) & 0x000000ff);
									E01348E90(_t1178 << 2,  &_v1396, 0, _t1178 << 2);
									_t977 = E01348FF0( &(( &_v1396)[_t1178]), 0x136fcd0 + ( *(0x13705d4 + _v1868 * 4) & 0x0000ffff) * 4, ( *(0x13705d7 + _t960 * 4) & 0x000000ff) << 2);
									_t1251 = _v1400;
									_t1348 =  &(_t1348[0x18]);
									_v1872 = _t1251;
									__eflags = _t1251 - _t1122;
									if(_t1251 > _t1122) {
										__eflags = _v936 - _t1122;
										if(_v936 > _t1122) {
											__eflags = _t1251 - _v936;
											_t1330 =  &_v1396;
											_t340 = _t1251 - _v936 > 0;
											__eflags = _t340;
											_t978 = _t977 & 0xffffff00 | _t340;
											if(_t340 >= 0) {
												_t1330 =  &_v932;
											}
											_v1896 = _t1330;
											__eflags = _t978;
											if(_t978 == 0) {
												_v1892 = _t1251;
												_t1251 = _v936;
												_v1872 = _t1251;
												_v1916 =  &_v1396;
											} else {
												_v1892 = _v936;
												_v1916 =  &_v932;
											}
											_t980 = 0;
											_t1292 = 0;
											_v1864 = 0;
											__eflags = _t1251;
											if(_t1251 == 0) {
												L172:
												_v936 = _t980;
												_t1323 = 0x1cc;
												_t981 = _t980 << 2;
												__eflags = _t981;
												_push(_t981);
												_t982 =  &_v1860;
												goto L173;
											} else {
												do {
													__eflags =  *(_t1330 + _t1292 * 4);
													if( *(_t1330 + _t1292 * 4) != 0) {
														_t1179 = 0;
														_t1331 = _t1292;
														_v1880 = 0;
														_v1900 = 0;
														__eflags = _v1892;
														if(_v1892 != 0) {
															_t1252 = 0;
															while(1) {
																__eflags = _t1331 - 0x73;
																if(_t1331 == 0x73) {
																	break;
																}
																__eflags = _t1331 - _t980;
																if(_t1331 == _t980) {
																	 *(_t1344 + _t1331 * 4 - 0x740) =  *(_t1344 + _t1331 * 4 - 0x740) & 0x00000000;
																	_t372 = _t1292 + 1; // 0x1
																	_t998 = _t372 + _t1179;
																	__eflags = _t998;
																	_v1864 = _t998;
																}
																_t993 =  *(_v1916 + _t1179 * 4);
																_t1182 = _v1896;
																_t1252 = _t993 *  *(_t1182 + _t1292 * 4) >> 0x20;
																asm("adc edx, 0x0");
																 *(_t1344 + _t1331 * 4 - 0x740) = _t993 *  *(_t1182 + _t1292 * 4) +  *(_t1344 + _t1331 * 4 - 0x740) + _v1880;
																_t980 = _v1864;
																asm("adc edx, 0x0");
																_t1179 = _v1900 + 1;
																_v1880 = _t1252;
																_t1331 = _t1331 + 1;
																_v1900 = _t1179;
																__eflags = _t1179 - _v1892;
																if(_t1179 != _v1892) {
																	continue;
																}
																break;
															}
															__eflags = _t1252;
															if(_t1252 != 0) {
																_t1181 =  &_v1860 + _t1331 * 4;
																_v1880 = _t1181;
																while(1) {
																	__eflags = _t1331 - 0x73;
																	if(_t1331 == 0x73) {
																		goto L168;
																	}
																	__eflags = _t1331 - _t980;
																	if(_t1331 == _t980) {
																		 *_t1181 =  *_t1181 & 0x00000000;
																		__eflags =  *_t1181;
																		_t402 = _t1331 + 1; // 0x1
																		_v1864 = _t402;
																	}
																	_v1880 = _v1880 + 4;
																	_t991 = _t1252;
																	_t1331 = _t1331 + 1;
																	_t1252 = 0;
																	 *_t1181 =  *_t1181 + _t991;
																	__eflags =  *_t1181;
																	_t980 = _v1864;
																	asm("adc edx, edx");
																	if( *_t1181 != 0) {
																		_t1181 = _v1880;
																		continue;
																	}
																	goto L168;
																}
															}
															L168:
															_t1251 = _v1872;
														}
														__eflags = _t1331 - 0x73;
														if(_t1331 == 0x73) {
															__eflags = 0;
															_t1323 = 0x1cc;
															_v2420 = 0;
															_v936 = 0;
															_push(0);
															_t988 =  &_v2416;
															goto L182;
														} else {
															_t1330 = _v1896;
															goto L171;
														}
													} else {
														__eflags = _t1292 - _t980;
														if(_t1292 == _t980) {
															 *(_t1344 + _t1292 * 4 - 0x740) =  *(_t1344 + _t1292 * 4 - 0x740) & 0x00000000;
															_t361 = _t1292 + 1; // 0x1
															_t980 = _t361;
															_v1864 = _t980;
														}
														goto L171;
													}
													goto L175;
													L171:
													_t1292 = _t1292 + 1;
													__eflags = _t1292 - _t1251;
												} while (_t1292 != _t1251);
												goto L172;
											}
										} else {
											_t1293 = _v932;
											_t1323 = 0x1cc;
											_v1920 = _t1293;
											_v936 = _t1251;
											E01353D96( &_v932, 0x1cc,  &_v1396, _t1251 << 2);
											_t1348 =  &(_t1348[0x10]);
											__eflags = _t1293;
											if(_t1293 != 0) {
												__eflags = _t1293 - _t1122;
												if(_t1293 == _t1122) {
													goto L174;
												} else {
													__eflags = _v936;
													if(_v936 == 0) {
														goto L174;
													} else {
														_t1186 = 0;
														_v1900 = _v936;
														_t1294 = 0;
														__eflags = 0;
														do {
															_t1006 = _v1920;
															_t1253 = _t1006 *  *(_t1344 + _t1294 * 4 - 0x3a0) >> 0x20;
															 *(_t1344 + _t1294 * 4 - 0x3a0) = _t1006 *  *(_t1344 + _t1294 * 4 - 0x3a0) + _t1186;
															asm("adc edx, 0x0");
															_t1294 = _t1294 + 1;
															_t1186 = _t1253;
															__eflags = _t1294 - _v1900;
														} while (_t1294 != _v1900);
														__eflags = _t1186;
														if(_t1186 == 0) {
															goto L174;
														} else {
															_t1009 = _v936;
															__eflags = _t1009 - 0x73;
															if(_t1009 >= 0x73) {
																_v1400 = 0;
																_v936 = 0;
																_push(0);
																_t988 =  &_v1396;
																L182:
																_push(_t988);
																_push(_t1323);
																_push( &_v932);
																E01353D96();
																_t1348 =  &(_t1348[0x10]);
																_t985 = 0;
															} else {
																 *(_t1344 + _t1009 * 4 - 0x3a0) = _t1186;
																_v936 = _v936 + 1;
																goto L174;
															}
														}
													}
												}
											} else {
												_v1400 = 0;
												_v936 = 0;
												_push(0);
												_t982 =  &_v1396;
												L173:
												_push(_t982);
												_push(_t1323);
												_push( &_v932);
												E01353D96();
												_t1348 =  &(_t1348[0x10]);
												L174:
												_t985 = _t1122;
											}
										}
									} else {
										_t1295 = _v1396;
										__eflags = _t1295;
										if(_t1295 != 0) {
											__eflags = _t1295 - _t1122;
											if(_t1295 == _t1122) {
												goto L125;
											} else {
												__eflags = _v936;
												if(_v936 == 0) {
													goto L125;
												} else {
													_t1187 = 0;
													_v1920 = _v936;
													_t1332 = 0;
													__eflags = 0;
													do {
														_t1013 = _t1295;
														_t1254 = _t1013 *  *(_t1344 + _t1332 * 4 - 0x3a0) >> 0x20;
														 *(_t1344 + _t1332 * 4 - 0x3a0) = _t1013 *  *(_t1344 + _t1332 * 4 - 0x3a0) + _t1187;
														asm("adc edx, 0x0");
														_t1332 = _t1332 + 1;
														_t1187 = _t1254;
														__eflags = _t1332 - _v1920;
													} while (_t1332 != _v1920);
													__eflags = _t1187;
													if(_t1187 == 0) {
														goto L125;
													} else {
														_t1016 = _v936;
														__eflags = _t1016 - 0x73;
														if(_t1016 >= 0x73) {
															_v1400 = 0;
															_v936 = 0;
															E01353D96( &_v932, 0x1cc,  &_v1396, 0);
															_t1348 =  &(_t1348[0x10]);
															_t985 = 0;
															goto L126;
														} else {
															 *(_t1344 + _t1016 * 4 - 0x3a0) = _t1187;
															_v936 = _v936 + 1;
															goto L125;
														}
													}
												}
											}
											goto L265;
										} else {
											__eflags = 0;
											_v1864 = 0;
											_v936 = 0;
											E01353D96( &_v932, 0x1cc,  &_v1860, 0);
											_t1348 =  &(_t1348[0x10]);
											L125:
											_t985 = _t1122;
										}
										L126:
										_t1323 = 0x1cc;
									}
									L175:
									__eflags = _t985;
									if(_t985 == 0) {
										_v2420 = _v2420 & 0x00000000;
										_t428 =  &_v936;
										 *_t428 = _v936 & 0x00000000;
										__eflags =  *_t428;
										_push(0);
										L184:
										_push( &_v2416);
										_t899 =  &_v932;
										L264:
										_push(_t1323);
										_push(_t899);
										E01353D96();
										_t1348 =  &(_t1348[0x10]);
									} else {
										goto L176;
									}
									goto L265;
									L176:
									_t960 = _v1876 - _v1868;
									__eflags = _t960;
									_v1876 = _t960;
								} while (_t960 != 0);
								_t1176 = _v1936;
								goto L178;
							}
						}
						L265:
						_t1151 = _v472;
						_t1276 = _v1888;
						_v1872 = _t1276;
						__eflags = _t1151;
						if(_t1151 != 0) {
							_v1876 = _v1876 & 0x00000000;
							_t1281 = 0;
							__eflags = 0;
							do {
								_t888 =  *(_t1344 + _t1281 * 4 - 0x1d0);
								_t1242 = 0xa;
								_t1243 = _t888 * _t1242 >> 0x20;
								 *(_t1344 + _t1281 * 4 - 0x1d0) = _t888 * _t1242 + _v1876;
								asm("adc edx, 0x0");
								_t1281 = _t1281 + 1;
								_v1876 = _t1243;
								__eflags = _t1281 - _t1151;
							} while (_t1281 != _t1151);
							_t1276 = _v1872;
							__eflags = _t1243;
							if(_t1243 != 0) {
								_t891 = _v472;
								__eflags = _t891 - 0x73;
								if(_t891 >= 0x73) {
									__eflags = 0;
									_v2420 = 0;
									_v472 = 0;
									E01353D96( &_v468, _t1323,  &_v2416, 0);
									_t1348 =  &(_t1348[0x10]);
								} else {
									 *(_t1344 + _t891 * 4 - 0x1d0) = _t1243;
									_v472 = _v472 + 1;
								}
							}
						}
						_t853 = E013538A0( &_v472,  &_v936);
						_t1154 = _v1888;
						_t1233 = 0xa;
						__eflags = _t853 - _t1233;
						if(_t853 != _t1233) {
							__eflags = _t853;
							if(_t853 != 0) {
								_t1276 = _t1154 + 1;
								 *_t1154 = _t853 + 0x30;
								_v1872 = _t1276;
								goto L280;
							} else {
								_t855 = _v1904 - 1;
								goto L281;
							}
							goto L312;
						} else {
							_t879 = _v936;
							_t1276 = _t1154 + 1;
							_v1904 = _v1904 + 1;
							 *_t1154 = 0x31;
							_v1872 = _t1276;
							_v1908 = _t879;
							__eflags = _t879;
							if(_t879 != 0) {
								_t1280 = 0;
								_t1163 = 0;
								__eflags = 0;
								do {
									_t880 =  *(_t1344 + _t1163 * 4 - 0x3a0);
									 *(_t1344 + _t1163 * 4 - 0x3a0) = _t880 * _t1233 + _t1280;
									asm("adc edx, 0x0");
									_t1163 = _t1163 + 1;
									_t1280 = _t880 * _t1233 >> 0x20;
									_t1233 = 0xa;
									__eflags = _t1163 - _v1908;
								} while (_t1163 != _v1908);
								_v1908 = _t1280;
								__eflags = _t1280;
								_t1276 = _v1872;
								if(_t1280 != 0) {
									_t1164 = _v936;
									__eflags = _t1164 - 0x73;
									if(_t1164 >= 0x73) {
										_v2420 = 0;
										_v936 = 0;
										E01353D96( &_v932, _t1323,  &_v2416, 0);
										_t1348 =  &(_t1348[0x10]);
									} else {
										 *((intOrPtr*)(_t1344 + _t1164 * 4 - 0x3a0)) = _v1908;
										_t719 =  &_v936;
										 *_t719 = _v936 + 1;
										__eflags =  *_t719;
									}
								}
								_t1154 = _v1888;
							}
							L280:
							_t855 = _v1904;
						}
						L281:
						 *((intOrPtr*)(_v1932 + 4)) = _t855;
						_t1235 = _v1928;
						__eflags = _t855;
						if(_t855 >= 0) {
							__eflags = _t1235 - 0x7fffffff;
							if(_t1235 <= 0x7fffffff) {
								__eflags = _a16;
								if(_a16 == 0) {
									_t1235 = _t1235 + _t855;
									__eflags = _t1235;
								}
							}
						}
						_t857 = _a28 - 1;
						__eflags = _t857 - _t1235;
						if(_t857 >= _t1235) {
							_t857 = _t1235;
						}
						_t858 = _t857 + _t1154;
						_t1227 = 0;
						_v1876 = _t858;
						_v1881 = 0;
						__eflags = _t1276 - _t858;
						if(_t1276 != _t858) {
							while(1) {
								_t863 = _v472;
								_v1908 = _t863;
								__eflags = _t863;
								if(_t863 == 0) {
									goto L309;
								}
								_t1278 = 0;
								_t1158 = 0;
								__eflags = 0;
								do {
									_t864 =  *(_t1344 + _t1158 * 4 - 0x1d0);
									_t1237 = _t864 * 0x3b9aca00 >> 0x20;
									 *(_t1344 + _t1158 * 4 - 0x1d0) = _t864 * 0x3b9aca00 + _t1278;
									asm("adc edx, 0x0");
									_t1158 = _t1158 + 1;
									_t1278 = 0x3b9aca00;
									__eflags = _t1158 - _v1908;
								} while (_t1158 != _v1908);
								_v1908 = 0x3b9aca00;
								__eflags = 0x3b9aca00;
								_t1279 = _v1872;
								if(0x3b9aca00 != 0) {
									_t1162 = _v472;
									__eflags = _t1162 - 0x73;
									if(_t1162 >= 0x73) {
										__eflags = 0;
										_v2420 = 0;
										_v472 = 0;
										E01353D96( &_v468, _t1323,  &_v2416, 0);
										_t1348 =  &(_t1348[0x10]);
									} else {
										 *(_t1344 + _t1162 * 4 - 0x1d0) = _t1237;
										_v472 = _v472 + 1;
									}
								}
								_t869 = E013538A0( &_v472,  &_v936);
								_v1928 = 8;
								_t1154 = _v1876 - _t1279;
								__eflags = _t1154;
								do {
									_v1908 = _t869 / _v1924;
									_t1240 = _t869 % _v1924 + 0x30;
									_t871 = _v1928;
									__eflags = _t1154 - _t871;
									if(_t1154 > _t871) {
										 *((char*)(_t871 + _t1279)) = _t1240;
										goto L304;
									} else {
										__eflags = _t1240 - 0x30;
										if(_t1240 == 0x30) {
											L304:
											_t1227 = _v1881;
										} else {
											_t1227 = _t1122;
											_v1881 = _t1227;
										}
									}
									_t872 = _t871 - 1;
									_v1928 = _t872;
									__eflags = _t872 - 0xffffffff;
									_t869 = _v1908;
								} while (_t872 != 0xffffffff);
								__eflags = _t1154 - 9;
								if(_t1154 > 9) {
									_t1154 = 9;
								}
								_t1276 = _t1279 + _t1154;
								_v1872 = _t1276;
								__eflags = _t1276 - _v1876;
								if(_t1276 != _v1876) {
									continue;
								}
								goto L309;
							}
						}
						L309:
						 *_t1276 = 0;
						__eflags = _v472;
						if(_v472 != 0) {
							goto L311;
						} else {
							__eflags = _t1227;
							if(__eflags != 0) {
								goto L311;
							}
						}
						goto L312;
					} else {
						_t1154 = _v1932;
						 *((intOrPtr*)(_v1932 + 4)) = _t1122;
						_t1101 = _t819 - 1;
						__eflags = _t1101;
						if(_t1101 == 0) {
							_t1102 = E0135A952(_v1888, _a28, "1#INF");
							__eflags = _t1102;
							if(_t1102 != 0) {
								goto L315;
							} else {
								L311:
								_t1122 = 0;
								__eflags = 0;
								goto L312;
							}
						} else {
							_t1113 = _t1101 - 1;
							__eflags = _t1113;
							if(_t1113 == 0) {
								_push("1#QNAN");
								goto L20;
							} else {
								_t1115 = _t1113 - 1;
								__eflags = _t1115;
								if(_t1115 == 0) {
									_push("1#SNAN");
									goto L20;
								} else {
									__eflags = _t1115 != 1;
									if(_t1115 != 1) {
										goto L24;
									} else {
										_push("1#IND");
										goto L20;
									}
								}
							}
						}
					}
				} else {
					_t1154 = _t1315 & 0x000fffff;
					if((_a4 | _t1315 & 0x000fffff) == 0 || (_v1956 & 0x01000000) != 0) {
						_push(0x1372fb0);
						 *((intOrPtr*)(_v1932 + 4)) =  *(_v1932 + 4) & 0x00000000;
						L20:
						_push(_a28);
						_push(_v1888);
						if(E0135A952() != 0) {
							L315:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E0134C5DF();
							asm("int3");
							_push(_t1344);
							_t1267 = _v2448;
							__eflags = _t1267;
							if(_t1267 != 0) {
								_t1220 = _a4;
								__eflags = _t1220;
								if(_t1220 != 0) {
									__eflags = _t1220 & 0xffffff80;
									if((_t1220 & 0xffffff80) != 0) {
										_push(_t1122);
										_push(_t1315);
										__eflags = _t1220 & 0xfffff800;
										if((_t1220 & 0xfffff800) != 0) {
											__eflags = _t1220 & 0xffff0000;
											if((_t1220 & 0xffff0000) != 0) {
												__eflags = _t1220 & 0xffe00000;
												if((_t1220 & 0xffe00000) != 0) {
													goto L337;
												} else {
													__eflags = _t1220 - 0x10ffff;
													if(_t1220 > 0x10ffff) {
														goto L337;
													} else {
														_push(3);
														_t1133 = 0xf0;
														goto L333;
													}
												}
											} else {
												__eflags = _t1220 - 0xd800;
												if(_t1220 < 0xd800) {
													L329:
													_push(2);
													_t1133 = 0xe0;
													L333:
													_pop(1);
													goto L334;
												} else {
													__eflags = _t1220 - 0xdfff;
													if(_t1220 <= 0xdfff) {
														L337:
														_t1105 = E01368141(_a8, _a12);
													} else {
														goto L329;
													}
												}
											}
										} else {
											_t1133 = 0xc0;
											L334:
											_push(_t1269);
											_t1312 = 1;
											do {
												_t1106 = _t1220;
												_t1220 = _t1220 >> 6;
												 *(_t1312 + _t1267) = _t1106 & 0x0000003f | 0x00000080;
												_t1312 = _t1312 - 1;
												__eflags = _t1312;
											} while (_t1312 != 0);
											 *_t1267 = _t1220 | _t1133;
											_t1105 = E0136812D(2, _a8);
										}
										return _t1105;
									} else {
										 *_t1267 = _t1220;
										goto L319;
									}
								} else {
									 *_t1267 = _t1220;
									goto L318;
								}
							} else {
								_t1220 = 0;
								__eflags = 0;
								L318:
								_t1112 = _a8;
								 *_t1112 = _t1220;
								 *(_t1112 + 4) = _t1220;
								L319:
								__eflags = 1;
								return 1;
							}
						} else {
							L312:
							_t1358 = _v1944;
							_pop(_t1277);
							_pop(_t1324);
							if(_v1944 != 0) {
								E01367E5E(_t1154, _t1358,  &_v1952);
							}
							_pop(_t1127);
							return E01347708(_t1122, _t1127, _v8 ^ _t1344, _t1227, _t1277, _t1324);
						}
					} else {
						goto L12;
					}
				}
			}

0x01364609
0x01364609
0x01364614
0x0136461b
0x01364621
0x0136462a
0x01364638
0x01364648
0x0136464c
0x0136465e
0x01364664
0x0136464e
0x0136464e
0x0136464e
0x0136466b
0x0136466e
0x01364671
0x01364672
0x01364674
0x01364683
0x0136467e
0x01364680
0x01364680
0x01364685
0x0136468f
0x01364697
0x013646a1
0x013646b0
0x013646b5
0x013646e3
0x013646e7
0x013646ed
0x013646ef
0x01364762
0x0136476b
0x01364778
0x0136477c
0x0136477f
0x01364785
0x0136478d
0x01364793
0x0136479d
0x0136479d
0x013647a0
0x013647ac
0x013647ae
0x013647b3
0x013647b3
0x013647b3
0x013647a2
0x013647a2
0x013647a4
0x013647a4
0x013647bf
0x013647cd
0x013647d3
0x013647d5
0x013647dd
0x013647e3
0x013647e8
0x013647ea
0x013647ed
0x013647f3
0x013647f4
0x013647f9
0x01364801
0x01364802
0x01364807
0x01364810
0x01364810
0x01364812
0x01364809
0x01364809
0x0136480e
0x00000000
0x00000000
0x0136480e
0x01364818
0x01364826
0x01364828
0x01364831
0x01364837
0x01364838
0x0136483e
0x01364844
0x0136484a
0x01364be9
0x01364bec
0x01364d06
0x01364d08
0x01364d0d
0x01364d0d
0x01364d0d
0x01364d1b
0x01364d22
0x01364d25
0x01364d2a
0x01364d2a
0x01364d27
0x01364d27
0x01364d27
0x01364d2e
0x01364d30
0x01364d34
0x01364d36
0x01364d39
0x01364d68
0x01364d6b
0x01364d6e
0x01364d70
0x01364d73
0x01364d73
0x01364d75
0x01364d80
0x01364d80
0x01364d77
0x01364d77
0x01364d77
0x01364d82
0x01364d84
0x01364d8f
0x01364d8f
0x01364d86
0x01364d86
0x01364d86
0x01364d98
0x01364d9f
0x01364da0
0x01364da1
0x01364da4
0x00000000
0x00000000
0x01364da6
0x01364da6
0x01364d73
0x01364dae
0x01364dae
0x01364d3b
0x01364d3b
0x01364d48
0x01364d5e
0x01364d63
0x01364d63
0x01364dc7
0x01364dd3
0x01364de0
0x01364de2
0x01364bf2
0x01364bf2
0x01364bf9
0x01364c03
0x01364c0d
0x01364c0f
0x01364c15
0x01364c15
0x01364c17
0x01364c17
0x01364c1e
0x01364c25
0x00000000
0x00000000
0x01364c2b
0x01364c2e
0x01364c31
0x00000000
0x01364c33
0x01364c33
0x01364c35
0x01364c38
0x01364c3e
0x01364c43
0x01364c40
0x01364c40
0x01364c40
0x01364c47
0x01364c4a
0x01364c4e
0x01364c50
0x01364c53
0x01364c7f
0x01364c82
0x01364c85
0x01364c87
0x01364c8a
0x01364c8a
0x01364c8c
0x01364c97
0x01364c8e
0x01364c8e
0x01364c8e
0x01364c99
0x01364c9b
0x01364ca6
0x01364c9d
0x01364c9d
0x01364c9d
0x01364cb0
0x01364cb7
0x01364cb8
0x01364cb9
0x01364cbc
0x00000000
0x00000000
0x01364cbe
0x01364cbe
0x01364c8a
0x01364cc6
0x01364cc6
0x01364c55
0x01364c5c
0x01364c69
0x01364c75
0x01364c7a
0x01364c7a
0x01364cdf
0x01364ceb
0x01364cfa
0x01364cfa
0x00000000
0x01364c31
0x01364c17
0x00000000
0x01364c0f
0x01364de9
0x01364de9
0x01364dec
0x01364df1
0x01364df7
0x01364e10
0x01364e17
0x01364e1a
0x01364e1a
0x01364850
0x01364850
0x01364857
0x01364861
0x0136486b
0x0136486d
0x01364a51
0x01364a51
0x01364a5d
0x01364a65
0x01364a6b
0x01364a75
0x01364a7b
0x01364a80
0x01364a86
0x01364a87
0x01364a87
0x01364a87
0x01364a8e
0x01364a94
0x01364a96
0x01364aa3
0x01364aa6
0x01364ab1
0x01364ab1
0x01364ab1
0x01364aa8
0x01364aa9
0x01364aa9
0x01364ab8
0x01364abe
0x01364ac3
0x01364ac6
0x01364ac9
0x01364afc
0x01364b02
0x01364b08
0x01364b0a
0x01364b10
0x01364b13
0x00000000
0x01364b15
0x01364b15
0x01364b18
0x01364b19
0x01364b1f
0x01364b25
0x01364b27
0x01364b2f
0x01364b2f
0x01364b37
0x01364b3a
0x01364b40
0x01364b40
0x01364b42
0x01364b49
0x01364b49
0x01364b44
0x01364b44
0x01364b44
0x01364b4b
0x01364b51
0x01364b54
0x01364b56
0x01364b5c
0x01364b5c
0x01364b58
0x01364b58
0x01364b58
0x01364b80
0x01364b88
0x01364b97
0x01364b98
0x01364b9b
0x01364ba1
0x01364ba2
0x01364ba8
0x01364bae
0x00000000
0x00000000
0x01364bb0
0x01364bb0
0x01364bb8
0x01364bb8
0x01364bbe
0x01364bc0
0x01364bc2
0x01364bca
0x01364bca
0x01364bca
0x01364bd2
0x01364bd2
0x01364acb
0x01364acb
0x01364ace
0x01364ad4
0x01364ae9
0x01364aee
0x01364aee
0x01364bd8
0x01364be2
0x01364873
0x01364873
0x01364873
0x01364875
0x0136487c
0x01364883
0x00000000
0x00000000
0x01364889
0x0136488c
0x0136488f
0x00000000
0x01364891
0x01364891
0x0136489d
0x013648a5
0x013648ab
0x013648b5
0x013648bb
0x013648c0
0x013648c6
0x013648c7
0x013648c7
0x013648c7
0x013648ce
0x013648d4
0x013648d6
0x013648e3
0x013648e6
0x013648f1
0x013648f1
0x013648f1
0x013648e8
0x013648e9
0x013648e9
0x013648f8
0x013648fe
0x01364903
0x01364906
0x01364909
0x0136493c
0x01364942
0x01364948
0x0136494a
0x01364950
0x01364953
0x00000000
0x01364955
0x01364955
0x01364958
0x01364959
0x0136495f
0x01364965
0x01364967
0x0136496f
0x0136496f
0x01364977
0x0136497a
0x01364980
0x01364980
0x01364982
0x01364989
0x01364989
0x01364984
0x01364984
0x01364984
0x0136498b
0x01364991
0x01364994
0x01364996
0x0136499c
0x0136499c
0x01364998
0x01364998
0x01364998
0x013649c0
0x013649c8
0x013649d7
0x013649d8
0x013649db
0x013649e1
0x013649e2
0x013649e8
0x013649ee
0x00000000
0x00000000
0x013649f0
0x013649f0
0x013649f8
0x013649f8
0x013649fe
0x01364a00
0x01364a02
0x01364a0a
0x01364a0a
0x01364a0a
0x01364a12
0x01364a12
0x0136490b
0x0136490b
0x0136490e
0x01364914
0x01364929
0x0136492e
0x0136492e
0x01364a1a
0x01364a1b
0x01364a21
0x01364a21
0x00000000
0x0136488f
0x00000000
0x01364875
0x01364a22
0x01364a22
0x01364a2f
0x01364a36
0x01364a3c
0x01364a3d
0x01364a3e
0x01364a44
0x01364a49
0x01364a49
0x01364e1b
0x01364e25
0x01364e26
0x01364e2c
0x01364e2e
0x0136532c
0x0136532e
0x01365330
0x01365336
0x01365338
0x0136533e
0x01365340
0x01365722
0x01365722
0x01365724
0x0136572a
0x01365731
0x01365737
0x01365739
0x013657ec
0x013657ec
0x013657ee
0x013657ef
0x013657f5
0x00000000
0x0136573f
0x0136573f
0x01365741
0x01365747
0x0136574d
0x0136574f
0x01365755
0x0136575c
0x0136575c
0x0136575e
0x0136575e
0x0136576b
0x01365772
0x01365778
0x0136577b
0x0136577c
0x01365782
0x01365782
0x01365786
0x01365788
0x0136578e
0x01365794
0x01365797
0x00000000
0x01365799
0x01365799
0x013657a0
0x013657a0
0x01365797
0x01365788
0x0136574f
0x01365741
0x01365739
0x01365346
0x01365346
0x01365346
0x01365349
0x0136534d
0x0136534d
0x0136534e
0x01365360
0x0136536d
0x0136537c
0x013653a6
0x013653ab
0x013653b1
0x013653b4
0x013653ba
0x013653bc
0x0136548e
0x01365494
0x0136555e
0x01365564
0x0136556a
0x0136556a
0x0136556a
0x0136556d
0x0136556f
0x0136556f
0x01365575
0x0136557b
0x0136557d
0x01365599
0x013655a5
0x013655ab
0x013655b1
0x0136557f
0x01365585
0x01365591
0x01365591
0x013655b7
0x013655b9
0x013655bb
0x013655c1
0x013655c3
0x013656d4
0x013656d4
0x013656da
0x013656df
0x013656df
0x013656e2
0x013656e3
0x00000000
0x013655c9
0x013655c9
0x013655c9
0x013655cd
0x013655ed
0x013655ef
0x013655f1
0x013655f7
0x013655fd
0x01365603
0x01365609
0x0136560b
0x0136560b
0x0136560e
0x00000000
0x00000000
0x01365610
0x01365612
0x01365614
0x0136561c
0x0136561f
0x0136561f
0x01365621
0x01365621
0x0136562d
0x01365630
0x01365636
0x01365645
0x01365648
0x0136564f
0x01365655
0x01365658
0x01365659
0x0136565a
0x01365660
0x01365666
0x0136566c
0x00000000
0x00000000
0x00000000
0x0136566c
0x0136566e
0x01365670
0x01365678
0x0136567b
0x01365681
0x01365681
0x01365684
0x00000000
0x00000000
0x01365686
0x01365688
0x0136568a
0x0136568a
0x0136568d
0x01365690
0x01365690
0x01365696
0x0136569d
0x0136569f
0x013656a0
0x013656a2
0x013656a2
0x013656a4
0x013656aa
0x013656ac
0x013656ae
0x00000000
0x013656ae
0x00000000
0x013656ac
0x01365681
0x013656b6
0x013656b6
0x013656b6
0x013656bc
0x013656bf
0x013657a8
0x00000000
0x013656c5
0x013656c5
0x00000000
0x013656c5
0x013655cf
0x013655cf
0x013655d1
0x013655d7
0x013655df
0x013655df
0x013655e2
0x013655e2
0x00000000
0x013655d1
0x00000000
0x013656cb
0x013656cb
0x013656cc
0x013656cc
0x00000000
0x013655c9
0x0136549a
0x0136549a
0x013654a5
0x013654b1
0x013654be
0x013654c6
0x013654cb
0x013654ce
0x013654d0
0x013654ec
0x013654ee
0x00000000
0x013654f4
0x013654f4
0x013654fb
0x00000000
0x01365501
0x01365507
0x01365509
0x0136550f
0x0136550f
0x01365511
0x01365511
0x01365517
0x01365520
0x01365527
0x0136552a
0x0136552b
0x0136552d
0x0136552d
0x01365535
0x01365537
0x00000000
0x0136553d
0x0136553d
0x01365543
0x01365546
0x013657ad
0x013657b0
0x013657b6
0x013657cb
0x013657d0
0x013657d3
0x0136554c
0x0136554c
0x01365553
0x00000000
0x01365553
0x01365546
0x01365537
0x013654fb
0x013654d2
0x013654d4
0x013654da
0x013654e0
0x013654e1
0x013656e9
0x013656e9
0x013656f0
0x013656f1
0x013656f2
0x013656f7
0x013656fa
0x013656fa
0x013656fa
0x013654d0
0x013653c2
0x013653c2
0x013653c8
0x013653ca
0x01365402
0x01365404
0x00000000
0x01365406
0x01365406
0x0136540d
0x00000000
0x0136540f
0x01365415
0x01365417
0x0136541d
0x0136541d
0x0136541f
0x0136541f
0x01365421
0x0136542a
0x01365431
0x01365434
0x01365435
0x01365437
0x01365437
0x0136543f
0x01365441
0x00000000
0x01365443
0x01365443
0x01365449
0x0136544c
0x01365460
0x01365466
0x0136547f
0x01365484
0x01365487
0x00000000
0x0136544e
0x0136544e
0x01365455
0x00000000
0x01365455
0x0136544c
0x01365441
0x0136540d
0x00000000
0x013653cc
0x013653cc
0x013653cf
0x013653d5
0x013653ee
0x013653f3
0x013653f6
0x013653f6
0x013653f6
0x013653f8
0x013653f8
0x013653f8
0x013656fc
0x013656fc
0x013656fe
0x013657da
0x013657e1
0x013657e8
0x013657fb
0x01365801
0x01365802
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01365704
0x0136570a
0x0136570a
0x01365710
0x01365710
0x0136571c
0x00000000
0x0136571c
0x01364e34
0x01364e34
0x01364e36
0x01364e3c
0x01364e3e
0x01364e44
0x01364e46
0x01365241
0x01365241
0x01365243
0x01365249
0x01365250
0x01365256
0x01365258
0x013652bc
0x013652be
0x013652c4
0x013652ca
0x013652cc
0x013652d2
0x013652d9
0x013652d9
0x013652db
0x013652db
0x013652e8
0x013652ef
0x013652f5
0x013652f8
0x013652f9
0x013652ff
0x013652ff
0x01365303
0x01365305
0x0136530b
0x01365311
0x01365314
0x00000000
0x0136531a
0x0136531a
0x01365321
0x01365321
0x01365314
0x01365305
0x013652cc
0x0136525a
0x0136525a
0x0136525c
0x01365262
0x01365268
0x00000000
0x01365268
0x01365258
0x01364e4c
0x01364e4c
0x01364e4c
0x01364e4f
0x01364e53
0x01364e53
0x01364e54
0x01364e66
0x01364e73
0x01364e82
0x01364eac
0x01364eb1
0x01364eb7
0x01364eba
0x01364ec0
0x01364ec2
0x01364f94
0x01364f9a
0x0136507a
0x01365080
0x01365086
0x01365086
0x01365086
0x01365089
0x0136508b
0x0136508b
0x01365091
0x01365097
0x01365099
0x013650b5
0x013650c1
0x013650c7
0x013650cd
0x0136509b
0x013650a1
0x013650ad
0x013650ad
0x013650d3
0x013650d5
0x013650d7
0x013650dd
0x013650df
0x013651f7
0x013651f7
0x013651fd
0x01365202
0x01365202
0x01365205
0x01365206
0x00000000
0x013650e5
0x013650e5
0x013650e5
0x013650e9
0x01365109
0x0136510b
0x0136510d
0x01365113
0x01365119
0x0136511f
0x01365125
0x01365127
0x01365127
0x0136512a
0x00000000
0x00000000
0x0136512c
0x0136512e
0x01365130
0x01365138
0x0136513b
0x0136513b
0x0136513d
0x0136513d
0x01365149
0x0136514c
0x01365152
0x01365162
0x0136516b
0x01365172
0x01365178
0x0136517b
0x0136517c
0x01365182
0x01365183
0x01365189
0x0136518f
0x00000000
0x00000000
0x00000000
0x0136518f
0x01365191
0x01365193
0x0136519b
0x0136519e
0x013651a4
0x013651a4
0x013651a7
0x00000000
0x00000000
0x013651a9
0x013651ab
0x013651ad
0x013651ad
0x013651b0
0x013651b3
0x013651b3
0x013651b9
0x013651c0
0x013651c2
0x013651c3
0x013651c5
0x013651c5
0x013651c7
0x013651cd
0x013651cf
0x013651d1
0x00000000
0x013651d1
0x00000000
0x013651cf
0x013651a4
0x013651d9
0x013651d9
0x013651d9
0x013651df
0x013651e2
0x0136526b
0x0136526d
0x01365272
0x01365278
0x0136527e
0x0136527f
0x00000000
0x013651e8
0x013651e8
0x00000000
0x013651e8
0x013650eb
0x013650eb
0x013650ed
0x013650f3
0x013650fb
0x013650fb
0x013650fe
0x013650fe
0x00000000
0x013650ed
0x00000000
0x013651ee
0x013651ee
0x013651ef
0x013651ef
0x00000000
0x013650e5
0x01364fa0
0x01364fa0
0x01364fab
0x01364fb7
0x01364fc4
0x01364fcc
0x01364fd1
0x01364fd4
0x01364fd6
0x01364ff2
0x01364ff4
0x00000000
0x01364ffa
0x01364ffa
0x01365001
0x00000000
0x01365007
0x0136500d
0x0136500f
0x01365015
0x01365015
0x01365017
0x01365017
0x0136501d
0x01365026
0x0136502d
0x01365030
0x01365031
0x01365033
0x01365033
0x0136503b
0x0136503d
0x00000000
0x01365043
0x01365043
0x01365049
0x0136504c
0x01365062
0x01365068
0x0136506e
0x0136506f
0x01365285
0x01365285
0x0136528c
0x0136528d
0x0136528e
0x01365293
0x01365296
0x0136504e
0x0136504e
0x01365055
0x00000000
0x01365055
0x0136504c
0x0136503d
0x01365001
0x01364fd8
0x01364fda
0x01364fe0
0x01364fe6
0x01364fe7
0x0136520c
0x0136520c
0x01365213
0x01365214
0x01365215
0x0136521a
0x0136521d
0x0136521d
0x0136521d
0x01364fd6
0x01364ec8
0x01364ec8
0x01364ece
0x01364ed0
0x01364f08
0x01364f0a
0x00000000
0x01364f0c
0x01364f0c
0x01364f13
0x00000000
0x01364f15
0x01364f1b
0x01364f1d
0x01364f23
0x01364f23
0x01364f25
0x01364f25
0x01364f27
0x01364f30
0x01364f37
0x01364f3a
0x01364f3b
0x01364f3d
0x01364f3d
0x01364f45
0x01364f47
0x00000000
0x01364f49
0x01364f49
0x01364f4f
0x01364f52
0x01364f66
0x01364f6c
0x01364f85
0x01364f8a
0x01364f8d
0x00000000
0x01364f54
0x01364f54
0x01364f5b
0x00000000
0x01364f5b
0x01364f52
0x01364f47
0x01364f13
0x00000000
0x01364ed2
0x01364ed2
0x01364ed5
0x01364edb
0x01364ef4
0x01364ef9
0x01364efc
0x01364efc
0x01364efc
0x01364efe
0x01364efe
0x01364efe
0x0136521f
0x0136521f
0x01365221
0x0136529a
0x013652a1
0x013652a1
0x013652a1
0x013652a8
0x013652aa
0x013652b0
0x013652b1
0x01365808
0x01365808
0x01365809
0x0136580a
0x0136580f
0x00000000
0x00000000
0x00000000
0x00000000
0x01365223
0x01365229
0x01365229
0x0136522f
0x0136522f
0x0136523b
0x00000000
0x0136523b
0x01364e46
0x01365812
0x01365812
0x01365818
0x0136581e
0x01365824
0x01365826
0x01365828
0x0136582f
0x0136582f
0x01365831
0x01365831
0x0136583a
0x0136583b
0x01365843
0x0136584a
0x0136584d
0x0136584e
0x01365854
0x01365854
0x01365858
0x0136585e
0x01365860
0x01365862
0x01365868
0x0136586b
0x0136587c
0x0136587f
0x01365885
0x0136589a
0x0136589f
0x0136586d
0x0136586d
0x01365874
0x01365874
0x0136586b
0x01365860
0x013658b0
0x013658b7
0x013658bf
0x013658c0
0x013658c2
0x01365a2c
0x01365a2e
0x01365a3e
0x01365a41
0x01365a43
0x00000000
0x01365a30
0x01365a36
0x00000000
0x01365a36
0x00000000
0x013658c8
0x013658c8
0x013658ce
0x013658d1
0x013658d7
0x013658da
0x013658e0
0x013658e6
0x013658e8
0x013658ea
0x013658ec
0x013658ec
0x013658ee
0x013658ee
0x013658fb
0x01365902
0x01365905
0x01365906
0x01365908
0x01365909
0x01365909
0x01365911
0x01365917
0x01365919
0x0136591f
0x01365921
0x01365927
0x0136592a
0x01365a04
0x01365a0a
0x01365a1f
0x01365a24
0x01365930
0x01365936
0x0136593d
0x0136593d
0x0136593d
0x0136593d
0x0136592a
0x01365943
0x01365943
0x01365949
0x01365949
0x01365949
0x0136594f
0x01365955
0x01365958
0x0136595e
0x01365960
0x01365962
0x01365968
0x0136596a
0x0136596e
0x01365970
0x01365970
0x01365970
0x0136596e
0x01365968
0x01365975
0x01365976
0x01365978
0x0136597a
0x0136597a
0x0136597c
0x0136597e
0x01365980
0x01365986
0x0136598c
0x0136598e
0x01365994
0x01365994
0x0136599a
0x013659a0
0x013659a2
0x00000000
0x00000000
0x013659a8
0x013659aa
0x013659aa
0x013659ac
0x013659ac
0x013659b8
0x013659bc
0x013659c3
0x013659c6
0x013659c7
0x013659c9
0x013659c9
0x013659d1
0x013659d7
0x013659d9
0x013659df
0x013659e5
0x013659eb
0x013659ee
0x01365a4e
0x01365a51
0x01365a57
0x01365a6c
0x01365a71
0x013659f0
0x013659f2
0x013659f9
0x013659f9
0x013659ee
0x01365a82
0x01365a8f
0x01365a99
0x01365a99
0x01365a9b
0x01365aa3
0x01365aa9
0x01365aac
0x01365ab2
0x01365ab4
0x01365ac5
0x00000000
0x01365ab6
0x01365ab6
0x01365ab9
0x01365ac8
0x01365ac8
0x01365abb
0x01365abb
0x01365abd
0x01365abd
0x01365ab9
0x01365ace
0x01365acf
0x01365ad5
0x01365ad8
0x01365ad8
0x01365ae0
0x01365ae3
0x01365ae7
0x01365ae7
0x01365ae8
0x01365aea
0x01365af0
0x01365af6
0x00000000
0x00000000
0x00000000
0x01365af6
0x01365994
0x01365afc
0x01365afc
0x01365aff
0x01365b06
0x00000000
0x01365b08
0x01365b08
0x01365b0a
0x00000000
0x00000000
0x01365b0a
0x00000000
0x013646f1
0x013646f1
0x013646f7
0x013646fa
0x013646fa
0x013646fd
0x0136474d
0x01364755
0x01364757
0x00000000
0x0136475d
0x01365b0c
0x01365b0c
0x01365b0c
0x00000000
0x01365b0c
0x013646ff
0x013646ff
0x013646ff
0x01364702
0x0136471c
0x00000000
0x01364704
0x01364704
0x01364704
0x01364707
0x01364715
0x00000000
0x01364709
0x01364709
0x0136470c
0x00000000
0x0136470e
0x0136470e
0x00000000
0x0136470e
0x0136470c
0x01364707
0x01364702
0x013646fd
0x013646b7
0x013646bc
0x013646c4
0x013646d8
0x013646dd
0x01364721
0x01364721
0x01364724
0x01364734
0x01365b35
0x01365b37
0x01365b38
0x01365b39
0x01365b3a
0x01365b3b
0x01365b3c
0x01365b41
0x01365b44
0x01365b47
0x01365b4a
0x01365b4c
0x01365b5d
0x01365b60
0x01365b62
0x01365b68
0x01365b6e
0x01365b74
0x01365b75
0x01365b76
0x01365b7c
0x01365b85
0x01365b8b
0x01365ba3
0x01365ba9
0x00000000
0x01365bab
0x01365bab
0x01365bb1
0x00000000
0x01365bb3
0x01365bb3
0x01365bb5
0x00000000
0x01365bb5
0x01365bb1
0x01365b8d
0x01365b8d
0x01365b93
0x01365b9d
0x01365b9d
0x01365b9f
0x01365bb7
0x01365bb7
0x00000000
0x01365b95
0x01365b95
0x01365b9b
0x01365be1
0x01365be7
0x00000000
0x00000000
0x00000000
0x01365b9b
0x01365b93
0x01365b7e
0x01365b80
0x01365bb8
0x01365bb8
0x01365bb9
0x01365bbb
0x01365bbb
0x01365bbd
0x01365bc4
0x01365bc7
0x01365bc7
0x01365bc7
0x01365bd5
0x01365bd7
0x01365bde
0x01365bf1
0x01365b70
0x01365b70
0x00000000
0x01365b70
0x01365b64
0x01365b64
0x00000000
0x01365b64
0x01365b4e
0x01365b4e
0x01365b4e
0x01365b50
0x01365b50
0x01365b53
0x01365b55
0x01365b58
0x01365b5a
0x01365b5c
0x01365b5c
0x0136473a
0x01365b0e
0x01365b0e
0x01365b15
0x01365b16
0x01365b17
0x01365b20
0x01365b25
0x01365b2d
0x01365b34
0x01365b34
0x00000000
0x00000000
0x00000000
0x013646c4

APIs

__floor_pentium4.LIBCMT ref: 013647ED

Strings

1#SNAN, xrefs: 01364715
1#INF, xrefs: 0136473F
1#QNAN, xrefs: 0136471C
1#IND, xrefs: 0136470E

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ffb86801e8b187852a6d2fe7190f66dbcef786b105ebc42b62a354486135ec0b
Instruction ID: 09c1bd2d7b89f10bf977724132b7977b1f5d2c3767d8dec4fb53ef976651c936
Opcode Fuzzy Hash: ffb86801e8b187852a6d2fe7190f66dbcef786b105ebc42b62a354486135ec0b
Instruction Fuzzy Hash: 68D24B71E082298FDB65CE28DC407EAB7B9EB45358F1481EAD50DE7244E778AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 01363BA3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E01363BA3(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					if(GetLocaleInfoW( *(_a8 + 8), 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = L"ACP";
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = L"OCP";
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E01354579(_t27, _t23);
									goto L25;
								}
								if(GetLocaleInfoW( *(_a8 + 8), 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x01363ba9
0x01363bb0
0x01363c54
0x01363c6d
0x01363c73
0x01363c78
0x01363c7a
0x01363c7a
0x01363c80
0x01363c83
0x01363c83
0x01363c6f
0x01363c6f
0x00000000
0x01363c6f
0x01363bb6
0x01363bbb
0x00000000
0x00000000
0x01363bc1
0x01363bc6
0x01363bc8
0x01363bc8
0x01363bce
0x00000000
0x00000000
0x01363bd3
0x01363bea
0x01363bea
0x01363bf3
0x01363bf5
0x00000000
0x00000000
0x01363bf7
0x01363bfc
0x01363bfe
0x01363bfe
0x01363c04
0x00000000
0x00000000
0x01363c09
0x01363c27
0x01363c29
0x01363c4c
0x00000000
0x01363c51
0x01363c44
0x00000000
0x00000000
0x01363c46
0x00000000
0x01363c46
0x01363c0b
0x01363c13
0x00000000
0x00000000
0x01363c15
0x01363c18
0x01363c1e
0x00000000
0x00000000
0x00000000
0x01363c20
0x01363c22
0x01363c24
0x00000000
0x01363c24
0x01363bd5
0x01363bdd
0x00000000
0x00000000
0x01363bdf
0x01363be2
0x01363be8
0x00000000
0x00000000
0x00000000
0x01363be8
0x01363bee
0x01363bf0
0x00000000

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,01363EC1,00000002,00000000,?,?,?,01363EC1,?,00000000), ref: 01363C3C
GetLocaleInfoW.KERNEL32(?,20001004,01363EC1,00000002,00000000,?,?,?,01363EC1,?,00000000), ref: 01363C65
GetACP.KERNEL32(?,?,01363EC1,?,00000000), ref: 01363C7A

Strings

ACP, xrefs: 01363BC1
OCP, xrefs: 01363BF7

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ef52d38635d575f13962114648a7870a2190fb6fe2985ac6a3b2279b84f37983
Instruction ID: 586e4f5963f4f2b09bf5c0188549a4958d769f5875fb49e6b1adc13220659e14
Opcode Fuzzy Hash: ef52d38635d575f13962114648a7870a2190fb6fe2985ac6a3b2279b84f37983
Instruction Fuzzy Hash: CA217132605105AAEF358F5AC901A97B7AEFF40B6CB56C428F94ED711DE732DA40C350

Uniqueness

Uniqueness Score: -1.00%

Function 01363D78 Relevance: 7.7, APIs: 5, Instructions: 183
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 87%

			E01363D78(void* __ecx, void* __edx, signed short _a4, signed short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed short* _v24;
				signed short* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed short* _t46;
				signed short _t47;
				signed short _t48;
				int _t49;
				void* _t53;
				signed short* _t57;
				signed short _t70;
				intOrPtr _t73;
				void* _t75;
				signed short _t76;
				intOrPtr _t83;
				short* _t86;
				signed short _t89;
				signed short* _t99;
				void* _t100;
				signed short _t101;
				signed int _t104;
				void* _t105;

				_t39 =  *0x1383020; // 0xc9209188
				_v8 = _t39 ^ _t104;
				_t86 = _a12;
				_t101 = _a4;
				_v28 = _a8;
				_v24 = E0135AE3C(__ecx, __edx, _t101) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E0135AE3C(__ecx, __edx, _t101);
				_t97 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t89 = _t101 + 0x80;
				_t46 = _v24;
				 *_t46 = _t101;
				_t99 =  &(_t46[2]);
				 *_t99 = _t89;
				if(_t89 != 0 &&  *_t89 != 0) {
					_t83 =  *0x1372604; // 0x17
					E01363D17(_t89, 0, 0x13724f0, _t83 - 1, _t99);
					_t46 = _v24;
					_t105 = _t105 + 0xc;
					_t97 = 0;
				}
				_v20 = _t97;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t97) {
					_t48 =  *_t99;
					if(_t48 == 0 ||  *_t48 == _t97) {
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
					} else {
						E013636B6(_t89, _t97,  &_v20);
						_pop(_t89);
					}
					goto L20;
				} else {
					_t70 =  *_t99;
					if(_t70 == 0 ||  *_t70 == _t97) {
						E0136379C(_t89, _t97,  &_v20);
					} else {
						E01363701(_t89, _t97,  &_v20);
					}
					_pop(_t89);
					if(_v20 != 0) {
						_t100 = 0;
						goto L25;
					} else {
						_t73 =  *0x13724ec; // 0x41
						_t75 = E01363D17(_t89, _t97, 0x13721e0, _t73 - 1, _v24);
						_t105 = _t105 + 0xc;
						if(_t75 == 0) {
							L20:
							_t100 = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t101 = E01363BA3(_t89,  ~_t101 & _t101 + 0x00000100,  &_v20);
								if(_t101 == 0 || IsValidCodePage(_t101 & 0x0000ffff) == 0 || IsValidLocale(_v16, 1) == 0) {
									goto L22;
								} else {
									_t57 = _v28;
									if(_t57 != 0) {
										 *_t57 = _t101;
									}
									E0135CE62(_v16,  &(_v24[0x128]), 0x55, _t100);
									if(_t86 == 0) {
										L34:
										_t53 = 1;
										L23:
										return E01347708(_t53, _t86, _v8 ^ _t104, _t97, _t100, _t101);
									} else {
										_t33 =  &(_t86[0x90]); // 0xd0
										E0135CE62(_v16, _t33, 0x55, _t100);
										if(GetLocaleInfoW(_v16, 0x1001, _t86, 0x40) == 0) {
											goto L22;
										}
										_t36 =  &(_t86[0x40]); // 0x30
										if(GetLocaleInfoW(_v12, 0x1002, _t36, 0x40) == 0) {
											goto L22;
										}
										_t38 =  &(_t86[0x80]); // 0xb0
										E01353F3C(_t38, _t101, _t38, 0x10, 0xa);
										goto L34;
									}
								}
							}
							L22:
							_t53 = 0;
							goto L23;
						}
						_t76 =  *_t99;
						_t100 = 0;
						if(_t76 == 0 ||  *_t76 == 0) {
							E0136379C(_t89, _t97,  &_v20);
						} else {
							E01363701(_t89, _t97,  &_v20);
						}
						_pop(_t89);
						goto L21;
					}
				}
			}

0x01363d80
0x01363d87
0x01363d8e
0x01363d92
0x01363d96
0x01363da4
0x01363da9
0x01363daa
0x01363dab
0x01363dac
0x01363db4
0x01363db6
0x01363dbc
0x01363dc2
0x01363dc5
0x01363dc7
0x01363dca
0x01363dce
0x01363dd5
0x01363de2
0x01363de7
0x01363dea
0x01363ded
0x01363ded
0x01363def
0x01363df2
0x01363df6
0x01363e66
0x01363e6a
0x01363e7d
0x01363e84
0x01363e8a
0x01363e8d
0x01363e71
0x01363e75
0x01363e7a
0x01363e7a
0x00000000
0x01363dfd
0x01363dfd
0x01363e01
0x01363e17
0x01363e08
0x01363e0c
0x01363e0c
0x01363e20
0x01363e21
0x01363ea9
0x00000000
0x01363e27
0x01363e27
0x01363e36
0x01363e3b
0x01363e40
0x01363e90
0x01363e90
0x01363e92
0x01363e96
0x01363eab
0x01363eb7
0x01363ec1
0x01363ec7
0x00000000
0x01363ee6
0x01363ee6
0x01363eeb
0x01363eed
0x01363eed
0x01363efe
0x01363f05
0x01363f65
0x01363f67
0x01363e9a
0x01363ea8
0x01363f07
0x01363f0a
0x01363f14
0x01363f2c
0x00000000
0x00000000
0x01363f34
0x01363f4b
0x00000000
0x00000000
0x01363f55
0x01363f5d
0x00000000
0x01363f62
0x01363f05
0x01363ec7
0x01363e98
0x01363e98
0x00000000
0x01363e98
0x01363e42
0x01363e44
0x01363e48
0x01363e5e
0x01363e4f
0x01363e53
0x01363e53
0x01363e63
0x00000000
0x01363e63
0x01363e21

APIs

Part of subcall function 0135AE3C: GetLastError.KERNEL32(?,00000008,013603BC), ref: 0135AE40
Part of subcall function 0135AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0135AEE2

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 01363E84
IsValidCodePage.KERNEL32(00000000), ref: 01363ECD
IsValidLocale.KERNEL32(?,00000001), ref: 01363EDC
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 01363F24
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 01363F43

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 0f0b443851e44765c4f19c3484e6e0f59c2744a03888ef328eee289c623feea1
Instruction ID: 3661c8d09833535c88febb577b5496ce0b08a0b4668bc8db2a7b0bc88fc63387
Opcode Fuzzy Hash: 0f0b443851e44765c4f19c3484e6e0f59c2744a03888ef328eee289c623feea1
Instruction Fuzzy Hash: 0F516372A0020AABEB20DFA9DC44ABE7BBCBF54708F148525E94DE7194E770D944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01363414 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 70%

			E01363414(void* __ecx, void* __edx, intOrPtr* _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t33;
				short* _t34;
				intOrPtr* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed short _t39;
				signed short* _t42;
				intOrPtr _t45;
				void* _t47;
				signed int _t50;
				void* _t52;
				signed int _t56;
				void* _t68;
				void* _t72;
				void* _t73;
				void* _t77;
				intOrPtr* _t84;
				short* _t87;
				void* _t89;
				intOrPtr* _t92;
				intOrPtr* _t96;
				short _t114;
				void* _t115;
				intOrPtr* _t117;
				intOrPtr _t119;
				signed int* _t120;
				void* _t121;
				void* _t122;
				intOrPtr* _t123;
				signed short _t125;
				int _t127;
				void* _t128;
				void* _t131;
				signed int _t132;

				_push(__ecx);
				_push(__ecx);
				_push(_t122);
				_t117 = _a4;
				_t33 = E0135AE3C(__ecx, __edx, _t122);
				_t114 = 0;
				_v12 = 0;
				_t3 = _t33 + 0x50; // 0x50
				_t123 = _t3;
				_t4 = _t123 + 0x250; // 0x2a0
				_t34 = _t4;
				 *((intOrPtr*)(_t123 + 8)) = 0;
				 *_t34 = 0;
				_t6 = _t123 + 4; // 0x54
				_t84 = _t6;
				_v8 = _t34;
				_t92 = _t117;
				_t35 = _t117 + 0x80;
				 *_t123 = _t117;
				 *_t84 = _t35;
				if( *_t35 != 0) {
					E013633A7(0x13724f0, 0x16, _t84);
					_t92 =  *_t123;
					_t131 = _t131 + 0xc;
					_t114 = 0;
				}
				_push(_t123);
				if( *_t92 == _t114) {
					E01362D18(_t84, _t92);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t84)) == _t114) {
						E01362E38();
					} else {
						E01362D9F(_t92);
					}
					if( *((intOrPtr*)(_t123 + 8)) == 0) {
						_t77 = E013633A7(0x13721e0, 0x40, _t123);
						_t131 = _t131 + 0xc;
						if(_t77 != 0) {
							_push(_t123);
							if( *((intOrPtr*)( *_t84)) == 0) {
								E01362E38();
							} else {
								E01362D9F(0);
							}
							L12:
						}
					}
				}
				if( *((intOrPtr*)(_t123 + 8)) == 0) {
					L37:
					_t37 = 0;
					goto L38;
				} else {
					_t38 = _t117 + 0x100;
					if( *_t117 != 0 ||  *_t38 != 0) {
						_t39 = E01363264(_t38, _t123);
					} else {
						_t39 = GetACP();
					}
					_t125 = _t39;
					if(_t125 == 0 || _t125 == 0xfde8 || IsValidCodePage(_t125 & 0x0000ffff) == 0) {
						goto L37;
					} else {
						_t42 = _a8;
						if(_t42 != 0) {
							 *_t42 = _t125;
						}
						_t119 = _a12;
						if(_t119 == 0) {
							L36:
							_t37 = 1;
							L38:
							return _t37;
						} else {
							_t96 = _v8;
							_t15 = _t119 + 0x120; // 0xd0
							_t87 = _t15;
							 *_t87 = 0;
							_t16 = _t96 + 2; // 0x6
							_t115 = _t16;
							do {
								_t45 =  *_t96;
								_t96 = _t96 + 2;
							} while (_t45 != _v12);
							_t18 = (_t96 - _t115 >> 1) + 1; // 0x3
							_t47 = E01361A01(_t96 - _t115 >> 1, _t87, 0x55, _v8);
							_t132 = _t131 + 0x10;
							if(_t47 != 0) {
								L39:
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E0134C5DF();
								asm("int3");
								_t130 = _t132;
								_t50 =  *0x1383020; // 0xc9209188
								_v52 = _t50 ^ _t132;
								_push(_t87);
								_push(_t125);
								_t126 = _v40;
								_push(_t119);
								_t52 = E0135AE3C(_t98, _t115, _v40);
								_t88 = _t52;
								_t120 =  *(E0135AE3C(_t98, _t115, _v40) + 0x34c);
								_t127 = E01363B4F(_t126);
								asm("sbb ecx, ecx");
								_t56 = GetLocaleInfoW(_t127, ( ~( *(_t52 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								if(_t56 != 0) {
									if(E01350A02(_t120, _t127,  *((intOrPtr*)(_t88 + 0x54)),  &_v272) == 0 && E01363C84(_t127) != 0) {
										 *_t120 =  *_t120 | 0x00000004;
										_t120[2] = _t127;
										_t120[1] = _t127;
									}
									_t62 =  !( *_t120 >> 2) & 0x00000001;
								} else {
									 *_t120 =  *_t120 & _t56;
									_t62 = _t56 + 1;
								}
								_pop(_t121);
								_pop(_t128);
								_pop(_t89);
								return E01347708(_t62, _t89, _v32 ^ _t130, _t115, _t121, _t128);
							} else {
								if(E0135CD1F(_t87, 0x1001, _t119, 0x40) == 0) {
									goto L37;
								} else {
									_t20 = _t119 + 0x80; // 0x30
									_t87 = _t20;
									_t21 = _t119 + 0x120; // 0xd0
									if(E0135CD1F(_t21, 0x1002, _t87, 0x40) == 0) {
										goto L37;
									} else {
										_t68 = E01348B51(_t87, 0x5f);
										_pop(_t98);
										if(_t68 != 0) {
											L31:
											_t22 = _t119 + 0x120; // 0xd0
											if(E0135CD1F(_t22, 7, _t87, 0x40) == 0) {
												goto L37;
											} else {
												goto L32;
											}
										} else {
											_t73 = E01348B51(_t87, 0x2e);
											_pop(_t98);
											if(_t73 == 0) {
												L32:
												_t119 = _t119 + 0x100;
												if(_t125 != 0xfde9) {
													E01353F3C(_t98, _t125, _t119, 0x10, 0xa);
													goto L36;
												} else {
													_push(5);
													_t72 = E01361A01(_t98, _t119, 0x10, L"utf8");
													_t132 = _t132 + 0x10;
													if(_t72 != 0) {
														goto L39;
													} else {
														goto L36;
													}
												}
											} else {
												goto L31;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x01363419
0x0136341a
0x0136341c
0x0136341e
0x01363421
0x01363428
0x0136342a
0x0136342d
0x0136342d
0x01363430
0x01363430
0x01363436
0x01363439
0x0136343c
0x0136343c
0x0136343f
0x01363442
0x01363444
0x0136344a
0x0136344c
0x01363451
0x0136345b
0x01363460
0x01363462
0x01363465
0x01363465
0x01363467
0x0136346b
0x013634b4
0x00000000
0x0136346d
0x01363472
0x0136347b
0x01363474
0x01363474
0x01363474
0x01363486
0x01363490
0x01363495
0x0136349a
0x013634a0
0x013634a4
0x013634ad
0x013634a6
0x013634a6
0x013634a6
0x013634b9
0x013634b9
0x0136349a
0x01363486
0x013634bf
0x013635fb
0x013635fb
0x00000000
0x013634c5
0x013634c5
0x013634ce
0x013634df
0x013634d5
0x013634d5
0x013634d5
0x013634e6
0x013634ea
0x00000000
0x0136350e
0x0136350e
0x01363513
0x01363515
0x01363515
0x01363517
0x0136351c
0x013635f6
0x013635f8
0x013635fd
0x01363601
0x01363522
0x01363522
0x01363525
0x01363525
0x0136352d
0x01363530
0x01363530
0x01363533
0x01363533
0x01363536
0x01363539
0x01363543
0x0136354d
0x01363552
0x01363557
0x01363602
0x01363604
0x01363605
0x01363606
0x01363607
0x01363608
0x01363609
0x0136360e
0x01363612
0x0136361a
0x01363621
0x01363624
0x01363625
0x01363626
0x01363629
0x0136362a
0x0136362f
0x01363637
0x01363646
0x01363652
0x01363663
0x0136366b
0x01363685
0x01363692
0x01363695
0x01363698
0x01363698
0x013636a2
0x0136366d
0x0136366d
0x0136366f
0x0136366f
0x013636a8
0x013636a9
0x013636ac
0x013636b3
0x0136355d
0x0136356d
0x00000000
0x01363573
0x01363575
0x01363575
0x01363581
0x0136358f
0x00000000
0x01363591
0x01363594
0x0136359a
0x0136359d
0x013635ad
0x013635b2
0x013635c0
0x00000000
0x00000000
0x00000000
0x00000000
0x0136359f
0x013635a2
0x013635a8
0x013635ab
0x013635c2
0x013635c2
0x013635ce
0x013635ee
0x00000000
0x013635d0
0x013635d0
0x013635da
0x013635df
0x013635e4
0x00000000
0x013635e6
0x00000000
0x013635e6
0x013635e4
0x00000000
0x00000000
0x00000000
0x013635ab
0x0136359d
0x0136358f
0x0136356d
0x01363557
0x0136351c
0x013634ea

APIs

Part of subcall function 0135AE3C: GetLastError.KERNEL32(?,00000008,013603BC), ref: 0135AE40
Part of subcall function 0135AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0135AEE2

GetACP.KERNEL32(?,?,?,?,?,?,0135994B,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 013634D5
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0135994B,?,?,?,00000055,?,-00000050,?,?), ref: 01363500
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 01363663

Strings

utf8, xrefs: 013635D2

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: c56334d9f4e477d2effe39dfea2a2818ea018dd962b9d6b7eecf709824dd3d3e
Instruction ID: dedbb3601a79547fdc3cb1f752abb25a8e3433a9fa3ba7ffcc3a2dbfc1198f8f
Opcode Fuzzy Hash: c56334d9f4e477d2effe39dfea2a2818ea018dd962b9d6b7eecf709824dd3d3e
Instruction Fuzzy Hash: BB71EA71600306AAEB26AB7DCC45EA7B7ACFF5475CF14C429EA09D7188FB74E9408760

Uniqueness

Uniqueness Score: -1.00%

Function 0135B336 Relevance: 6.3, APIs: 4, Instructions: 337
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 82%

			E0135B336(signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				unsigned int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t87;
				void* _t93;
				intOrPtr _t94;
				signed int _t98;
				signed int _t100;
				signed int _t101;
				signed int _t104;
				signed int _t105;
				signed int _t106;
				signed int _t111;
				void* _t113;
				signed int _t114;
				void* _t115;
				void* _t118;
				void* _t120;
				void* _t122;
				signed int* _t124;
				void* _t127;
				signed int _t129;
				signed int _t131;
				signed int _t136;
				signed int* _t140;
				signed int _t141;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				signed int _t157;
				void* _t161;
				unsigned int _t162;
				intOrPtr _t171;
				signed int _t173;
				signed int* _t174;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t188;
				intOrPtr _t189;
				void* _t190;

				_t186 = _a24;
				if(_t186 < 0) {
					_t186 = 0;
				}
				_t183 = _a8;
				_t3 = _t186 + 0xb; // 0xb
				 *_t183 = 0;
				if(_a12 > _t3) {
					_t140 = _a4;
					_t147 = _t140[1];
					_t173 =  *_t140;
					__eflags = (_t147 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if(__eflags != 0) {
						__eflags = _t147;
						if(__eflags > 0) {
							L13:
							_t174 = _t183 + 1;
							_t87 = _a28 ^ 0x00000001;
							_v20 = 0x3ff;
							_v5 = _t87;
							_v16 = _t174;
							_v48 = ((_t87 & 0x000000ff) << 5) + 7;
							__eflags = _t147 & 0x7ff00000;
							_t93 = 0x30;
							if((_t147 & 0x7ff00000) != 0) {
								 *_t183 = 0x31;
								L18:
								_t149 = 0;
								__eflags = 0;
								L19:
								_t184 =  &(_t174[0]);
								__eflags = _t186;
								if(_t186 != 0) {
									_t94 = _a40;
									__eflags =  *((char*)(_t94 + 0x14));
									if(__eflags == 0) {
										E013506A0(_t94, _t174, __eflags);
										_t94 = _a40;
										_t174 = _v16;
									}
									_t149 = 0;
									__eflags = 0;
									_t98 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)) + 0x88))))));
								} else {
									_t98 = _t149;
								}
								 *_t174 = _t98;
								_t100 = _t140[1] & 0x000fffff;
								__eflags = _t100;
								_v40 = _t100;
								if(_t100 > 0) {
									L26:
									_t175 = _t149;
									_t150 = 0xf0000;
									_t101 = 0x30;
									_v12 = _t101;
									_v24 = _t149;
									_v28 = 0xf0000;
									while(1) {
										_v32 = _v12 & 0x0000ffff;
										_t104 = _t184;
										_v36 = _t184;
										_v40 = _t186;
										__eflags = _t186;
										if(__eflags <= 0) {
											break;
										}
										_t127 = E01368EE0( *_t140 & _t175, _v32 & 0x0000ffff, _t140[1] & _t150 & 0x000fffff);
										_t161 = 0x30;
										_t129 = _t127 + _t161 & 0x0000ffff;
										__eflags = _t129 - 0x39;
										if(_t129 > 0x39) {
											_t129 = _t129 + _v48;
											__eflags = _t129;
										}
										_t162 = _v28;
										_t175 = (_t162 << 0x00000020 | _v24) >> 4;
										 *_t184 = _t129;
										_t184 = _t184 + 1;
										_t150 = _t162 >> 4;
										_t131 = _v12 - 4;
										_t186 = _t186 - 1;
										_v24 = (_t162 << 0x00000020 | _v24) >> 4;
										_v28 = _t162 >> 4;
										_v12 = _t131;
										__eflags = _t131;
										if(_t131 >= 0) {
											continue;
										} else {
											goto L43;
										}
									}
									_t186 = _v40;
									_t184 = _t104;
									_t105 = E0135BB67(__eflags, _t140, _t175, _t150, _v32, _a36);
									_t190 = _t190 + 0x14;
									__eflags = _t105;
									if(_t105 == 0) {
										goto L43;
									}
									_t184 = _v36;
									_t146 = 0x30;
									_t124 = _t184 - 1;
									while(1) {
										_t156 =  *_t124;
										__eflags = _t156 - 0x66;
										if(_t156 == 0x66) {
											goto L36;
										}
										__eflags = _t156 - 0x46;
										if(_t156 != 0x46) {
											_t140 = _a4;
											__eflags = _t124 - _v16;
											if(_t124 == _v16) {
												_t65 = _t124 - 1;
												 *_t65 =  *(_t124 - 1) + 1;
												__eflags =  *_t65;
											} else {
												__eflags = _t156 - 0x39;
												if(_t156 != 0x39) {
													_t157 = _t156 + 1;
													__eflags = _t157;
												} else {
													_t157 = _v48 + 0x3a;
												}
												 *_t124 = _t157;
											}
											goto L43;
										}
										L36:
										 *_t124 = _t146;
										_t124 = _t124 - 1;
									}
								} else {
									__eflags =  *_t140 - _t149;
									if( *_t140 <= _t149) {
										L43:
										__eflags = _t186;
										if(_t186 > 0) {
											_push(_t186);
											_t122 = 0x30;
											_push(_t122);
											_push(_t184);
											E01348E90(_t184);
											_t184 = _t184 + _t186;
											__eflags = _t184;
										}
										_t106 = _v16;
										__eflags =  *_t106;
										if( *_t106 == 0) {
											_t184 = _t106;
										}
										 *_t184 = (_v5 << 5) + 0x50;
										_t176 = _t140[1];
										_t111 = E01368EE0( *_t140, 0x34, _t176);
										_t141 = 0;
										_t188 = _t176 & 0;
										_t177 = _t184 + 2;
										_t154 = (_t111 & 0x000007ff) - _v20;
										__eflags = _t154;
										_v48 = _t177;
										asm("sbb esi, ebx");
										if(__eflags < 0) {
											L51:
											_t154 =  ~_t154;
											asm("adc esi, ebx");
											_t188 =  ~_t188;
											0x2b = 0x2d;
											goto L52;
										} else {
											if(__eflags > 0) {
												L50:
												L52:
												 *(_t184 + 1) = 0x2b;
												_t185 = _t177;
												_t113 = 0x30;
												 *_t177 = _t113;
												__eflags = _t188 - _t141;
												if(__eflags < 0) {
													L61:
													_t178 = 0x30;
													L62:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														L66:
														_t155 = _t154 + _t178;
														__eflags = _t155;
														 *_t185 = _t155;
														 *(_t185 + 1) = _t141;
														L67:
														_t114 = 0;
														__eflags = 0;
														L68:
														return _t114;
													}
													if(__eflags > 0) {
														L65:
														_push(_t141);
														_push(_t141);
														_push(0xa);
														_push(_t188);
														_push(_t154);
														_t115 = E01368F00();
														_v48 = _t178;
														_t178 = 0x30;
														 *_t185 = _t115 + _t178;
														_t185 = _t185 + 1;
														_t141 = 0;
														__eflags = 0;
														goto L66;
													}
													__eflags = _t154 - 0xa;
													if(_t154 < 0xa) {
														goto L66;
													}
													goto L65;
												}
												if(__eflags > 0) {
													L55:
													_push(_t141);
													_push(_t141);
													_push(0x3e8);
													_push(_t188);
													_push(_t154);
													_t118 = E01368F00();
													_t188 = _t141;
													_v40 = _t177;
													_t177 = _v48;
													_t141 = 0;
													_t76 = _t177 + 1; // 0x1
													_t185 = _t76;
													 *_t177 = _t118 + 0x30;
													__eflags = _t185 - _t177;
													if(_t185 != _t177) {
														L59:
														_push(_t141);
														_push(_t141);
														_push(0x64);
														_push(_t188);
														_push(_t154);
														_t120 = E01368F00();
														_t188 = _t141;
														_v40 = _t177;
														_t141 = 0;
														_t178 = 0x30;
														 *_t185 = _t120 + _t178;
														_t185 = _t185 + 1;
														__eflags = _t185 - _v48;
														if(_t185 != _v48) {
															goto L65;
														}
														goto L62;
													}
													L56:
													__eflags = _t188 - _t141;
													if(__eflags < 0) {
														goto L61;
													}
													if(__eflags > 0) {
														goto L59;
													}
													__eflags = _t154 - 0x64;
													if(_t154 < 0x64) {
														goto L61;
													}
													goto L59;
												}
												__eflags = _t154 - 0x3e8;
												if(_t154 < 0x3e8) {
													goto L56;
												}
												goto L55;
											}
											__eflags = _t154;
											if(_t154 < 0) {
												goto L51;
											}
											goto L50;
										}
									}
									goto L26;
								}
							}
							 *_t183 = _t93;
							_t149 =  *_t140 | _t140[1] & 0x000fffff;
							__eflags = _t149;
							if(_t149 != 0) {
								_v20 = 0x3fe;
								goto L18;
							}
							_v20 = _t149;
							goto L19;
						}
						if(__eflags < 0) {
							L12:
							 *_t183 = 0x2d;
							_t183 = _t183 + 1;
							__eflags = _t183;
							_t147 = _t140[1];
							goto L13;
						}
						__eflags = _t173;
						if(_t173 >= 0) {
							goto L13;
						}
						goto L12;
					}
					_t114 = E0135B662(_t140, _t147, _t173, __eflags, _t140, _t183, _a12, _a16, _a20, _t186, 0, _a32, _a36, _a40);
					__eflags = _t114;
					if(_t114 == 0) {
						_t136 = E01369070(_t183, 0x65);
						__eflags = _t136;
						if(_t136 != 0) {
							 *_t136 = ((_a28 ^ 0x00000001) << 5) + 0x50;
							 *((char*)(_t136 + 3)) = 0;
						}
						goto L67;
					}
					 *_t183 = 0;
					goto L68;
				}
				_t171 = _a40;
				_t189 = 0x22;
				 *((char*)(_t171 + 0x1c)) = 1;
				 *((intOrPtr*)(_t171 + 0x18)) = _t189;
				E0134C535(_t183, _t189, 0, 0, 0, 0, 0, _t171);
				return _t189;
			}

0x0135b341
0x0135b347
0x0135b349
0x0135b349
0x0135b34b
0x0135b34e
0x0135b351
0x0135b356
0x0135b37b
0x0135b37e
0x0135b383
0x0135b38d
0x0135b392
0x0135b3eb
0x0135b3ed
0x0135b3fc
0x0135b3ff
0x0135b402
0x0135b404
0x0135b40b
0x0135b41d
0x0135b420
0x0135b425
0x0135b429
0x0135b42a
0x0135b44a
0x0135b44d
0x0135b44d
0x0135b44d
0x0135b44f
0x0135b44f
0x0135b452
0x0135b454
0x0135b45a
0x0135b45d
0x0135b461
0x0135b465
0x0135b46a
0x0135b46d
0x0135b46d
0x0135b473
0x0135b473
0x0135b47d
0x0135b456
0x0135b456
0x0135b456
0x0135b47f
0x0135b484
0x0135b484
0x0135b489
0x0135b48c
0x0135b496
0x0135b498
0x0135b49a
0x0135b49f
0x0135b4a0
0x0135b4a3
0x0135b4a6
0x0135b4a9
0x0135b4af
0x0135b4b2
0x0135b4b4
0x0135b4b7
0x0135b4ba
0x0135b4bc
0x00000000
0x00000000
0x0135b4d3
0x0135b4da
0x0135b4de
0x0135b4e1
0x0135b4e4
0x0135b4e6
0x0135b4e6
0x0135b4e6
0x0135b4ec
0x0135b4ef
0x0135b4f3
0x0135b4f5
0x0135b4f9
0x0135b4fc
0x0135b4ff
0x0135b500
0x0135b503
0x0135b506
0x0135b509
0x0135b50c
0x00000000
0x0135b50e
0x00000000
0x0135b50e
0x0135b50c
0x0135b513
0x0135b516
0x0135b51e
0x0135b523
0x0135b526
0x0135b528
0x00000000
0x00000000
0x0135b52a
0x0135b52f
0x0135b530
0x0135b533
0x0135b533
0x0135b535
0x0135b538
0x00000000
0x00000000
0x0135b53a
0x0135b53d
0x0135b544
0x0135b547
0x0135b54a
0x0135b55f
0x0135b55f
0x0135b55f
0x0135b54c
0x0135b54c
0x0135b54f
0x0135b559
0x0135b559
0x0135b551
0x0135b554
0x0135b554
0x0135b55b
0x0135b55b
0x00000000
0x0135b54a
0x0135b53f
0x0135b53f
0x0135b541
0x0135b541
0x0135b48e
0x0135b48e
0x0135b490
0x0135b562
0x0135b562
0x0135b564
0x0135b566
0x0135b569
0x0135b56a
0x0135b56b
0x0135b56c
0x0135b574
0x0135b574
0x0135b574
0x0135b576
0x0135b579
0x0135b57c
0x0135b57e
0x0135b57e
0x0135b58a
0x0135b58e
0x0135b591
0x0135b596
0x0135b5a2
0x0135b5a4
0x0135b5a7
0x0135b5a7
0x0135b5aa
0x0135b5ad
0x0135b5af
0x0135b5bb
0x0135b5bb
0x0135b5bf
0x0135b5c1
0x0135b5c3
0x00000000
0x0135b5b1
0x0135b5b1
0x0135b5b7
0x0135b5c4
0x0135b5c4
0x0135b5c7
0x0135b5cb
0x0135b5cc
0x0135b5ce
0x0135b5d0
0x0135b62c
0x0135b62e
0x0135b62f
0x0135b62f
0x0135b631
0x0135b654
0x0135b654
0x0135b654
0x0135b656
0x0135b658
0x0135b65b
0x0135b65b
0x0135b65b
0x0135b65d
0x00000000
0x0135b65d
0x0135b633
0x0135b63a
0x0135b63a
0x0135b63b
0x0135b63c
0x0135b63e
0x0135b63f
0x0135b640
0x0135b649
0x0135b64c
0x0135b64f
0x0135b651
0x0135b652
0x0135b652
0x00000000
0x0135b652
0x0135b635
0x0135b638
0x00000000
0x00000000
0x00000000
0x0135b638
0x0135b5d7
0x0135b5dd
0x0135b5dd
0x0135b5de
0x0135b5df
0x0135b5e0
0x0135b5e1
0x0135b5e2
0x0135b5e7
0x0135b5eb
0x0135b5f0
0x0135b5f3
0x0135b5f5
0x0135b5f5
0x0135b5f8
0x0135b5fa
0x0135b5fc
0x0135b609
0x0135b609
0x0135b60a
0x0135b60b
0x0135b60d
0x0135b60e
0x0135b60f
0x0135b614
0x0135b61a
0x0135b61d
0x0135b61f
0x0135b622
0x0135b624
0x0135b625
0x0135b628
0x00000000
0x00000000
0x00000000
0x0135b62a
0x0135b5fe
0x0135b5fe
0x0135b600
0x00000000
0x00000000
0x0135b602
0x00000000
0x00000000
0x0135b604
0x0135b607
0x00000000
0x00000000
0x00000000
0x0135b607
0x0135b5d9
0x0135b5db
0x00000000
0x00000000
0x00000000
0x0135b5db
0x0135b5b3
0x0135b5b5
0x00000000
0x00000000
0x00000000
0x0135b5b5
0x0135b5af
0x00000000
0x0135b490
0x0135b48c
0x0135b42c
0x0135b438
0x0135b438
0x0135b43a
0x0135b441
0x00000000
0x0135b441
0x0135b43c
0x00000000
0x0135b43c
0x0135b3ef
0x0135b3f5
0x0135b3f5
0x0135b3f8
0x0135b3f8
0x0135b3f9
0x00000000
0x0135b3f9
0x0135b3f1
0x0135b3f3
0x00000000
0x00000000
0x00000000
0x0135b3f3
0x0135b3ac
0x0135b3b4
0x0135b3b6
0x0135b3c3
0x0135b3ca
0x0135b3cc
0x0135b3de
0x0135b3e0
0x0135b3e0
0x00000000
0x0135b3cc
0x0135b3b8
0x00000000
0x0135b3b8
0x0135b358
0x0135b35d
0x0135b364
0x0135b368
0x0135b36b
0x00000000

APIs

_strrchr.LIBCMT ref: 0135B3C3

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: f068e2ee9b525f32e3efd226be2df2fe614e6fc1a05ef0a7f01a5d797c6cceda
Instruction ID: b5c2c65bb4de45915829850f9da1dd74204d5d3e58c6131530b02dd387462f01
Opcode Fuzzy Hash: f068e2ee9b525f32e3efd226be2df2fe614e6fc1a05ef0a7f01a5d797c6cceda
Instruction Fuzzy Hash: 22B14972904246DFDB158F6CC890FFEFFA6EF59718F14816AED05AB245D2349901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013483BD Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E013483BD(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E013485B5(_t34);
				 *_t60 = 0x2cc;
				_v632 = E01348E90(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E01348E90(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E013485B5(_t49);
				}
				return _t49;
			}

0x013483bd
0x013483bd
0x013483bd
0x013483d1
0x013483d3
0x013483d6
0x013483d6
0x013483da
0x013483df
0x013483f7
0x013483fd
0x01348403
0x01348409
0x0134840f
0x01348415
0x0134841b
0x01348422
0x01348429
0x01348430
0x01348437
0x0134843e
0x01348445
0x01348446
0x0134844f
0x01348455
0x01348458
0x0134845e
0x0134846d
0x01348479
0x01348484
0x0134848b
0x01348492
0x0134849d
0x013484a5
0x013484ae
0x013484b0
0x013484b3
0x013484b5
0x013484bf
0x013484c7
0x013484cd
0x00000000
0x013484d4
0x013484d7

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 013483C9
IsDebuggerPresent.KERNEL32 ref: 01348495
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 013484B5
UnhandledExceptionFilter.KERNEL32(?), ref: 013484BF

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 540717a24a3d51ce86a9642526f3976e2f36e4739b489adce0f91bed78309cf4
Instruction ID: b266ef68fa4c34ff7e78663da873c9ceb625d5ae30a426edbff8b33df2044e7e
Opcode Fuzzy Hash: 540717a24a3d51ce86a9642526f3976e2f36e4739b489adce0f91bed78309cf4
Instruction Fuzzy Hash: 7B312B75D0121DDBDB21EFA4D9497CDBBF8AF08304F1040DAE44DAB250EBB15A858F44

Uniqueness

Uniqueness Score: -1.00%

Function 01332161 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
windowCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E01332161(void* __ecx, long _a4, CHAR* _a8) {
				signed int _v8;
				signed int _t6;
				long _t8;
				void* _t13;

				_t6 =  &_v8;
				__imp__GetLocaleInfoEx(L"!x-sys-default-locale", 0x20000001, _t6, 2, _t13, __ecx);
				_t14 = _a8;
				asm("sbb eax, eax");
				_t8 =  ~_t6 & _v8;
				_v8 = _t8;
				return E0133213D( *_t14, FormatMessageA(0x1300, 0, _a4, _t8, _a8, 0, 0));
			}

0x01332168
0x01332176
0x0133217c
0x01332181
0x01332185
0x0133218f
0x013321a8

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,?,01323270,?), ref: 01332176
FormatMessageA.KERNEL32(00001300,00000000,C9209188,00000000,00000000,00000000,00000000,?,?,?,01323270,?), ref: 01332198

Strings

!x-sys-default-locale, xrefs: 01332171

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 77220e087634c5220a5f9f1d6e4a5c5df6b06ae90f2d5f5c6495d7d1a167b02a
Instruction ID: 05028c728bd9b2b1cc02451cd4bb18d4bc89d63b871c7eb76a8bd2b3ded83a4f
Opcode Fuzzy Hash: 77220e087634c5220a5f9f1d6e4a5c5df6b06ae90f2d5f5c6495d7d1a167b02a
Instruction Fuzzy Hash: 18E039B6650118FFEB149FA1CC0BDAB7A6DEB04794F008118FA41D2144E2B06E008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 01363827 Relevance: 4.7, APIs: 3, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E01363827(void* __ecx, signed char __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				signed int _v252;
				intOrPtr _v256;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t50;
				int _t56;
				signed int _t58;
				void* _t74;
				intOrPtr _t80;
				void* _t89;
				void* _t92;
				intOrPtr _t93;
				void* _t94;
				signed int _t111;
				signed int _t115;
				intOrPtr* _t117;
				intOrPtr* _t122;
				signed int* _t124;
				int _t126;
				signed int _t127;
				void* _t128;
				void* _t140;

				_t121 = __edx;
				_t50 =  *0x1383020; // 0xc9209188
				_v8 = _t50 ^ _t127;
				_t125 = _a4;
				_t94 = E0135AE3C(__ecx, __edx, _a4);
				_t124 =  *(E0135AE3C(__ecx, __edx, _a4) + 0x34c);
				_t126 = E01363B4F(_t125);
				asm("sbb ecx, ecx");
				_t56 = GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x64)) & 0xfffff005) + 0x1002,  &_v248, 0x78);
				_v252 = _v252 & 0x00000000;
				if(_t56 == 0) {
					L37:
					 *_t124 = 0;
					_t58 = 1;
					L38:
					return E01347708(_t58, _t94, _v8 ^ _t127, _t121, _t124, _t126);
				}
				if(E01350A02(_t124, _t126,  *((intOrPtr*)(_t94 + 0x54)),  &_v248) != 0) {
					L16:
					if(( *_t124 & 0x00000300) == 0x300) {
						L36:
						_t58 =  !( *_t124 >> 2) & 0x00000001;
						goto L38;
					}
					asm("sbb eax, eax");
					if(GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
						goto L37;
					}
					_t74 = E01350A02(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248);
					if(_t74 != 0) {
						if( *(_t94 + 0x60) == 0 &&  *((intOrPtr*)(_t94 + 0x5c)) != 0 && E01350A02(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248) == 0) {
							_push(_t124);
							_t94 = 0;
							if(E01363CA9(_t126, 0) == 0) {
								goto L36;
							}
							 *_t124 =  *_t124 | 0x00000100;
							L34:
							if(_t140 == 0) {
								_t124[1] = _t126;
							}
						}
						goto L36;
					}
					_t111 =  *_t124 | 0x00000200;
					 *_t124 = _t111;
					if( *(_t94 + 0x60) == _t74) {
						if( *((intOrPtr*)(_t94 + 0x5c)) == _t74) {
							goto L20;
						}
						_t122 =  *((intOrPtr*)(_t94 + 0x50));
						_v256 = _t122 + 2;
						do {
							_t80 =  *_t122;
							_t122 = _t122 + 2;
						} while (_t80 != _v252);
						_t121 = _t122 - _v256 >> 1;
						if(_t122 - _v256 >> 1 !=  *((intOrPtr*)(_t94 + 0x5c))) {
							_t74 = 0;
							goto L20;
						}
						_push(_t124);
						if(E01363CA9(_t126, 1) == 0) {
							goto L36;
						}
						 *_t124 =  *_t124 | 0x00000100;
						_t74 = 0;
						L21:
						_t140 = _t124[1] - _t74;
						goto L34;
					}
					L20:
					 *_t124 = _t111 | 0x00000100;
					goto L21;
				}
				asm("sbb eax, eax");
				if(GetLocaleInfoW(_t126, ( ~( *(_t94 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78) == 0) {
					goto L37;
				}
				_t89 = E01350A02(_t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248);
				_t115 =  *_t124;
				if(_t89 != 0) {
					if((_t115 & 0x00000002) != 0) {
						goto L16;
					}
					if( *((intOrPtr*)(_t94 + 0x5c)) == 0) {
						L12:
						_t121 =  *_t124;
						if((_t121 & 0x00000001) != 0 || E01363C84(_t126) == 0) {
							goto L16;
						} else {
							 *_t124 = _t121;
							goto L15;
						}
					}
					_t92 = E01350F1E(_t94, _t124, _t126,  *((intOrPtr*)(_t94 + 0x50)),  &_v248,  *((intOrPtr*)(_t94 + 0x5c)));
					_t128 = _t128 + 0xc;
					if(_t92 != 0) {
						goto L12;
					}
					 *_t124 =  *_t124 | 0x00000002;
					_t124[2] = _t126;
					_t117 =  *((intOrPtr*)(_t94 + 0x50));
					_t121 = _t117 + 2;
					do {
						_t93 =  *_t117;
						_t117 = _t117 + 2;
					} while (_t93 != _v252);
					if(_t117 - _t121 >> 1 ==  *((intOrPtr*)(_t94 + 0x5c))) {
						_t124[1] = _t126;
					}
				} else {
					_t124[1] = _t126;
					 *_t124 = _t115 | 0x00000304;
					L15:
					_t124[2] = _t126;
				}
			}

0x01363827
0x01363832
0x01363839
0x0136383e
0x01363847
0x0136384f
0x0136385e
0x0136386a
0x0136387b
0x01363881
0x0136388a
0x01363a64
0x01363a66
0x01363a68
0x01363a69
0x01363a77
0x01363a77
0x013638a3
0x0136395e
0x01363969
0x01363a58
0x01363a5f
0x00000000
0x01363a5f
0x0136397d
0x01363993
0x00000000
0x00000000
0x013639a3
0x013639ac
0x01363a1d
0x01363a39
0x01363a3a
0x01363a48
0x00000000
0x00000000
0x01363a4a
0x01363a53
0x01363a53
0x01363a55
0x01363a55
0x01363a53
0x00000000
0x01363a1d
0x013639b0
0x013639b6
0x013639bb
0x013639d0
0x00000000
0x00000000
0x013639d2
0x013639d8
0x013639de
0x013639de
0x013639e1
0x013639e4
0x013639f3
0x013639f8
0x01363a14
0x00000000
0x01363a14
0x013639fa
0x01363a08
0x00000000
0x00000000
0x01363a0a
0x01363a10
0x013639c5
0x013639c5
0x00000000
0x013639c5
0x013639bd
0x013639c3
0x00000000
0x013639c3
0x013638b7
0x013638cd
0x00000000
0x00000000
0x013638dd
0x013638e4
0x013638e8
0x013638fa
0x00000000
0x00000000
0x01363900
0x01363944
0x01363944
0x01363949
0x00000000
0x01363956
0x01363959
0x00000000
0x01363959
0x01363949
0x0136390f
0x01363914
0x01363919
0x00000000
0x00000000
0x0136391b
0x0136391e
0x01363921
0x01363924
0x01363927
0x01363927
0x0136392a
0x0136392d
0x0136393d
0x0136393f
0x0136393f
0x013638ea
0x013638f0
0x013638f3
0x0136395b
0x0136395b
0x0136395b

APIs

Part of subcall function 0135AE3C: GetLastError.KERNEL32(?,00000008,013603BC), ref: 0135AE40
Part of subcall function 0135AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0135AEE2

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0136387B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 013638C5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0136398B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 0ffd86e1926bd41af11f3f81ed3da31f21cc492b6c5f6025a03ab135bb5a7ec2
Instruction ID: c2baef49c0714ad6c23558c80eea5f265885e71d0d942bfdd17818be45bbc677
Opcode Fuzzy Hash: 0ffd86e1926bd41af11f3f81ed3da31f21cc492b6c5f6025a03ab135bb5a7ec2
Instruction Fuzzy Hash: 9B61B171A102079BEB29DF2CCC82BBAB7ACFF04718F108169E909C6589E775D985DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0134C3B6 Relevance: 4.6, APIs: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E0134C3B6(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x1383020; // 0xc9209188
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E013485B5(_t41);
					_pop(_t61);
				}
				E01348E90(_t66,  &_v804, 0, 0x50);
				E01348E90(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E013485B5(_t57);
				}
				return E01347708(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x0134c3b6
0x0134c3b6
0x0134c3b6
0x0134c3c1
0x0134c3c6
0x0134c3c8
0x0134c3d0
0x0134c3d2
0x0134c3d5
0x0134c3da
0x0134c3da
0x0134c3e6
0x0134c3f9
0x0134c407
0x0134c40d
0x0134c413
0x0134c419
0x0134c41f
0x0134c425
0x0134c42b
0x0134c431
0x0134c437
0x0134c43d
0x0134c444
0x0134c44b
0x0134c452
0x0134c459
0x0134c460
0x0134c467
0x0134c468
0x0134c471
0x0134c477
0x0134c47a
0x0134c480
0x0134c48d
0x0134c496
0x0134c49f
0x0134c4a8
0x0134c4b6
0x0134c4b8
0x0134c4cd
0x0134c4d9
0x0134c4dc
0x0134c4e1
0x0134c4ee

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0134C4AE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0134C4B8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0134C4C5

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 83424dcb862d7f1e37fee56324f15301ba0e0a2674c304b2962dcda2917616e0
Instruction ID: 7bfccbe883816fe295d283400ad5e3325aa09a7f894218abc94e917e845f217a
Opcode Fuzzy Hash: 83424dcb862d7f1e37fee56324f15301ba0e0a2674c304b2962dcda2917616e0
Instruction Fuzzy Hash: C331D474901229EBCB61DF68D98879DBBF8BF18314F5041EAE40CA7250E774AF858F44

Uniqueness

Uniqueness Score: -1.00%

Function 01321D70 Relevance: 4.6, APIs: 3, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E01321D70(struct HINSTANCE__* __ecx, struct HRSRC__* __edx, signed int _a4) {
				char _v16;
				signed int _t9;
				void* _t12;
				struct HINSTANCE__* _t20;
				signed int _t27;
				void* _t31;
				struct HRSRC__* _t33;
				signed short* _t38;
				signed int _t42;

				_push(0xffffffff);
				_push(0x1369360);
				_push( *[fs:0x0]);
				_t9 =  *0x1383020; // 0xc9209188
				_push(_t9 ^ _t42);
				 *[fs:0x0] =  &_v16;
				_t33 = __edx;
				_t20 = __ecx;
				_t12 = LoadResource(__ecx, __edx);
				if(_t12 == 0) {
					L7:
					 *[fs:0x0] = _v16;
					return 0;
				} else {
					_t38 = LockResource(_t12);
					if(_t38 == 0) {
						goto L7;
					} else {
						_t31 = _t38 + SizeofResource(_t20, _t33);
						_t27 = _a4 & 0x0000000f;
						if(_t27 <= 0) {
							L5:
							if(_t38 >= _t31) {
								goto L7;
							} else {
								_t39 =  ==  ? 0 : _t38;
								_t17 =  ==  ? 0 : _t38;
								 *[fs:0x0] = _v16;
								return  ==  ? 0 : _t38;
							}
						} else {
							while(_t38 < _t31) {
								_t38 =  &(( &(_t38[ *_t38 & 0x0000ffff]))[1]);
								_t27 = _t27 - 1;
								if(_t27 != 0) {
									continue;
								} else {
									goto L5;
								}
								goto L8;
							}
							goto L7;
						}
					}
				}
				L8:
			}

0x01321d73
0x01321d75
0x01321d80
0x01321d84
0x01321d8b
0x01321d8f
0x01321d95
0x01321d97
0x01321d9b
0x01321da3
0x01321df7
0x01321dfc
0x01321e0a
0x01321da5
0x01321dac
0x01321db0
0x00000000
0x01321db2
0x01321dbd
0x01321dc0
0x01321dc3
0x01321dd7
0x01321dd9
0x00000000
0x01321ddb
0x01321de0
0x01321de3
0x01321de8
0x01321df6
0x01321df6
0x01321dc5
0x01321dc5
0x01321dcf
0x01321dd2
0x01321dd5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01321dd5
0x00000000
0x01321dc5
0x01321dc3
0x01321db0
0x00000000

APIs

LoadResource.KERNEL32(00000000,00000000,C9209188,00000001,00000000,?,00000000,01369360,000000FF,?,01321D1C,00000010,?,?,?,-00000010), ref: 01321D9B
LockResource.KERNEL32(00000000,?,01321D1C,00000010,?,?,?,-00000010,01369340,000000FF,?,0132202C,?,00000000,0136938D,000000FF), ref: 01321DA6
SizeofResource.KERNEL32(00000000,00000000,?,01321D1C,00000010,?,?,?,-00000010,01369340,000000FF,?,0132202C,?,00000000,0136938D), ref: 01321DB4

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: f82bafb4d557bfd1da42756ecfb58779e9cebdf75d39027368a30264262828b4
Instruction ID: 61022fad23fe98cae9c67ecc6c9ca6b5758be2d445f442f6f58567ef7045ea83
Opcode Fuzzy Hash: f82bafb4d557bfd1da42756ecfb58779e9cebdf75d39027368a30264262828b4
Instruction Fuzzy Hash: D611E732A04664DBC731AF6DD845B7AF7ECE785614F00492EEC56D3240E63598008790

Uniqueness

Uniqueness Score: -1.00%

Function 013538A0 Relevance: 3.4, APIs: 2, Instructions: 449
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 94%

			E013538A0(signed int* _a4, intOrPtr* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr* _v52;
				signed int _v56;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v540;
				signed int _v544;
				signed int* _t179;
				signed int _t181;
				intOrPtr _t182;
				signed int _t185;
				signed int* _t187;
				signed int _t189;
				unsigned int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t201;
				intOrPtr _t207;
				void* _t210;
				signed int _t212;
				signed int _t223;
				void* _t227;
				signed int _t230;
				intOrPtr* _t237;
				signed int _t238;
				signed int* _t239;
				signed int _t241;
				signed int _t243;
				signed int _t244;
				void* _t245;
				intOrPtr* _t246;
				signed int _t247;
				signed int _t252;
				unsigned int _t253;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				intOrPtr _t260;
				void* _t264;
				signed char _t270;
				intOrPtr* _t272;
				signed int _t276;
				signed int* _t277;
				signed int _t284;
				signed int _t285;
				signed int* _t288;
				signed int _t291;
				signed int _t293;
				intOrPtr* _t294;
				signed int _t298;
				signed int _t299;
				intOrPtr* _t300;
				signed int _t305;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed int _t314;
				void* _t315;
				signed int _t316;
				signed int* _t323;
				signed int* _t325;
				signed int _t329;
				signed int _t331;
				signed int _t332;
				signed int _t334;
				void* _t335;
				signed int _t340;
				signed int _t345;
				intOrPtr* _t347;
				signed int* _t348;

				_t179 = _a4;
				_t329 =  *_t179;
				if(_t329 == 0) {
					L76:
					__eflags = 0;
					return 0;
				} else {
					_t237 = _a8;
					_t310 =  *_t237;
					_v72 = _t310;
					if(_t310 == 0) {
						goto L76;
					} else {
						_t4 = _t329 - 1; // 0x1cb
						_t252 = _t4;
						_v8 = _t252;
						_t311 = _t310 + 0xffffffff;
						if(_t311 != 0) {
							__eflags = _t311 - _t252;
							if(_t311 > _t252) {
								goto L76;
							} else {
								_t181 = _t252;
								_t284 = _t252 - _t311;
								__eflags = _t252 - _t284;
								if(_t252 < _t284) {
									L19:
									_t284 = _t284 + 1;
									__eflags = _t284;
								} else {
									_t345 =  &(_a4[1]);
									__eflags = _t345;
									_t272 = _t345 + _t252 * 4;
									_t46 = _t237 + 4; // 0x13658b9
									_t347 = _t46 + _t311 * 4;
									while(1) {
										__eflags =  *_t347 -  *_t272;
										if(__eflags != 0) {
											break;
										}
										_t181 = _t181 - 1;
										_t347 = _t347 - 4;
										_t272 = _t272 - 4;
										__eflags = _t181 - _t284;
										if(_t181 >= _t284) {
											continue;
										} else {
											goto L19;
										}
										goto L20;
									}
									if(__eflags < 0) {
										goto L19;
									}
								}
								L20:
								__eflags = _t284;
								if(__eflags == 0) {
									goto L76;
								} else {
									_t182 = _a8;
									_t238 = _v72;
									_t331 =  *(_t182 + _t238 * 4);
									_t54 = _t238 * 4; // 0xfffedfeb
									_t253 =  *(_t182 + _t54 - 4);
									asm("bsr eax, esi");
									_v44 = _t331;
									_v36 = _t253;
									if(__eflags == 0) {
										_t312 = 0x20;
									} else {
										_t312 = 0x1f - _t182;
									}
									_v12 = _t312;
									_v40 = 0x20 - _t312;
									__eflags = _t312;
									if(_t312 != 0) {
										_t270 = _t312;
										_v36 = _v36 << _t270;
										_v44 = _t331 << _t270 | _t253 >> _v40;
										__eflags = _t238 - 2;
										if(_t238 > 2) {
											_t67 = _t238 * 4; // 0xe850ffff
											_t69 =  &_v36;
											 *_t69 = _v36 |  *(_a8 + _t67 - 8) >> _v40;
											__eflags =  *_t69;
										}
									}
									_t332 = 0;
									_v32 = 0;
									_t285 = _t284 + 0xffffffff;
									__eflags = _t285;
									_v80 = _t285;
									if(_t285 >= 0) {
										_t187 = _a4;
										_t256 = _t285 + _t238;
										_v48 = _t256;
										_v52 = _t187 + (_t285 + 1) * 4;
										_t189 = _t187 + _t256 * 4 + 0xfffffffc;
										__eflags = _t189;
										_v28 = _t189;
										do {
											__eflags = _t256 - _v8;
											if(_t256 > _v8) {
												_t257 = 0;
												__eflags = 0;
											} else {
												_t257 =  *(_t189 + 8);
											}
											_t291 =  *(_t189 + 4);
											_t241 = _t257;
											_t190 =  *_t189;
											_v76 = _t257;
											_v56 = 0;
											_v20 = _t190;
											__eflags = _t312;
											if(_t312 != 0) {
												_t298 = _t241;
												_t212 = E01368EC0(_t291, _v12, _t298);
												_t257 = _v12;
												_t241 = _t298;
												_t291 = _t190 >> _v40 | _t212;
												_t332 = _v20 << _t257;
												__eflags = _v48 - 3;
												_v20 = _t332;
												if(_v48 >= 3) {
													_t257 = _v40;
													_t332 = _t332 |  *(_v28 - 4) >> _t257;
													__eflags = _t332;
													_v20 = _t332;
												}
											}
											_push(_t241);
											_t191 = E01368E20(_t291, _t241, _v44, 0);
											_v56 = _t241;
											_t243 = _t191;
											_t334 = _t332 ^ _t332;
											_t192 = _t291;
											_v24 = _t243;
											_v16 = _t192;
											_t314 = _t257;
											_v68 = _t243;
											_v64 = _t192;
											_v56 = _t334;
											__eflags = _t192;
											if(_t192 != 0) {
												L37:
												_t244 = _t243 + 1;
												asm("adc eax, 0xffffffff");
												_t314 = _t314 + E013482C0(_t244, _t192, _v44, 0);
												asm("adc esi, edx");
												_t243 = _t244 | 0xffffffff;
												_t192 = 0;
												__eflags = 0;
												_v56 = _t334;
												_v24 = _t243;
												_v68 = _t243;
												_v16 = 0;
												_v64 = 0;
											} else {
												__eflags = _t243 - 0xffffffff;
												if(_t243 > 0xffffffff) {
													goto L37;
												}
											}
											__eflags = _t334;
											if(__eflags <= 0) {
												if(__eflags < 0) {
													goto L42;
												} else {
													__eflags = _t314 - 0xffffffff;
													if(_t314 <= 0xffffffff) {
														while(1) {
															L42:
															_v24 = _v20;
															_t210 = E013482C0(_v36, 0, _t243, _t192);
															__eflags = _t291 - _t314;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L45:
																_t192 = _v16;
																_t243 = _t243 + 0xffffffff;
																_v68 = _t243;
																asm("adc eax, 0xffffffff");
																_t314 = _t314 + _v44;
																__eflags = _t314;
																_v16 = _t192;
																asm("adc dword [ebp-0x34], 0x0");
																_v64 = _t192;
																if(_t314 == 0) {
																	__eflags = _t314 - 0xffffffff;
																	if(_t314 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t210 - _v24;
																if(_t210 <= _v24) {
																	break;
																} else {
																	goto L45;
																}
															}
															L49:
															_v24 = _t243;
															goto L50;
														}
														_t192 = _v16;
														goto L49;
													}
												}
											}
											L50:
											__eflags = _t192;
											if(_t192 != 0) {
												L52:
												_t258 = _v72;
												_t315 = 0;
												_t335 = 0;
												__eflags = _t258;
												if(_t258 != 0) {
													_t246 = _v52;
													_t201 = _a8 + 4;
													__eflags = _t201;
													_v56 = _t201;
													_v20 = _t258;
													do {
														_v8 =  *_t201;
														_t207 =  *_t246;
														_t264 = _t315 + _v68 * _v8;
														asm("adc esi, edx");
														_t315 = _t335;
														_t335 = 0;
														__eflags = _t207 - _t264;
														if(_t207 < _t264) {
															_t315 = _t315 + 1;
															asm("adc esi, esi");
														}
														 *_t246 = _t207 - _t264;
														_t246 = _t246 + 4;
														_t201 = _v56 + 4;
														_t143 =  &_v20;
														 *_t143 = _v20 - 1;
														__eflags =  *_t143;
														_v56 = _t201;
													} while ( *_t143 != 0);
													_t243 = _v24;
													_t258 = _v72;
												}
												__eflags = 0 - _t335;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L61:
														__eflags = _t258;
														if(_t258 != 0) {
															_t245 = 0;
															_t294 = _v52;
															_t340 = _a8 + 4;
															__eflags = _t340;
															_t316 = _t258;
															do {
																_t260 =  *_t294;
																_t151 = _t340 + 4; // 0x8d8b5959
																_t340 = _t151;
																_t294 = _t294 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t294 - 4)) = _t260 +  *((intOrPtr*)(_t340 - 4)) + _t245;
																asm("adc eax, 0x0");
																_t245 = 0;
																_t316 = _t316 - 1;
																__eflags = _t316;
															} while (_t316 != 0);
															_t243 = _v24;
														}
														_t243 = _t243 + 0xffffffff;
														asm("adc dword [ebp-0xc], 0xffffffff");
													} else {
														__eflags = _v76 - _t315;
														if(_v76 < _t315) {
															goto L61;
														}
													}
												}
												_t259 = _v48;
												_v8 = _t259 - 1;
											} else {
												__eflags = _t243;
												if(_t243 == 0) {
													_t259 = _v48;
												} else {
													goto L52;
												}
											}
											_t332 = _v32;
											_t312 = _v12;
											asm("adc esi, 0x0");
											_v32 = 0 + _t243;
											_t293 = _v80 - 1;
											_v52 = _v52 - 4;
											_t256 = _t259 - 1;
											_t189 = _v28 - 4;
											_v80 = _t293;
											_v48 = _t256;
											_v28 = _t189;
											__eflags = _t293;
										} while (_t293 >= 0);
									}
									_t239 = _a4;
									_t255 = _v8 + 1;
									_t185 = _t255;
									__eflags = _t185 -  *_t239;
									if(_t185 <  *_t239) {
										_t288 =  &(( &(_t239[1]))[_t185]);
										do {
											 *_t288 = 0;
											_t288 =  &(_t288[1]);
											_t185 = _t185 + 1;
											__eflags = _t185 -  *_t239;
										} while (_t185 <  *_t239);
									}
									 *_t239 = _t255;
									__eflags = _t255;
									if(_t255 != 0) {
										while(1) {
											__eflags = _t239[_t255];
											if(_t239[_t255] != 0) {
												goto L75;
											}
											_t255 = _t255 + 0xffffffff;
											__eflags = _t255;
											 *_t239 = _t255;
											if(_t255 != 0) {
												continue;
											}
											goto L75;
										}
									}
									L75:
									return _v32;
								}
							}
						} else {
							_t6 = _t237 + 4; // 0xfffff8a4
							_t299 =  *_t6;
							_v8 = _t299;
							if(_t299 != 1) {
								__eflags = _t252;
								if(_t252 != 0) {
									_t247 = 0;
									_v12 = 0;
									_t323 = 0;
									_v28 = 0;
									__eflags = _t252 - 0xffffffff;
									if(_t252 != 0xffffffff) {
										_t276 = _t252 + 1;
										__eflags = _t276;
										_t277 =  &(_t179[_t276]);
										_v32 = _t277;
										do {
											_push(_t247);
											_t227 = E01368E20( *_t277, _t323, _t299, 0);
											_v28 = _t247;
											_t247 = _v12;
											_t323 = _t277;
											_v64 = _t299;
											_v12 = 0 + _t227;
											_t299 = _v8;
											asm("adc ebx, 0x0");
											_t277 = _v32 - 4;
											_v32 = _t277;
											_t329 = _t329 - 1;
											__eflags = _t329;
										} while (_t329 != 0);
										_t179 = _a4;
									}
									_t36 =  &(_t179[1]); // 0x4
									_t348 = _t36;
									 *_t179 = 0;
									_v544 = 0;
									E01353D96(_t348, 0x1cc,  &_v540, 0);
									_t223 = _v28;
									_t300 = _a4;
									__eflags = 0 - _t223;
									 *_t348 = _t323;
									asm("sbb ecx, ecx");
									 *(_t300 + 8) = _t223;
									__eflags =  ~0x00000000;
									 *_t300 = 0xbadbae;
									return _v12;
								} else {
									_t325 =  &(_t179[1]);
									 *_t179 = _t252;
									_v544 = _t252;
									E01353D96(_t325, 0x1cc,  &_v540, _t252);
									_t230 = _t179[1];
									_t305 = _t230 % _v8;
									 *_t325 = _t305;
									__eflags = 0 - _t305;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_a4 =  ~0x00000000;
									return _t230 / _v8;
								}
							} else {
								 *_t179 = _t311;
								_v544 = _t311;
								E01353D96( &(_t179[1]), 0x1cc,  &_v540, _t311);
								return _t179[1];
							}
						}
					}
				}
			}

0x013538a5
0x013538b0
0x013538b5
0x01353d1d
0x01353d21
0x01353d27
0x013538bb
0x013538bb
0x013538be
0x013538c0
0x013538c5
0x00000000
0x013538cb
0x013538cb
0x013538cb
0x013538ce
0x013538d1
0x013538d4
0x013539fb
0x013539fd
0x00000000
0x01353a03
0x01353a05
0x01353a07
0x01353a09
0x01353a0b
0x01353a35
0x01353a35
0x01353a35
0x01353a0d
0x01353a10
0x01353a10
0x01353a13
0x01353a16
0x01353a19
0x01353a20
0x01353a22
0x01353a24
0x00000000
0x00000000
0x01353a26
0x01353a27
0x01353a2a
0x01353a2d
0x01353a2f
0x00000000
0x01353a31
0x00000000
0x01353a31
0x00000000
0x01353a2f
0x01353a33
0x00000000
0x00000000
0x01353a33
0x01353a36
0x01353a36
0x01353a38
0x00000000
0x01353a3e
0x01353a3e
0x01353a41
0x01353a44
0x01353a47
0x01353a47
0x01353a4b
0x01353a4e
0x01353a51
0x01353a54
0x01353a5f
0x01353a56
0x01353a5b
0x01353a5b
0x01353a69
0x01353a6e
0x01353a71
0x01353a73
0x01353a7c
0x01353a7e
0x01353a85
0x01353a88
0x01353a8b
0x01353a93
0x01353a99
0x01353a99
0x01353a99
0x01353a99
0x01353a8b
0x01353a9c
0x01353a9e
0x01353aa5
0x01353aa5
0x01353aa8
0x01353aab
0x01353ab1
0x01353ab4
0x01353ab8
0x01353ac1
0x01353ac4
0x01353ac4
0x01353ac7
0x01353ad0
0x01353ad0
0x01353ad3
0x01353ada
0x01353ada
0x01353ad5
0x01353ad5
0x01353ad5
0x01353adc
0x01353adf
0x01353ae1
0x01353ae3
0x01353ae6
0x01353aed
0x01353af0
0x01353af2
0x01353b00
0x01353b04
0x01353b09
0x01353b0e
0x01353b15
0x01353b17
0x01353b19
0x01353b1d
0x01353b20
0x01353b25
0x01353b2d
0x01353b2d
0x01353b2f
0x01353b2f
0x01353b20
0x01353b32
0x01353b3a
0x01353b3f
0x01353b44
0x01353b46
0x01353b48
0x01353b4a
0x01353b4d
0x01353b50
0x01353b52
0x01353b55
0x01353b58
0x01353b5b
0x01353b5d
0x01353b64
0x01353b69
0x01353b6c
0x01353b76
0x01353b78
0x01353b7a
0x01353b7d
0x01353b7d
0x01353b7f
0x01353b82
0x01353b85
0x01353b88
0x01353b8b
0x01353b5f
0x01353b5f
0x01353b62
0x00000000
0x00000000
0x01353b62
0x01353b8e
0x01353b90
0x01353b92
0x00000000
0x01353b94
0x01353b94
0x01353b97
0x01353ba0
0x01353ba0
0x01353bae
0x01353bb1
0x01353bb6
0x01353bb8
0x00000000
0x00000000
0x01353bba
0x01353bc1
0x01353bc1
0x01353bc4
0x01353bc7
0x01353bca
0x01353bcd
0x01353bcd
0x01353bd0
0x01353bd3
0x01353bd7
0x01353bda
0x01353bdc
0x01353bdf
0x00000000
0x00000000
0x01353be1
0x01353bdf
0x01353bbc
0x01353bbc
0x01353bbf
0x00000000
0x00000000
0x00000000
0x00000000
0x01353bbf
0x01353be6
0x01353be6
0x00000000
0x01353be6
0x01353be3
0x00000000
0x01353be3
0x01353b97
0x01353b92
0x01353be9
0x01353be9
0x01353beb
0x01353bf5
0x01353bf5
0x01353bf8
0x01353bfa
0x01353bfc
0x01353bfe
0x01353c03
0x01353c06
0x01353c06
0x01353c09
0x01353c0c
0x01353c10
0x01353c12
0x01353c27
0x01353c29
0x01353c2b
0x01353c2d
0x01353c2f
0x01353c31
0x01353c33
0x01353c35
0x01353c38
0x01353c38
0x01353c3c
0x01353c3e
0x01353c44
0x01353c47
0x01353c47
0x01353c47
0x01353c4b
0x01353c4b
0x01353c50
0x01353c53
0x01353c53
0x01353c58
0x01353c5a
0x01353c5c
0x01353c63
0x01353c63
0x01353c65
0x01353c6a
0x01353c6c
0x01353c6f
0x01353c6f
0x01353c72
0x01353c74
0x01353c74
0x01353c76
0x01353c76
0x01353c7b
0x01353c81
0x01353c85
0x01353c88
0x01353c8b
0x01353c8d
0x01353c8d
0x01353c8d
0x01353c92
0x01353c92
0x01353c95
0x01353c98
0x01353c5e
0x01353c5e
0x01353c61
0x00000000
0x00000000
0x01353c61
0x01353c5c
0x01353c9c
0x01353ca2
0x01353bed
0x01353bed
0x01353bef
0x01353ca7
0x00000000
0x00000000
0x00000000
0x01353bef
0x01353caa
0x01353cb4
0x01353cb7
0x01353cba
0x01353cc0
0x01353cc1
0x01353cc5
0x01353cc6
0x01353cc9
0x01353ccc
0x01353ccf
0x01353cd2
0x01353cd2
0x01353ad0
0x01353cdd
0x01353ce0
0x01353ce1
0x01353ce3
0x01353ce5
0x01353cea
0x01353cf0
0x01353cf0
0x01353cf6
0x01353cf9
0x01353cfa
0x01353cfa
0x01353cf0
0x01353cfe
0x01353d00
0x01353d02
0x01353d04
0x01353d04
0x01353d08
0x00000000
0x00000000
0x01353d0a
0x01353d0a
0x01353d0d
0x01353d0f
0x00000000
0x00000000
0x00000000
0x01353d0f
0x01353d04
0x01353d11
0x01353d1c
0x01353d1c
0x01353a38
0x013538da
0x013538da
0x013538da
0x013538dd
0x013538e3
0x01353914
0x01353916
0x0135395b
0x0135395d
0x01353964
0x01353966
0x01353969
0x0135396c
0x0135396e
0x0135396e
0x0135396f
0x01353972
0x01353975
0x01353975
0x0135397f
0x01353984
0x01353989
0x0135398c
0x01353991
0x01353998
0x0135399b
0x0135399e
0x013539a1
0x013539a4
0x013539a7
0x013539a7
0x013539a7
0x013539ac
0x013539ac
0x013539af
0x013539af
0x013539b2
0x013539c0
0x013539d1
0x013539d6
0x013539dc
0x013539e1
0x013539e3
0x013539e5
0x013539e9
0x013539ef
0x013539f1
0x013539fa
0x01353918
0x0135391b
0x0135391f
0x0135392e
0x01353934
0x01353939
0x0135393d
0x01353948
0x0135394a
0x0135394c
0x01353950
0x01353953
0x0135395a
0x0135395a
0x013538e5
0x013538eb
0x013538fb
0x01353901
0x01353913
0x01353913
0x013538e3
0x013538d4
0x013538c5

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ed78c7c429dff4e87f4ebae4af2bdfb9d68bf7abf48bfa11f875b6aae70124
Instruction ID: 7a53f7b194310a723679e8ac3c133d92f10d0373f71d180e357fcc39e5524579
Opcode Fuzzy Hash: 55ed78c7c429dff4e87f4ebae4af2bdfb9d68bf7abf48bfa11f875b6aae70124
Instruction Fuzzy Hash: AFF13071E002199FDF14CFADC880AADBBF1FF88768F158269D915AB381D731A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0135D192 Relevance: 1.9, APIs: 1, Instructions: 408
timeCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0135D192(void* __ebx, void* __eflags, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr* _v24;
				signed int _v28;
				signed int _v32;
				char _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v120;
				char _v632;
				void* __edi;
				void* __esi;
				signed int _t73;
				signed int _t75;
				signed int _t78;
				void* _t79;
				signed int _t83;
				signed int _t85;
				long _t87;
				intOrPtr* _t90;
				signed int _t91;
				signed int _t99;
				signed int _t102;
				signed int _t105;
				void* _t106;
				void* _t110;
				signed int _t112;
				signed int _t121;
				signed int _t122;
				signed int _t124;
				void* _t126;
				void* _t127;
				signed int _t133;
				signed int _t137;
				signed short _t139;
				void* _t140;
				void* _t142;
				signed int _t143;
				signed int _t144;
				signed int _t145;
				signed int _t147;
				intOrPtr* _t148;
				void* _t151;
				void* _t152;
				signed int _t164;
				signed int _t166;
				signed int _t171;
				void* _t176;
				signed int _t177;
				signed int _t178;
				intOrPtr _t180;
				signed int _t181;
				signed short _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				void* _t186;
				void* _t187;
				intOrPtr _t188;
				signed int _t189;
				intOrPtr* _t190;
				void* _t192;
				signed int _t196;
				signed int _t201;
				void* _t202;
				signed int _t207;
				signed int _t211;
				intOrPtr* _t212;
				signed int _t213;
				void* _t219;
				signed int _t220;
				void* _t221;
				signed int _t222;
				void* _t226;
				void* _t227;

				_push(__ebx);
				_push(_t189);
				_t147 = E0135D005();
				_v20 = _t147;
				_v24 = E0135D00B();
				_t196 = 0;
				_v28 = 0;
				_v8 = 0;
				_v12 = 0;
				if(E0135D069( &_v8) != 0 || E0135D011( &_v12) != 0) {
					L47:
					_push(_t196);
					_push(_t196);
					_push(_t196);
					_push(_t196);
					_push(_t196);
					E0134C5DF();
					asm("int3");
					_t219 = _t221;
					_t222 = _t221 - 0xc;
					_push(_t147);
					_push(_t196);
					_push(_t189);
					_t190 = E0135D005();
					_t148 = E0135D00B();
					_v72 = 0;
					_v76 = 0;
					_v80 = 0;
					_t73 = E0135D069( &_v72);
					__eflags = _t73;
					if(_t73 != 0) {
						L60:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E0134C5DF();
						asm("int3");
						_push(_t219);
						_t220 = _t222;
						_t75 =  *0x1383020; // 0xc9209188
						_v120 = _t75 ^ _t220;
						 *0x13833f4 =  *0x13833f4 | 0xffffffff;
						 *0x13833e8 =  *0x13833e8 | 0xffffffff;
						_push(0);
						_push(_t190);
						 *0x13855f8 = 0;
						_t78 = E0135D0D4(_t148, 0, __eflags,  &_v632);
						asm("sbb esi, esi");
						_t201 =  ~(_t78 -  &_v632) & _t78;
						__eflags = _t78;
						if(_t78 == 0) {
							L64:
							L48();
						} else {
							__eflags =  *_t78;
							if(__eflags == 0) {
								goto L64;
							} else {
								_push(_t78);
								E0135D192(_t148, __eflags);
							}
						}
						_t79 = E0135AA28(_t201);
						_pop(_t192);
						__eflags = _v16 ^ _t220;
						_pop(_t202);
						return E01347708(_t79, _t148, _v16 ^ _t220, _t184, _t192, _t202);
					} else {
						_t83 = E0135D011( &_v16);
						__eflags = _t83;
						if(_t83 != 0) {
							goto L60;
						} else {
							_t85 = E0135D03D( &_v20);
							__eflags = _t85;
							if(_t85 != 0) {
								goto L60;
							} else {
								E0135AA28( *0x13855f0);
								 *0x13855f0 = 0;
								 *_t222 = 0x1385600;
								_t87 = GetTimeZoneInformation(??);
								__eflags = _t87 - 0xffffffff;
								if(_t87 != 0xffffffff) {
									_t185 =  *0x1385600 * 0x3c;
									_t164 = 1;
									__eflags =  *0x1385646; // 0x0
									_t207 =  *0x1385654; // 0x0
									 *0x13855f8 = 1;
									_v12 = _t185;
									if(__eflags != 0) {
										_t102 = _t207 * 0x3c + _t185;
										__eflags = _t102;
										_v12 = _t102;
									}
									__eflags =  *0x138569a;
									if( *0x138569a == 0) {
										L57:
										_t91 = 0;
										_t164 = 0;
										__eflags = 0;
									} else {
										_t99 =  *0x13856a8; // 0x0
										__eflags = _t99;
										if(_t99 == 0) {
											goto L57;
										} else {
											_t91 = (_t99 - _t207) * 0x3c;
										}
									}
									_v16 = _t164;
									_v20 = _t91;
									E01348E90(_t190,  *_t148, 0, 0x80);
									__eflags = 0;
									E01348E90(_t190,  *((intOrPtr*)(_t148 + 4)), 0, 0x80);
									E01348E90(_t190,  *_t190, 0, 0x40);
									E01348E90(_t190,  *((intOrPtr*)(_t190 + 4)), 0, 0x40);
									_t210 = E01357514(_t185, 0);
									E0135D5F4(_t148, _t164, _t185, _t190, _t96, 0x1385604,  *_t148,  *_t190, _t96);
									E0135D5F4(_t148, _t164, _t185, _t190, _t96, 0x1385658,  *((intOrPtr*)(_t148 + 4)),  *((intOrPtr*)(_t190 + 4)), _t210);
								}
								 *(E0135CFFF()) = _v12;
								 *(E0135CFF0()) = _v16;
								_t90 = E0135CFF6();
								 *_t90 = _v20;
								return _t90;
							}
						}
					}
				} else {
					_t105 =  *0x13855f0; // 0x0
					_t189 = _a4;
					if(_t105 == 0) {
						L11:
						_t166 = _t189;
						_t11 = _t166 + 2; // 0x2
						_t186 = _t11;
						do {
							_t106 =  *_t166;
							_t166 = _t166 + 2;
						} while (_t106 != _t196);
						_t211 = E0135B127(2 + (_t166 - _t186 >> 1) * 2);
						if(_t211 != 0) {
							E0135AA28( *0x13855f0);
							_t171 = _t189;
							 *0x13855f0 = _t211;
							_t14 = _t171 + 2; // 0x2
							_t184 = _t14;
							do {
								_t110 =  *_t171;
								_t171 = _t171 + 2;
								__eflags = _t110 - _v28;
							} while (_t110 != _v28);
							_t16 = (_t171 - _t184 >> 1) + 1; // -1
							_t112 = E01350D87(_t211, _t16, _t189);
							_t221 = _t221 + 0xc;
							__eflags = _t112;
							if(_t112 != 0) {
								_t196 = 0;
								__eflags = 0;
								goto L47;
							} else {
								_t212 = _v24;
								E01348E90(_t189,  *_t212, _t112, 0x80);
								E01348E90(_t189,  *((intOrPtr*)(_t212 + 4)), 0, 0x80);
								E01348E90(_t189,  *_t147, 0, 0x40);
								E01348E90(_t189,  *((intOrPtr*)(_t147 + 4)), 0, 0x40);
								_push(3);
								_push( *_t147);
								_push( *_t212);
								E0135D14B(_t147, _t173, _t184, _t189);
								_t226 = _t221 + 0x40;
								__eflags = 0;
								_t121 = 3;
								do {
									__eflags =  *_t189;
									if( *_t189 != 0) {
										_t189 = _t189 + 2;
										__eflags = _t189;
									}
									_t121 = _t121 - 1;
									__eflags = _t121;
								} while (_t121 != 0);
								_t122 =  *_t189 & 0x0000ffff;
								_v32 = _t122;
								_t176 = 0x2d;
								__eflags = _t122 - _t176;
								if(_t122 == _t176) {
									_t189 = _t189 + 2;
									__eflags = _t189;
								}
								_t124 = E013545B8(_t184, _t189,  &_v16, 0xa);
								_t227 = _t226 + 0xc;
								_t213 = _t124 * 0xe10;
								__eflags = _t213;
								_v8 = _t213;
								while(1) {
									_t177 =  *_t189 & 0x0000ffff;
									__eflags = _t177 - 0x2b;
									if(_t177 == 0x2b) {
										goto L28;
									}
									__eflags = _t177 - 0x30 - 9;
									if(_t177 - 0x30 <= 9) {
										goto L28;
									}
									_t126 = 0x3a;
									__eflags = _t177 - _t126;
									if(_t177 == _t126) {
										_t189 = _t189 + 2;
										_t137 = E013545B8(_t184, _t189,  &_v16, 0xa);
										_t227 = _t227 + 0xc;
										_t180 = 0x30;
										_t213 = _v8 + _t137 * 0x3c;
										_v28 = _t180;
										_t139 =  *_t189 & 0x0000ffff;
										_v8 = _t213;
										_t184 = _t139;
										__eflags = _t139 - _t180;
										if(_t139 >= _t180) {
											_t182 = _t139;
											_t152 = 0x39;
											while(1) {
												_t184 = _t182 & 0x0000ffff;
												__eflags = _t182 - _t152;
												if(_t182 > _t152) {
													break;
												}
												_t189 = _t189 + 2;
												_t145 =  *_t189 & 0x0000ffff;
												_t182 = _t145;
												_t184 = _t145;
												__eflags = _t145 - _v28;
												if(_t145 >= _v28) {
													continue;
												}
												break;
											}
											_t147 = _v20;
										}
										_t140 = 0x3a;
										__eflags = _t184 - _t140;
										if(_t184 == _t140) {
											_t189 = _t189 + 2;
											_t142 = E013545B8(_t184, _t189,  &_v16, 0xa);
											_t227 = _t227 + 0xc;
											_t213 = _v8 + _t142;
											_t143 =  *_t189 & 0x0000ffff;
											_v8 = _t213;
											_t184 = 0x30;
											__eflags = _t143 - _t184;
											if(_t143 >= _t184) {
												_t181 = _t143;
												_t151 = 0x39;
												while(1) {
													__eflags = _t181 - _t151;
													if(_t181 > _t151) {
														break;
													}
													_t189 = _t189 + 2;
													_t144 =  *_t189 & 0x0000ffff;
													_t181 = _t144;
													__eflags = _t144 - _t184;
													if(_t144 >= _t184) {
														continue;
													}
													break;
												}
												_t147 = _v20;
											}
										}
									}
									_t127 = 0x2d;
									__eflags = _v32 - _t127;
									if(_v32 == _t127) {
										_t213 =  ~_t213;
										_v8 = _t213;
									}
									_t178 =  *_t189 & 0x0000ffff;
									__eflags = _t178;
									_v12 = 0 | _t178 != 0x00000000;
									__eflags = _t178;
									if(_t178 != 0) {
										_push(3);
										_push( *((intOrPtr*)(_t147 + 4)));
										_push( *((intOrPtr*)(_v24 + 4)));
										E0135D14B(_t147, _t178, _t184, _t189);
										_t213 = _v8;
									}
									 *(E0135CFFF()) = _t213;
									 *(E0135CFF0()) = _v12;
									goto L14;
									L28:
									_t189 = _t189 + 2;
								}
							}
						} else {
							L14:
							_t133 = E0135AA28(0);
							goto L15;
						}
					} else {
						_t183 = _t189;
						while(1) {
							_t187 =  *_t183;
							if(_t187 !=  *_t105) {
								break;
							}
							if(_t187 == 0) {
								L8:
								_t133 = _t196;
							} else {
								_t188 =  *((intOrPtr*)(_t183 + 2));
								if(_t188 !=  *((intOrPtr*)(_t105 + 2))) {
									break;
								} else {
									_t183 = _t183 + 4;
									_t105 = _t105 + 4;
									if(_t188 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t133 == 0) {
								L15:
								return _t133;
							} else {
								goto L11;
							}
							goto L66;
						}
						asm("sbb eax, eax");
						_t133 = _t105 | 0x00000001;
						__eflags = _t133;
						goto L10;
					}
				}
				L66:
			}

0x0135d19a
0x0135d19c
0x0135d1a2
0x0135d1a4
0x0135d1ac
0x0135d1af
0x0135d1b4
0x0135d1b8
0x0135d1bb
0x0135d1c6
0x0135d419
0x0135d419
0x0135d41a
0x0135d41b
0x0135d41c
0x0135d41d
0x0135d41e
0x0135d423
0x0135d427
0x0135d429
0x0135d42c
0x0135d42d
0x0135d42e
0x0135d434
0x0135d43b
0x0135d442
0x0135d446
0x0135d449
0x0135d44c
0x0135d452
0x0135d454
0x0135d573
0x0135d573
0x0135d574
0x0135d575
0x0135d576
0x0135d577
0x0135d578
0x0135d57d
0x0135d580
0x0135d581
0x0135d589
0x0135d590
0x0135d593
0x0135d5a0
0x0135d5a7
0x0135d5a8
0x0135d5ac
0x0135d5b2
0x0135d5c4
0x0135d5c6
0x0135d5c8
0x0135d5ca
0x0135d5da
0x0135d5da
0x0135d5cc
0x0135d5cc
0x0135d5cf
0x00000000
0x0135d5d1
0x0135d5d1
0x0135d5d2
0x0135d5d7
0x0135d5cf
0x0135d5e0
0x0135d5e9
0x0135d5ea
0x0135d5ec
0x0135d5f3
0x0135d45a
0x0135d45e
0x0135d464
0x0135d466
0x00000000
0x0135d46c
0x0135d470
0x0135d476
0x0135d478
0x00000000
0x0135d47e
0x0135d484
0x0135d489
0x0135d48f
0x0135d496
0x0135d49c
0x0135d49f
0x0135d4a5
0x0135d4ae
0x0135d4af
0x0135d4b6
0x0135d4bc
0x0135d4c2
0x0135d4c5
0x0135d4ca
0x0135d4ca
0x0135d4cc
0x0135d4cc
0x0135d4cf
0x0135d4d7
0x0135d4e9
0x0135d4e9
0x0135d4eb
0x0135d4eb
0x0135d4d9
0x0135d4d9
0x0135d4de
0x0135d4e0
0x00000000
0x0135d4e2
0x0135d4e4
0x0135d4e4
0x0135d4e0
0x0135d4f2
0x0135d4f6
0x0135d4fd
0x0135d503
0x0135d509
0x0135d513
0x0135d51e
0x0135d528
0x0135d534
0x0135d548
0x0135d54d
0x0135d558
0x0135d562
0x0135d567
0x0135d56d
0x0135d572
0x0135d572
0x0135d478
0x0135d466
0x0135d1de
0x0135d1de
0x0135d1e3
0x0135d1e8
0x0135d21b
0x0135d21b
0x0135d21d
0x0135d21d
0x0135d220
0x0135d220
0x0135d223
0x0135d226
0x0135d23c
0x0135d241
0x0135d257
0x0135d25d
0x0135d25f
0x0135d265
0x0135d265
0x0135d268
0x0135d268
0x0135d26b
0x0135d26e
0x0135d26e
0x0135d279
0x0135d27e
0x0135d283
0x0135d286
0x0135d288
0x0135d417
0x0135d417
0x00000000
0x0135d28e
0x0135d28e
0x0135d299
0x0135d2a9
0x0135d2b5
0x0135d2c2
0x0135d2c7
0x0135d2c9
0x0135d2cb
0x0135d2ce
0x0135d2d3
0x0135d2d6
0x0135d2da
0x0135d2db
0x0135d2db
0x0135d2de
0x0135d2e0
0x0135d2e0
0x0135d2e0
0x0135d2e3
0x0135d2e3
0x0135d2e3
0x0135d2e8
0x0135d2ef
0x0135d2f2
0x0135d2f3
0x0135d2f6
0x0135d2f8
0x0135d2f8
0x0135d2f8
0x0135d302
0x0135d307
0x0135d30a
0x0135d30a
0x0135d310
0x0135d313
0x0135d313
0x0135d316
0x0135d319
0x00000000
0x00000000
0x0135d31e
0x0135d322
0x00000000
0x00000000
0x0135d32b
0x0135d32c
0x0135d32f
0x0135d33a
0x0135d33f
0x0135d347
0x0135d34f
0x0135d350
0x0135d352
0x0135d355
0x0135d358
0x0135d35b
0x0135d35d
0x0135d360
0x0135d364
0x0135d366
0x0135d367
0x0135d367
0x0135d36a
0x0135d36d
0x00000000
0x00000000
0x0135d36f
0x0135d372
0x0135d375
0x0135d377
0x0135d379
0x0135d37d
0x00000000
0x00000000
0x00000000
0x0135d37d
0x0135d37f
0x0135d37f
0x0135d384
0x0135d385
0x0135d388
0x0135d38f
0x0135d394
0x0135d39c
0x0135d39f
0x0135d3a1
0x0135d3a4
0x0135d3a9
0x0135d3aa
0x0135d3ad
0x0135d3b1
0x0135d3b3
0x0135d3b4
0x0135d3b4
0x0135d3b7
0x00000000
0x00000000
0x0135d3b9
0x0135d3bc
0x0135d3bf
0x0135d3c1
0x0135d3c4
0x00000000
0x00000000
0x00000000
0x0135d3c4
0x0135d3c6
0x0135d3c6
0x0135d3ad
0x0135d388
0x0135d3cb
0x0135d3cc
0x0135d3d0
0x0135d3d2
0x0135d3d4
0x0135d3d4
0x0135d3d7
0x0135d3dc
0x0135d3e2
0x0135d3e5
0x0135d3e8
0x0135d3ed
0x0135d3ef
0x0135d3f2
0x0135d3f6
0x0135d3fb
0x0135d3fe
0x0135d406
0x0135d410
0x00000000
0x0135d324
0x0135d324
0x0135d324
0x0135d313
0x0135d243
0x0135d243
0x0135d246
0x00000000
0x0135d24b
0x0135d1ea
0x0135d1ea
0x0135d1ec
0x0135d1ec
0x0135d1f2
0x00000000
0x00000000
0x0135d1f7
0x0135d20e
0x0135d20e
0x0135d1f9
0x0135d1f9
0x0135d201
0x00000000
0x0135d203
0x0135d203
0x0135d206
0x0135d20c
0x00000000
0x00000000
0x00000000
0x00000000
0x0135d20c
0x0135d201
0x0135d217
0x0135d219
0x0135d24c
0x0135d250
0x00000000
0x00000000
0x00000000
0x00000000
0x0135d219
0x0135d212
0x0135d214
0x0135d214
0x00000000
0x0135d214
0x0135d1e8
0x00000000

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0135D5D7,00000000,00000000,00000000), ref: 0135D496

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: a759ac3736693bfbc6ce016cbf89e17833b80ed5f07fd371428c984228150d5f
Instruction ID: 4e9ef175f51591c97a092e5dac4c4378d54e93a58f4cba2db839e36a99bd27c4
Opcode Fuzzy Hash: a759ac3736693bfbc6ce016cbf89e17833b80ed5f07fd371428c984228150d5f
Instruction Fuzzy Hash: D3C1E771D00216EBDB61AFECD801EAE7BB9EF14B68F544056ED05EB284E7709E41C790

Uniqueness

Uniqueness Score: -1.00%

Function 0135DB30 Relevance: 1.8, APIs: 1, Instructions: 274
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E0135DB30(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed char _t193;
				signed int _t196;
				signed int _t200;
				signed int _t203;
				void* _t204;
				void* _t207;
				signed int _t210;
				void* _t211;
				signed int _t226;
				unsigned int* _t241;
				signed char _t243;
				signed int* _t251;
				unsigned int* _t257;
				signed int* _t258;
				signed char _t260;
				long _t263;
				signed int* _t266;

				 *(_a4 + 4) = 0;
				_t263 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t243 = _a12;
				if((_t243 & 0x00000010) != 0) {
					_t263 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t243 & 0x00000002) != 0) {
					_t263 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t243 & 0x00000001) != 0) {
					_t263 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t243 & 0x00000004) != 0) {
					_t263 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t243 & 0x00000008) != 0) {
					_t263 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t266 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
				_t260 = E0135E166(_a4);
				if((_t260 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t260 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t260 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t260 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t260 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t266 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffd | 1;
						L26:
						 *_t258 = _t226;
						L29:
						_t175 =  *_t266 & 0x00000300;
						if(_t175 == 0) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
							L35:
							 *_t251 = _t178;
							L36:
							_t179 = _a4;
							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t255 = _a4;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t241;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t241;
							}
							E0135E0D2(_t255);
							RaiseException(_t263, 0, 1,  &_a4);
							_t257 = _a4;
							_t193 = _t257[2];
							if((_t193 & 0x00000010) != 0) {
								 *_t266 =  *_t266 & 0xfffffffe;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000008) != 0) {
								 *_t266 =  *_t266 & 0xfffffffb;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000004) != 0) {
								 *_t266 =  *_t266 & 0xfffffff7;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000002) != 0) {
								 *_t266 =  *_t266 & 0xffffffef;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000001) != 0) {
								 *_t266 =  *_t266 & 0xffffffdf;
							}
							_t196 =  *_t257 & 0x00000003;
							if(_t196 == 0) {
								 *_t266 =  *_t266 & 0xfffff3ff;
							} else {
								_t207 = _t196 - 1;
								if(_t207 == 0) {
									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t266 = _t210;
									L58:
									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
									if(_t200 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t266 = _t203;
										L65:
										if(_a28 == 0) {
											 *_t241 = _t257[0x14];
										} else {
											 *_t241 = _t257[0x14];
										}
										return _t203;
									}
									_t204 = _t200 - 1;
									if(_t204 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t203 = _t204 - 1;
									if(_t203 == 0) {
										 *_t266 =  *_t266 & 0xfffff3ff;
									}
									goto L65;
								}
								_t211 = _t207 - 1;
								if(_t211 == 0) {
									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t211 == 1) {
									 *_t266 =  *_t266 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x0135db3e
0x0135db45
0x0135db4a
0x0135db50
0x0135db53
0x0135db59
0x0135db5e
0x0135db63
0x0135db63
0x0135db69
0x0135db6e
0x0135db73
0x0135db73
0x0135db7a
0x0135db7f
0x0135db84
0x0135db84
0x0135db8b
0x0135db90
0x0135db95
0x0135db95
0x0135db9c
0x0135dba1
0x0135dba6
0x0135dba6
0x0135dbae
0x0135dbbe
0x0135dbd0
0x0135dbe2
0x0135dbf5
0x0135dc07
0x0135dc0f
0x0135dc14
0x0135dc19
0x0135dc19
0x0135dc20
0x0135dc25
0x0135dc25
0x0135dc2c
0x0135dc31
0x0135dc31
0x0135dc38
0x0135dc3d
0x0135dc3d
0x0135dc44
0x0135dc49
0x0135dc49
0x0135dc53
0x0135dc55
0x0135dc8f
0x0135dc57
0x0135dc5c
0x0135dc80
0x0135dc88
0x0135dc7c
0x0135dc7c
0x0135dc92
0x0135dc99
0x0135dc9b
0x0135dcbd
0x0135dcc5
0x0135dcc8
0x0135dcc8
0x0135dcca
0x0135dcca
0x0135dcd5
0x0135dcdb
0x0135dce0
0x0135dce7
0x0135dd21
0x0135dd2c
0x0135dd32
0x0135dd35
0x0135dd38
0x0135dd44
0x0135dd4c
0x0135dce9
0x0135dcec
0x0135dcf8
0x0135dcfe
0x0135dd04
0x0135dd07
0x0135dd10
0x0135dd10
0x0135dd4f
0x0135dd5d
0x0135dd63
0x0135dd66
0x0135dd6b
0x0135dd6d
0x0135dd70
0x0135dd70
0x0135dd75
0x0135dd77
0x0135dd7a
0x0135dd7a
0x0135dd7f
0x0135dd81
0x0135dd84
0x0135dd84
0x0135dd89
0x0135dd8b
0x0135dd8e
0x0135dd8e
0x0135dd93
0x0135dd95
0x0135dd95
0x0135dda2
0x0135dda5
0x0135dddc
0x0135dda7
0x0135dda7
0x0135ddaa
0x0135ddd5
0x0135ddca
0x0135ddca
0x0135ddde
0x0135dde6
0x0135dde9
0x0135de08
0x0135de0d
0x0135de0d
0x0135de0f
0x0135de14
0x0135de20
0x0135de16
0x0135de19
0x0135de19
0x0135de25
0x0135de25
0x0135ddeb
0x0135ddee
0x0135ddfd
0x00000000
0x0135ddfd
0x0135ddf0
0x0135ddf3
0x0135ddf5
0x0135ddf5
0x00000000
0x0135ddf3
0x0135ddac
0x0135ddaf
0x0135ddc5
0x00000000
0x0135ddc5
0x0135ddb4
0x0135ddb6
0x0135ddb6
0x0135ddb4
0x00000000
0x0135dda5
0x0135dca2
0x0135dcb0
0x0135dcb8
0x00000000
0x0135dcb8
0x0135dca6
0x0135dcab
0x0135dcab
0x00000000
0x0135dca6
0x0135dc63
0x0135dc71
0x0135dc79
0x00000000
0x0135dc79
0x0135dc67
0x0135dc6c
0x0135dc6c
0x0135dc67

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0135DB2B,?,?,00000008,?,?,01366AD4,00000000), ref: 0135DD5D

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1973558d8ab4926058821a42f8122f670134f43b684cc0dfb0674a2069f65914
Instruction ID: dc773dda4a43b266180705e8e3b361a79113dce29fb2d9ffd8d7b20906468d36
Opcode Fuzzy Hash: 1973558d8ab4926058821a42f8122f670134f43b684cc0dfb0674a2069f65914
Instruction Fuzzy Hash: 77B13731210608CFEB59CF6CC486E657BE0FF45768F258658E99ACF2A1C335E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0134801C Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0134801C(signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t66;
				signed int _t67;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t77;
				signed int _t78;
				intOrPtr* _t82;
				signed int _t85;
				signed int _t90;
				intOrPtr* _t93;
				signed int _t96;
				signed int _t99;
				signed int _t104;

				_t90 = __edx;
				 *0x1384e5c =  *0x1384e5c & 0x00000000;
				 *0x138302c =  *0x138302c | 0x00000001;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L23:
					return 0;
				}
				_v20 = _v20 & 0x00000000;
				_push(_t74);
				_t93 =  &_v40;
				asm("cpuid");
				_t75 = _t74;
				 *_t93 = 0;
				 *((intOrPtr*)(_t93 + 4)) = _t74;
				 *((intOrPtr*)(_t93 + 8)) = 0;
				 *(_t93 + 0xc) = _t90;
				_v16 = _v40;
				_v8 = _v28 ^ 0x49656e69;
				_v12 = _v32 ^ 0x6c65746e;
				_push(_t75);
				asm("cpuid");
				_t77 =  &_v40;
				 *_t77 = 1;
				 *((intOrPtr*)(_t77 + 4)) = _t75;
				 *((intOrPtr*)(_t77 + 8)) = 0;
				 *(_t77 + 0xc) = _t90;
				if((_v8 | _v12 | _v36 ^ 0x756e6547) != 0) {
					L9:
					_t96 =  *0x1384e60; // 0x2
					L10:
					_t85 = _v32;
					_t60 = 7;
					_v8 = _t85;
					if(_v16 < _t60) {
						_t78 = _v20;
					} else {
						_push(_t77);
						asm("cpuid");
						_t82 =  &_v40;
						 *_t82 = _t60;
						 *((intOrPtr*)(_t82 + 4)) = _t77;
						 *((intOrPtr*)(_t82 + 8)) = 0;
						_t85 = _v8;
						 *(_t82 + 0xc) = _t90;
						_t78 = _v36;
						if((_t78 & 0x00000200) != 0) {
							 *0x1384e60 = _t96 | 0x00000002;
						}
					}
					_t61 =  *0x138302c; // 0x6f
					_t62 = _t61 | 0x00000002;
					 *0x1384e5c = 1;
					 *0x138302c = _t62;
					if((_t85 & 0x00100000) != 0) {
						_t63 = _t62 | 0x00000004;
						 *0x1384e5c = 2;
						 *0x138302c = _t63;
						if((_t85 & 0x08000000) != 0 && (_t85 & 0x10000000) != 0) {
							asm("xgetbv");
							_v24 = _t63;
							_v20 = _t90;
							_t104 = 6;
							if((_v24 & _t104) == _t104) {
								_t66 =  *0x138302c; // 0x6f
								_t67 = _t66 | 0x00000008;
								 *0x1384e5c = 3;
								 *0x138302c = _t67;
								if((_t78 & 0x00000020) != 0) {
									 *0x1384e5c = 5;
									 *0x138302c = _t67 | 0x00000020;
									if((_t78 & 0xd0030000) == 0xd0030000 && (_v24 & 0x000000e0) == 0xe0) {
										 *0x138302c =  *0x138302c | 0x00000040;
										 *0x1384e5c = _t104;
									}
								}
							}
						}
					}
					goto L23;
				}
				_t73 = _v40 & 0x0fff3ff0;
				if(_t73 == 0x106c0 || _t73 == 0x20660 || _t73 == 0x20670 || _t73 == 0x30650 || _t73 == 0x30660 || _t73 == 0x30670) {
					_t99 =  *0x1384e60; // 0x2
					_t96 = _t99 | 0x00000001;
					 *0x1384e60 = _t96;
					goto L10;
				} else {
					goto L9;
				}
			}

0x0134801c
0x0134801f
0x01348029
0x0134803a
0x013481ec
0x013481ef
0x013481ef
0x01348040
0x01348046
0x0134804b
0x0134804f
0x01348053
0x01348055
0x01348057
0x0134805a
0x0134805f
0x01348068
0x01348079
0x01348084
0x0134808a
0x0134808b
0x01348091
0x01348094
0x0134809e
0x013480a1
0x013480a4
0x013480a7
0x013480ec
0x013480ec
0x013480f2
0x013480f2
0x013480f7
0x013480f8
0x013480fe
0x01348130
0x01348100
0x01348102
0x01348103
0x01348109
0x0134810c
0x0134810e
0x01348111
0x01348114
0x01348117
0x0134811a
0x01348123
0x01348128
0x01348128
0x01348123
0x01348133
0x01348138
0x0134813b
0x01348145
0x01348150
0x01348156
0x01348159
0x01348163
0x0134816e
0x0134817a
0x0134817d
0x01348180
0x0134818b
0x01348190
0x01348192
0x01348197
0x0134819a
0x013481a4
0x013481ac
0x013481b1
0x013481bb
0x013481c9
0x013481dc
0x013481e3
0x013481e3
0x013481c9
0x013481ac
0x01348190
0x0134816e
0x00000000
0x013481eb
0x013480ac
0x013480b6
0x013480db
0x013480e1
0x013480e4
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 01348032

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: a58892ad6f4a6a8f7983bb6480216f58ef8cf0f2ddaedd236e88dad122e0e4dd
Instruction ID: faa50a65d4441ca43a8b88dd61839b4171ac84bf93760f3ecdbbb87dd0283f5c
Opcode Fuzzy Hash: a58892ad6f4a6a8f7983bb6480216f58ef8cf0f2ddaedd236e88dad122e0e4dd
Instruction Fuzzy Hash: ED515DB1A14315DBEB25CFA9D8917AEBBF8FB48718F14806AD505EB284D3B5E900CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0134FA8E Relevance: 1.6, Strings: 1, Instructions: 388
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E0134FA8E(intOrPtr* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				short _v28;
				signed int _v32;
				signed int* _v36;
				intOrPtr _v40;
				signed int _v44;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t149;
				signed int _t151;
				signed int _t152;
				void* _t153;
				signed int _t154;
				signed char _t157;
				signed int _t161;
				short _t163;
				signed char _t168;
				signed char _t171;
				signed int* _t176;
				signed int _t178;
				signed int _t183;
				signed int* _t188;
				signed int _t190;
				signed int* _t192;
				signed int* _t198;
				signed short _t200;
				signed int _t201;
				void* _t202;
				signed int* _t208;
				void* _t209;
				void* _t211;
				signed char _t213;
				signed char _t215;
				signed int _t216;
				signed int _t218;
				signed int _t220;
				signed int _t221;
				signed int _t224;
				signed int** _t225;
				signed int* _t226;
				void* _t227;
				void* _t229;
				signed int _t233;
				unsigned int _t235;
				signed int* _t236;
				signed int _t238;
				signed int* _t239;
				intOrPtr _t240;
				void* _t242;
				signed char _t245;
				signed int _t246;
				signed int _t255;
				signed int _t258;
				signed int _t259;
				void* _t260;
				signed int _t261;
				signed int _t263;
				void* _t264;
				void* _t265;
				signed int _t266;
				short _t267;
				signed int _t270;
				intOrPtr* _t271;
				signed int _t272;
				void* _t273;
				void* _t274;
				void* _t275;

				_t265 = __edi;
				_t149 =  *0x1383020; // 0xc9209188
				_v8 = _t149 ^ _t272;
				_t271 = __ecx;
				_t224 = 0;
				_t255 = 0x41;
				_t151 =  *(__ecx + 0x2e) & 0x0000ffff;
				_v20 = _t255;
				_t229 = 0x58;
				_t274 = _t151 - 0x64;
				if(_t274 > 0) {
					__eflags = _t151 - 0x70;
					if(__eflags > 0) {
						_t152 = _t151 - 0x73;
						__eflags = _t152;
						if(_t152 == 0) {
							L9:
							_t153 = E01350578(_t271);
							L10:
							if(_t153 != 0) {
								__eflags =  *((intOrPtr*)(_t271 + 0x2c)) - _t224;
								if( *((intOrPtr*)(_t271 + 0x2c)) != _t224) {
									L112:
									_t154 = 1;
									L113:
									return E01347708(_t154, _t224, _v8 ^ _t272, _t255, _t265, _t271);
								}
								_push(_t265);
								_t157 =  *(_t271 + 0x1c) >> 4;
								_v16 = _t224;
								_t233 = _t224;
								_v12 = _t224;
								_v24 = _t233;
								_t266 = 0x20;
								__eflags = 1 & _t157;
								if((1 & _t157) == 0) {
									L44:
									_t258 =  *(_t271 + 0x2e) & 0x0000ffff;
									_t267 = 0x78;
									__eflags = _t258 - _t267;
									if(_t258 == _t267) {
										L46:
										__eflags = 1;
										if(1 != 0) {
											L48:
											__eflags = _t258 - 0x61;
											if(_t258 == 0x61) {
												L50:
												_t161 = 1;
												L51:
												_v28 = 0x30;
												__eflags = _t161;
												if(_t161 != 0) {
													L53:
													 *((short*)(_t272 + _t233 * 2 - 0xc)) = _v28;
													_t163 = 0x58;
													__eflags = _t258 - _t163;
													if(_t258 == _t163) {
														L55:
														_t267 = _t163;
														L56:
														 *((short*)(_t272 + _t233 * 2 - 0xa)) = _t267;
														_t233 = _t233 + 2;
														__eflags = _t233;
														_v24 = _t233;
														L57:
														_t270 =  *((intOrPtr*)(_t271 + 0x20)) -  *(_t271 + 0x34) - _t233;
														__eflags =  *(_t271 + 0x1c) & 0x0000000c;
														if(( *(_t271 + 0x1c) & 0x0000000c) != 0) {
															L69:
															_push( *((intOrPtr*)(_t271 + 8)));
															_v36 = _t271 + 0x14;
															_t259 = _t271 + 0x448;
															_v32 = _t259;
															E013507AE(_t259,  &_v16, _t233, _t271 + 0x14);
															_t235 =  *(_t271 + 0x1c);
															_t168 = _t235 >> 3;
															__eflags = _t168 & 0x00000001;
															if((_t168 & 0x00000001) == 0) {
																_t236 = _t271 + 0x14;
																L83:
																__eflags =  *((char*)(_t271 + 0x38));
																if( *((char*)(_t271 + 0x38)) != 0) {
																	L97:
																	_push( *((intOrPtr*)(_t271 + 8)));
																	E013507AE(_t271 + 0x448,  *((intOrPtr*)(_t271 + 0x30)),  *(_t271 + 0x34), _t236);
																	L98:
																	_t255 = _t271 + 0x448;
																	L99:
																	_t238 =  *(_t271 + 0x14);
																	__eflags = _t238;
																	if(_t238 < 0) {
																		L111:
																		_pop(_t265);
																		goto L112;
																	}
																	_t171 =  *(_t271 + 0x1c) >> 2;
																	__eflags = _t171 & 0x00000001;
																	if((_t171 & 0x00000001) == 0) {
																		goto L111;
																	}
																	__eflags = _t270;
																	if(_t270 <= 0) {
																		goto L111;
																	}
																	_t271 = 0x20;
																	while(1) {
																		_t260 =  *_t255;
																		__eflags =  *((intOrPtr*)(_t260 + 8)) -  *((intOrPtr*)(_t260 + 4));
																		if( *((intOrPtr*)(_t260 + 8)) !=  *((intOrPtr*)(_t260 + 4))) {
																			_t239 = _v36;
																			 *_t239 = _t238 + 1;
																			 *((intOrPtr*)(_t260 + 8)) =  *((intOrPtr*)(_t260 + 8)) + 1;
																			_t255 = _v32;
																			 *( *( *_t255)) = _t271;
																			_t176 =  *_t255;
																			 *_t176 =  *_t176 + 2;
																			__eflags =  *_t176;
																			_t238 =  *_t239;
																		} else {
																			__eflags =  *((char*)(_t260 + 0xc));
																			if( *((char*)(_t260 + 0xc)) == 0) {
																				_t238 = _t238 | 0xffffffff;
																				__eflags = _t238;
																			} else {
																				_t238 = _t238 + 1;
																			}
																			_t255 = _v32;
																			 *_v36 = _t238;
																		}
																		__eflags = _t238 - 0xffffffff;
																		if(_t238 == 0xffffffff) {
																			goto L111;
																		}
																		_t224 = _t224 + 1;
																		__eflags = _t224 - _t270;
																		if(_t224 < _t270) {
																			continue;
																		}
																		goto L111;
																	}
																	goto L111;
																}
																_t178 =  *(_t271 + 0x34);
																__eflags = _t178;
																if(_t178 <= 0) {
																	goto L97;
																}
																_t240 =  *((intOrPtr*)(_t271 + 8));
																_v40 = _t240;
																__eflags =  *((char*)(_t240 + 0x14));
																if(__eflags == 0) {
																	E013506A0(_t240, _t259, __eflags);
																	_t178 =  *(_t271 + 0x34);
																}
																_t241 =  *((intOrPtr*)(_t271 + 0x30));
																_v28 =  *((intOrPtr*)(_t271 + 0x30));
																_v20 = _t224;
																__eflags = _t178;
																if(_t178 == 0) {
																	goto L98;
																} else {
																	while(1) {
																		_v24 = 0;
																		_t183 = E0135BEE5(_t241, _t259,  &_v24, _t241,  *((intOrPtr*)( *((intOrPtr*)(_v40 + 0xc)) + 4)),  *((intOrPtr*)(_t271 + 8)));
																		_t273 = _t273 + 0x10;
																		_v16 = _t183;
																		_t255 = _t271 + 0x448;
																		__eflags = _t183;
																		if(_t183 <= 0) {
																			break;
																		}
																		_t242 =  *_t255;
																		_v44 = _v24 & 0x0000ffff;
																		__eflags =  *((intOrPtr*)(_t242 + 8)) -  *((intOrPtr*)(_t242 + 4));
																		if( *((intOrPtr*)(_t242 + 8)) !=  *((intOrPtr*)(_t242 + 4))) {
																			 *(_t271 + 0x14) =  *(_t271 + 0x14) + 1;
																			 *((intOrPtr*)(_t242 + 8)) =  *((intOrPtr*)(_t242 + 8)) + 1;
																			 *( *( *_t255)) = _v44;
																			_t188 =  *_t255;
																			 *_t188 =  *_t188 + 2;
																			__eflags =  *_t188;
																		} else {
																			__eflags =  *((char*)(_t242 + 0xc));
																			if( *((char*)(_t242 + 0xc)) == 0) {
																				 *(_t271 + 0x14) =  *(_t271 + 0x14) | 0xffffffff;
																			} else {
																				 *(_t271 + 0x14) =  *(_t271 + 0x14) + 1;
																			}
																		}
																		_t241 = _v28 + _v16;
																		_t190 = _v20 + 1;
																		_v28 = _v28 + _v16;
																		_v20 = _t190;
																		__eflags = _t190 -  *(_t271 + 0x34);
																		if(_t190 !=  *(_t271 + 0x34)) {
																			continue;
																		} else {
																			goto L99;
																		}
																	}
																	 *(_t271 + 0x14) =  *(_t271 + 0x14) | 0xffffffff;
																	goto L99;
																}
															}
															_t245 = _t235 >> 2;
															__eflags = _t245 & 0x00000001;
															_t236 = _t271 + 0x14;
															if((_t245 & 0x00000001) != 0) {
																goto L83;
															}
															_v24 = _t224;
															__eflags = _t270;
															if(_t270 <= 0) {
																goto L83;
															}
															_t261 =  *_t236;
															_t225 = _t271 + 0x448;
															while(1) {
																_t192 =  *_t225;
																_v20 = _t192;
																_t226 = _t192;
																__eflags = _t192[2] - _t226[1];
																_t225 = _t271 + 0x448;
																if(_t192[2] != _t226[1]) {
																	 *_t236 = _t261 + 1;
																	 *((intOrPtr*)(_v20 + 8)) =  *((intOrPtr*)(_v20 + 8)) + 1;
																	 *( *( *_t225)) = _v28;
																	_t198 =  *_t225;
																	 *_t198 =  *_t198 + 2;
																	__eflags =  *_t198;
																	_t259 =  *_t236;
																} else {
																	_t201 = _v20;
																	__eflags =  *((char*)(_t201 + 0xc));
																	if( *((char*)(_t201 + 0xc)) == 0) {
																		_t259 = _t259 | 0xffffffff;
																		__eflags = _t259;
																	} else {
																		_t259 = _t259 + 1;
																	}
																	 *_t236 = _t259;
																}
																__eflags = _t259 - 0xffffffff;
																if(_t259 == 0xffffffff) {
																	break;
																}
																_t200 = _v24 + 1;
																_v24 = _t200;
																__eflags = _t200 - _t270;
																if(_t200 < _t270) {
																	continue;
																}
																break;
															}
															_t224 = 0;
															goto L83;
														}
														__eflags = _t270;
														if(_t270 <= 0) {
															goto L69;
														}
														_t263 =  *(_t271 + 0x14);
														_t246 = _t224;
														while(1) {
															_t202 =  *(_t271 + 0x448);
															_t227 =  *(_t271 + 0x448);
															__eflags =  *((intOrPtr*)(_t202 + 8)) -  *((intOrPtr*)(_t227 + 4));
															if( *((intOrPtr*)(_t202 + 8)) !=  *((intOrPtr*)(_t227 + 4))) {
																 *(_t271 + 0x14) = _t263 + 1;
																_t264 = 0x20;
																( *(_t271 + 0x448))[2] = ( *(_t271 + 0x448))[2] + 1;
																 *( *( *(_t271 + 0x448))) = _t264;
																_t208 =  *(_t271 + 0x448);
																 *_t208 =  *_t208 + 2;
																__eflags =  *_t208;
																_t263 =  *(_t271 + 0x14);
															} else {
																_t209 = _t227;
																__eflags =  *((char*)(_t209 + 0xc));
																if( *((char*)(_t209 + 0xc)) == 0) {
																	_t263 = _t263 | 0xffffffff;
																	__eflags = _t263;
																} else {
																	_t263 = _t263 + 1;
																}
																 *(_t271 + 0x14) = _t263;
															}
															__eflags = _t263 - 0xffffffff;
															if(_t263 == 0xffffffff) {
																break;
															}
															_t246 = _t246 + 1;
															__eflags = _t246 - _t270;
															if(_t246 < _t270) {
																continue;
															}
															break;
														}
														_t233 = _v24;
														_t224 = 0;
														__eflags = 0;
														goto L69;
													}
													__eflags = _t258 - _v20;
													if(_t258 != _v20) {
														goto L56;
													}
													goto L55;
												}
												__eflags = _t161;
												if(_t161 == 0) {
													goto L57;
												}
												goto L53;
											}
											_t161 = _t224;
											__eflags = _t258 - _v20;
											if(_t258 != _v20) {
												goto L51;
											}
											goto L50;
										}
										L47:
										goto L48;
									}
									_t211 = 0x58;
									__eflags = _t258 - _t211;
									if(_t258 != _t211) {
										goto L47;
									}
									goto L46;
								}
								_t213 =  *(_t271 + 0x1c) >> 6;
								__eflags = 1 & _t213;
								if((1 & _t213) == 0) {
									__eflags =  *(_t271 + 0x1c) & 1;
									if(( *(_t271 + 0x1c) & 1) == 0) {
										_t215 =  *(_t271 + 0x1c) >> 1;
										__eflags = 1 & _t215;
										if((1 & _t215) != 0) {
											_v16 = _t266;
											_t233 = 1;
											_v24 = 1;
										}
										goto L44;
									}
									_push(0x2b);
									L41:
									_pop(_t216);
									_t233 = 1;
									_v16 = _t216;
									_v24 = 1;
									goto L44;
								}
								_push(0x2d);
								goto L41;
							}
							L11:
							_t154 = 0;
							goto L113;
						}
						_t218 = _t152;
						__eflags = _t218;
						if(__eflags == 0) {
							L28:
							_t153 = E0134DE43(_t271, __eflags, _t224);
							goto L10;
						}
						__eflags = _t218 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_t153 = E0134E142(_t271, __eflags);
						goto L10;
					}
					if(__eflags == 0) {
						_t153 = E013504F1(__ecx);
						goto L10;
					}
					__eflags = _t151 - 0x67;
					if(_t151 <= 0x67) {
						L29:
						_t153 = E01350141(_t271);
						goto L10;
					}
					__eflags = _t151 - 0x69;
					if(_t151 == 0x69) {
						L27:
						_t4 = _t271 + 0x1c;
						 *_t4 =  *(_t271 + 0x1c) | 0x00000010;
						__eflags =  *_t4;
						goto L28;
					}
					__eflags = _t151 - 0x6e;
					if(_t151 == 0x6e) {
						_t153 = E0135041D(__ecx, _t255);
						goto L10;
					}
					__eflags = _t151 - 0x6f;
					if(_t151 != 0x6f) {
						goto L11;
					}
					_t153 = E013504BE(__ecx);
					goto L10;
				}
				if(_t274 == 0) {
					goto L27;
				}
				_t275 = _t151 - _t229;
				if(_t275 > 0) {
					_t220 = _t151 - 0x5a;
					__eflags = _t220;
					if(_t220 == 0) {
						_t153 = E0134FF5D(__ecx);
						goto L10;
					}
					_t221 = _t220 - 7;
					__eflags = _t221;
					if(_t221 == 0) {
						goto L29;
					}
					__eflags = _t221;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t153 = E01350376(_t271, _t255, __eflags, _t224);
					goto L10;
				}
				if(_t275 == 0) {
					_push(1);
					goto L13;
				}
				if(_t151 == _t255) {
					goto L29;
				}
				if(_t151 == 0x43) {
					goto L17;
				}
				if(_t151 <= 0x44) {
					goto L11;
				}
				if(_t151 <= 0x47) {
					goto L29;
				}
				if(_t151 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x0134fa8e
0x0134fa96
0x0134fa9d
0x0134faa2
0x0134faa4
0x0134faa8
0x0134faab
0x0134faaf
0x0134fab2
0x0134fab3
0x0134fab6
0x0134fb28
0x0134fb2b
0x0134fb7b
0x0134fb7b
0x0134fb7e
0x0134fae4
0x0134fae6
0x0134faeb
0x0134faed
0x0134fb99
0x0134fb9c
0x0134fe9f
0x0134fe9f
0x0134fea1
0x0134feae
0x0134feae
0x0134fba7
0x0134fba8
0x0134fbac
0x0134fbaf
0x0134fbb1
0x0134fbb5
0x0134fbba
0x0134fbbb
0x0134fbbd
0x0134fbf2
0x0134fbf2
0x0134fbf8
0x0134fbf9
0x0134fbfc
0x0134fc06
0x0134fc0e
0x0134fc10
0x0134fc14
0x0134fc14
0x0134fc17
0x0134fc21
0x0134fc21
0x0134fc23
0x0134fc23
0x0134fc2a
0x0134fc2c
0x0134fc32
0x0134fc37
0x0134fc3c
0x0134fc3d
0x0134fc40
0x0134fc48
0x0134fc48
0x0134fc4a
0x0134fc4a
0x0134fc4f
0x0134fc4f
0x0134fc52
0x0134fc55
0x0134fc5b
0x0134fc5d
0x0134fc61
0x0134fccb
0x0134fccb
0x0134fcd2
0x0134fcd5
0x0134fcdf
0x0134fce5
0x0134fcea
0x0134fcef
0x0134fcf2
0x0134fcf4
0x0134fd68
0x0134fd6b
0x0134fd6b
0x0134fd6f
0x0134fe25
0x0134fe25
0x0134fe35
0x0134fe3a
0x0134fe3a
0x0134fe40
0x0134fe40
0x0134fe43
0x0134fe45
0x0134fe9e
0x0134fe9e
0x00000000
0x0134fe9e
0x0134fe4a
0x0134fe4d
0x0134fe4f
0x00000000
0x00000000
0x0134fe51
0x0134fe53
0x00000000
0x00000000
0x0134fe57
0x0134fe58
0x0134fe58
0x0134fe5d
0x0134fe60
0x0134fe7b
0x0134fe7e
0x0134fe80
0x0134fe83
0x0134fe8a
0x0134fe8d
0x0134fe8f
0x0134fe8f
0x0134fe92
0x0134fe62
0x0134fe62
0x0134fe66
0x0134fe6b
0x0134fe6b
0x0134fe68
0x0134fe68
0x0134fe68
0x0134fe71
0x0134fe74
0x0134fe74
0x0134fe94
0x0134fe97
0x00000000
0x00000000
0x0134fe99
0x0134fe9a
0x0134fe9c
0x00000000
0x00000000
0x00000000
0x0134fe9c
0x00000000
0x0134fe58
0x0134fd75
0x0134fd78
0x0134fd7a
0x00000000
0x00000000
0x0134fd80
0x0134fd83
0x0134fd86
0x0134fd8a
0x0134fd8c
0x0134fd91
0x0134fd91
0x0134fd94
0x0134fd97
0x0134fd9a
0x0134fd9d
0x0134fd9f
0x00000000
0x0134fda5
0x0134fda5
0x0134fdaa
0x0134fdbc
0x0134fdc1
0x0134fdc4
0x0134fdc7
0x0134fdcd
0x0134fdcf
0x00000000
0x00000000
0x0134fdd1
0x0134fdd7
0x0134fddd
0x0134fde0
0x0134fdf3
0x0134fdf6
0x0134fe00
0x0134fe03
0x0134fe05
0x0134fe05
0x0134fde2
0x0134fde2
0x0134fde6
0x0134fded
0x0134fde8
0x0134fde8
0x0134fde8
0x0134fde6
0x0134fe0b
0x0134fe11
0x0134fe12
0x0134fe15
0x0134fe18
0x0134fe1b
0x00000000
0x0134fe1d
0x00000000
0x0134fe1d
0x0134fe1b
0x0134fe1f
0x00000000
0x0134fe1f
0x0134fd9f
0x0134fcf6
0x0134fcf9
0x0134fcfc
0x0134fcff
0x00000000
0x00000000
0x0134fd01
0x0134fd04
0x0134fd06
0x00000000
0x00000000
0x0134fd08
0x0134fd0a
0x0134fd10
0x0134fd10
0x0134fd12
0x0134fd15
0x0134fd1a
0x0134fd1d
0x0134fd23
0x0134fd3e
0x0134fd43
0x0134fd4a
0x0134fd4d
0x0134fd4f
0x0134fd4f
0x0134fd52
0x0134fd25
0x0134fd25
0x0134fd28
0x0134fd2c
0x0134fd31
0x0134fd31
0x0134fd2e
0x0134fd2e
0x0134fd2e
0x0134fd34
0x0134fd34
0x0134fd54
0x0134fd57
0x00000000
0x00000000
0x0134fd5c
0x0134fd5d
0x0134fd60
0x0134fd62
0x00000000
0x00000000
0x00000000
0x0134fd62
0x0134fd64
0x00000000
0x0134fd64
0x0134fc63
0x0134fc65
0x00000000
0x00000000
0x0134fc67
0x0134fc6a
0x0134fc6c
0x0134fc6c
0x0134fc72
0x0134fc7b
0x0134fc7e
0x0134fc96
0x0134fca1
0x0134fca2
0x0134fcad
0x0134fcb0
0x0134fcb6
0x0134fcb6
0x0134fcb9
0x0134fc80
0x0134fc80
0x0134fc82
0x0134fc86
0x0134fc8b
0x0134fc8b
0x0134fc88
0x0134fc88
0x0134fc88
0x0134fc8e
0x0134fc8e
0x0134fcbc
0x0134fcbf
0x00000000
0x00000000
0x0134fcc1
0x0134fcc2
0x0134fcc4
0x00000000
0x00000000
0x00000000
0x0134fcc4
0x0134fcc6
0x0134fcc9
0x0134fcc9
0x00000000
0x0134fcc9
0x0134fc42
0x0134fc46
0x00000000
0x00000000
0x00000000
0x0134fc46
0x0134fc2e
0x0134fc30
0x00000000
0x00000000
0x00000000
0x0134fc30
0x0134fc19
0x0134fc1b
0x0134fc1f
0x00000000
0x00000000
0x00000000
0x0134fc1f
0x0134fc12
0x00000000
0x0134fc12
0x0134fc00
0x0134fc01
0x0134fc04
0x00000000
0x00000000
0x00000000
0x0134fc04
0x0134fbc2
0x0134fbc5
0x0134fbc7
0x0134fbcd
0x0134fbd0
0x0134fbe3
0x0134fbe5
0x0134fbe7
0x0134fbe9
0x0134fbed
0x0134fbef
0x0134fbef
0x00000000
0x0134fbe7
0x0134fbd2
0x0134fbd4
0x0134fbd4
0x0134fbd5
0x0134fbd7
0x0134fbdb
0x00000000
0x0134fbdb
0x0134fbc9
0x00000000
0x0134fbc9
0x0134faf3
0x0134faf3
0x00000000
0x0134faf3
0x0134fb85
0x0134fb85
0x0134fb88
0x0134fb59
0x0134fb5c
0x00000000
0x0134fb5c
0x0134fb8a
0x0134fb8d
0x00000000
0x00000000
0x0134fb93
0x0134fafc
0x0134fafe
0x00000000
0x0134fafe
0x0134fb2d
0x0134fb71
0x00000000
0x0134fb71
0x0134fb2f
0x0134fb32
0x0134fb63
0x0134fb65
0x00000000
0x0134fb65
0x0134fb34
0x0134fb37
0x0134fb55
0x0134fb55
0x0134fb55
0x0134fb55
0x00000000
0x0134fb55
0x0134fb39
0x0134fb3c
0x0134fb4e
0x00000000
0x0134fb4e
0x0134fb3e
0x0134fb41
0x00000000
0x00000000
0x0134fb45
0x00000000
0x0134fb45
0x0134fab8
0x00000000
0x00000000
0x0134fabe
0x0134fac0
0x0134fb05
0x0134fb05
0x0134fb08
0x0134fb21
0x00000000
0x0134fb21
0x0134fb0a
0x0134fb0a
0x0134fb0d
0x00000000
0x00000000
0x0134fb10
0x0134fb13
0x00000000
0x00000000
0x0134fb15
0x0134fb18
0x00000000
0x0134fb18
0x0134fac2
0x0134fafa
0x00000000
0x0134fafa
0x0134fac6
0x00000000
0x00000000
0x0134facf
0x00000000
0x00000000
0x0134fad4
0x00000000
0x00000000
0x0134fad9
0x00000000
0x00000000
0x0134fae2
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 0134FC23

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3e4cc75ea7d080e22e7f83369bd45d87a875f72a71cd97df3f8d5423edcfc276
Instruction ID: d98c35b607dd1bf1ccb9c393d8de9ee0dab5060b9e124d0eb5537bfc66f41347
Opcode Fuzzy Hash: 3e4cc75ea7d080e22e7f83369bd45d87a875f72a71cd97df3f8d5423edcfc276
Instruction Fuzzy Hash: 43E1CF30A006098FDB24CF6CC180A6EB7F9FF4571CB188619D55A9B691C730BD86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 013605E9 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E013605E9(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				char* _v28;
				signed int _v32;
				WCHAR* _v36;
				signed int _v48;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				signed int _v612;
				signed int _v616;
				intOrPtr _v620;
				char* _v648;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t44;
				void* _t49;
				signed int _t52;
				signed char _t54;
				void* _t63;
				intOrPtr _t65;
				intOrPtr _t67;
				int _t70;
				void* _t84;
				void* _t86;
				void* _t90;
				union _FINDEX_INFO_LEVELS _t91;
				signed int* _t92;
				void* _t93;
				void* _t94;
				intOrPtr* _t97;
				intOrPtr _t100;
				void* _t102;
				char* _t103;
				void* _t111;
				signed int _t116;
				WCHAR* _t117;
				void* _t118;
				intOrPtr _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;
				void* _t129;
				signed int _t130;
				void* _t131;

				_push(__ecx);
				_t97 = _a4;
				_t2 = _t97 + 2; // 0x2
				_t111 = _t2;
				do {
					_t44 =  *_t97;
					_t97 = _t97 + 2;
				} while (_t44 != 0);
				_t116 = _a12;
				_t100 = (_t97 - _t111 >> 1) + 1;
				_v8 = _t100;
				if(_t100 <=  !_t116) {
					_t5 = _t116 + 1; // 0x1
					_t90 = _t5 + _t100;
					_t122 = E0135C72B(_t90, 2);
					_t102 = _t121;
					if(_t116 == 0) {
						L7:
						_push(_v8);
						_t90 = _t90 - _t116;
						_t49 = E01361A01(_t102, _t122 + _t116 * 2, _t90, _a4);
						_t130 = _t129 + 0x10;
						if(_t49 != 0) {
							goto L12;
						} else {
							_t119 = _a16;
							_t94 = E01360860(_t119);
							if(_t94 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)(_t119 + 4)))) = _t122;
								 *((intOrPtr*)(_t119 + 4)) =  *((intOrPtr*)(_t119 + 4)) + 4;
								_t94 = 0;
							} else {
								E0135AA28(_t122);
							}
							E0135AA28(0);
							_t84 = _t94;
							goto L4;
						}
					} else {
						_push(_t116);
						_t86 = E01361A01(_t102, _t122, _t90, _a8);
						_t130 = _t129 + 0x10;
						if(_t86 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E0134C5DF();
							asm("int3");
							_t128 = _t130;
							_t131 = _t130 - 0x264;
							_t52 =  *0x1383020; // 0xc9209188
							_v48 = _t52 ^ _t130;
							_t112 = _v32;
							_t103 = _v28;
							_push(_t90);
							_push(_t122);
							_push(_t116);
							_t117 = _v36;
							_v648 = _t103;
							if(_t112 != _t117) {
								while(E0136083C( *_t112 & 0x0000ffff) == 0) {
									_t112 = _t112 - 2;
									if(_t112 != _t117) {
										continue;
									}
									break;
								}
								_t103 = _v612;
							}
							_t123 =  *_t112 & 0x0000ffff;
							if(( *_t112 & 0x0000ffff) != 0x3a || _t112 ==  &(_t117[1])) {
								_t103 =  &_v605;
								_t54 = E0136083C(_t123);
								_t112 = (_t112 - _t117 >> 1) + 1;
								asm("sbb eax, eax");
								_t91 = 0;
								_v616 =  ~(_t54 & 0x000000ff) & _t112;
								_t124 = FindFirstFileExW(_t117, 0,  &_v604, 0, 0, 0);
								if(_t124 != 0xffffffff) {
									_t92 = _v612;
									_v612 = _t92[1] -  *_t92 >> 2;
									_t63 = 0x2e;
									do {
										if(_v604.cFileName != _t63 || _v558 != 0 && (_v558 != _t63 || _v556 != 0)) {
											_push(_t92);
											_t65 = E013605E9(_t103,  &(_v604.cFileName), _t117, _v616);
											_t131 = _t131 + 0x10;
											_v620 = _t65;
											if(_t65 != 0) {
												FindClose(_t124);
												_t67 = _v620;
											} else {
												goto L29;
											}
										} else {
											goto L29;
										}
										goto L34;
										L29:
										_t70 = FindNextFileW(_t124,  &_v604);
										_t63 = 0x2e;
									} while (_t70 != 0);
									_t112 =  *_t92;
									_t106 = _v612;
									_t73 = _t92[1] -  *_t92 >> 2;
									if(_v612 != _t92[1] -  *_t92 >> 2) {
										E01366C00(_t112, _t112 + _t106 * 4, _t73 - _t106, 4, E01360419);
									}
									FindClose(_t124);
									_t67 = 0;
								} else {
									_push(_v612);
									goto L20;
								}
							} else {
								_push(_t103);
								_t91 = 0;
								L20:
								_t67 = E013605E9(_t103, _t117, _t91, _t91);
							}
							L34:
							_pop(_t118);
							_pop(_t125);
							_pop(_t93);
							return E01347708(_t67, _t93, _v12 ^ _t128, _t112, _t118, _t125);
						} else {
							goto L7;
						}
					}
				} else {
					_t84 = 0xc;
					L4:
					return _t84;
				}
			}

0x013605ee
0x013605ef
0x013605f6
0x013605f6
0x013605f9
0x013605f9
0x013605fc
0x013605ff
0x01360604
0x0136060d
0x01360610
0x01360615
0x0136061f
0x01360622
0x0136062c
0x0136062f
0x01360632
0x01360646
0x01360646
0x01360649
0x01360653
0x01360658
0x0136065d
0x00000000
0x0136065f
0x0136065f
0x01360669
0x0136066d
0x0136067b
0x0136067d
0x01360681
0x0136066f
0x01360670
0x01360675
0x01360685
0x0136068b
0x00000000
0x0136068d
0x01360634
0x01360634
0x0136063a
0x0136063f
0x01360644
0x01360690
0x01360692
0x01360693
0x01360694
0x01360695
0x01360696
0x01360697
0x0136069c
0x013606a0
0x013606a2
0x013606a8
0x013606af
0x013606b2
0x013606b5
0x013606b8
0x013606b9
0x013606ba
0x013606bb
0x013606be
0x013606c6
0x013606c8
0x013606db
0x013606e0
0x00000000
0x00000000
0x00000000
0x013606e0
0x013606e2
0x013606e2
0x013606e8
0x013606ee
0x0136070b
0x01360711
0x0136071d
0x01360720
0x01360722
0x01360729
0x0136073e
0x01360743
0x0136074d
0x0136075d
0x01360763
0x01360764
0x0136076b
0x0136078a
0x01360799
0x0136079e
0x013607a1
0x013607a9
0x013607f8
0x013607fe
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x013607ab
0x013607b3
0x013607bd
0x013607bd
0x013607c3
0x013607c7
0x013607cd
0x013607d2
0x013607ed
0x013607f2
0x013607d5
0x013607db
0x01360745
0x01360745
0x00000000
0x01360745
0x013606f7
0x013606f7
0x013606f8
0x013606fa
0x013606fd
0x01360702
0x01360804
0x01360807
0x01360808
0x0136080b
0x01360812
0x00000000
0x00000000
0x00000000
0x01360644
0x01360617
0x01360619
0x0136061a
0x0136061d
0x0136061d

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d906dc2f514b493a65ca52ef5d06bcb4c02bd5073327f895645ff21e75b192f
Instruction ID: 5e82ea899fad2053d073d240b74fb29386832676ddbfef7cf526bb8e5224cce2
Opcode Fuzzy Hash: 4d906dc2f514b493a65ca52ef5d06bcb4c02bd5073327f895645ff21e75b192f
Instruction Fuzzy Hash: 3E31C676900219AFDB24DFBCCCC5DAFB76DEB84318F148159F90597248EA30ED408B54

Uniqueness

Uniqueness Score: -1.00%

Function 0134F700 Relevance: 1.6, Strings: 1, Instructions: 344
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 89%

			E0134F700(signed int __ecx, signed int __edx, void* __edi) {
				signed int _v8;
				char _v16;
				signed int _v18;
				signed int _v20;
				signed int _v24;
				signed int* _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t115;
				char _t117;
				signed int _t118;
				void* _t119;
				signed int _t120;
				signed char _t123;
				signed int _t127;
				signed char _t132;
				signed char _t135;
				signed int* _t141;
				signed int _t145;
				signed int _t149;
				signed int _t150;
				signed int* _t156;
				signed int _t158;
				signed int _t159;
				signed int* _t160;
				signed int* _t166;
				signed char _t169;
				signed char _t171;
				signed int _t173;
				signed int _t175;
				signed int _t176;
				signed int _t179;
				signed int _t180;
				signed int* _t181;
				void* _t183;
				signed int _t187;
				unsigned int _t190;
				signed int _t192;
				signed int** _t193;
				signed short* _t194;
				signed char _t197;
				signed int _t198;
				signed int _t199;
				intOrPtr _t211;
				signed int _t214;
				void* _t215;
				signed int* _t216;
				signed int _t217;
				signed int _t218;
				signed int** _t219;
				signed int _t220;
				void* _t221;
				void* _t222;
				void* _t223;

				_t215 = __edi;
				_t208 = __edx;
				_t115 =  *0x1383020; // 0xc9209188
				_v8 = _t115 ^ _t220;
				_t218 = __ecx;
				_t179 = 0;
				_v32 = __ecx;
				_t183 = 0x58;
				_t117 =  *((char*)(__ecx + 0x2d));
				_t222 = _t117 - 0x64;
				if(_t222 > 0) {
					__eflags = _t117 - 0x70;
					if(__eflags > 0) {
						_t118 = _t117 - 0x73;
						__eflags = _t118;
						if(_t118 == 0) {
							L9:
							_t119 = E01350507(_t218);
							L10:
							if(_t119 != 0) {
								__eflags =  *((intOrPtr*)(_t218 + 0x2c)) - _t179;
								if( *((intOrPtr*)(_t218 + 0x2c)) != _t179) {
									L104:
									_t120 = 1;
									L105:
									return E01347708(_t120, _t179, _v8 ^ _t220, _t208, _t215, _t218);
								}
								_t123 =  *(_t218 + 0x1c) >> 4;
								_v20 = _t179;
								_t187 = _t179;
								_v18 = _t179;
								_v28 = _t187;
								__eflags = 1 & _t123;
								if((1 & _t123) == 0) {
									L44:
									_t211 =  *((intOrPtr*)(_t218 + 0x2d));
									__eflags = _t211 - 0x78;
									if(_t211 == 0x78) {
										L46:
										__eflags = 1;
										if(1 != 0) {
											L48:
											__eflags = _t211 - 0x61;
											if(_t211 == 0x61) {
												L50:
												_t127 = 1;
												L51:
												__eflags = _t127;
												if(_t127 != 0) {
													L53:
													 *((char*)(_t220 + _t187 - 0x10)) = 0x30;
													__eflags = _t211 - 0x58;
													if(_t211 == 0x58) {
														L56:
														0x78 = 0x58;
														L57:
														 *((char*)(_t220 + _t187 - 0xf)) = 0x78;
														_t187 = _t187 + 2;
														__eflags = _t187;
														_v28 = _t187;
														L58:
														_t208 =  *((intOrPtr*)(_t218 + 0x20)) -  *((intOrPtr*)(_t218 + 0x34)) - _t187;
														__eflags =  *(_t218 + 0x1c) & 0x0000000c;
														_push(_t215);
														_v36 = _t208;
														if(( *(_t218 + 0x1c) & 0x0000000c) != 0) {
															L70:
															_push( *((intOrPtr*)(_t218 + 8)));
															_t216 = _t218 + 0x14;
															_v28 = _t218 + 0x448;
															E01350747(_t218 + 0x448,  &_v20, _t187, _t216);
															_t190 =  *(_t218 + 0x1c);
															_t132 = _t190 >> 3;
															__eflags = _t132 & 0x00000001;
															if((_t132 & 0x00000001) == 0) {
																L83:
																__eflags =  *((char*)(_t218 + 0x38));
																if( *((char*)(_t218 + 0x38)) == 0) {
																	L91:
																	_push( *((intOrPtr*)(_t218 + 8)));
																	E01350747(_t218 + 0x448,  *(_t218 + 0x30),  *((intOrPtr*)(_t218 + 0x34)), _t216);
																	L92:
																	_t192 =  *_t216;
																	__eflags = _t192;
																	if(_t192 < 0) {
																		L103:
																		_pop(_t215);
																		goto L104;
																	}
																	_t135 =  *(_t218 + 0x1c) >> 2;
																	__eflags = _t135 & 0x00000001;
																	if((_t135 & 0x00000001) == 0) {
																		goto L103;
																	}
																	_t218 = _v36;
																	__eflags = _t218;
																	if(_t218 <= 0) {
																		goto L103;
																	} else {
																		goto L95;
																	}
																	while(1) {
																		L95:
																		_t208 =  *_v28;
																		__eflags =  *((intOrPtr*)(_t208 + 8)) -  *((intOrPtr*)(_t208 + 4));
																		if( *((intOrPtr*)(_t208 + 8)) !=  *((intOrPtr*)(_t208 + 4))) {
																			_t193 = _v28;
																			 *_t216 = _t192 + 1;
																			 *((intOrPtr*)(_t208 + 8)) =  *((intOrPtr*)(_t208 + 8)) + 1;
																			 *( *( *_t193)) = 0x20;
																			_t141 =  *_t193;
																			 *_t141 =  *_t141 + 1;
																			__eflags =  *_t141;
																			_t192 =  *_t216;
																		} else {
																			__eflags =  *((char*)(_t208 + 0xc));
																			if( *((char*)(_t208 + 0xc)) == 0) {
																				_t192 = _t192 | 0xffffffff;
																				__eflags = _t192;
																			} else {
																				_t192 = _t192 + 1;
																			}
																			 *_t216 = _t192;
																		}
																		__eflags = _t192 - 0xffffffff;
																		if(_t192 == 0xffffffff) {
																			goto L103;
																		}
																		_t179 = _t179 + 1;
																		__eflags = _t179 - _t218;
																		if(_t179 < _t218) {
																			continue;
																		}
																		goto L103;
																	}
																	goto L103;
																}
																__eflags =  *((intOrPtr*)(_t218 + 0x34)) - _t179;
																if( *((intOrPtr*)(_t218 + 0x34)) <= _t179) {
																	goto L91;
																}
																_t194 =  *(_t218 + 0x30);
																_v20 = _t179;
																while(1) {
																	_v24 = _t179;
																	_v32 =  &(_t194[1]);
																	_t145 = E0135BD7B(_t208,  &_v24,  &_v16, 6,  *_t194 & 0x0000ffff,  *((intOrPtr*)(_t218 + 8)));
																	_t221 = _t221 + 0x14;
																	__eflags = _t145;
																	if(_t145 != 0) {
																		break;
																	}
																	__eflags = _v24 - _t145;
																	if(_v24 == _t145) {
																		break;
																	}
																	_push( *((intOrPtr*)(_t218 + 8)));
																	E01350747(_t218 + 0x448,  &_v16, _v24, _t216);
																	_t194 = _v32;
																	_t149 = _v20 + 1;
																	_v20 = _t149;
																	__eflags = _t149 -  *((intOrPtr*)(_t218 + 0x34));
																	if(_t149 !=  *((intOrPtr*)(_t218 + 0x34))) {
																		continue;
																	}
																	goto L92;
																}
																 *_t216 =  *_t216 | 0xffffffff;
																goto L92;
															}
															_t197 = _t190 >> 2;
															__eflags = _t197 & 0x00000001;
															if((_t197 & 0x00000001) != 0) {
																goto L83;
															}
															_t198 = _v36;
															_v20 = _t179;
															__eflags = _t198;
															if(_t198 <= 0) {
																goto L83;
															}
															_t214 =  *_t216;
															_t219 = _v28;
															while(1) {
																_t150 =  *_t219;
																_v24 = _t150;
																_t180 = _t150;
																__eflags =  *((intOrPtr*)(_t150 + 8)) -  *((intOrPtr*)(_t180 + 4));
																if( *((intOrPtr*)(_t150 + 8)) !=  *((intOrPtr*)(_t180 + 4))) {
																	 *_t216 = _t214 + 1;
																	 *((intOrPtr*)(_t180 + 8)) =  *((intOrPtr*)(_t180 + 8)) + 1;
																	 *( *( *_t219)) = 0x30;
																	_t156 =  *_t219;
																	 *_t156 =  *_t156 + 1;
																	__eflags =  *_t156;
																	_t208 =  *_t216;
																} else {
																	_t159 = _t180;
																	__eflags =  *((char*)(_t159 + 0xc));
																	if( *((char*)(_t159 + 0xc)) == 0) {
																		_t208 = _t208 | 0xffffffff;
																		__eflags = _t208;
																	} else {
																		_t208 = _t208 + 1;
																	}
																	 *_t216 = _t208;
																}
																__eflags = _t208 - 0xffffffff;
																if(_t208 == 0xffffffff) {
																	break;
																}
																_t158 = _v20 + 1;
																_v20 = _t158;
																__eflags = _t158 - _t198;
																if(_t158 < _t198) {
																	continue;
																}
																break;
															}
															_t218 = _v32;
															_t179 = 0;
															__eflags = 0;
															goto L83;
														}
														__eflags = _t208;
														if(_t208 <= 0) {
															goto L70;
														}
														_t217 =  *(_t218 + 0x14);
														_t199 = _t179;
														while(1) {
															_t160 =  *(_t218 + 0x448);
															_t181 =  *(_t218 + 0x448);
															__eflags = _t160[2] - _t181[1];
															if(_t160[2] != _t181[1]) {
																 *(_t218 + 0x14) = _t217 + 1;
																_t181[2] = _t181[2] + 1;
																 *( *( *(_t218 + 0x448))) = 0x20;
																_t166 =  *(_t218 + 0x448);
																 *_t166 =  *_t166 + 1;
																__eflags =  *_t166;
																_t217 =  *(_t218 + 0x14);
															} else {
																__eflags = _t181[3];
																if(_t181[3] == 0) {
																	_t217 = _t217 | 0xffffffff;
																	__eflags = _t217;
																} else {
																	_t217 = _t217 + 1;
																}
																 *(_t218 + 0x14) = _t217;
															}
															__eflags = _t217 - 0xffffffff;
															if(_t217 == 0xffffffff) {
																break;
															}
															_t199 = _t199 + 1;
															__eflags = _t199 - _t208;
															if(_t199 < _t208) {
																continue;
															}
															break;
														}
														_t187 = _v28;
														_t179 = 0;
														__eflags = 0;
														goto L70;
													}
													__eflags = _t211 - 0x41;
													if(_t211 == 0x41) {
														goto L56;
													}
													goto L57;
												}
												__eflags = _t127;
												if(_t127 == 0) {
													goto L58;
												}
												goto L53;
											}
											_t127 = _t179;
											__eflags = _t211 - 0x41;
											if(_t211 != 0x41) {
												goto L51;
											}
											goto L50;
										}
										L47:
										goto L48;
									}
									__eflags = _t211 - 0x58;
									if(_t211 != 0x58) {
										goto L47;
									}
									goto L46;
								}
								_t169 =  *(_t218 + 0x1c) >> 6;
								__eflags = 1 & _t169;
								if((1 & _t169) == 0) {
									__eflags =  *(_t218 + 0x1c) & 1;
									if(( *(_t218 + 0x1c) & 1) == 0) {
										_t171 =  *(_t218 + 0x1c) >> 1;
										__eflags = 1 & _t171;
										if((1 & _t171) != 0) {
											_v20 = 0x20;
											_t187 = 1;
											_v28 = 1;
										}
										goto L44;
									}
									_v20 = 0x2b;
									L41:
									_t187 = 1;
									_v28 = 1;
									goto L44;
								}
								_v20 = 0x2d;
								goto L41;
							}
							L11:
							_t120 = 0;
							goto L105;
						}
						_t173 = _t118;
						__eflags = _t173;
						if(__eflags == 0) {
							L28:
							_t119 = E0134DCC6(_t218, __eflags, _t179);
							goto L10;
						}
						__eflags = _t173 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_t119 = E0134DFC5(_t218, __eflags);
						goto L10;
					}
					if(__eflags == 0) {
						_t119 = E013504DB(__ecx);
						goto L10;
					}
					__eflags = _t117 - 0x67;
					if(_t117 <= 0x67) {
						L29:
						_t119 = E0134FFB7(_t179, _t218);
						goto L10;
					}
					__eflags = _t117 - 0x69;
					if(_t117 == 0x69) {
						L27:
						_t4 = _t218 + 0x1c;
						 *_t4 =  *(_t218 + 0x1c) | 0x00000010;
						__eflags =  *_t4;
						goto L28;
					}
					__eflags = _t117 - 0x6e;
					if(_t117 == 0x6e) {
						_t119 = E0135041D(__ecx, __edx);
						goto L10;
					}
					__eflags = _t117 - 0x6f;
					if(_t117 != 0x6f) {
						goto L11;
					}
					_t119 = E013504A1(__ecx);
					goto L10;
				}
				if(_t222 == 0) {
					goto L27;
				}
				_t223 = _t117 - _t183;
				if(_t223 > 0) {
					_t175 = _t117 - 0x5a;
					__eflags = _t175;
					if(_t175 == 0) {
						_t119 = E0134FF03(__ecx);
						goto L10;
					}
					_t176 = _t175 - 7;
					__eflags = _t176;
					if(_t176 == 0) {
						goto L29;
					}
					__eflags = _t176;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t119 = E013502E1(_t179, _t218, _t208, __eflags, _t179);
					goto L10;
				}
				if(_t223 == 0) {
					_push(1);
					goto L13;
				}
				if(_t117 == 0x41) {
					goto L29;
				}
				if(_t117 == 0x43) {
					goto L17;
				}
				if(_t117 <= 0x44) {
					goto L11;
				}
				if(_t117 <= 0x47) {
					goto L29;
				}
				if(_t117 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x0134f700
0x0134f700
0x0134f708
0x0134f70f
0x0134f714
0x0134f716
0x0134f71a
0x0134f71d
0x0134f71e
0x0134f722
0x0134f725
0x0134f798
0x0134f79b
0x0134f7eb
0x0134f7eb
0x0134f7ee
0x0134f754
0x0134f756
0x0134f75b
0x0134f75d
0x0134f809
0x0134f80c
0x0134fa7e
0x0134fa7e
0x0134fa80
0x0134fa8d
0x0134fa8d
0x0134f817
0x0134f81b
0x0134f81f
0x0134f821
0x0134f824
0x0134f827
0x0134f829
0x0134f85d
0x0134f85d
0x0134f860
0x0134f863
0x0134f86a
0x0134f872
0x0134f874
0x0134f878
0x0134f878
0x0134f87b
0x0134f884
0x0134f884
0x0134f886
0x0134f886
0x0134f888
0x0134f88e
0x0134f88e
0x0134f893
0x0134f896
0x0134f8a1
0x0134f8a3
0x0134f8a4
0x0134f8a4
0x0134f8a8
0x0134f8a8
0x0134f8ab
0x0134f8ae
0x0134f8b4
0x0134f8b6
0x0134f8ba
0x0134f8bb
0x0134f8be
0x0134f91e
0x0134f91e
0x0134f921
0x0134f92f
0x0134f935
0x0134f93a
0x0134f93f
0x0134f942
0x0134f944
0x0134f9aa
0x0134f9aa
0x0134f9ae
0x0134fa12
0x0134fa12
0x0134fa22
0x0134fa27
0x0134fa27
0x0134fa29
0x0134fa2b
0x0134fa7d
0x0134fa7d
0x00000000
0x0134fa7d
0x0134fa30
0x0134fa33
0x0134fa35
0x00000000
0x00000000
0x0134fa37
0x0134fa3a
0x0134fa3c
0x00000000
0x00000000
0x00000000
0x00000000
0x0134fa3e
0x0134fa3e
0x0134fa41
0x0134fa46
0x0134fa49
0x0134fa5e
0x0134fa61
0x0134fa63
0x0134fa6a
0x0134fa6d
0x0134fa6f
0x0134fa6f
0x0134fa71
0x0134fa4b
0x0134fa4b
0x0134fa4f
0x0134fa54
0x0134fa54
0x0134fa51
0x0134fa51
0x0134fa51
0x0134fa57
0x0134fa57
0x0134fa73
0x0134fa76
0x00000000
0x00000000
0x0134fa78
0x0134fa79
0x0134fa7b
0x00000000
0x00000000
0x00000000
0x0134fa7b
0x00000000
0x0134fa3e
0x0134f9b0
0x0134f9b3
0x00000000
0x00000000
0x0134f9b5
0x0134f9b8
0x0134f9bb
0x0134f9ca
0x0134f9d1
0x0134f9d5
0x0134f9da
0x0134f9dd
0x0134f9df
0x00000000
0x00000000
0x0134f9e1
0x0134f9e4
0x00000000
0x00000000
0x0134f9e6
0x0134f9f7
0x0134f9ff
0x0134fa02
0x0134fa03
0x0134fa06
0x0134fa09
0x00000000
0x00000000
0x00000000
0x0134fa0b
0x0134fa0d
0x00000000
0x0134fa0d
0x0134f946
0x0134f949
0x0134f94c
0x00000000
0x00000000
0x0134f94e
0x0134f951
0x0134f954
0x0134f956
0x00000000
0x00000000
0x0134f958
0x0134f95a
0x0134f95d
0x0134f95d
0x0134f95f
0x0134f962
0x0134f967
0x0134f96a
0x0134f981
0x0134f985
0x0134f98c
0x0134f98f
0x0134f991
0x0134f991
0x0134f993
0x0134f96c
0x0134f96c
0x0134f96e
0x0134f972
0x0134f977
0x0134f977
0x0134f974
0x0134f974
0x0134f974
0x0134f97a
0x0134f97a
0x0134f995
0x0134f998
0x00000000
0x00000000
0x0134f99d
0x0134f99e
0x0134f9a1
0x0134f9a3
0x00000000
0x00000000
0x00000000
0x0134f9a3
0x0134f9a5
0x0134f9a8
0x0134f9a8
0x00000000
0x0134f9a8
0x0134f8c0
0x0134f8c2
0x00000000
0x00000000
0x0134f8c4
0x0134f8c7
0x0134f8c9
0x0134f8c9
0x0134f8cf
0x0134f8d8
0x0134f8db
0x0134f8f1
0x0134f8f6
0x0134f901
0x0134f904
0x0134f90a
0x0134f90a
0x0134f90c
0x0134f8dd
0x0134f8dd
0x0134f8e1
0x0134f8e6
0x0134f8e6
0x0134f8e3
0x0134f8e3
0x0134f8e3
0x0134f8e9
0x0134f8e9
0x0134f90f
0x0134f912
0x00000000
0x00000000
0x0134f914
0x0134f915
0x0134f917
0x00000000
0x00000000
0x00000000
0x0134f917
0x0134f919
0x0134f91c
0x0134f91c
0x00000000
0x0134f91c
0x0134f898
0x0134f89b
0x00000000
0x00000000
0x00000000
0x0134f89d
0x0134f88a
0x0134f88c
0x00000000
0x00000000
0x00000000
0x0134f88c
0x0134f87d
0x0134f87f
0x0134f882
0x00000000
0x00000000
0x00000000
0x0134f882
0x0134f876
0x00000000
0x0134f876
0x0134f865
0x0134f868
0x00000000
0x00000000
0x00000000
0x0134f868
0x0134f82e
0x0134f831
0x0134f833
0x0134f83b
0x0134f83e
0x0134f84e
0x0134f850
0x0134f852
0x0134f854
0x0134f858
0x0134f85a
0x0134f85a
0x00000000
0x0134f852
0x0134f840
0x0134f844
0x0134f844
0x0134f846
0x00000000
0x0134f846
0x0134f835
0x00000000
0x0134f835
0x0134f763
0x0134f763
0x00000000
0x0134f763
0x0134f7f5
0x0134f7f5
0x0134f7f8
0x0134f7c9
0x0134f7cc
0x00000000
0x0134f7cc
0x0134f7fa
0x0134f7fd
0x00000000
0x00000000
0x0134f803
0x0134f76c
0x0134f76e
0x00000000
0x0134f76e
0x0134f79d
0x0134f7e1
0x00000000
0x0134f7e1
0x0134f79f
0x0134f7a2
0x0134f7d3
0x0134f7d5
0x00000000
0x0134f7d5
0x0134f7a4
0x0134f7a7
0x0134f7c5
0x0134f7c5
0x0134f7c5
0x0134f7c5
0x00000000
0x0134f7c5
0x0134f7a9
0x0134f7ac
0x0134f7be
0x00000000
0x0134f7be
0x0134f7ae
0x0134f7b1
0x00000000
0x00000000
0x0134f7b5
0x00000000
0x0134f7b5
0x0134f727
0x00000000
0x00000000
0x0134f72d
0x0134f72f
0x0134f775
0x0134f775
0x0134f778
0x0134f791
0x00000000
0x0134f791
0x0134f77a
0x0134f77a
0x0134f77d
0x00000000
0x00000000
0x0134f780
0x0134f783
0x00000000
0x00000000
0x0134f785
0x0134f788
0x00000000
0x0134f788
0x0134f731
0x0134f76a
0x00000000
0x0134f76a
0x0134f736
0x00000000
0x00000000
0x0134f73f
0x00000000
0x00000000
0x0134f744
0x00000000
0x00000000
0x0134f749
0x00000000
0x00000000
0x0134f752
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 0134F88E

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0e67666ef9a30e046a99580155b3a829a1510af99e642a3c232077d5f5482ff2
Instruction ID: 0f5509d541d3521c9556a85d478c55894c59c8bf3dc145ad901efbb1f4068b45
Opcode Fuzzy Hash: 0e67666ef9a30e046a99580155b3a829a1510af99e642a3c232077d5f5482ff2
Instruction Fuzzy Hash: CCC1ED3490064A8FEB29CF2CC480A7ABFE9EF4531CF1C4619D996DB6A1D334B946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01363A7A Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E01363A7A(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				short _v248;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t15;
				signed int _t21;
				void* _t23;
				void* _t30;
				void* _t32;
				signed int _t41;
				signed int* _t47;
				int _t49;
				signed int _t50;

				_t46 = __edx;
				_t15 =  *0x1383020; // 0xc9209188
				_v8 = _t15 ^ _t50;
				_t48 = _a4;
				_t32 = E0135AE3C(__ecx, __edx, _a4);
				_t47 =  *(E0135AE3C(__ecx, __edx, _a4) + 0x34c);
				_t49 = E01363B4F(_t48);
				asm("sbb ecx, ecx");
				_t21 = GetLocaleInfoW(_t49, ( ~( *(_t32 + 0x60)) & 0xfffff002) + 0x1001,  &_v248, 0x78);
				if(_t21 != 0) {
					_t23 = E01350A02(_t47, _t49,  *((intOrPtr*)(_t32 + 0x50)),  &_v248);
					_t41 =  *(_t32 + 0x60);
					if(_t23 != 0) {
						if(_t41 == 0 &&  *((intOrPtr*)(_t32 + 0x5c)) != _t41) {
							_t30 = E01350A02(_t47, _t49,  *((intOrPtr*)(_t32 + 0x50)),  &_v248);
							if(_t30 == 0) {
								_push(_t47);
								_push(_t30);
								goto L9;
							}
						}
					} else {
						if(_t41 != 0) {
							L10:
							 *_t47 =  *_t47 | 0x00000004;
							_t47[1] = _t49;
							_t47[2] = _t49;
						} else {
							_push(_t47);
							_push(1);
							L9:
							_push(_t49);
							if(E01363CA9() != 0) {
								goto L10;
							}
						}
					}
					_t27 =  !( *_t47 >> 2) & 0x00000001;
				} else {
					 *_t47 =  *_t47 & _t21;
					_t27 = _t21 + 1;
				}
				return E01347708(_t27, _t32, _v8 ^ _t50, _t46, _t47, _t49);
			}

0x01363a7a
0x01363a85
0x01363a8c
0x01363a91
0x01363a9a
0x01363aa2
0x01363ab1
0x01363abd
0x01363ace
0x01363ad6
0x01363ae7
0x01363aee
0x01363af3
0x01363b00
0x01363b11
0x01363b1a
0x01363b1c
0x01363b1d
0x00000000
0x01363b1d
0x01363b1a
0x01363af5
0x01363af7
0x01363b2b
0x01363b2b
0x01363b2e
0x01363b31
0x01363af9
0x01363af9
0x01363afa
0x01363b1e
0x01363b1e
0x01363b29
0x00000000
0x00000000
0x01363b29
0x01363af7
0x01363b3b
0x01363ad8
0x01363ad8
0x01363ada
0x01363ada
0x01363b4c

APIs

Part of subcall function 0135AE3C: GetLastError.KERNEL32(?,00000008,013603BC), ref: 0135AE40
Part of subcall function 0135AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0135AEE2

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 01363ACE

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 5312ff9a95f349d280092ba72c45da26cfd690a0045f553cecf65269067b90c2
Instruction ID: 5293555885ec7448587c0c120789f7b0e0a46cc706899bcc0f5d4f7c4970e125
Opcode Fuzzy Hash: 5312ff9a95f349d280092ba72c45da26cfd690a0045f553cecf65269067b90c2
Instruction Fuzzy Hash: CD21C272601256ABEB289F2DCC41EBA77ACFF44718F10817AED09D7145EB75E9048B50

Uniqueness

Uniqueness Score: -1.00%

Function 01363701 Relevance: 1.6, APIs: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E01363701(void* __ecx, void* __edx, signed int* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t26;
				intOrPtr _t29;
				signed int _t32;
				signed char _t33;
				signed char _t34;
				intOrPtr* _t38;
				intOrPtr* _t41;
				signed int _t47;
				void* _t50;
				void* _t51;
				signed int* _t52;
				void* _t53;
				void* _t54;
				signed int _t62;

				_t54 = E0135AE3C(__ecx, __edx, _t53);
				_t47 = 2;
				_t38 =  *((intOrPtr*)(_t54 + 0x50));
				_t50 = _t38 + 2;
				do {
					_t26 =  *_t38;
					_t38 = _t38 + _t47;
				} while (_t26 != 0);
				_t41 =  *((intOrPtr*)(_t54 + 0x54));
				 *(_t54 + 0x60) = 0 | _t38 - _t50 >> 0x00000001 == 0x00000003;
				_t51 = _t41 + 2;
				do {
					_t29 =  *_t41;
					_t41 = _t41 + _t47;
				} while (_t29 != 0);
				_t52 = _a4;
				 *(_t54 + 0x64) = 0 | _t41 - _t51 >> 0x00000001 == 0x00000003;
				_t52[1] = 0;
				if( *(_t54 + 0x60) == 0) {
					_t47 = E013637FB( *((intOrPtr*)(_t54 + 0x50)));
				}
				 *(_t54 + 0x5c) = _t47;
				_t32 = EnumSystemLocalesW(E01363827, 1);
				_t62 =  *_t52 & 0x00000007;
				asm("bt ecx, 0x9");
				_t33 = _t32 & 0xffffff00 | _t62 > 0x00000000;
				asm("bt ecx, 0x8");
				_t34 = _t33 & 0xffffff00 | _t62 > 0x00000000;
				if((_t34 & (_t47 & 0xffffff00 | _t62 != 0x00000000) & _t33) == 0) {
					 *_t52 = 0;
					return _t34;
				}
				return _t34;
			}

0x0136370e
0x01363714
0x01363715
0x01363718
0x0136371b
0x0136371b
0x0136371e
0x01363720
0x0136372e
0x01363734
0x01363737
0x0136373a
0x0136373a
0x0136373d
0x0136373f
0x01363748
0x01363753
0x01363756
0x0136375c
0x01363767
0x01363767
0x01363770
0x01363773
0x0136377b
0x01363781
0x01363785
0x0136378a
0x0136378e
0x01363793
0x01363795
0x00000000
0x01363795
0x0136379b

APIs

Part of subcall function 0135AE3C: GetLastError.KERNEL32(?,00000008,013603BC), ref: 0135AE40
Part of subcall function 0135AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0135AEE2

EnumSystemLocalesW.KERNEL32(01363827,00000001,00000000,?,-00000050,?,01363E58,00000000,?,?,?,00000055,?), ref: 01363773

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 43d5b342b3cb9af60c4e99a3cb94d7e0dc7eb8f4658e2c94ffca21839cf387e0
Instruction ID: 7456cd3b299ae33eee860a8dd82b938ac593298cb6cb7ec05deff0f1e99190a9
Opcode Fuzzy Hash: 43d5b342b3cb9af60c4e99a3cb94d7e0dc7eb8f4658e2c94ffca21839cf387e0
Instruction Fuzzy Hash: EF11257B2003019FDB189F3DC8919BABBA5FF8032CB18842CE98A87B40D375B802C740

Uniqueness

Uniqueness Score: -1.00%

Function 01363CA9 Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E01363CA9(signed int _a4, intOrPtr _a8) {
				short _v8;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t8;
				void* _t11;
				intOrPtr _t13;
				void* _t15;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t25;
				signed int _t26;
				intOrPtr* _t28;

				_push(_t15);
				_push(_t25);
				_t8 = E0135AE3C(_t15, _t21, _t25);
				_t26 = _a4;
				_t23 = _t8;
				if(GetLocaleInfoW(_t26 & 0x000003ff | 0x00000400, 0x20000001,  &_v8, 2) == 0) {
					L7:
					_t11 = 0;
				} else {
					if(_t26 == _v8 || _a8 == 0) {
						L6:
						_t11 = 1;
					} else {
						_t28 =  *((intOrPtr*)(_t23 + 0x50));
						_t19 = _t28 + 2;
						do {
							_t13 =  *_t28;
							_t28 = _t28 + 2;
						} while (_t13 != 0);
						if(E013637FB( *((intOrPtr*)(_t23 + 0x50))) == _t28 - _t19 >> 1) {
							goto L7;
						} else {
							goto L6;
						}
					}
				}
				return _t11;
			}

0x01363cae
0x01363caf
0x01363cb1
0x01363cb6
0x01363cb9
0x01363cdd
0x01363d11
0x01363d11
0x01363cdf
0x01363ce2
0x01363d0c
0x01363d0e
0x01363cea
0x01363cea
0x01363ced
0x01363cf0
0x01363cf0
0x01363cf3
0x01363cf6
0x01363d0a
0x00000000
0x00000000
0x00000000
0x00000000
0x01363d0a
0x01363ce2
0x01363d16

APIs

Part of subcall function 0135AE3C: GetLastError.KERNEL32(?,00000008,013603BC), ref: 0135AE40
Part of subcall function 0135AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0135AEE2

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,01363A43,00000000,00000000,?), ref: 01363CD5

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 4868e473e6ebece649f3a889d22751e89e1443db5adddd29099a7cbe5212f6fa
Instruction ID: 16559d7cbab31b3cd3fdfa591af5db537c87ef2f776384902364a3baa54fcbfa
Opcode Fuzzy Hash: 4868e473e6ebece649f3a889d22751e89e1443db5adddd29099a7cbe5212f6fa
Instruction Fuzzy Hash: C9F0CD32A00116BBEB245B69CC05BFA7F6CFB5075CF158429DD4AA3148DB74FD42C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 0136379C Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0136379C(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t11;
				signed char* _t15;
				intOrPtr* _t19;
				intOrPtr _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t27 = E0135AE3C(__ecx, __edx, _t26);
				_t24 = 2;
				_t19 =  *((intOrPtr*)(_t27 + 0x50));
				_t25 = _t19 + 2;
				do {
					_t11 =  *_t19;
					_t19 = _t19 + _t24;
				} while (_t11 != 0);
				_t4 = _t19 - _t25 >> 1 == 3;
				 *(_t27 + 0x60) = 0 | _t4;
				if(_t4 != 0) {
					_t24 = E013637FB( *((intOrPtr*)(_t27 + 0x50)));
				}
				 *((intOrPtr*)(_t27 + 0x5c)) = _t24;
				EnumSystemLocalesW(E01363A7A, 1);
				_t15 = _a4;
				if(( *_t15 & 0x00000004) == 0) {
					 *_t15 = 0;
					return _t15;
				}
				return _t15;
			}

0x013637a9
0x013637af
0x013637b0
0x013637b3
0x013637b6
0x013637b6
0x013637b9
0x013637bb
0x013637c9
0x013637cc
0x013637cf
0x013637da
0x013637da
0x013637e3
0x013637e6
0x013637ec
0x013637f2
0x013637f4
0x00000000
0x013637f4
0x013637fa

APIs

Part of subcall function 0135AE3C: GetLastError.KERNEL32(?,00000008,013603BC), ref: 0135AE40
Part of subcall function 0135AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0135AEE2

EnumSystemLocalesW.KERNEL32(01363A7A,00000001,?,?,-00000050,?,01363E1C,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 013637E6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d593a02ec7dd3cd0c628721a1b52f6be9c814dfac7bae680ff7503eb0efb42e3
Instruction ID: c2a9b68cf19bd4454defb028592f5c375861182cedae1737fd0460e38050d5d3
Opcode Fuzzy Hash: d593a02ec7dd3cd0c628721a1b52f6be9c814dfac7bae680ff7503eb0efb42e3
Instruction Fuzzy Hash: B9F022763003056FDB249F3DC881A7A7BA9FB8076CF04802CEA494BA40D6B5A8029600

Uniqueness

Uniqueness Score: -1.00%

Function 0135C7A2 Relevance: 1.5, APIs: 1, Instructions: 33
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E0135C7A2(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t17;
				signed int _t29;
				void* _t31;

				_push(0xc);
				_push(0x13810c8);
				E013485D0(__ebx, __edi, __esi);
				 *(_t31 - 0x1c) =  *(_t31 - 0x1c) & 0x00000000;
				E013572CA( *((intOrPtr*)( *((intOrPtr*)(_t31 + 8)))));
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				 *0x13855d8 = E0135822A( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t31 + 0xc)))))));
				_t29 = EnumSystemLocalesW(E0135C795, 1);
				_t17 =  *0x1383020; // 0xc9209188
				 *0x13855d8 = _t17;
				 *(_t31 - 0x1c) = _t29;
				 *(_t31 - 4) = 0xfffffffe;
				E0135C812();
				 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0x10));
				return _t29;
			}

0x0135c7a2
0x0135c7a4
0x0135c7a9
0x0135c7ae
0x0135c7b7
0x0135c7bd
0x0135c7ce
0x0135c7e0
0x0135c7e2
0x0135c7e7
0x0135c7ec
0x0135c7ef
0x0135c7f6
0x0135c800
0x0135c80c

APIs

Part of subcall function 013572CA: EnterCriticalSection.KERNEL32(?,?,0136163A,00000000,013811A8,0000000C,01361601,?,?,0135C75E,?,?,0135AFDA,00000001,00000364,?), ref: 013572D9

EnumSystemLocalesW.KERNEL32(0135C795,00000001,013810C8,0000000C,0135CBC4,00000000), ref: 0135C7DA

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: d6165fac7be1872ba66c76d577d3e26ac8a1ccbc74fcaf06b9c651cb98c38fc9
Instruction ID: bc72cba6648a26f473d813ab2788358123fb496c836d448691f59683c941901a
Opcode Fuzzy Hash: d6165fac7be1872ba66c76d577d3e26ac8a1ccbc74fcaf06b9c651cb98c38fc9
Instruction Fuzzy Hash: 52F04972A00305EFD750EF98E441B9D7BF4FB18B28F20816AE811DB390DB7559018F50

Uniqueness

Uniqueness Score: -1.00%

Function 013471C1 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,01344EEC,00000000,0137B6C9,00000004,01343D92,0137B6C9,00000004,013441A5,00000000,00000000), ref: 013471DA

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c94982bfc24723cc85ffa7ac45fb2d61a04bc387c16b8a1f00d55c5c9c393e9e
Instruction ID: 333ba9840146761b2420e0de7b15b6f4267d54b09cec8ea0220ff722e4020739
Opcode Fuzzy Hash: c94982bfc24723cc85ffa7ac45fb2d61a04bc387c16b8a1f00d55c5c9c393e9e
Instruction Fuzzy Hash: 9EE0D872290244B7E7659BBC9E1FF6A3AECD70074EF404541F702D50C5C7A0D601D261

Uniqueness

Uniqueness Score: -1.00%

Function 013636B6 Relevance: 1.5, APIs: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E013636B6(void* __ecx, void* __edx, signed char* _a4) {
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				signed char* _t13;
				intOrPtr* _t15;
				void* _t19;
				void* _t21;
				void* _t22;

				_t19 = E0135AE3C(__ecx, __edx, _t21);
				_t15 =  *((intOrPtr*)(_t19 + 0x54));
				_t22 = _t15 + 2;
				do {
					_t9 =  *_t15;
					_t15 = _t15 + 2;
				} while (_t9 != 0);
				 *(_t19 + 0x64) = 0 | _t15 - _t22 >> 0x00000001 == 0x00000003;
				EnumSystemLocalesW(0x136360f, 1);
				_t13 = _a4;
				if(( *_t13 & 0x00000004) == 0) {
					 *_t13 = 0;
					return _t13;
				}
				return _t13;
			}

0x013636c2
0x013636c6
0x013636c9
0x013636cc
0x013636cc
0x013636cf
0x013636d2
0x013636ea
0x013636ed
0x013636f3
0x013636f9
0x013636fb
0x00000000
0x013636fb
0x01363700

APIs

Part of subcall function 0135AE3C: GetLastError.KERNEL32(?,00000008,013603BC), ref: 0135AE40
Part of subcall function 0135AE3C: SetLastError.KERNEL32(00000000,00000000,00000006,000000FF), ref: 0135AEE2

EnumSystemLocalesW.KERNEL32(0136360F,00000001,?,?,?,01363E7A,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 013636ED

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9a72452ebd8aaf2c65f53f462e65c0eb83a085b33df8bacf3ad148014e0d5ff5
Instruction ID: 2d225e03c4ebdc316e4fd776e7ecbe1ebcfaf2839c62950baaf284b945d22bac
Opcode Fuzzy Hash: 9a72452ebd8aaf2c65f53f462e65c0eb83a085b33df8bacf3ad148014e0d5ff5
Instruction Fuzzy Hash: FFF0553630020957CB04AF3AC885A6A7F98FFC1728B06805CEA098B354C271EC43C750

Uniqueness

Uniqueness Score: -1.00%

Function 0135CD1F Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0135A4B1,?,20001004,00000000,00000002,?,?,01359AB3), ref: 0135CD53

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: af5334a28c6a1e4520242bb6fe6d1f39bc992c736a3f5fa78a0caf1346377c21
Instruction ID: ab3aebef588e5db3e88013ca569ae4f250ccd80c957d24b99f793de4603e7ff2
Opcode Fuzzy Hash: af5334a28c6a1e4520242bb6fe6d1f39bc992c736a3f5fa78a0caf1346377c21
Instruction Fuzzy Hash: AFE04F3550031DBBCF522F64DC04E9E7F5EEF44B69F009011FD05A6120CB718921ABD0

Uniqueness

Uniqueness Score: -1.00%

Function 01361533 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01361533() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x13856ec = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x01361533
0x0136153b
0x01361543

APIs

GetProcessHeap.KERNEL32 ref: 01361533

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8bc7400422dcaf6a055b6f5c4578b70a3bfd99685b920a215d0c4b7295103019
Instruction ID: c3cc891344402eebd7b344c6d76f367f9f84d9d911add3cc9a859822ac6bedca
Opcode Fuzzy Hash: 8bc7400422dcaf6a055b6f5c4578b70a3bfd99685b920a215d0c4b7295103019
Instruction Fuzzy Hash: D1A001B0642201CBEBA08FB6A60920E3AADAA457A9B15D169E445C6268EA6884509F01

Uniqueness

Uniqueness Score: -1.00%

Function 01356078 Relevance: .7, Instructions: 655
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E01356078(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _t264;
				intOrPtr _t266;
				void* _t270;
				intOrPtr _t274;
				void* _t278;
				intOrPtr _t280;
				void* _t284;
				intOrPtr _t286;
				void* _t290;
				intOrPtr _t292;
				void* _t296;
				intOrPtr _t298;
				intOrPtr _t300;
				intOrPtr _t302;
				intOrPtr _t303;
				intOrPtr _t305;
				void* _t312;
				intOrPtr _t313;
				intOrPtr _t315;
				void* _t322;
				intOrPtr _t323;
				intOrPtr _t325;
				void* _t332;
				intOrPtr _t333;
				intOrPtr _t335;
				void* _t342;
				intOrPtr _t343;
				intOrPtr _t345;
				void* _t352;
				intOrPtr _t354;
				intOrPtr _t356;
				intOrPtr _t358;
				intOrPtr _t360;
				intOrPtr _t362;
				void* _t370;
				void* _t377;
				void* _t384;
				void* _t391;
				void* _t397;
				void* _t401;
				void* _t405;
				intOrPtr* _t407;
				intOrPtr* _t409;
				intOrPtr* _t411;
				intOrPtr* _t413;
				intOrPtr* _t415;
				intOrPtr _t416;
				unsigned int _t418;
				unsigned int _t425;
				unsigned int _t427;
				unsigned int _t429;
				intOrPtr* _t432;
				intOrPtr* _t433;
				intOrPtr* _t436;
				intOrPtr* _t440;
				intOrPtr* _t444;
				intOrPtr* _t448;
				intOrPtr* _t452;
				intOrPtr* _t454;
				intOrPtr* _t456;
				void* _t457;
				intOrPtr _t458;
				intOrPtr* _t459;
				intOrPtr* _t463;
				intOrPtr* _t468;
				intOrPtr* _t473;
				intOrPtr* _t478;
				intOrPtr* _t483;
				intOrPtr* _t486;
				intOrPtr* _t489;
				intOrPtr* _t492;
				void* _t504;
				intOrPtr _t505;
				intOrPtr _t506;
				void* _t507;
				void* _t508;
				void* _t509;
				intOrPtr _t512;
				long _t515;
				void* _t522;
				void* _t524;
				intOrPtr* _t526;
				intOrPtr* _t528;
				intOrPtr* _t530;
				intOrPtr* _t532;
				intOrPtr* _t534;
				intOrPtr _t535;
				void* _t540;

				_t512 = 0;
				E01350904( &_v44, _t504, 0);
				_t515 = 0x164;
				_v20 = 0;
				_t505 = 0;
				_v12 = 0;
				_t432 =  *((intOrPtr*)(_v40 + 0x9c));
				_t264 = 0;
				_v8 = _t432;
				_v16 = 0;
				L1:
				while(1) {
					L1:
					if(_t505 != 1) {
						L4:
						_t506 = _t512;
						_v24 = _t264;
						_v24 = _v24 - _t432;
						_t407 = _t432;
						_v28 = _t506;
						do {
							if(_v12 != 1) {
								L8:
								_t433 =  *_t407;
								_v28 = _t433 + 1;
								do {
									_t266 =  *_t433;
									_t433 = _t433 + 1;
								} while (_t266 != 0);
								goto L10;
							} else {
								 *((intOrPtr*)(_v24 + _t407)) = _t264 + _t515;
								_t270 = E0135A952(_t264 + _t515, _v20 - _t515,  *_t407);
								_t540 = _t540 + 0xc;
								if(_t270 != 0) {
									L127:
									_push(_t512);
									_push(_t512);
									_push(_t512);
									_push(_t512);
									_push(_t512);
									E0134C5DF();
									asm("int3");
									return E01356794(_t506, _v72, _v68, _v64, _v60, _v56, 0);
								} else {
									_t506 = _v28;
									goto L8;
								}
							}
							goto L129;
							L10:
							_t264 = _v16;
							_t515 = _t515 + 1 + _t433 - _v28;
							_t506 = _t506 + 1;
							_t407 = _t407 + 4;
							_v28 = _t506;
						} while (_t506 < 7);
						_t506 = _t512;
						_v28 = _t506;
						_t409 = _v8 + 0x1c;
						do {
							if(_v12 != 1) {
								L15:
								_t436 =  *_t409;
								_v28 = _t436 + 1;
								do {
									_t274 =  *_t436;
									_t436 = _t436 + 1;
								} while (_t274 != 0);
								goto L17;
							} else {
								 *((intOrPtr*)(_t409 + _v24)) = _v16 + _t515;
								_t278 = E0135A952(_v16 + _t515, _v20 - _t515,  *_t409);
								_t540 = _t540 + 0xc;
								if(_t278 != 0) {
									goto L127;
								} else {
									_t506 = _v28;
									goto L15;
								}
							}
							goto L129;
							L17:
							_t515 = _t515 + 1 + _t436 - _v28;
							_t409 = _t409 + 4;
							_t506 = _t506 + 1;
							_v28 = _t506;
						} while (_t506 < 7);
						_t506 = _t512;
						_v28 = _t506;
						_t411 = _v8 + 0x38;
						do {
							if(_v12 != 1) {
								L22:
								_t440 =  *_t411;
								_v28 = _t440 + 1;
								do {
									_t280 =  *_t440;
									_t440 = _t440 + 1;
								} while (_t280 != 0);
								goto L24;
							} else {
								 *((intOrPtr*)(_t411 + _v24)) = _v16 + _t515;
								_t284 = E0135A952(_v16 + _t515, _v20 - _t515,  *_t411);
								_t540 = _t540 + 0xc;
								if(_t284 != 0) {
									goto L127;
								} else {
									_t506 = _v28;
									goto L22;
								}
							}
							goto L129;
							L24:
							_t515 = _t515 + 1 + _t440 - _v28;
							_t411 = _t411 + 4;
							_t506 = _t506 + 1;
							_v28 = _t506;
						} while (_t506 < 0xc);
						_t506 = _t512;
						_v28 = _t506;
						_t413 = _v8 + 0x68;
						do {
							if(_v12 != 1) {
								L29:
								_t444 =  *_t413;
								_v28 = _t444 + 1;
								do {
									_t286 =  *_t444;
									_t444 = _t444 + 1;
								} while (_t286 != 0);
								goto L31;
							} else {
								 *((intOrPtr*)(_t413 + _v24)) = _v16 + _t515;
								_t290 = E0135A952(_v16 + _t515, _v20 - _t515,  *_t413);
								_t540 = _t540 + 0xc;
								if(_t290 != 0) {
									goto L127;
								} else {
									_t506 = _v28;
									goto L29;
								}
							}
							goto L129;
							L31:
							_t515 = _t515 + 1 + _t444 - _v28;
							_t413 = _t413 + 4;
							_t506 = _t506 + 1;
							_v28 = _t506;
						} while (_t506 < 0xc);
						_t506 = _t512;
						_v28 = _t506;
						_t415 = _v8 + 0x98;
						do {
							if(_v12 != 1) {
								L36:
								_t448 =  *_t415;
								_v28 = _t448 + 1;
								do {
									_t292 =  *_t448;
									_t448 = _t448 + 1;
								} while (_t292 != 0);
								goto L38;
							} else {
								 *((intOrPtr*)(_t415 + _v24)) = _v16 + _t515;
								_t296 = E0135A952(_v16 + _t515, _v20 - _t515,  *_t415);
								_t540 = _t540 + 0xc;
								if(_t296 != 0) {
									goto L127;
								} else {
									_t506 = _v28;
									goto L36;
								}
							}
							goto L129;
							L38:
							_t515 = _t515 + 1 + _t448 - _v28;
							_t415 = _t415 + 4;
							_t506 = _t506 + 1;
							_v28 = _t506;
						} while (_t506 < 2);
						_t416 = _v16;
						if(_v12 != 1) {
							L41:
							_t452 =  *((intOrPtr*)(_v8 + 0xa0));
							_t506 = _t452 + 1;
							do {
								_t298 =  *_t452;
								_t452 = _t452 + 1;
							} while (_t298 != 0);
							_t522 = _t515 + 1 + _t452 - _t506;
							if(_v12 != 1) {
								L45:
								_t454 =  *((intOrPtr*)(_v8 + 0xa4));
								_t506 = _t454 + 1;
								do {
									_t300 =  *_t454;
									_t454 = _t454 + 1;
								} while (_t300 != 0);
								_t524 = _t522 + 1 + _t454 - _t506;
								if(_v12 != 1) {
									L49:
									_t456 =  *((intOrPtr*)(_v8 + 0xa8));
									_t102 = _t456 + 1; // 0x1
									_t507 = _t102;
									do {
										_t302 =  *_t456;
										_t456 = _t456 + 1;
									} while (_t302 != 0);
									_t457 = _t456 - _t507;
									_t506 = _v12;
									_t104 = _t457 + 1; // 0x2
									_t458 = _v16;
									_t418 = _t104 + _t524;
									if(_t506 == 1) {
										 *((intOrPtr*)(_t458 + 0xac)) =  *((intOrPtr*)(_v8 + 0xac));
										 *((intOrPtr*)(_t458 + 0xb0)) = _t512;
									}
									_v28 = _t512;
									_t526 = _v8 + 0xb4;
									L55:
									while((_t418 & 0x00000001) == 0) {
										if(_t506 != 1) {
											L58:
											_t459 =  *_t526;
											_t508 = _t459 + 2;
											do {
												_t303 =  *_t459;
												_t459 = _t459 + 2;
											} while (_t303 != _t512);
											_t506 = _v12;
											_t526 = _t526 + 4;
											_t458 = _v16;
											_t418 = _t418 + (_t459 - _t508 >> 1) * 2 + 2;
											_t305 = _v28 + 1;
											_v28 = _t305;
											if(_t305 < 7) {
												continue;
											} else {
												_v28 = _t512;
												_t528 = _v8 + 0xd0;
												L63:
												while((_t418 & 0x00000001) == 0) {
													if(_v12 != 1) {
														L66:
														_t463 =  *_t528;
														_t506 = _t463 + 2;
														do {
															_t313 =  *_t463;
															_t463 = _t463 + 2;
														} while (_t313 != _t512);
														_t528 = _t528 + 4;
														_t418 = _t418 + (_t463 - _t506 >> 1) * 2 + 2;
														_t315 = _v28 + 1;
														_v28 = _t315;
														if(_t315 < 7) {
															continue;
														} else {
															_v28 = _t512;
															_t530 = _v8 + 0xec;
															L71:
															while((_t418 & 0x00000001) == 0) {
																if(_v12 != 1) {
																	L74:
																	_t468 =  *_t530;
																	_t506 = _t468 + 2;
																	do {
																		_t323 =  *_t468;
																		_t468 = _t468 + 2;
																	} while (_t323 != _t512);
																	_t530 = _t530 + 4;
																	_t418 = _t418 + (_t468 - _t506 >> 1) * 2 + 2;
																	_t325 = _v28 + 1;
																	_v28 = _t325;
																	if(_t325 < 0xc) {
																		continue;
																	} else {
																		_v28 = _t512;
																		_t532 = _v8 + 0x11c;
																		L79:
																		while((_t418 & 0x00000001) == 0) {
																			if(_v12 != 1) {
																				L82:
																				_t473 =  *_t532;
																				_t506 = _t473 + 2;
																				do {
																					_t333 =  *_t473;
																					_t473 = _t473 + 2;
																				} while (_t333 != _t512);
																				_t532 = _t532 + 4;
																				_t418 = _t418 + (_t473 - _t506 >> 1) * 2 + 2;
																				_t335 = _v28 + 1;
																				_v28 = _t335;
																				if(_t335 < 0xc) {
																					continue;
																				} else {
																					_v28 = _t512;
																					_t534 = _v8 + 0x14c;
																					L87:
																					while((_t418 & 0x00000001) == 0) {
																						if(_v12 != 1) {
																							L90:
																							_t478 =  *_t534;
																							_t506 = _t478 + 2;
																							do {
																								_t343 =  *_t478;
																								_t478 = _t478 + 2;
																							} while (_t343 != _t512);
																							_t534 = _t534 + 4;
																							_t418 = _t418 + (_t478 - _t506 >> 1) * 2 + 2;
																							_t345 = _v28 + 1;
																							_v28 = _t345;
																							if(_t345 < 2) {
																								continue;
																							} else {
																								while((_t418 & 0x00000001) != 0) {
																									_t418 = _t418 + 1;
																								}
																								_t535 = _v16;
																								if(_v12 != 1) {
																									L98:
																									_t483 =  *((intOrPtr*)(_v8 + 0x154));
																									_t506 = _t483 + 2;
																									do {
																										_t354 =  *_t483;
																										_t483 = _t483 + 2;
																									} while (_t354 != _t512);
																									_t425 = _t418 + (_t483 - _t506 >> 1) * 2 + 2;
																									while((_t425 & 0x00000001) != 0) {
																										_t425 = _t425 + 1;
																									}
																									if(_v12 != 1) {
																										L105:
																										_t486 =  *((intOrPtr*)(_v8 + 0x158));
																										_t506 = _t486 + 2;
																										do {
																											_t356 =  *_t486;
																											_t486 = _t486 + 2;
																										} while (_t356 != _t512);
																										_t427 = _t425 + (_t486 - _t506 >> 1) * 2 + 2;
																										while((_t427 & 0x00000001) != 0) {
																											_t427 = _t427 + 1;
																										}
																										if(_v12 != 1) {
																											L112:
																											_t489 =  *((intOrPtr*)(_v8 + 0x15c));
																											_t506 = _t489 + 2;
																											do {
																												_t358 =  *_t489;
																												_t489 = _t489 + 2;
																											} while (_t358 != _t512);
																											_t429 = _t427 + (_t489 - _t506 >> 1) * 2 + 2;
																											while((_t429 & 0x00000001) != 0) {
																												_t429 = _t429 + 1;
																											}
																											if(_v12 != 1) {
																												L119:
																												_t492 =  *((intOrPtr*)(_v8 + 0x160));
																												_t509 = _t492 + 2;
																												do {
																													_t360 =  *_t492;
																													_t492 = _t492 + 2;
																												} while (_t360 != _t512);
																												_t505 = _v12 + 1;
																												_v12 = _t505;
																												_t515 = _t429 + ((_t492 - _t509 >> 1) + 1) * 2;
																												if(_t505 >= 2) {
																													_t512 = _v16;
																													goto L124;
																												} else {
																													_t264 = _v16;
																													_t432 = _v8;
																													goto L1;
																												}
																											} else {
																												 *((intOrPtr*)(_t535 + 0x160)) = _t535 + (_t429 >> 1) * 2;
																												_t370 = E01350D87(_t535 + (_t429 >> 1) * 2, _v20 - _t429 >> 1,  *((intOrPtr*)(_v8 + 0x160)));
																												_t540 = _t540 + 0xc;
																												if(_t370 != 0) {
																													goto L127;
																												} else {
																													goto L119;
																												}
																											}
																										} else {
																											 *((intOrPtr*)(_t535 + 0x15c)) = _t535 + (_t427 >> 1) * 2;
																											_t377 = E01350D87(_t535 + (_t427 >> 1) * 2, _v20 - _t427 >> 1,  *((intOrPtr*)(_v8 + 0x15c)));
																											_t540 = _t540 + 0xc;
																											if(_t377 != 0) {
																												goto L127;
																											} else {
																												goto L112;
																											}
																										}
																									} else {
																										 *((intOrPtr*)(_t535 + 0x158)) = _t535 + (_t425 >> 1) * 2;
																										_t384 = E01350D87(_t535 + (_t425 >> 1) * 2, _v20 - _t425 >> 1,  *((intOrPtr*)(_v8 + 0x158)));
																										_t540 = _t540 + 0xc;
																										if(_t384 != 0) {
																											goto L127;
																										} else {
																											goto L105;
																										}
																									}
																								} else {
																									 *((intOrPtr*)(_t535 + 0x154)) = _t535 + (_t418 >> 1) * 2;
																									_t391 = E01350D87(_t535 + (_t418 >> 1) * 2, _v20 - _t418 >> 1,  *((intOrPtr*)(_v8 + 0x154)));
																									_t540 = _t540 + 0xc;
																									if(_t391 != 0) {
																										goto L127;
																									} else {
																										goto L98;
																									}
																								}
																							}
																						} else {
																							 *((intOrPtr*)(_t534 + _v24)) = _v16 + (_t418 >> 1) * 2;
																							_t352 = E01350D87(_v16 + (_t418 >> 1) * 2, _v20 - _t418 >> 1,  *_t534);
																							_t540 = _t540 + 0xc;
																							if(_t352 != 0) {
																								goto L127;
																							} else {
																								goto L90;
																							}
																						}
																						goto L129;
																					}
																					_t418 = _t418 + 1;
																					goto L87;
																				}
																			} else {
																				 *((intOrPtr*)(_t532 + _v24)) = _v16 + (_t418 >> 1) * 2;
																				_t342 = E01350D87(_v16 + (_t418 >> 1) * 2, _v20 - _t418 >> 1,  *_t532);
																				_t540 = _t540 + 0xc;
																				if(_t342 != 0) {
																					goto L127;
																				} else {
																					goto L82;
																				}
																			}
																			goto L129;
																		}
																		_t418 = _t418 + 1;
																		goto L79;
																	}
																} else {
																	 *((intOrPtr*)(_t530 + _v24)) = _v16 + (_t418 >> 1) * 2;
																	_t332 = E01350D87(_v16 + (_t418 >> 1) * 2, _v20 - _t418 >> 1,  *_t530);
																	_t540 = _t540 + 0xc;
																	if(_t332 != 0) {
																		goto L127;
																	} else {
																		goto L74;
																	}
																}
																goto L129;
															}
															_t418 = _t418 + 1;
															goto L71;
														}
													} else {
														 *((intOrPtr*)(_t528 + _v24)) = _v16 + (_t418 >> 1) * 2;
														_t322 = E01350D87(_v16 + (_t418 >> 1) * 2, _v20 - _t418 >> 1,  *_t528);
														_t540 = _t540 + 0xc;
														if(_t322 != 0) {
															goto L127;
														} else {
															goto L66;
														}
													}
													goto L129;
												}
												_t418 = _t418 + 1;
												goto L63;
											}
										} else {
											 *((intOrPtr*)(_t526 + _v24)) = _t458 + (_t418 >> 1) * 2;
											_t312 = E01350D87(_t458 + (_t418 >> 1) * 2, _v20 - _t418 >> 1,  *_t526);
											_t540 = _t540 + 0xc;
											if(_t312 != 0) {
												goto L127;
											} else {
												goto L58;
											}
										}
										goto L129;
									}
									_t418 = _t418 + 1;
									goto L55;
								} else {
									 *((intOrPtr*)(_t416 + 0xa8)) = _t416 + _t524;
									_t397 = E0135A952(_t416 + _t524, _v20 - _t524,  *((intOrPtr*)(_v8 + 0xa8)));
									_t540 = _t540 + 0xc;
									if(_t397 != 0) {
										goto L127;
									} else {
										goto L49;
									}
								}
							} else {
								 *((intOrPtr*)(_t416 + 0xa4)) = _t416 + _t522;
								_t401 = E0135A952(_t416 + _t522, _v20 - _t522,  *((intOrPtr*)(_v8 + 0xa4)));
								_t540 = _t540 + 0xc;
								if(_t401 != 0) {
									goto L127;
								} else {
									goto L45;
								}
							}
						} else {
							 *((intOrPtr*)(_t416 + 0xa0)) = _t416 + _t515;
							_t405 = E0135A952(_t416 + _t515, _v20 - _t515,  *((intOrPtr*)(_v8 + 0xa0)));
							_t540 = _t540 + 0xc;
							if(_t405 != 0) {
								goto L127;
							} else {
								goto L41;
							}
						}
					} else {
						_t362 = E0135B127(_t515);
						_v16 = _t362;
						if(_t362 == 0) {
							L124:
							if(_v32 != 0) {
								 *(_v44 + 0x350) =  *(_v44 + 0x350) & 0xfffffffd;
							}
							return _t512;
						} else {
							E01348E90(_t512, _t362, _t512, _t515);
							_t264 = _v16;
							_t540 = _t540 + 0xc;
							_t432 = _v8;
							_v20 = _t515;
							_t515 = 0x164;
							goto L4;
						}
					}
					L129:
				}
			}

0x01356083
0x01356089
0x01356091
0x01356096
0x01356099
0x0135609b
0x0135609e
0x013560a4
0x013560a6
0x013560a9
0x00000000
0x013560ac
0x013560ac
0x013560af
0x013560dc
0x013560dc
0x013560de
0x013560e1
0x013560e4
0x013560e6
0x013560e9
0x013560ed
0x01356114
0x01356114
0x01356119
0x0135611c
0x0135611c
0x0135611e
0x0135611f
0x00000000
0x013560ef
0x013560f5
0x01356101
0x01356106
0x0135610b
0x01356769
0x01356769
0x0135676a
0x0135676b
0x0135676c
0x0135676d
0x0135676e
0x01356773
0x01356793
0x01356111
0x01356111
0x00000000
0x01356111
0x0135610b
0x00000000
0x01356123
0x01356127
0x0135612a
0x0135612c
0x0135612d
0x01356130
0x01356133
0x0135613b
0x0135613d
0x01356140
0x01356143
0x01356147
0x01356170
0x01356170
0x01356175
0x01356178
0x01356178
0x0135617a
0x0135617b
0x00000000
0x01356149
0x01356151
0x0135615d
0x01356162
0x01356167
0x00000000
0x0135616d
0x0135616d
0x00000000
0x0135616d
0x01356167
0x00000000
0x0135617f
0x01356183
0x01356185
0x01356188
0x01356189
0x0135618c
0x01356194
0x01356196
0x01356199
0x0135619c
0x013561a0
0x013561c9
0x013561c9
0x013561ce
0x013561d1
0x013561d1
0x013561d3
0x013561d4
0x00000000
0x013561a2
0x013561aa
0x013561b6
0x013561bb
0x013561c0
0x00000000
0x013561c6
0x013561c6
0x00000000
0x013561c6
0x013561c0
0x00000000
0x013561d8
0x013561dc
0x013561de
0x013561e1
0x013561e2
0x013561e5
0x013561ed
0x013561ef
0x013561f2
0x013561f5
0x013561f9
0x01356222
0x01356222
0x01356227
0x0135622a
0x0135622a
0x0135622c
0x0135622d
0x00000000
0x013561fb
0x01356203
0x0135620f
0x01356214
0x01356219
0x00000000
0x0135621f
0x0135621f
0x00000000
0x0135621f
0x01356219
0x00000000
0x01356231
0x01356235
0x01356237
0x0135623a
0x0135623b
0x0135623e
0x01356246
0x01356248
0x0135624b
0x01356251
0x01356255
0x0135627e
0x0135627e
0x01356283
0x01356286
0x01356286
0x01356288
0x01356289
0x00000000
0x01356257
0x0135625f
0x0135626b
0x01356270
0x01356275
0x00000000
0x0135627b
0x0135627b
0x00000000
0x0135627b
0x01356275
0x00000000
0x0135628d
0x01356291
0x01356293
0x01356296
0x01356297
0x0135629a
0x013562a3
0x013562a6
0x013562d1
0x013562d4
0x013562da
0x013562dd
0x013562dd
0x013562df
0x013562e0
0x013562e7
0x013562ed
0x01356318
0x0135631b
0x01356321
0x01356324
0x01356324
0x01356326
0x01356327
0x0135632e
0x01356334
0x0135635f
0x01356362
0x01356368
0x01356368
0x0135636b
0x0135636b
0x0135636d
0x0135636e
0x01356372
0x01356374
0x01356377
0x0135637a
0x0135637d
0x01356382
0x0135638d
0x01356393
0x01356393
0x0135639c
0x0135639f
0x00000000
0x013563a8
0x013563b0
0x013563da
0x013563da
0x013563dc
0x013563df
0x013563df
0x013563e2
0x013563e5
0x013563ef
0x013563f2
0x013563fa
0x013563fd
0x01356400
0x01356401
0x01356407
0x00000000
0x01356409
0x0135640c
0x0135640f
0x00000000
0x01356418
0x01356421
0x0135644e
0x0135644e
0x01356450
0x01356453
0x01356453
0x01356456
0x01356459
0x01356465
0x0135646b
0x0135646e
0x0135646f
0x01356475
0x00000000
0x01356477
0x0135647a
0x0135647d
0x00000000
0x01356486
0x0135648f
0x013564bc
0x013564bc
0x013564be
0x013564c1
0x013564c1
0x013564c4
0x013564c7
0x013564d3
0x013564d9
0x013564dc
0x013564dd
0x013564e3
0x00000000
0x013564e5
0x013564e8
0x013564eb
0x00000000
0x013564f4
0x013564fd
0x0135652a
0x0135652a
0x0135652c
0x0135652f
0x0135652f
0x01356532
0x01356535
0x01356541
0x01356547
0x0135654a
0x0135654b
0x01356551
0x00000000
0x01356553
0x01356556
0x01356559
0x00000000
0x01356562
0x0135656b
0x01356598
0x01356598
0x0135659a
0x0135659d
0x0135659d
0x013565a0
0x013565a3
0x013565af
0x013565b5
0x013565b8
0x013565b9
0x013565bf
0x00000000
0x013565c1
0x013565c4
0x013565c3
0x013565c3
0x013565cd
0x013565d0
0x01356601
0x01356604
0x0135660a
0x0135660d
0x0135660d
0x01356610
0x01356613
0x0135661f
0x01356625
0x01356624
0x01356624
0x0135662e
0x0135665f
0x01356662
0x01356668
0x0135666b
0x0135666b
0x0135666e
0x01356671
0x0135667d
0x01356683
0x01356682
0x01356682
0x0135668c
0x013566bd
0x013566c0
0x013566c6
0x013566c9
0x013566c9
0x013566cc
0x013566cf
0x013566db
0x013566e1
0x013566e0
0x013566e0
0x013566ea
0x01356717
0x0135671a
0x01356720
0x01356723
0x01356723
0x01356726
0x01356729
0x01356735
0x01356736
0x0135673c
0x01356742
0x0135674f
0x00000000
0x01356744
0x01356744
0x01356747
0x00000000
0x01356747
0x013566ec
0x013566f6
0x0135670b
0x01356710
0x01356715
0x00000000
0x00000000
0x00000000
0x00000000
0x01356715
0x0135668e
0x01356698
0x013566ad
0x013566b2
0x013566b7
0x00000000
0x00000000
0x00000000
0x00000000
0x013566b7
0x01356630
0x0135663a
0x0135664f
0x01356654
0x01356659
0x00000000
0x00000000
0x00000000
0x00000000
0x01356659
0x013565d2
0x013565dc
0x013565f1
0x013565f6
0x013565fb
0x00000000
0x00000000
0x00000000
0x00000000
0x013565fb
0x013565d0
0x0135656d
0x0135657a
0x01356588
0x0135658d
0x01356592
0x00000000
0x00000000
0x00000000
0x00000000
0x01356592
0x00000000
0x0135656b
0x01356561
0x00000000
0x01356561
0x013564ff
0x0135650c
0x0135651a
0x0135651f
0x01356524
0x00000000
0x00000000
0x00000000
0x00000000
0x01356524
0x00000000
0x013564fd
0x013564f3
0x00000000
0x013564f3
0x01356491
0x0135649e
0x013564ac
0x013564b1
0x013564b6
0x00000000
0x00000000
0x00000000
0x00000000
0x013564b6
0x00000000
0x0135648f
0x01356485
0x00000000
0x01356485
0x01356423
0x01356430
0x0135643e
0x01356443
0x01356448
0x00000000
0x00000000
0x00000000
0x00000000
0x01356448
0x00000000
0x01356421
0x01356417
0x00000000
0x01356417
0x013563b2
0x013563bc
0x013563ca
0x013563cf
0x013563d4
0x00000000
0x00000000
0x00000000
0x00000000
0x013563d4
0x00000000
0x013563b0
0x013563a7
0x00000000
0x01356336
0x0135633c
0x0135634f
0x01356354
0x01356359
0x00000000
0x00000000
0x00000000
0x00000000
0x01356359
0x013562ef
0x013562f5
0x01356308
0x0135630d
0x01356312
0x00000000
0x00000000
0x00000000
0x00000000
0x01356312
0x013562a8
0x013562ae
0x013562c1
0x013562c6
0x013562cb
0x00000000
0x00000000
0x00000000
0x00000000
0x013562cb
0x013560b1
0x013560b2
0x013560b7
0x013560bd
0x01356752
0x01356756
0x0135675b
0x0135675b
0x01356768
0x013560c3
0x013560c6
0x013560cb
0x013560ce
0x013560d1
0x013560d4
0x013560d7
0x00000000
0x013560d7
0x013560bd
0x00000000
0x013560af

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: be38b7a26d08611aa2ea31345a83c278132bfa6209997761a86c1b4acfd6cd2c
Instruction ID: d92fca53de1e142c90b96506615c6a8d12ca47ca264a50f65c50220d40bcb027
Opcode Fuzzy Hash: be38b7a26d08611aa2ea31345a83c278132bfa6209997761a86c1b4acfd6cd2c
Instruction Fuzzy Hash: B0329FB4A0021ADFCF55CF9CC992ABEBBB5EF44708F54416DDC41A7316D632AA06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0135E919 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcd8be4010e06d998486b969792c7cf2f378381761f71f92f722a5fdeb639491
Instruction ID: 1b1297be4dcdbd0ac28ac8fddbe0826c26638989ded23565898ad97d47139c05
Opcode Fuzzy Hash: bcd8be4010e06d998486b969792c7cf2f378381761f71f92f722a5fdeb639491
Instruction Fuzzy Hash: AD322622D29F014DE7739538C822336A69DAFB77C8F15D737EC19B599AEB29C5834200

Uniqueness

Uniqueness Score: -1.00%

Function 01362EC5 Relevance: .3, Instructions: 327
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E01362EC5(void* __ebx, void* __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v32;
				char _v36;
				char _v136;
				signed int _v140;
				intOrPtr* _v168;
				signed int _v180;
				char _v272;
				char _v420;
				signed int _v448;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t93;
				signed int _t97;
				void* _t99;
				intOrPtr _t111;
				void* _t113;
				signed int _t115;
				signed int _t119;
				intOrPtr _t127;
				intOrPtr _t137;
				signed int _t139;
				signed int _t140;
				signed int _t143;
				intOrPtr _t146;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr _t152;
				void* _t161;
				intOrPtr _t163;
				void* _t166;
				void* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				signed int _t172;
				void* _t173;
				void* _t175;
				intOrPtr* _t176;
				signed int _t196;
				intOrPtr* _t198;
				intOrPtr* _t209;
				signed int _t211;
				intOrPtr* _t212;
				intOrPtr* _t217;
				intOrPtr* _t220;
				void* _t221;
				intOrPtr* _t224;
				signed int _t227;
				intOrPtr* _t229;
				intOrPtr* _t231;
				intOrPtr* _t233;
				void* _t235;
				intOrPtr _t236;
				intOrPtr _t237;
				intOrPtr* _t238;
				intOrPtr* _t241;
				intOrPtr* _t242;
				signed int _t243;
				void* _t244;
				void* _t245;
				void* _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				void* _t251;
				signed int _t252;

				_t234 = __edx;
				_t171 = __ebx;
				_t93 =  *0x1383020; // 0xc9209188
				_v8 = _t93 ^ _t248;
				_t241 = _a4;
				_t245 = E0135AE3C(__ecx, __edx, _t244);
				asm("sbb ecx, ecx");
				_t97 = E0135CD1F(_t241, ( ~( *(_t245 + 0x64)) & 0xfffff005) + 0x1002,  &_v136, 0x40);
				if(_t97 != 0) {
					_push(__ebx);
					_t99 = E01350A02(_t241, _t245,  *((intOrPtr*)(_t245 + 0x54)),  &_v136);
					_t172 = 0;
					_v140 = 0;
					if(_t99 != 0) {
						L15:
						if(( *(_t245 + 0x58) & 0x00000300) == 0x300) {
							L47:
							_t105 =  !( *(_t245 + 0x58) >> 2) & 0x00000001;
							goto L48;
						} else {
							asm("sbb ecx, ecx");
							if(E0135CD1F(_t241, ( ~( *(_t245 + 0x60)) & 0xfffff002) + 0x1001,  &_v136, 0x40) != 0) {
								if(E01350A02(_t241, _t245,  *((intOrPtr*)(_t245 + 0x50)),  &_v136) != 0) {
									goto L47;
								} else {
									_t196 =  *(_t245 + 0x58) | 0x00000200;
									 *(_t245 + 0x58) = _t196;
									if( *(_t245 + 0x60) == _t172) {
										if( *((intOrPtr*)(_t245 + 0x5c)) == _t172) {
											L43:
											_t62 = _t245 + 0x2a0; // 0x2a0
											_t234 = _t62;
											 *(_t245 + 0x58) = _t196 | 0x00000100;
											if( *_t62 != _t172) {
												goto L47;
											} else {
												_t198 = _t241;
												_t173 = _t198 + 2;
												do {
													_t111 =  *_t198;
													_t198 = _t198 + 2;
												} while (_t111 != _v140);
												goto L46;
											}
										} else {
											_t238 =  *((intOrPtr*)(_t245 + 0x50));
											_t175 = _t238 + 2;
											do {
												_t146 =  *_t238;
												_t238 = _t238 + 2;
											} while (_t146 != _v140);
											_t240 = _t238 - _t175 >> 1;
											if(_t238 - _t175 >> 1 !=  *((intOrPtr*)(_t245 + 0x5c))) {
												_t172 = 0;
												goto L43;
											} else {
												if(E0136335A(_t175, _t196, _t240, _t241, _t241) != 0) {
													L38:
													 *(_t245 + 0x58) =  *(_t245 + 0x58) | 0x00000100;
													_t59 = _t245 + 0x2a0; // 0x2a0
													_t234 = _t59;
													if( *_t59 != 0) {
														goto L47;
													} else {
														_t220 = _t241;
														_t173 = _t220 + 2;
														do {
															_t149 =  *_t220;
															_t220 = _t220 + 2;
														} while (_t149 != _v140);
														goto L46;
													}
												} else {
													_t176 =  *((intOrPtr*)(_t245 + 0x50));
													_t234 = 0;
													_t221 = _t176 + 2;
													do {
														_t150 =  *_t176;
														_t176 = _t176 + 2;
													} while (_t150 != 0);
													if(E01362E91( *((intOrPtr*)(_t245 + 0x50))) == _t176 - _t221 >> 1) {
														goto L47;
													} else {
														goto L38;
													}
												}
											}
										}
									} else {
										_t45 = _t245 + 0x2a0; // 0x2a0
										_t234 = _t45;
										 *(_t245 + 0x58) = _t196 | 0x00000100;
										if( *_t45 != _t172) {
											goto L47;
										} else {
											_t224 = _t241;
											_t173 = _t224 + 2;
											do {
												_t152 =  *_t224;
												_t224 = _t224 + 2;
											} while (_t152 != _v140);
											L46:
											_t200 = _t198 - _t173 >> 1;
											_push((_t198 - _t173 >> 1) + 1);
											_t113 = E01361A01(_t198 - _t173 >> 1, _t234, 0x55, _t241);
											_t252 = _t251 + 0x10;
											if(_t113 != 0) {
												_t172 = 0;
												goto L51;
											} else {
												goto L47;
											}
										}
									}
								}
							} else {
								 *(_t245 + 0x58) = _t172;
								goto L18;
							}
						}
					} else {
						asm("sbb eax, eax");
						if(E0135CD1F(_t241, ( ~( *(_t245 + 0x60)) & 0xfffff002) + 0x1001,  &_v136, 0x40) != 0) {
							_t161 = E01350A02(_t241, _t245,  *((intOrPtr*)(_t245 + 0x50)),  &_v136);
							_t227 =  *(_t245 + 0x58);
							if(_t161 != 0) {
								if((_t227 & 0x00000002) != 0) {
									goto L15;
								} else {
									if( *((intOrPtr*)(_t245 + 0x5c)) == 0) {
										L19:
										if(( *(_t245 + 0x58) & 0x00000001) != 0 || E0136335A(_t172, _t227, _t234, _t241, _t241) == 0) {
											goto L15;
										} else {
											 *(_t245 + 0x58) =  *(_t245 + 0x58) | 0x00000001;
											_t229 = _t241;
											_t234 = _t229 + 2;
											do {
												_t163 =  *_t229;
												_t229 = _t229 + 2;
											} while (_t163 != _t172);
											goto L14;
										}
									} else {
										_t168 = E01350F1E(0, _t241, _t245,  *((intOrPtr*)(_t245 + 0x50)),  &_v136,  *((intOrPtr*)(_t245 + 0x5c)));
										_t251 = _t251 + 0xc;
										if(_t168 != 0) {
											goto L19;
										} else {
											 *(_t245 + 0x58) =  *(_t245 + 0x58) | 0x00000002;
											_t231 = _t241;
											_t234 = _t231 + 2;
											do {
												_t169 =  *_t231;
												_t231 = _t231 + 2;
											} while (_t169 != 0);
											goto L14;
										}
									}
								}
							} else {
								 *(_t245 + 0x58) = _t227 | 0x00000304;
								_t233 = _t241;
								_t234 = _t233 + 2;
								do {
									_t170 =  *_t233;
									_t233 = _t233 + 2;
								} while (_t170 != 0);
								L14:
								_t200 = _t229 - _t234 >> 1;
								_push((_t229 - _t234 >> 1) + 1);
								_t29 = _t245 + 0x2a0; // 0x2a0
								_t166 = E01361A01(_t229 - _t234 >> 1, _t29, 0x55, _t241);
								_t252 = _t251 + 0x10;
								if(_t166 != 0) {
									L51:
									_push(_t172);
									_push(_t172);
									_push(_t172);
									_push(_t172);
									_push(_t172);
									E0134C5DF();
									asm("int3");
									_push(_t248);
									_t249 = _t252;
									_t115 =  *0x1383020; // 0xc9209188
									_v180 = _t115 ^ _t249;
									_push(_t245);
									_push(_t241);
									_t242 = _v168;
									_t246 = E0135AE3C(_t200, _t234, _t245);
									asm("sbb ecx, ecx");
									_t119 = E0135CD1F(_t242, ( ~( *(_t246 + 0x60)) & 0xfffff002) + 0x1001,  &_v420, 0x78);
									if(_t119 != 0) {
										if(E01350A02(_t242, _t246,  *((intOrPtr*)(_t246 + 0x50)),  &_v272) != 0) {
											L58:
											_t125 =  !( *(_t246 + 0x58) >> 2) & 0x00000001;
											goto L59;
										} else {
											_t209 = _t242;
											_push(_t172);
											_t234 = _t209 + 2;
											do {
												_t127 =  *_t209;
												_t209 = _t209 + 2;
											} while (_t127 != 0);
											_t211 = _t209 - _t234 >> 1;
											_push(_t211 + 1);
											_t79 = _t246 + 0x2a0; // 0x2a0
											if(E01361A01(_t211, _t79, 0x55, _t242) != 0) {
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												_push(0);
												E0134C5DF();
												asm("int3");
												_push(_t249);
												_push(_t211);
												_push(_t246);
												_t247 = _v448;
												_push(_t242);
												if(_t247 == 0) {
													L87:
													_push(2);
													_push( &_v36);
													_push(0x20001004);
												} else {
													_t243 = 0;
													if( *_t247 == 0) {
														goto L87;
													} else {
														_t212 = L"ACP";
														_t139 = _t247;
														while(1) {
															_t235 =  *_t139;
															if(_t235 !=  *_t212) {
																break;
															}
															if(_t235 == 0) {
																L68:
																_t140 = _t243;
															} else {
																_t237 =  *((intOrPtr*)(_t139 + 2));
																if(_t237 !=  *((intOrPtr*)(_t212 + 2))) {
																	break;
																} else {
																	_t139 = _t139 + 4;
																	_t212 = _t212 + 4;
																	if(_t237 != 0) {
																		continue;
																	} else {
																		goto L68;
																	}
																}
															}
															L70:
															if(_t140 == 0) {
																goto L87;
															} else {
																if(E01350A02(_t243, _t247, _t247, L"utf8") == 0 || E01350A02(_t243, _t247, _t247, L"utf-8") == 0) {
																	L84:
																	return 0xfde9;
																}
																_t217 = L"OCP";
																_t143 = _t247;
																while(1) {
																	_t236 =  *_t143;
																	if(_t236 !=  *_t217) {
																		break;
																	}
																	if(_t236 != 0) {
																		_t236 =  *((intOrPtr*)(_t143 + 2));
																		if(_t236 !=  *((intOrPtr*)(_t217 + 2))) {
																			break;
																		} else {
																			_t143 = _t143 + 4;
																			_t217 = _t217 + 4;
																			if(_t236 != 0) {
																				continue;
																			} else {
																			}
																		}
																	}
																	L80:
																	if(_t243 != 0) {
																		return E01354579(_t236, _t247);
																	}
																	_push(2);
																	_push( &_v36);
																	_push(0x2000000b);
																	goto L82;
																}
																asm("sbb edi, edi");
																_t243 = _t243 | 0x00000001;
																goto L80;
															}
															goto L82;
														}
														asm("sbb eax, eax");
														_t140 = _t139 | 0x00000001;
														goto L70;
													}
												}
												L82:
												_push(_v20 + 0x250);
												if(E0135CD1F() == 0) {
													return 0;
												}
												_t137 = _v36;
												if(_t137 < 3) {
													goto L84;
												}
												return _t137;
											} else {
												 *(_t246 + 0x58) =  *(_t246 + 0x58) | 0x00000004;
												_pop(_t172);
												goto L58;
											}
										}
									} else {
										 *(_t246 + 0x58) =  *(_t246 + 0x58) & _t119;
										_t125 = _t119 + 1;
										L59:
										return E01347708(_t125, _t172, _v32 ^ _t249, _t234, _t242, _t246);
									}
								} else {
									goto L15;
								}
							}
						} else {
							 *(_t245 + 0x58) =  *(_t245 + 0x58) & 0;
							L18:
							_t105 = 1;
							L48:
							_pop(_t171);
							goto L49;
						}
					}
				} else {
					 *(_t245 + 0x58) =  *(_t245 + 0x58) & _t97;
					_t105 = _t97 + 1;
					L49:
					return E01347708(_t105, _t171, _v8 ^ _t248, _t234, _t241, _t245);
				}
			}

0x01362ec5
0x01362ec5
0x01362ed0
0x01362ed7
0x01362edc
0x01362ee4
0x01362ef4
0x01362f04
0x01362f0b
0x01362f16
0x01362f21
0x01362f26
0x01362f28
0x01362f32
0x01362ff5
0x01363001
0x0136317c
0x01363184
0x00000000
0x01363007
0x01363014
0x0136302c
0x01363076
0x00000000
0x0136307c
0x0136307f
0x01363085
0x0136308b
0x013630c1
0x0136313c
0x01363142
0x01363142
0x01363148
0x0136314e
0x00000000
0x01363150
0x01363150
0x01363152
0x01363155
0x01363155
0x01363158
0x0136315b
0x00000000
0x01363155
0x013630c3
0x013630c3
0x013630c6
0x013630c9
0x013630c9
0x013630cc
0x013630cf
0x013630da
0x013630df
0x0136313a
0x00000000
0x013630e1
0x013630ea
0x01363110
0x01363110
0x01363117
0x01363117
0x01363122
0x00000000
0x01363124
0x01363124
0x01363126
0x01363129
0x01363129
0x0136312c
0x0136312f
0x00000000
0x01363138
0x013630ec
0x013630ec
0x013630ef
0x013630f1
0x013630f4
0x013630f4
0x013630f7
0x013630fa
0x0136310e
0x00000000
0x00000000
0x00000000
0x00000000
0x0136310e
0x013630ea
0x013630df
0x0136308d
0x01363093
0x01363093
0x01363099
0x0136309f
0x00000000
0x013630a5
0x013630a5
0x013630a7
0x013630aa
0x013630aa
0x013630ad
0x013630b0
0x01363164
0x01363166
0x0136316b
0x01363170
0x01363175
0x0136317a
0x01363198
0x00000000
0x00000000
0x00000000
0x00000000
0x0136317a
0x0136309f
0x0136308b
0x0136302e
0x0136302e
0x00000000
0x0136302e
0x0136302c
0x01362f38
0x01362f46
0x01362f5b
0x01362f6f
0x01362f76
0x01362f7b
0x01362f9b
0x00000000
0x01362f9d
0x01362fa0
0x01363039
0x0136303d
0x00000000
0x0136304a
0x0136304a
0x0136304e
0x01363050
0x01363053
0x01363053
0x01363056
0x01363059
0x00000000
0x0136305e
0x01362fa6
0x01362fb3
0x01362fb8
0x01362fbd
0x00000000
0x01362fbf
0x01362fbf
0x01362fc3
0x01362fc5
0x01362fc8
0x01362fc8
0x01362fcb
0x01362fce
0x00000000
0x01362fc8
0x01362fbd
0x01362fa0
0x01362f7d
0x01362f83
0x01362f86
0x01362f88
0x01362f8b
0x01362f8b
0x01362f8e
0x01362f91
0x01362fd3
0x01362fd5
0x01362fda
0x01362fdc
0x01362fe5
0x01362fea
0x01362fef
0x0136319a
0x0136319a
0x0136319b
0x0136319c
0x0136319d
0x0136319e
0x0136319f
0x013631a4
0x013631a7
0x013631a8
0x013631b0
0x013631b7
0x013631ba
0x013631bb
0x013631bc
0x013631c4
0x013631d4
0x013631e4
0x013631eb
0x01363206
0x0136323e
0x01363246
0x00000000
0x01363208
0x01363208
0x0136320a
0x0136320d
0x01363210
0x01363210
0x01363213
0x01363216
0x0136321d
0x01363222
0x01363224
0x01363237
0x01363259
0x0136325a
0x0136325b
0x0136325c
0x0136325d
0x0136325e
0x01363263
0x01363266
0x01363269
0x0136326a
0x0136326b
0x0136326e
0x01363271
0x01363349
0x01363349
0x0136334e
0x0136334f
0x01363277
0x01363277
0x0136327c
0x00000000
0x01363282
0x01363282
0x01363287
0x01363289
0x01363289
0x0136328f
0x00000000
0x00000000
0x01363294
0x013632ab
0x013632ab
0x01363296
0x01363296
0x0136329e
0x00000000
0x013632a0
0x013632a0
0x013632a3
0x013632a9
0x00000000
0x00000000
0x00000000
0x00000000
0x013632a9
0x0136329e
0x013632b4
0x013632b6
0x00000000
0x013632bc
0x013632cb
0x01363337
0x00000000
0x01363337
0x013632de
0x013632e3
0x013632e5
0x013632e5
0x013632eb
0x00000000
0x00000000
0x013632f0
0x013632f2
0x013632fa
0x00000000
0x013632fc
0x013632fc
0x013632ff
0x01363305
0x00000000
0x00000000
0x01363307
0x01363305
0x013632fa
0x0136330e
0x01363310
0x00000000
0x01363346
0x01363312
0x01363317
0x01363318
0x00000000
0x01363318
0x01363309
0x0136330b
0x00000000
0x0136330b
0x00000000
0x013632b6
0x013632af
0x013632b1
0x00000000
0x013632b1
0x0136327c
0x0136331d
0x01363325
0x0136332d
0x00000000
0x01363356
0x0136332f
0x01363335
0x00000000
0x00000000
0x0136333f
0x01363239
0x01363239
0x0136323d
0x00000000
0x0136323d
0x01363237
0x013631ed
0x013631ed
0x013631f0
0x01363249
0x01363256
0x01363256
0x00000000
0x00000000
0x00000000
0x01362fef
0x01362f5d
0x01362f5d
0x01363031
0x01363033
0x01363187
0x01363187
0x00000000
0x01363187
0x01362f5b
0x01362f0d
0x01362f0d
0x01362f10
0x01363188
0x01363195
0x01363195

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: f9fd154a06456eb35bdef2704df4df099fdd95b965ec1ad99cada72fde84e98d
Instruction ID: 09c8f444cf387d70f96868c8827751771db13a6de41b287842c8398e2a63ee3e
Opcode Fuzzy Hash: f9fd154a06456eb35bdef2704df4df099fdd95b965ec1ad99cada72fde84e98d
Instruction Fuzzy Hash: B5B1F3755003469BDB29AB2CCC91AB7B3ECFF4430CF54852DDA4BC6688EA75E585C710

Uniqueness

Uniqueness Score: -1.00%

Function 013518EF Relevance: .2, Instructions: 158
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 25%

			E013518EF(signed char _a4, signed int _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed char _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v28;
				signed char _v32;
				intOrPtr _v36;
				void* _t85;
				intOrPtr _t106;
				intOrPtr _t109;
				signed char _t111;
				signed char _t113;
				intOrPtr _t119;
				signed int _t121;
				signed char _t127;
				signed int _t128;
				void* _t133;
				signed int* _t138;
				signed int _t139;
				signed int _t140;
				signed int _t141;
				intOrPtr _t142;
				signed int _t143;
				signed char _t144;
				signed int _t145;

				_t106 = _a20;
				_t139 = _a8;
				_t133 = ((0 |  *((intOrPtr*)(_t106 + 4)) == 0x00000000) - 0x00000001 & 0x0000001d) + 0x17;
				if(_t139 > 0x40) {
					_t140 = _t139 >> 5;
					_t113 = _t139 & 0x0000001f;
					_v32 = _t113;
					_t143 = _t140 - 2;
					_v16 = _t143 << 5;
					_t81 = _a4;
					_v28 =  *((intOrPtr*)(_t81 + 4 + _t143 * 4));
					_v12 =  *((intOrPtr*)(_t81 + _t140 * 4));
					_t109 = _a20;
					__eflags = _t113;
					if(_t113 != 0) {
						_t111 = 1;
						_v24 = (1 << _t113) - 1;
						_t85 = 0x40;
						_v20 = _t85 - _t113;
						_v36 = _v16 + _t113 + _t133;
						_v8 = E01368EC0(_v12, _v20 - 0x20, 0);
						_v12 = 0;
						_v8 = _v8 + E01368EC0( *(_a4 + 4 + _t140 * 4) & _v24, _v20, 0);
						asm("adc [ebp-0x8], edx");
						_t141 = _v28;
						_t81 = E01368EE0( !_v24 & _t141, _v32, 0);
						_t119 = _v8 + _t81;
						_v8 = _t119;
						asm("adc [ebp-0x8], edx");
						__eflags = _a16;
						if(_a16 != 0) {
							L15:
							_t111 = 0;
							__eflags = 0;
						} else {
							__eflags = _v24 & _t141;
							if((_v24 & _t141) != 0) {
								goto L15;
							}
						}
						_v16 = _t111;
						__eflags = _t143;
						if(_t143 != 0) {
							_t121 = _a4 + 4;
							__eflags = _t121;
							do {
								__eflags =  *_t121;
								_t121 = _t121 + 4;
								_t81 = (_t81 & 0xffffff00 | __eflags != 0x00000000) - 1;
								_t111 = _t111 & _t81;
								_v16 = _t111;
								_t143 = _t143 - 1;
								__eflags = _t143;
							} while (_t143 != 0);
							_t119 = _v8;
						}
						_push(_a20);
						_push(_v16);
						_push(_a12);
						_push(_v36);
						_push(_v12);
						_push(_t119);
					} else {
						_t142 = _v12;
						_v24 = _v16 + _t133;
						_v20 = 0 +  *((intOrPtr*)(_t81 + 4 + _t143 * 4));
						asm("adc edi, 0x0");
						_t127 = _a16 ^ 0x00000001;
						_v16 = _t127;
						__eflags = _t143;
						if(_t143 != 0) {
							_t138 = _t81 + 4;
							do {
								__eflags =  *_t138;
								_t138 =  &(_t138[1]);
								_t81 = (_t81 & 0xffffff00 | __eflags != 0x00000000) - 1;
								_t127 = _t127 & _t81;
								_t143 = _t143 - 1;
								__eflags = _t143;
							} while (_t143 != 0);
							_v16 = _t127;
						}
						_push(_t109);
						_push(_v16);
						_push(_a12);
						_push(_v24);
						_push(_t142);
						_push(_v20);
					}
				} else {
					_t144 = _a4;
					if( *_t144 <= 0) {
						_t128 = 0;
						__eflags = 0;
						goto L5;
					} else {
						_t128 =  *((intOrPtr*)(_t144 + 4));
						if( *_t144 <= 1) {
							L5:
							_t145 = 0;
							__eflags = 0;
						} else {
							_t145 =  *((intOrPtr*)(_t144 + 8));
						}
					}
					_push(_t106);
					_push((_a16 ^ 0x00000001) & 0x000000ff);
					_push(_a12);
					_t81 = 0 + _t128;
					_push(_t133);
					asm("adc esi, 0x0");
					_push(_t145);
					_push(0 + _t128);
				}
				return E0135159C(_t81);
			}

0x013518fa
0x013518ff
0x0135190c
0x01351912
0x0135194b
0x0135194e
0x01351951
0x01351954
0x0135195c
0x0135195f
0x01351966
0x0135196c
0x0135196f
0x01351972
0x01351974
0x013519c7
0x013519cd
0x013519d2
0x013519d5
0x013519e4
0x013519f5
0x013519fb
0x01351a0c
0x01351a12
0x01351a17
0x01351a21
0x01351a29
0x01351a2b
0x01351a2e
0x01351a31
0x01351a35
0x01351a3c
0x01351a3c
0x01351a3c
0x01351a37
0x01351a37
0x01351a3a
0x00000000
0x00000000
0x01351a3a
0x01351a3e
0x01351a41
0x01351a43
0x01351a48
0x01351a48
0x01351a4b
0x01351a4b
0x01351a4e
0x01351a54
0x01351a56
0x01351a58
0x01351a5b
0x01351a5b
0x01351a5b
0x01351a60
0x01351a60
0x01351a63
0x01351a69
0x01351a6c
0x01351a6f
0x01351a72
0x01351a73
0x01351976
0x01351979
0x0135197e
0x01351987
0x0135198d
0x01351990
0x01351993
0x01351996
0x01351998
0x0135199a
0x0135199d
0x0135199d
0x013519a0
0x013519a6
0x013519a8
0x013519aa
0x013519aa
0x013519aa
0x013519af
0x013519af
0x013519b2
0x013519b3
0x013519b6
0x013519b9
0x013519bc
0x013519bd
0x013519bd
0x01351914
0x01351914
0x0135191a
0x01351929
0x01351929
0x00000000
0x0135191c
0x0135191f
0x01351922
0x0135192b
0x0135192b
0x0135192b
0x01351924
0x01351924
0x01351924
0x01351922
0x01351932
0x01351936
0x01351937
0x0135193c
0x0135193e
0x0135193f
0x01351942
0x01351943
0x01351943
0x01351a80

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241b6fb9a289495fc9e6c92dd56fb41bf9160e20364eef422bda7a05c9cbced3
Instruction ID: d813a59957d07b4c99122d010f0ac750f4cefdd8ddf9f55b33d9d65299370357
Opcode Fuzzy Hash: 241b6fb9a289495fc9e6c92dd56fb41bf9160e20364eef422bda7a05c9cbced3
Instruction Fuzzy Hash: 69517172E00219AFDF45CF99C980BEEBBB6EF88304F198459D915AB201C7349E50CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01349730 Relevance: .1, Instructions: 76
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E01349730(signed int _a4, signed char _a8, intOrPtr _a12) {
				intOrPtr _t13;
				void* _t14;
				signed char _t20;
				signed char _t24;
				signed int _t27;
				signed char _t32;
				unsigned int _t33;
				signed char _t35;
				signed char _t37;
				signed int _t39;

				_t13 = _a12;
				if(_t13 == 0) {
					L11:
					return _t13;
				} else {
					_t39 = _a4;
					_t20 = _a8;
					if((_t39 & 0x00000003) == 0) {
						L5:
						_t14 = _t13 - 4;
						if(_t14 < 0) {
							L8:
							_t13 = _t14 + 4;
							if(_t13 == 0) {
								goto L11;
							} else {
								while(1) {
									_t24 =  *_t39;
									_t39 = _t39 + 1;
									if((_t24 ^ _t20) == 0) {
										goto L20;
									}
									_t13 = _t13 - 1;
									if(_t13 != 0) {
										continue;
									} else {
										goto L11;
									}
									goto L24;
								}
								goto L20;
							}
						} else {
							_t20 = ((_t20 << 8) + _t20 << 0x10) + (_t20 << 8) + _t20;
							do {
								_t27 =  *_t39 ^ _t20;
								_t39 = _t39 + 4;
								if(((_t27 ^ 0xffffffff ^ 0x7efefeff + _t27) & 0x81010100) == 0) {
									goto L12;
								} else {
									_t32 =  *(_t39 - 4) ^ _t20;
									if(_t32 == 0) {
										_t12 = _t39 - 4; // -12
										return _t12;
									} else {
										_t33 = _t32 ^ _t20;
										if(_t33 == 0) {
											_t11 = _t39 - 3; // -11
											return _t11;
										} else {
											_t35 = _t33 >> 0x00000010 ^ _t20;
											if(_t35 == 0) {
												_t10 = _t39 - 2; // -10
												return _t10;
											} else {
												if((_t35 ^ _t20) == 0) {
													goto L20;
												} else {
													goto L12;
												}
											}
										}
									}
								}
								goto L24;
								L12:
								_t14 = _t14 - 4;
							} while (_t14 >= 0);
							goto L8;
						}
					} else {
						while(1) {
							_t37 =  *_t39;
							_t39 = _t39 + 1;
							if((_t37 ^ _t20) == 0) {
								break;
							}
							_t13 = _t13 - 1;
							if(_t13 == 0) {
								goto L11;
							} else {
								if((_t39 & 0x00000003) != 0) {
									continue;
								} else {
									goto L5;
								}
							}
							goto L24;
						}
						L20:
						_t9 = _t39 - 1; // -9
						return _t9;
					}
				}
				L24:
			}

0x01349730
0x01349737
0x0134978c
0x0134978c
0x01349739
0x01349739
0x0134973f
0x01349749
0x01349761
0x01349761
0x01349764
0x01349778
0x01349778
0x0134977b
0x00000000
0x0134977d
0x0134977d
0x0134977d
0x0134977f
0x01349784
0x00000000
0x00000000
0x01349786
0x01349789
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01349789
0x00000000
0x0134977d
0x01349766
0x01349773
0x01349792
0x01349794
0x013497a2
0x013497ab
0x00000000
0x013497ad
0x013497b0
0x013497b2
0x013497d7
0x013497dc
0x013497b4
0x013497b4
0x013497b6
0x013497d1
0x013497d6
0x013497b8
0x013497bb
0x013497bd
0x013497cb
0x013497d0
0x013497bf
0x013497c1
0x00000000
0x013497c3
0x00000000
0x013497c3
0x013497c1
0x013497bd
0x013497b6
0x013497b2
0x00000000
0x0134978d
0x0134978d
0x0134978d
0x00000000
0x01349777
0x0134974b
0x0134974b
0x0134974b
0x0134974d
0x01349752
0x00000000
0x00000000
0x01349754
0x01349757
0x00000000
0x01349759
0x0134975f
0x00000000
0x00000000
0x00000000
0x00000000
0x0134975f
0x00000000
0x01349757
0x013497c6
0x013497c6
0x013497ca
0x013497ca
0x01349749
0x00000000

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 05166a12f722791d00447500e77358736f2f55dd6b8954565267bc6c0605d889
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: FB11CB7B20014247F614CE2DD8F8BB7AFD5EBCD22DB2D43B6D2424BA58D122B1459700

Uniqueness

Uniqueness Score: -1.00%

Function 0134ADD9 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71b6a6063a67aa86184ae30f4ffd283944199a75b410871177e3d1cbcf28fca
Instruction ID: 09ee0a229a8c22c771eb83d65b9cdbb502a85e5eb35544cc0ed3c88a34fa8587
Opcode Fuzzy Hash: c71b6a6063a67aa86184ae30f4ffd283944199a75b410871177e3d1cbcf28fca
Instruction Fuzzy Hash: 56112B714663827BDF45CB3C85601E7BBE0AA2B364B05305AE482CF142E52BB843FB40

Uniqueness

Uniqueness Score: -1.00%

Function 013603E8 Relevance: .0, Instructions: 22
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E013603E8(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E0135CAB9(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x013603f5
0x013603f7
0x013603fa
0x013603fd
0x01360400
0x01360411
0x01360413
0x01360402
0x01360406
0x0136040f
0x00000000
0x00000000
0x0136040f
0x01360418

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction ID: f365b89abc2262b48ebdeb31c88a6f358870a7d0d53a2284e1f4ecb09afa16c3
Opcode Fuzzy Hash: 2864318f6dce3f34aa64f3b9f5968b0c36cd4cfae0ffe164939727a64b01d4d1
Instruction Fuzzy Hash: 5FE08C32911238EBCB29DBDDC904D9AFBFCEB48A48B1144AAFA01E3110C270DE00CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0135843F Relevance: .0, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0135843F(void* __ecx, void* __eflags) {

				if(E013603E8(__ecx) == 1 || ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) != 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x01358447
0x01358460
0x0135845b
0x0135845d
0x0135845d

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dda80f92e8400fcc772db5e13d420266169146e784e576c0d4a49e31e5b18b9
Instruction ID: 7b38f70eaf3d581aede4a6ac1eb86e451499cfa2bf2576a8e530342e56b36b1d
Opcode Fuzzy Hash: 3dda80f92e8400fcc772db5e13d420266169146e784e576c0d4a49e31e5b18b9
Instruction Fuzzy Hash: 3FC08C74002A0087CF7A8A18C2B1BAD3758B391B8AF9049CDCD5A0BA46C91F9882D640

Uniqueness

Uniqueness Score: -1.00%

Function 01328790 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 349
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E01328790(short* __ecx, signed char __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t73;
				signed int _t74;
				WCHAR* _t78;
				signed char _t81;
				short* _t93;
				short* _t97;
				void* _t101;
				signed int* _t102;
				signed int _t104;
				signed int _t107;
				signed int _t110;
				short* _t115;
				signed char _t116;
				int _t117;
				signed char _t120;
				char* _t125;
				void* _t127;
				signed int _t128;
				void* _t129;
				void* _t130;
				void* _t131;
				void* _t132;
				int _t133;
				int _t134;
				void* _t140;
				signed int _t152;
				void* _t154;
				void* _t157;
				long _t161;
				void* _t162;
				signed char _t165;
				void* _t167;
				void* _t169;
				signed char _t173;
				short* _t175;
				signed char* _t176;
				signed char* _t177;
				void* _t179;
				signed int _t180;
				signed int _t181;
				void* _t182;
				void* _t184;
				void* _t185;
				signed int* _t186;
				signed int _t187;
				void* _t188;
				void* _t192;

				_t166 = __edx;
				_t187 = _t188 - 0x41c;
				_push(0xffffffff);
				_push(0x136a285);
				_push( *[fs:0x0]);
				_t73 =  *0x1383020; // 0xc9209188
				_t74 = _t73 ^ _t187;
				 *(_t187 + 0x418) = _t74;
				_push(_t127);
				_push(_t74);
				 *[fs:0x0] = _t187 - 0xc;
				_t184 = __edx;
				_t175 = __ecx;
				E01325880(_t127, _t187, __edx, __eflags, __fp0);
				_t192 = _t188 - 0x3fc + 8;
				 *(_t187 - 4) = 0;
				_t78 = E01329620(_t127, _t187, _t166, _t187 + 0x18);
				 *(_t187 - 4) = 1;
				if(_t78[0xa] >= 8) {
					_t78 =  *_t78;
				}
				_t128 = CreateFileW(_t78, 0x40000000, 0, 0, 2, 0x80, 0);
				 *(_t187 - 0x18) = _t128;
				 *(_t187 - 4) = 0;
				E01323CC0(_t187 + 0x18);
				if(_t128 != 0xffffffff) {
					 *(_t187 - 0x14) = 0;
					 *(_t187 - 0x10) = 0;
					 *(_t187 - 4) = 4;
					_t167 = 0;
					 *(_t187 - 0x10) = 0;
					 *(_t187 - 0x14) = 0;
					__eflags = _t175;
					if(_t175 != 0) {
						__eflags =  *_t175;
						if( *_t175 != 0) {
							_t134 = WideCharToMultiByte(0xfde9, 0, _t175, 0xffffffff, 0, 0, 0, 0);
							__eflags = _t134;
							if(_t134 <= 0) {
								_t167 = 0;
								__eflags = 0;
							} else {
								_t125 = LocalAlloc(0x40, _t134);
								 *(_t187 - 0x10) = _t125;
								 *(_t187 - 0x14) = _t134;
								WideCharToMultiByte(0xfde9, 0, _t175, 0xffffffff, _t125, _t134, 0, 0);
								_t167 =  *(_t187 - 0x10);
							}
						}
					}
					_t129 = _t167;
					_t176 = _t187 + 0x30;
					_t140 = "[InternetShortcut]\r\nURL=" - _t176;
					__eflags = _t140;
					_t81 = 0x5b;
					_t169 =  *(_t187 - 0x10);
					do {
						 *_t176 = _t81;
						_t176 =  &(_t176[1]);
						_t81 =  *((intOrPtr*)(_t140 + _t176));
						__eflags = _t81;
					} while (_t81 != 0);
					 *_t176 = _t81;
					_t166 =  *_t169;
					__eflags = _t166;
					if(_t166 == 0) {
						L26:
						 *_t176 = 0xa0d;
						_t177 =  &(_t176[2]);
						 *_t177 = 0;
						_t179 =  *(_t187 - 0x18);
						_t130 = WriteFile(_t179, _t187 + 0x30, _t177 - _t187 + 0x30, _t187 - 0x24, 0);
						 *(_t187 - 0x18) = _t130;
						CloseHandle(_t179);
						__eflags = _t184;
						if(_t184 == 0) {
							L45:
							_t180 = _t179 | 0xffffffff;
							__eflags = _t130;
							if(_t130 != 0) {
								_t93 = E01329620(_t130, _t187, _t166, _t187 + 0x18);
								 *(_t187 - 4) = 6;
								__eflags = _t93[0xa] - 8;
								if(_t93[0xa] >= 8) {
									_t93 =  *_t93;
								}
								_t132 = ShellExecuteW;
								_t180 = ShellExecuteW(0, L"open", _t93, 0, 0, 5);
								 *(_t187 - 4) = 4;
								E01323CC0(_t187 + 0x18);
								__eflags = _t184;
								if(__eflags != 0) {
									_t166 = L"open";
									_t101 = E01329020(_t180, L"open", __eflags, _t184);
									_t192 = _t192 + 4;
									_t184 = _t101;
								}
								__eflags = _t180 - 0x20;
								if(_t180 <= 0x20) {
									_t97 = E01329620(_t132, _t187, _t166, _t187 + 0x18);
									 *(_t187 - 4) = 7;
									__eflags = _t97[0xa] - 8;
									if(_t97[0xa] >= 8) {
										_t97 =  *_t97;
									}
									_t180 = ShellExecuteW(0, 0, _t97, 0, 0, 5);
									 *(_t187 - 4) = 4;
									E01323CC0(_t187 + 0x18);
									__eflags = _t184;
									if(_t184 != 0) {
										_t166 = 0;
										__eflags = 0;
										E01329020(_t180, 0, 0, _t184);
									}
								}
							}
							__eflags = _t180 - 0x20;
							_t181 =  >  ? 0 : _t180;
							 *(_t187 - 4) = 0;
							LocalFree( *(_t187 - 0x10));
							 *(_t187 - 0x10) = 0;
							 *(_t187 - 0x14) = 0;
							goto L56;
						}
						 *(_t187 - 0x20) = 0;
						 *(_t187 - 0x1c) = 0;
						 *(_t187 - 4) = 5;
						_t179 = 0;
						 *(_t187 - 0x1c) = 0;
						__eflags =  *(_t187 + 0x30);
						 *(_t187 - 0x20) = 0;
						if( *(_t187 + 0x30) != 0) {
							_t110 = MultiByteToWideChar(0xfde9, 0, _t187 + 0x30, 0xffffffff, 0, 0);
							_t133 = _t110;
							__eflags = _t133;
							if(__eflags > 0) {
								_t161 =  ~(0 | __eflags > 0x00000000) | _t110 * 0x00000002;
								__eflags = _t161;
								_t179 = LocalAlloc(0x40, _t161);
								 *(_t187 - 0x1c) = _t179;
								 *(_t187 - 0x20) = _t133;
								MultiByteToWideChar(0xfde9, 0, _t187 + 0x30, 0xffffffff, _t179, _t133);
							}
							_t130 =  *(_t187 - 0x18);
						}
						__eflags =  *_t184;
						_t102 = _t184;
						if( *_t184 == 0) {
							L33:
							_t186 = _t102;
							_t152 = 0x55;
							_t166 = L"URL Shortcut content:" - _t102;
							asm("o16 nop [eax+eax]");
							do {
								 *_t186 = _t152;
								_t186 =  &(_t186[0]);
								_t152 =  *(_t186 + _t166) & 0x0000ffff;
								__eflags = _t152;
							} while (_t152 != 0);
							 *_t186 = 0;
							__eflags = _t179;
							if(_t179 == 0) {
								L40:
								_t104 = 0xd;
								_t154 = L"\r\n" - _t186;
								__eflags = _t154;
								do {
									 *_t186 = _t104;
									_t186 =  &(_t186[0]);
									_t104 =  *(_t154 + _t186) & 0x0000ffff;
									__eflags = _t104;
								} while (_t104 != 0);
								 *_t186 = 0;
								 *(_t187 - 4) = 4;
								__eflags = _t179;
								if(_t179 != 0) {
									LocalFree(_t179);
								}
								 *(_t187 - 0x1c) = 0;
								 *(_t187 - 0x20) = 0;
								goto L45;
							}
							_t107 =  *_t179 & 0x0000ffff;
							__eflags = _t107;
							if(_t107 == 0) {
								L39:
								__eflags = 0;
								 *_t186 = 0;
								goto L40;
							}
							_t157 = _t179 - _t186;
							__eflags = _t157;
							do {
								 *_t186 = _t107;
								_t186 =  &(_t186[0]);
								_t107 =  *(_t157 + _t186) & 0x0000ffff;
								__eflags = _t107;
							} while (_t107 != 0);
							goto L39;
						} else {
							do {
								_t102 =  &(_t102[0]);
								__eflags =  *_t102;
							} while ( *_t102 != 0);
							goto L33;
						}
					} else {
						goto L12;
					}
					do {
						L12:
						_t129 = _t129 + 1;
						__eflags = _t166 - 0x61;
						if(_t166 < 0x61) {
							L14:
							__eflags = _t166 - 0x41;
							if(_t166 < 0x41) {
								L16:
								__eflags = _t166 - 0x30;
								if(_t166 < 0x30) {
									L18:
									_t115 = "-_.~!*\'();:@&=+$,/?#[]";
									_t162 = 0x2d;
									while(1) {
										__eflags = _t162 - _t166;
										if(_t162 == _t166) {
											break;
										}
										_t162 =  *((intOrPtr*)(_t115 + 1));
										_t115 = _t115 + 1;
										__eflags = _t162;
										if(_t162 != 0) {
											continue;
										}
										L23:
										 *_t176 = 0x25;
										_t173 = _t166 & 0x0000000f;
										_t165 = _t166 >> 0x00000004 & 0x0000000f;
										__eflags = _t165 - 0xa;
										asm("sbb al, al");
										_t120 = (_t116 & 0x000000f9) + 0x37 + _t165;
										__eflags = _t173 - 0xa;
										_t176[1] = _t120;
										asm("sbb al, al");
										_t176[2] = (_t120 & 0x000000f9) + 0x37 + _t173;
										_t117 = 3;
										goto L25;
									}
									_t116 = _t115 - "-_.~!*\'();:@&=+$,/?#[]";
									__eflags = _t116;
									if(_t116 >= 0) {
										L24:
										 *_t176 = _t166;
										_t117 = 1;
										goto L25;
									}
									goto L23;
								}
								__eflags = _t166 - 0x39;
								if(_t166 <= 0x39) {
									goto L24;
								}
								goto L18;
							}
							__eflags = _t166 - 0x5a;
							if(_t166 <= 0x5a) {
								goto L24;
							}
							goto L16;
						}
						__eflags = _t166 - 0x7a;
						if(_t166 <= 0x7a) {
							goto L24;
						}
						goto L14;
						L25:
						_t176 =  &(_t176[_t117]);
						 *_t176 = 0;
						_t166 =  *_t129;
						__eflags = _t166;
					} while (_t166 != 0);
					goto L26;
				} else {
					_t181 = _t175 | _t128;
					L56:
					 *(_t187 - 4) = 0xffffffff;
					E01323CC0(_t187);
					 *[fs:0x0] =  *((intOrPtr*)(_t187 - 0xc));
					_pop(_t182);
					_pop(_t185);
					_pop(_t131);
					return E01347708(_t181, _t131,  *(_t187 + 0x418) ^ _t187, _t166, _t182, _t185);
				}
			}

0x01328790
0x01328791
0x0132879e
0x013287a0
0x013287ab
0x013287af
0x013287b4
0x013287b6
0x013287bc
0x013287bf
0x013287c3
0x013287c9
0x013287cb
0x013287d3
0x013287d8
0x013287db
0x013287e9
0x013287ee
0x013287f6
0x013287f8
0x013287f8
0x01328813
0x01328815
0x01328818
0x0132881f
0x01328827
0x01328830
0x01328837
0x0132883e
0x01328842
0x01328844
0x01328847
0x0132884a
0x0132884c
0x0132884e
0x01328851
0x01328866
0x01328868
0x0132886a
0x01328896
0x01328896
0x0132886c
0x0132886f
0x01328880
0x01328888
0x0132888b
0x01328891
0x01328891
0x0132886a
0x01328851
0x01328898
0x0132889a
0x013288a4
0x013288a4
0x013288a6
0x013288a8
0x013288b0
0x013288b0
0x013288b2
0x013288b3
0x013288b6
0x013288b6
0x013288ba
0x013288bc
0x013288be
0x013288c0
0x0132894c
0x0132894c
0x01328954
0x01328959
0x01328963
0x01328971
0x01328974
0x01328977
0x0132897d
0x0132897f
0x01328a97
0x01328a97
0x01328a9a
0x01328a9c
0x01328aa9
0x01328aae
0x01328ab2
0x01328ab6
0x01328ab8
0x01328ab8
0x01328aba
0x01328ad0
0x01328ad2
0x01328ad9
0x01328ade
0x01328ae0
0x01328ae3
0x01328aea
0x01328aef
0x01328af2
0x01328af2
0x01328af4
0x01328af7
0x01328b00
0x01328b05
0x01328b09
0x01328b0d
0x01328b0f
0x01328b0f
0x01328b1e
0x01328b20
0x01328b27
0x01328b2c
0x01328b2e
0x01328b31
0x01328b31
0x01328b35
0x01328b3a
0x01328b2e
0x01328af7
0x01328b3f
0x01328b42
0x01328b45
0x01328b4b
0x01328b51
0x01328b58
0x00000000
0x01328b58
0x01328985
0x0132898c
0x01328993
0x01328997
0x01328999
0x0132899c
0x013289a0
0x013289a3
0x013289b3
0x013289b9
0x013289bb
0x013289bd
0x013289cd
0x013289cd
0x013289d9
0x013289e4
0x013289ec
0x013289ef
0x013289ef
0x013289f5
0x013289f5
0x013289f8
0x013289fc
0x013289fe
0x01328a09
0x01328a0e
0x01328a10
0x01328a15
0x01328a17
0x01328a20
0x01328a20
0x01328a23
0x01328a26
0x01328a2a
0x01328a2a
0x01328a31
0x01328a34
0x01328a36
0x01328a5a
0x01328a5f
0x01328a64
0x01328a64
0x01328a66
0x01328a66
0x01328a69
0x01328a6c
0x01328a70
0x01328a70
0x01328a77
0x01328a7a
0x01328a7e
0x01328a80
0x01328a83
0x01328a83
0x01328a89
0x01328a90
0x00000000
0x01328a90
0x01328a38
0x01328a3d
0x01328a40
0x01328a55
0x01328a55
0x01328a57
0x00000000
0x01328a57
0x01328a44
0x01328a44
0x01328a46
0x01328a46
0x01328a49
0x01328a4c
0x01328a50
0x01328a50
0x00000000
0x01328a00
0x01328a00
0x01328a00
0x01328a03
0x01328a03
0x00000000
0x01328a00
0x00000000
0x00000000
0x00000000
0x013288c6
0x013288c6
0x013288c6
0x013288c9
0x013288cc
0x013288d3
0x013288d3
0x013288d6
0x013288dd
0x013288dd
0x013288e0
0x013288e7
0x013288e7
0x013288ec
0x013288f0
0x013288f0
0x013288f2
0x00000000
0x00000000
0x013288f4
0x013288f7
0x013288f8
0x013288fa
0x00000000
0x00000000
0x01328905
0x01328907
0x0132890d
0x01328910
0x01328913
0x01328916
0x0132891c
0x0132891e
0x01328921
0x01328924
0x0132892c
0x0132892f
0x00000000
0x0132892f
0x013288fe
0x013288fe
0x01328903
0x01328936
0x01328936
0x01328938
0x00000000
0x01328938
0x00000000
0x01328903
0x013288e2
0x013288e5
0x00000000
0x00000000
0x00000000
0x013288e5
0x013288d8
0x013288db
0x00000000
0x00000000
0x00000000
0x013288db
0x013288ce
0x013288d1
0x00000000
0x00000000
0x00000000
0x0132893d
0x0132893d
0x0132893f
0x01328942
0x01328944
0x01328944
0x00000000
0x01328829
0x01328829
0x01328b5f
0x01328b5f
0x01328b69
0x01328b73
0x01328b7b
0x01328b7c
0x01328b7d
0x01328b92
0x01328b92

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 0132880D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 01328860
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 0132886F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0132888B
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 0132896B
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 01328977
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 013289B3
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 013289D2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 013289EF
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 01328A83
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 01328ACE
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 01328B1C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 01328B4B

Strings

open, xrefs: 01328AC7, 01328AE3
-_.~!*'();:@&=+$,/?#[], xrefs: 013288E7, 013288FE
[InternetShortcut]URL=, xrefs: 0132889F
URL Shortcut content:, xrefs: 01328A09

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: c04b6b6d296333b51925a94d9a374ec86e6199b422b971d8a992dc88cf996fc1
Instruction ID: 885fb9cde7ac867d99b01873668333bdd69943fd4a3836917e9dcb0b843a5e70
Opcode Fuzzy Hash: c04b6b6d296333b51925a94d9a374ec86e6199b422b971d8a992dc88cf996fc1
Instruction Fuzzy Hash: 2FC14671A002699FEB20EF6CCC45BAFBBF5EF54708F144169E6049B2C1EBB48945C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0132F010 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 254
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0132F010(void* __ebx, void* __edx) {
				intOrPtr _v4;
				signed int* _v8;
				signed int* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				long _v40;
				signed int _v44;
				char _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				short _v64;
				signed int _v68;
				short _v72;
				signed int _v76;
				char _v80;
				signed int _v84;
				signed int _v88;
				signed short _v92;
				signed short _v96;
				char _v100;
				signed int _v104;
				char _v108;
				signed short _v112;
				signed int _v116;
				signed short _v120;
				short _v124;
				signed short _v128;
				char _v132;
				signed short _v136;
				char _v140;
				signed short _v144;
				char _v148;
				signed short _v152;
				signed short* _v156;
				signed short _v160;
				char _v168;
				char _v176;
				char _v228;
				char _v276;
				signed int _v288;
				char _v308;
				long _v312;
				signed int _v384;
				char _v404;
				long _v408;
				intOrPtr _v496;
				signed short _v504;
				char _v512;
				signed int _v520;
				intOrPtr _v524;
				intOrPtr _v576;
				intOrPtr _v588;
				char _v636;
				signed short _v656;
				char _v664;
				signed int _v668;
				char _v672;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t306;
				signed int _t307;
				signed int _t314;
				intOrPtr _t331;
				signed int _t336;
				signed int _t339;
				signed int _t345;
				signed int _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t358;
				signed int _t363;
				signed int _t366;
				signed int _t372;
				signed int _t373;
				signed int _t374;
				signed int _t375;
				signed int _t376;
				signed int _t377;
				signed int _t386;
				signed int _t391;
				signed int _t392;
				void* _t396;
				signed int _t400;
				signed short _t401;
				signed int _t405;
				void* _t412;
				signed int _t414;
				signed int _t422;
				void* _t449;
				signed short _t453;
				void* _t472;
				signed int _t474;
				signed int _t477;
				void* _t480;
				signed short* _t482;
				signed int _t497;
				void* _t498;
				signed int _t499;
				intOrPtr _t502;
				void* _t507;
				void* _t508;
				intOrPtr _t510;
				void* _t511;
				signed int _t512;
				signed int _t514;
				signed int _t516;
				intOrPtr _t517;
				signed int _t518;
				signed int _t519;
				intOrPtr* _t520;
				void* _t522;
				void* _t524;
				signed short _t525;
				signed int _t527;
				signed int _t529;
				intOrPtr _t530;
				char _t531;
				void* _t533;
				signed short _t534;
				signed int _t537;
				signed int _t539;
				signed int _t541;
				signed int _t544;
				void* _t548;
				signed int _t551;
				signed int _t552;
				void* _t555;
				signed int _t557;
				void* _t559;
				void* _t561;
				void* _t563;
				signed int _t567;
				void* _t570;
				signed int _t571;
				void* _t572;
				void* _t581;

				_t507 = __edx;
				_push(__ebx);
				_t472 = _t548;
				_t551 = (_t548 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t472 + 4));
				_t537 = _t551;
				_push(0xffffffff);
				_push(0x136b100);
				_push( *[fs:0x0]);
				_push(_t472);
				_t552 = _t551 - 0xf8;
				_t306 =  *0x1383020; // 0xc9209188
				_t307 = _t306 ^ _t537;
				_v32 = _t307;
				_push(_t307);
				 *[fs:0x0] =  &_v24;
				_t484 =  *((intOrPtr*)(_t472 + 8));
				_t510 =  *((intOrPtr*)(_t472 + 0xc));
				_v156 = _t484;
				_v88 = 0;
				if(_t484 == 0 ||  *_t484 != 0) {
					L25:
					 *[fs:0x0] = _v24;
					_pop(_t511);
					_pop(_t524);
					return E01347708(4, _t472, _v32 ^ _t537, _t507, _t511, _t524);
				} else {
					_t525 = LocalAlloc(0x40, 0x18);
					_v160 = _t525;
					_v16 = 0;
					if(_t525 == 0) {
						_t525 = 0;
						__eflags = 0;
						goto L11;
					} else {
						_t331 =  *((intOrPtr*)(_t510 + 4));
						if(_t331 == 0) {
							_t512 = 0x137b6c9;
						} else {
							_t512 =  *(_t331 + 0x18);
							if(_t512 == 0) {
								_t512 = _t331 + 0x1c;
							}
						}
						_t484 =  &_v148;
						E01335EA5( &_v148, 0);
						_v16 = 1;
						_v144 = 0;
						_v140 = 0;
						_v16 = 2;
						_v136 = 0;
						_v132 = 0;
						_v16 = 3;
						_v128 = 0;
						_v124 = 0;
						_v16 = 4;
						_v120 = 0;
						_v116 = 0;
						_v16 = 5;
						_v112 = 0;
						_v108 = 0;
						_v16 = 6;
						_v104 = 0;
						_v100 = 0;
						_v16 = 7;
						_t592 = _t512;
						if(_t512 == 0) {
							L27:
							E013320D0("bad locale name");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t537);
							_t539 = _t552;
							_push(0xffffffff);
							_push(0x136b1dd);
							_push( *[fs:0x0]);
							_t557 = _t552 - 0x3c;
							_push(_t472);
							_push(_t525);
							_push(_t512);
							_t336 =  *0x1383020; // 0xc9209188
							_push(_t336 ^ _t539);
							 *[fs:0x0] =  &_v308;
							_t339 = _v288;
							_t474 = 0;
							_v312 = 0;
							__eflags = _t339;
							if(_t339 == 0) {
								L52:
								 *[fs:0x0] = _v28;
								return 4;
							} else {
								__eflags =  *_t339;
								if( *_t339 != 0) {
									goto L52;
								} else {
									_t527 = LocalAlloc(0x40, 8);
									_v36 = _t527;
									_v20 = 0;
									__eflags = _t527;
									if(_t527 == 0) {
										_t527 = 0;
										__eflags = 0;
										goto L38;
									} else {
										_t358 =  *(_v4 + 4);
										__eflags = _t358;
										if(_t358 == 0) {
											_t514 = 0x137b6c9;
										} else {
											_t514 =  *(_t358 + 0x18);
											__eflags = _t514;
											if(_t514 == 0) {
												_t514 = _t358 + 0x1c;
											}
										}
										_t484 =  &_v88;
										E01335EA5( &_v88, 0);
										_v20 = 1;
										_v84 = 0;
										_v80 = 0;
										_v20 = 2;
										_v76 = 0;
										_v72 = 0;
										_v20 = 3;
										_v68 = 0;
										_v64 = 0;
										_v20 = 4;
										_v60 = 0;
										_v56 = 0;
										_v20 = 5;
										_v52 = 0;
										_v48 = 0;
										_v20 = 6;
										_v44 = 0;
										_v40 = 0;
										_v20 = 7;
										__eflags = _t514;
										if(_t514 == 0) {
											E013320D0("bad locale name");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t539);
											_t541 = _t557;
											_push(0xffffffff);
											_push(0x136b2d1);
											_push( *[fs:0x0]);
											_t561 = _t557 - 0x40;
											_push(_t474);
											_push(_t527);
											_push(_t514);
											_t363 =  *0x1383020; // 0xc9209188
											_push(_t363 ^ _t541);
											 *[fs:0x0] =  &_v404;
											_t366 = _v384;
											_t477 = 0;
											_v408 = 0;
											__eflags = _t366;
											if(_t366 == 0) {
												L80:
												 *[fs:0x0] = _v32;
												return 5;
											} else {
												__eflags =  *_t366;
												if( *_t366 != 0) {
													goto L80;
												} else {
													_t516 = LocalAlloc(0x40, 0xc);
													_v44 = _t516;
													_v24 = 0;
													__eflags = _t516;
													if(_t516 == 0) {
														_t516 = 0;
														__eflags = 0;
														goto L66;
													} else {
														_t386 = _v8[1];
														__eflags = _t386;
														if(_t386 == 0) {
															_t529 = 0x137b6c9;
														} else {
															_t529 =  *(_t386 + 0x18);
															__eflags = _t529;
															if(_t529 == 0) {
																_t529 = _t386 + 0x1c;
															}
														}
														_t484 =  &_v96;
														E01335EA5(_t484, 0);
														_v24 = 1;
														_v92 = 0;
														_v88 = 0;
														_v24 = 2;
														_v84 = 0;
														_v80 = 0;
														_v24 = 3;
														_v76 = 0;
														_v72 = 0;
														_v24 = 4;
														_v68 = 0;
														_v64 = 0;
														_v24 = 5;
														_v60 = 0;
														_v56 = 0;
														_v24 = 6;
														_v52 = 0;
														_v48 = 0;
														_v24 = 7;
														__eflags = _t529;
														if(__eflags == 0) {
															E013320D0("bad locale name");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															_push(_t477);
															_t480 = _t561;
															_t567 = (_t561 - 0x00000008 & 0xfffffff8) + 4;
															_push(_t541);
															_v496 =  *((intOrPtr*)(_t480 + 4));
															_t544 = _t567;
															_push(0xffffffff);
															_push(0x136b2fd);
															_push( *[fs:0x0]);
															_push(_t480);
															_t391 =  *0x1383020; // 0xc9209188
															_t392 = _t391 ^ _t544;
															_v520 = _t392;
															_push(_t529);
															_push(_t516);
															_push(_t392);
															 *[fs:0x0] =  &_v512;
															_t530 = _t484;
															_t517 = E01356A36(_t507, _t530);
															_v576 = _t517;
															_t396 = E01336203(__eflags,  &_v636);
															_v588 = _t530;
															asm("movups xmm0, [eax]");
															asm("movups [ebp-0x40], xmm0");
															asm("movups xmm0, [eax+0x10]");
															asm("movups [ebp-0x30], xmm0");
															asm("movq xmm0, [eax+0x20]");
															asm("movq [ebp-0x20], xmm0");
															_v524 =  *((intOrPtr*)(_t396 + 0x28));
															 *(_t530 + 8) = 0;
															 *(_t530 + 0x10) = 0;
															 *(_t530 + 0x14) = 0;
															_v504 = 0;
															E01336203(__eflags,  &_v636);
															_t570 = _t567 - 0x78 + 8;
															__eflags =  *((char*)(_t480 + 0xc));
															if( *((char*)(_t480 + 0xc)) == 0) {
																_t518 =  *(_t517 + 8);
															} else {
																_t518 = 0x137b6c9;
															}
															_t497 = _t518;
															_t258 = _t497 + 1; // 0x137b6ca
															_t508 = _t258;
															do {
																_t400 =  *_t497;
																_t497 = _t497 + 1;
																__eflags = _t400;
															} while (_t400 != 0);
															_t498 = _t497 - _t508;
															_push(1);
															_t259 = _t498 + 1; // 0x137b6cb
															_t401 = _t259;
															_push(_t401);
															_v104 = _t401;
															_t499 = E01356A5E();
															_t571 = _t570 + 8;
															_v116 = _t499;
															__eflags = _t499;
															if(__eflags == 0) {
																E01332056(__eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t544);
																_push(0xffffffff);
																_push(0x136b34e);
																_push( *[fs:0x0]);
																_t572 = _t571 - 8;
																_push(_t530);
																_push(_t518);
																_t405 =  *0x1383020; // 0xc9209188
																_push(_t405 ^ _t571);
																 *[fs:0x0] =  &_v664;
																_t519 = _t499;
																_v668 = 0;
																_v656 = 0;
																_t531 = E01356078(_t480, _t519, _t530);
																_t520 = _t519 + 8;
																_v672 = _t531;
																_v668 = 1;
																__eflags = _t520 -  &_v672;
																if(_t520 !=  &_v672) {
																	E0134C213( *_t520);
																	_t572 = _t572 + 4;
																	 *_t520 = _t531;
																	_t531 = 0;
																	__eflags = 0;
																	_v56 = 0;
																}
																_v52 = 1;
																__eflags = 1;
																_v52 = 0;
																_v40 = 0xffffffff;
																_t412 = E0134C213(_t531);
																 *[fs:0x0] = _v48;
																return _t412;
															} else {
																_t414 = _v104;
																__eflags = _t414;
																if(_t414 != 0) {
																	E01348FF0(_t499, _t518, _t414);
																	_t499 = _v116;
																	_t571 = _t571 + 0xc;
																}
																 *(_t530 + 8) = _t499;
																_push( &_v96);
																 *(_t530 + 0x10) = E0132FBD0("false", 0);
																_push( &_v96);
																 *(_t530 + 0x14) = E0132FBD0("true", 0);
																__eflags =  *((char*)(_t480 + 0xc));
																_v120 = 0;
																if( *((char*)(_t480 + 0xc)) == 0) {
																	_t502 = _v108;
																	 *((short*)(_t530 + 0xc)) =  *( *(_t502 + 0x30)) & 0x0000ffff;
																	_t422 =  *( *(_t502 + 0x34)) & 0x0000ffff;
																} else {
																	_v100 = 0x2e;
																	_v104 = 0;
																	asm("xorps xmm0, xmm0");
																	asm("movlpd [ebp-0x50], xmm0");
																	E013362D2(_t499,  &_v104,  &_v100, 1,  &_v112,  &_v96);
																	 *((short*)(_t530 + 0xc)) = _v104 & 0x0000ffff;
																	asm("xorps xmm0, xmm0");
																	_v100 = 0x2c;
																	_v104 = 0;
																	asm("movlpd [ebp-0x50], xmm0");
																	E013362D2(_t499,  &_v104,  &_v100, 1,  &_v112,  &_v96);
																	_t422 = _v104 & 0x0000ffff;
																}
																 *(_t530 + 0xe) = _t422;
																_v36 = 0xffffffff;
																 *[fs:0x0] = _v44;
																_pop(_t522);
																_pop(_t533);
																__eflags = _v52 ^ _t544;
																return E01347708(_t422, _t480, _v52 ^ _t544, _t508, _t522, _t533);
															}
														} else {
															E01335D63(_t484,  &_v96, _t529);
															_t581 = _t561 + 8;
															_v24 = 8;
															_v36 = 1;
															 *_t516 = 0x136e0d8;
															_v24 = 9;
															 *_t516 = 0x136e0e8;
															 *(_t516 + 4) = 0;
															_v24 = 0xa;
															_t203 = _t516 + 8; // 0x8
															_t482 = _t203;
															 *_t516 = 0x136e620;
															 *_t482 = 0;
															_v24 = 0xc;
															_t534 = E01356078(_t482, _t516, _t529);
															_v40 = _t534;
															_v36 = 3;
															__eflags = _t482 -  &_v40;
															if(_t482 !=  &_v40) {
																E0134C213( *_t482);
																_t581 = _t581 + 4;
																 *_t482 = _t534;
																_t534 = 0;
																__eflags = 0;
																_v40 = 0;
															}
															_v36 = 3;
															_t477 = 1;
															_v36 = 3;
															_v24 = 0xb;
															E0134C213(_t534);
															_t561 = _t581 + 4;
															_v24 = 8;
															L66:
															_v24 = 0xd;
															 *_v12 = _t516;
															_v24 = 0xffffffff;
															__eflags = _t477 & 0x00000001;
															if((_t477 & 0x00000001) != 0) {
																_v36 = _t477 & 0xfffffffe;
																_v24 = 0x14;
																E01335DAE(_t484,  &_v96);
																_t563 = _t561 + 4;
																_v24 = 0x13;
																_t372 = _v52;
																__eflags = _t372;
																if(_t372 != 0) {
																	E0134C213(_t372);
																	_t563 = _t563 + 4;
																}
																_v52 = 0;
																_v24 = 0x12;
																_t373 = _v60;
																__eflags = _t373;
																if(_t373 != 0) {
																	E0134C213(_t373);
																	_t563 = _t563 + 4;
																}
																_v60 = 0;
																_v24 = 0x11;
																_t374 = _v68;
																__eflags = _t374;
																if(_t374 != 0) {
																	E0134C213(_t374);
																	_t563 = _t563 + 4;
																}
																_v68 = 0;
																_v24 = 0x10;
																_t375 = _v76;
																__eflags = _t375;
																if(_t375 != 0) {
																	E0134C213(_t375);
																	_t563 = _t563 + 4;
																}
																_v76 = 0;
																_v24 = 0xf;
																_t376 = _v84;
																__eflags = _t376;
																if(_t376 != 0) {
																	E0134C213(_t376);
																	_t563 = _t563 + 4;
																}
																_v84 = 0;
																_v24 = 0xe;
																_t377 = _v92;
																__eflags = _t377;
																if(_t377 != 0) {
																	E0134C213(_t377);
																}
																_v92 = 0;
																_v24 = 0xffffffff;
																E01335EFD( &_v96);
															}
															goto L80;
														}
													}
												}
											}
										} else {
											E01335D63( &_v88,  &_v88, _t514);
											_t557 = _t557 + 8;
											_v20 = 8;
											_t474 = 1;
											_v32 = 1;
											 *_t527 = 0x136e0d8;
											_v20 = 9;
											 *_t527 = 0x136e0e8;
											 *(_t527 + 4) = 0;
											_v20 = 0xa;
											 *_t527 = 0x136e670;
											_v20 = 8;
											L38:
											_v20 = 0xb;
											 *_v8 = _t527;
											_v20 = 0xffffffff;
											__eflags = _t474 & 0x00000001;
											if((_t474 & 0x00000001) != 0) {
												_v32 = _t474 & 0xfffffffe;
												_v20 = 0x12;
												E01335DAE(_t484,  &_v88);
												_t559 = _t557 + 4;
												_v20 = 0x11;
												_t345 = _v44;
												__eflags = _t345;
												if(_t345 != 0) {
													E0134C213(_t345);
													_t559 = _t559 + 4;
												}
												_v44 = 0;
												_v20 = 0x10;
												_t346 = _v52;
												__eflags = _t346;
												if(_t346 != 0) {
													E0134C213(_t346);
													_t559 = _t559 + 4;
												}
												_v52 = 0;
												_v20 = 0xf;
												_t347 = _v60;
												__eflags = _t347;
												if(_t347 != 0) {
													E0134C213(_t347);
													_t559 = _t559 + 4;
												}
												_v60 = 0;
												_v20 = 0xe;
												_t348 = _v68;
												__eflags = _t348;
												if(_t348 != 0) {
													E0134C213(_t348);
													_t559 = _t559 + 4;
												}
												_v68 = 0;
												_v20 = 0xd;
												_t349 = _v76;
												__eflags = _t349;
												if(_t349 != 0) {
													E0134C213(_t349);
													_t559 = _t559 + 4;
												}
												_v76 = 0;
												_v20 = 0xc;
												_t350 = _v84;
												__eflags = _t350;
												if(_t350 != 0) {
													E0134C213(_t350);
												}
												_v84 = 0;
												_v20 = 0xffffffff;
												E01335EFD( &_v88);
											}
											goto L52;
										}
									}
								}
							}
						} else {
							E01335D63( &_v148,  &_v148, _t512);
							_v16 = 8;
							_v88 = 1;
							 *_t525 = 0x136e0d8;
							_v16 = 9;
							 *_t525 = 0x136e0e8;
							 *(_t525 + 4) = 0;
							_v16 = 0xa;
							 *_t525 = 0x136e6a0;
							E01356A36(_t507, _t525);
							_t449 = E01336203(_t592,  &_v228);
							_v152 = _t525;
							asm("movups xmm0, [eax]");
							asm("movups [ebp-0x40], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [ebp-0x30], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [ebp-0x20], xmm0");
							_v36 =  *(_t449 + 0x28);
							 *(_t525 + 8) = 0;
							 *(_t525 + 0x10) = 0;
							 *(_t525 + 0x14) = 0;
							_v16 = 0xb;
							E01336203(_t592,  &_v276);
							_push(1);
							_push(1);
							_t453 = E01356A5E();
							_t552 = _t552 + 0x18;
							if(_t453 == 0) {
								E01332056(__eflags);
								goto L27;
							} else {
								 *_t453 = 0;
								 *(_t525 + 8) = _t453;
								_push( &_v76);
								 *(_t525 + 0x10) = E0132FBD0("false", 0);
								_push( &_v76);
								 *(_t525 + 0x14) = E0132FBD0("true", 0);
								_v152 = 0;
								asm("xorps xmm0, xmm0");
								_v80 = 0x2e;
								_v92 = 0;
								asm("movlpd [ebp-0x9c], xmm0");
								E013362D2( &_v148,  &_v92,  &_v80, 1,  &_v168,  &_v76);
								 *((short*)(_t525 + 0xc)) = _v92 & 0x0000ffff;
								asm("xorps xmm0, xmm0");
								_v84 = 0x2c;
								_v96 = 0;
								asm("movlpd [ebp-0xa4], xmm0");
								E013362D2(_t484,  &_v96,  &_v84, 1,  &_v176,  &_v76);
								_t552 = _t552 + 0x40;
								 *((short*)(_t525 + 0xe)) = _v96 & 0x0000ffff;
								_v16 = 8;
								L11:
								_v16 = 0xc;
								 *_v156 = _t525;
								_v16 = 0xffffffff;
								_t314 = _v88;
								if((_t314 & 0x00000001) != 0) {
									_v88 = _t314 & 0xfffffffe;
									_v16 = 0x13;
									E01335DAE(_t484,  &_v148);
									_t555 = _t552 + 4;
									_v16 = 0x12;
									_t318 = _v104;
									if(_v104 != 0) {
										E0134C213(_t318);
										_t555 = _t555 + 4;
									}
									_v104 = 0;
									_v16 = 0x11;
									_t319 = _v112;
									if(_v112 != 0) {
										E0134C213(_t319);
										_t555 = _t555 + 4;
									}
									_v112 = 0;
									_v16 = 0x10;
									_t320 = _v120;
									if(_v120 != 0) {
										E0134C213(_t320);
										_t555 = _t555 + 4;
									}
									_v120 = 0;
									_v16 = 0xf;
									_t321 = _v128;
									if(_v128 != 0) {
										E0134C213(_t321);
										_t555 = _t555 + 4;
									}
									_v128 = 0;
									_v16 = 0xe;
									_t322 = _v136;
									if(_v136 != 0) {
										E0134C213(_t322);
										_t555 = _t555 + 4;
									}
									_v136 = 0;
									_v16 = 0xd;
									_t323 = _v144;
									if(_v144 != 0) {
										E0134C213(_t323);
									}
									_v144 = 0;
									_v16 = 0xffffffff;
									E01335EFD( &_v148);
								}
								goto L25;
							}
						}
					}
				}
			}

0x0132f010
0x0132f010
0x0132f011
0x0132f019
0x0132f020
0x0132f024
0x0132f026
0x0132f028
0x0132f033
0x0132f034
0x0132f035
0x0132f03b
0x0132f040
0x0132f042
0x0132f047
0x0132f04b
0x0132f051
0x0132f056
0x0132f059
0x0132f05f
0x0132f064
0x0132f37b
0x0132f383
0x0132f38b
0x0132f38c
0x0132f39d
0x0132f072
0x0132f07c
0x0132f07e
0x0132f084
0x0132f08d
0x0132f282
0x0132f282
0x00000000
0x0132f093
0x0132f093
0x0132f098
0x0132f0a6
0x0132f09a
0x0132f09a
0x0132f09f
0x0132f0a1
0x0132f0a1
0x0132f09f
0x0132f0ad
0x0132f0b3
0x0132f0b8
0x0132f0bc
0x0132f0c6
0x0132f0ca
0x0132f0ce
0x0132f0d5
0x0132f0d9
0x0132f0df
0x0132f0e6
0x0132f0ea
0x0132f0ee
0x0132f0f1
0x0132f0f5
0x0132f0f9
0x0132f0fc
0x0132f0ff
0x0132f103
0x0132f106
0x0132f109
0x0132f10d
0x0132f10f
0x0132f3a3
0x0132f3a8
0x0132f3ad
0x0132f3ae
0x0132f3af
0x0132f3b0
0x0132f3b1
0x0132f3b3
0x0132f3b5
0x0132f3c0
0x0132f3c1
0x0132f3c4
0x0132f3c5
0x0132f3c6
0x0132f3c7
0x0132f3ce
0x0132f3d2
0x0132f3d8
0x0132f3db
0x0132f3dd
0x0132f3e0
0x0132f3e2
0x0132f5b7
0x0132f5bf
0x0132f5cd
0x0132f3e8
0x0132f3e8
0x0132f3ea
0x00000000
0x0132f3f0
0x0132f3fa
0x0132f3fc
0x0132f3ff
0x0132f402
0x0132f404
0x0132f4cf
0x0132f4cf
0x00000000
0x0132f40a
0x0132f40d
0x0132f410
0x0132f412
0x0132f420
0x0132f414
0x0132f414
0x0132f417
0x0132f419
0x0132f41b
0x0132f41b
0x0132f419
0x0132f427
0x0132f42a
0x0132f42f
0x0132f433
0x0132f43a
0x0132f43e
0x0132f442
0x0132f449
0x0132f44d
0x0132f453
0x0132f45a
0x0132f45e
0x0132f462
0x0132f465
0x0132f469
0x0132f46d
0x0132f470
0x0132f473
0x0132f477
0x0132f47a
0x0132f47d
0x0132f481
0x0132f483
0x0132f5d3
0x0132f5d8
0x0132f5d9
0x0132f5da
0x0132f5db
0x0132f5dc
0x0132f5dd
0x0132f5de
0x0132f5df
0x0132f5e0
0x0132f5e1
0x0132f5e3
0x0132f5e5
0x0132f5f0
0x0132f5f1
0x0132f5f4
0x0132f5f5
0x0132f5f6
0x0132f5f7
0x0132f5fe
0x0132f602
0x0132f608
0x0132f60b
0x0132f60d
0x0132f610
0x0132f612
0x0132f837
0x0132f83f
0x0132f84d
0x0132f618
0x0132f618
0x0132f61a
0x00000000
0x0132f620
0x0132f62a
0x0132f62c
0x0132f62f
0x0132f632
0x0132f634
0x0132f74f
0x0132f74f
0x00000000
0x0132f63a
0x0132f63d
0x0132f640
0x0132f642
0x0132f650
0x0132f644
0x0132f644
0x0132f647
0x0132f649
0x0132f64b
0x0132f64b
0x0132f649
0x0132f657
0x0132f65a
0x0132f65f
0x0132f663
0x0132f66a
0x0132f66e
0x0132f672
0x0132f679
0x0132f67d
0x0132f683
0x0132f68a
0x0132f68e
0x0132f692
0x0132f695
0x0132f699
0x0132f69d
0x0132f6a0
0x0132f6a3
0x0132f6a7
0x0132f6aa
0x0132f6ad
0x0132f6b1
0x0132f6b3
0x0132f853
0x0132f858
0x0132f859
0x0132f85a
0x0132f85b
0x0132f85c
0x0132f85d
0x0132f85e
0x0132f85f
0x0132f860
0x0132f861
0x0132f869
0x0132f86c
0x0132f870
0x0132f874
0x0132f876
0x0132f878
0x0132f883
0x0132f884
0x0132f888
0x0132f88d
0x0132f88f
0x0132f892
0x0132f893
0x0132f894
0x0132f898
0x0132f89e
0x0132f8a5
0x0132f8ae
0x0132f8b1
0x0132f8b9
0x0132f8bc
0x0132f8bf
0x0132f8c3
0x0132f8c7
0x0132f8cb
0x0132f8d0
0x0132f8d8
0x0132f8db
0x0132f8e2
0x0132f8e9
0x0132f8f0
0x0132f8fe
0x0132f903
0x0132f906
0x0132f90a
0x0132f913
0x0132f90c
0x0132f90c
0x0132f90c
0x0132f916
0x0132f918
0x0132f918
0x0132f920
0x0132f920
0x0132f922
0x0132f923
0x0132f923
0x0132f927
0x0132f929
0x0132f92b
0x0132f92b
0x0132f92e
0x0132f92f
0x0132f937
0x0132f939
0x0132f93c
0x0132f93f
0x0132f941
0x0132fa3e
0x0132fa43
0x0132fa44
0x0132fa45
0x0132fa46
0x0132fa47
0x0132fa48
0x0132fa49
0x0132fa4a
0x0132fa4b
0x0132fa4c
0x0132fa4d
0x0132fa4e
0x0132fa4f
0x0132fa50
0x0132fa53
0x0132fa55
0x0132fa60
0x0132fa61
0x0132fa64
0x0132fa65
0x0132fa66
0x0132fa6d
0x0132fa71
0x0132fa77
0x0132fa79
0x0132fa80
0x0132fa8c
0x0132fa8e
0x0132fa94
0x0132fa97
0x0132fa9e
0x0132faa0
0x0132faa4
0x0132faa9
0x0132faac
0x0132faae
0x0132faae
0x0132fab0
0x0132fab0
0x0132fab8
0x0132fabb
0x0132fabe
0x0132fac1
0x0132fac9
0x0132fad4
0x0132fae1
0x0132f947
0x0132f947
0x0132f94a
0x0132f94c
0x0132f951
0x0132f956
0x0132f959
0x0132f959
0x0132f95f
0x0132f962
0x0132f972
0x0132f978
0x0132f988
0x0132f98b
0x0132f98f
0x0132f996
0x0132fa00
0x0132fa09
0x0132fa10
0x0132f998
0x0132f99b
0x0132f9a3
0x0132f9b0
0x0132f9b7
0x0132f9bd
0x0132f9c9
0x0132f9cd
0x0132f9d3
0x0132f9d7
0x0132f9e2
0x0132f9f2
0x0132f9f7
0x0132f9fb
0x0132fa13
0x0132fa17
0x0132fa21
0x0132fa29
0x0132fa2a
0x0132fa2e
0x0132fa3b
0x0132fa3b
0x0132f6b9
0x0132f6be
0x0132f6c3
0x0132f6c6
0x0132f6ca
0x0132f6d1
0x0132f6d7
0x0132f6de
0x0132f6e4
0x0132f6eb
0x0132f6f2
0x0132f6f2
0x0132f6f5
0x0132f6fb
0x0132f701
0x0132f70a
0x0132f70f
0x0132f712
0x0132f719
0x0132f71b
0x0132f71f
0x0132f724
0x0132f727
0x0132f729
0x0132f729
0x0132f72b
0x0132f72b
0x0132f733
0x0132f736
0x0132f739
0x0132f73c
0x0132f741
0x0132f746
0x0132f749
0x0132f751
0x0132f751
0x0132f75b
0x0132f75d
0x0132f764
0x0132f767
0x0132f770
0x0132f773
0x0132f77e
0x0132f783
0x0132f786
0x0132f78a
0x0132f78d
0x0132f78f
0x0132f792
0x0132f797
0x0132f797
0x0132f79a
0x0132f7a1
0x0132f7a5
0x0132f7a8
0x0132f7aa
0x0132f7ad
0x0132f7b2
0x0132f7b2
0x0132f7b5
0x0132f7bc
0x0132f7c0
0x0132f7c3
0x0132f7c5
0x0132f7c8
0x0132f7cd
0x0132f7cd
0x0132f7d0
0x0132f7d7
0x0132f7db
0x0132f7de
0x0132f7e0
0x0132f7e3
0x0132f7e8
0x0132f7e8
0x0132f7eb
0x0132f7f2
0x0132f7f6
0x0132f7f9
0x0132f7fb
0x0132f7fe
0x0132f803
0x0132f803
0x0132f806
0x0132f80d
0x0132f811
0x0132f814
0x0132f816
0x0132f819
0x0132f81e
0x0132f821
0x0132f828
0x0132f832
0x0132f832
0x00000000
0x0132f767
0x0132f6b3
0x0132f634
0x0132f61a
0x0132f489
0x0132f48e
0x0132f493
0x0132f496
0x0132f49a
0x0132f49f
0x0132f4a2
0x0132f4a8
0x0132f4af
0x0132f4b5
0x0132f4bc
0x0132f4c3
0x0132f4c9
0x0132f4d1
0x0132f4d1
0x0132f4db
0x0132f4dd
0x0132f4e4
0x0132f4e7
0x0132f4f0
0x0132f4f3
0x0132f4fe
0x0132f503
0x0132f506
0x0132f50a
0x0132f50d
0x0132f50f
0x0132f512
0x0132f517
0x0132f517
0x0132f51a
0x0132f521
0x0132f525
0x0132f528
0x0132f52a
0x0132f52d
0x0132f532
0x0132f532
0x0132f535
0x0132f53c
0x0132f540
0x0132f543
0x0132f545
0x0132f548
0x0132f54d
0x0132f54d
0x0132f550
0x0132f557
0x0132f55b
0x0132f55e
0x0132f560
0x0132f563
0x0132f568
0x0132f568
0x0132f56b
0x0132f572
0x0132f576
0x0132f579
0x0132f57b
0x0132f57e
0x0132f583
0x0132f583
0x0132f586
0x0132f58d
0x0132f591
0x0132f594
0x0132f596
0x0132f599
0x0132f59e
0x0132f5a1
0x0132f5a8
0x0132f5b2
0x0132f5b2
0x00000000
0x0132f4e7
0x0132f483
0x0132f404
0x0132f3ea
0x0132f115
0x0132f11d
0x0132f122
0x0132f12b
0x0132f12e
0x0132f134
0x0132f13b
0x0132f141
0x0132f148
0x0132f14f
0x0132f155
0x0132f161
0x0132f169
0x0132f16f
0x0132f172
0x0132f176
0x0132f17a
0x0132f17e
0x0132f183
0x0132f18b
0x0132f18e
0x0132f195
0x0132f19c
0x0132f1a3
0x0132f1ae
0x0132f1b6
0x0132f1b8
0x0132f1ba
0x0132f1bf
0x0132f1c4
0x0132f39e
0x00000000
0x0132f1ca
0x0132f1ca
0x0132f1cd
0x0132f1d3
0x0132f1e3
0x0132f1e9
0x0132f1f9
0x0132f1ff
0x0132f209
0x0132f20c
0x0132f210
0x0132f21e
0x0132f231
0x0132f23d
0x0132f241
0x0132f247
0x0132f24b
0x0132f259
0x0132f26c
0x0132f275
0x0132f278
0x0132f27c
0x0132f284
0x0132f284
0x0132f291
0x0132f293
0x0132f29a
0x0132f29f
0x0132f2a8
0x0132f2ab
0x0132f2b9
0x0132f2be
0x0132f2c1
0x0132f2c5
0x0132f2ca
0x0132f2cd
0x0132f2d2
0x0132f2d2
0x0132f2d5
0x0132f2dc
0x0132f2e0
0x0132f2e5
0x0132f2e8
0x0132f2ed
0x0132f2ed
0x0132f2f0
0x0132f2f7
0x0132f2fb
0x0132f300
0x0132f303
0x0132f308
0x0132f308
0x0132f30b
0x0132f312
0x0132f316
0x0132f31b
0x0132f31e
0x0132f323
0x0132f323
0x0132f326
0x0132f32d
0x0132f331
0x0132f336
0x0132f339
0x0132f33e
0x0132f33e
0x0132f341
0x0132f348
0x0132f34c
0x0132f354
0x0132f357
0x0132f35c
0x0132f35f
0x0132f369
0x0132f376
0x0132f376
0x00000000
0x0132f29f
0x0132f1c4
0x0132f10f
0x0132f08d

APIs

LocalAlloc.KERNEL32(00000040,00000018,C9209188,?,00000000), ref: 0132F076
std::_Lockit::_Lockit.LIBCPMT ref: 0132F0B3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0132F11D
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0132F2B9
std::_Lockit::~_Lockit.LIBCPMT ref: 0132F376
Concurrency::cancel_current_task.LIBCPMT ref: 0132F39E

Strings

false, xrefs: 0132F1D6
true, xrefs: 0132F1EC
bad locale name, xrefs: 0132F3A3

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocConcurrency::cancel_current_taskLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 975656625-1062449267
Opcode ID: f8f9007fc48018a0b38b8fad11c2967049e54597d885978e611ad6463f86d15b
Instruction ID: b8cafc9094acc5853f56aee34a660e394317571ee72003fa949bd372a6d6c478
Opcode Fuzzy Hash: f8f9007fc48018a0b38b8fad11c2967049e54597d885978e611ad6463f86d15b
Instruction Fuzzy Hash: 83B182B0D01358DFEB20DFA8C9047DEBBF8BF15308F148199D558AB281E775AA48CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01326A60 Relevance: 15.1, APIs: 10, Instructions: 137
timeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E01326A60(long* __ecx, intOrPtr __edx) {
				struct _FILETIME* _v8;
				char _v16;
				long _v20;
				long* _v24;
				long* _v28;
				long _v32;
				intOrPtr _v36;
				struct _FILETIME* _v40;
				intOrPtr _v44;
				struct _FILETIME* _v48;
				intOrPtr _v52;
				struct _FILETIME _v60;
				struct _FILETIME _v68;
				signed int _t46;
				long* _t49;
				long _t50;
				long* _t76;
				long* _t77;
				void* _t80;
				long _t83;
				void* _t84;
				signed int _t85;

				_push(0xffffffff);
				_push(0x1369d75);
				_push( *[fs:0x0]);
				_t46 =  *0x1383020; // 0xc9209188
				_push(_t46 ^ _t85);
				 *[fs:0x0] =  &_v16;
				_v36 = __edx;
				_t49 = __ecx;
				_v24 = __ecx;
				if(__ecx != __edx) {
					_t76 =  &(__ecx[1]);
					_v28 = _t76;
					if(_t76 != __edx) {
						do {
							_t50 =  *_t49;
							_t83 =  *_t76;
							_v32 = _t83;
							_v20 = _t50;
							_t80 = OpenProcess(0x400, 0, _t50);
							_v52 = 0x1379700;
							_v48 = _t80;
							_v8 = 0;
							_t84 = OpenProcess(0x400, 0, _t83);
							_v44 = 0x1379700;
							_v40 = _t84;
							_v8 = 1;
							if(_t80 == 0xffffffff || _t84 == 0xffffffff) {
								_v8 = 0;
								_v44 = 0x1379700;
								__eflags = _t84;
								if(_t84 != 0) {
									CloseHandle(_t84);
									_v40 = 0;
								}
								_v8 = 0xffffffff;
								_v52 = 0x1379700;
								__eflags = _t80;
								if(_t80 != 0) {
									CloseHandle(_t80);
									_v48 = 0;
								}
								__eflags = 0;
							} else {
								GetProcessTimes(_t80,  &_v60, 0, 0, 0);
								GetProcessTimes(_t84,  &_v68, 0, 0, 0);
								if(_v60.dwHighDateTime <= _v68.dwHighDateTime) {
									if(__eflags != 0) {
										L13:
										_v8 = 0;
										_v44 = 0x1379700;
										__eflags = _t84;
										if(_t84 != 0) {
											CloseHandle(_t84);
											_v40 = 0;
										}
										_v8 = 0xffffffff;
										_v52 = 0x1379700;
										__eflags = _t80;
										if(__eflags != 0) {
											CloseHandle(_t80);
											_v48 = 0;
										}
									} else {
										__eflags = _v60.dwLowDateTime - _v68.dwLowDateTime;
										if(__eflags >= 0) {
											goto L6;
										} else {
											goto L13;
										}
									}
								} else {
									L6:
									_v8 = 0;
									_v44 = 0x1379700;
									if(_t84 != 0) {
										CloseHandle(_t84);
										_v40 = 0;
									}
									_v8 = 0xffffffff;
									_v52 = 0x1379700;
									if(_t80 != 0) {
										CloseHandle(_t80);
										_v48 = 0;
									}
								}
							}
							_t77 = _v28;
							_t49 =  ==  ? _v24 : _t77;
							_t76 = _t77 + 4;
							_v24 = _t49;
							_v28 = _t76;
						} while (_t76 != _v36);
					}
				}
				 *[fs:0x0] = _v16;
				return _t49;
			}

0x01326a63
0x01326a65
0x01326a70
0x01326a77
0x01326a7e
0x01326a82
0x01326a8a
0x01326a8f
0x01326a91
0x01326a96
0x01326a9c
0x01326a9f
0x01326aa4
0x01326ab0
0x01326ab0
0x01326ab2
0x01326abc
0x01326abf
0x01326ac8
0x01326aca
0x01326ad1
0x01326ad4
0x01326ae9
0x01326aeb
0x01326af2
0x01326af5
0x01326afc
0x01326bb3
0x01326bb7
0x01326bbe
0x01326bc0
0x01326bc3
0x01326bc5
0x01326bc5
0x01326bcc
0x01326bd3
0x01326bda
0x01326bdc
0x01326bdf
0x01326be1
0x01326be1
0x01326be8
0x01326b0b
0x01326b16
0x01326b27
0x01326b33
0x01326b6f
0x01326b79
0x01326b79
0x01326b7d
0x01326b84
0x01326b86
0x01326b89
0x01326b8b
0x01326b8b
0x01326b92
0x01326b99
0x01326ba0
0x01326ba2
0x01326ba5
0x01326ba7
0x01326ba7
0x01326b71
0x01326b74
0x01326b77
0x00000000
0x00000000
0x00000000
0x00000000
0x01326b77
0x01326b35
0x01326b35
0x01326b35
0x01326b39
0x01326b42
0x01326b45
0x01326b47
0x01326b47
0x01326b4e
0x01326b55
0x01326b5e
0x01326b61
0x01326b63
0x01326b63
0x01326b6a
0x01326b33
0x01326bea
0x01326bf1
0x01326bf5
0x01326bf8
0x01326bfb
0x01326bfe
0x01326ab0
0x01326aa4
0x01326c0a
0x01326c18

APIs

OpenProcess.KERNEL32(00000400,00000000,?,C9209188,?,00000000), ref: 01326AC2
OpenProcess.KERNEL32(00000400,00000000,00000000,?,C9209188,?,00000000), ref: 01326AE3
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,C9209188,?,00000000), ref: 01326B16
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,C9209188,?,00000000), ref: 01326B27
CloseHandle.KERNEL32(00000000,?,C9209188,?,00000000), ref: 01326B45
CloseHandle.KERNEL32(00000000,?,C9209188,?,00000000), ref: 01326B61
CloseHandle.KERNEL32(00000000,?,C9209188,?,00000000), ref: 01326B89
CloseHandle.KERNEL32(00000000,?,C9209188,?,00000000), ref: 01326BA5
CloseHandle.KERNEL32(00000000,?,C9209188,?,00000000), ref: 01326BC3
CloseHandle.KERNEL32(00000000,?,C9209188,?,00000000), ref: 01326BDF

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: a82c6c66bbe9b446c5abda2460949f9109b9a23e4b2ede84eddc11806249fcdb
Instruction ID: 15158f390081df4b102a7d55e39fa633635a98748597bffb95e7a53bb63caad8
Opcode Fuzzy Hash: a82c6c66bbe9b446c5abda2460949f9109b9a23e4b2ede84eddc11806249fcdb
Instruction Fuzzy Hash: 015160B0D01268EBDB24DF9DC985BEEFBB5BF48728F104219E915B7280C7745905CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 013459E2 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 356
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E013459E2(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t111;
				signed char _t113;
				signed int _t116;
				intOrPtr* _t119;
				intOrPtr _t121;
				intOrPtr* _t123;
				signed int _t140;
				signed int _t169;
				intOrPtr _t180;
				char _t185;
				signed int _t186;
				signed int _t189;
				signed int _t192;
				signed int _t193;
				signed int _t194;
				signed char _t197;
				signed int _t198;
				signed int _t199;
				signed int _t201;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t205;
				signed char _t208;
				signed int _t212;
				signed int _t213;
				signed int _t214;
				signed int _t215;
				signed int _t216;
				signed char _t219;
				void* _t221;
				void* _t222;
				void* _t223;
				signed char _t225;
				void* _t226;
				void* _t227;
				void* _t228;
				signed char _t230;
				void* _t239;
				signed char* _t241;
				void* _t242;
				void* _t252;
				void* _t253;

				_push(0xc);
				E01348213(0x136c61d, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t242 - 0x18)) = __ecx;
				_t180 =  *((intOrPtr*)(_t242 + 0x1c));
				E0132FD10(_t242 - 0x14,  *((intOrPtr*)(_t180 + 0x30)));
				 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
				_t111 = E0132C590(_t180, __edi, __esi, _t242 - 0x14);
				 *(_t242 - 4) =  *(_t242 - 4) | 0xffffffff;
				_t239 = _t111;
				E0132C710(_t242 - 0x14);
				_t241 =  *(_t242 + 0x20);
				_t185 =  *((char*)(_t242 + 0x28));
				 *(_t242 - 0x10) = 0;
				 *_t241 = 0;
				_t113 = 2;
				_t252 = _t185 - 0x61;
				if(_t252 > 0) {
					__eflags = _t185 - 0x6e;
					if(__eflags > 0) {
						_t186 = _t185 - 0x70;
						__eflags = _t186;
						if(__eflags == 0) {
							_push(0);
							_push(":AM:am:PM:pm");
							_push(0);
							_push(_t242 + 0x14);
							_push(_t242 + 0xc);
							_t116 = E013323AA(_t180, _t239, _t241, __eflags);
							__eflags = _t116;
							if(_t116 >= 0) {
								__eflags = _t116 - 1;
								if(_t116 > 1) {
									_t121 =  *((intOrPtr*)(_t242 + 0x24));
									_t99 = _t121 + 8;
									 *_t99 =  *(_t121 + 8) + 0xc;
									__eflags =  *_t99;
								}
							} else {
								 *_t241 =  *_t241 | 0x00000002;
							}
							L70:
							if(E0133598D(_t242 + 0xc, _t242 + 0x14) != 0) {
								 *_t241 =  *_t241 | 0x00000001;
							}
							_t119 =  *((intOrPtr*)(_t242 + 8));
							 *_t119 =  *((intOrPtr*)(_t242 + 0xc));
							 *((intOrPtr*)(_t119 + 4)) =  *((intOrPtr*)(_t242 + 0x10));
							return E013481F0(_t119);
						}
						_t189 = _t186 - _t113;
						__eflags = _t189;
						if(__eflags == 0) {
							_push("%I : %M : %S %p");
							L50:
							_push( *((intOrPtr*)(_t242 + 0x24)));
							_push(_t241);
							_push(_t180);
							_push( *((intOrPtr*)(_t242 + 0x18)));
							_push( *((intOrPtr*)(_t242 + 0x14)));
							_push( *((intOrPtr*)(_t242 + 0x10)));
							_push( *((intOrPtr*)(_t242 + 0xc)));
							_push(_t242 - 0x14);
							_t123 = E01344233(_t180,  *((intOrPtr*)(_t242 - 0x18)), _t239, _t241, __eflags);
							L33:
							 *((intOrPtr*)(_t242 + 0xc)) =  *_t123;
							 *((intOrPtr*)(_t242 + 0x10)) =  *((intOrPtr*)(_t123 + 4));
							goto L70;
						}
						_t192 = _t189 - _t113;
						__eflags = _t192;
						if(__eflags == 0) {
							L64:
							_push(" ");
							goto L50;
						}
						_t193 = _t192 - 3;
						__eflags = _t193;
						if(_t193 == 0) {
							_push(_t239);
							_push(_t242 - 0x18);
							_push( *((intOrPtr*)(_t242 + 0x24)) + 0x18);
							_push(6);
							L15:
							_push(0);
							L48:
							_push(_t242 + 0x14);
							_push(_t242 + 0xc);
							 *_t241 =  *_t241 | E0134355C(0);
							goto L70;
						}
						_t194 = _t193 - 1;
						__eflags = _t194;
						if(__eflags == 0) {
							_push("%d / %m / %y");
							goto L50;
						}
						__eflags = _t194 == 1;
						if(_t194 == 1) {
							_t197 =  *_t241 | E0134355C(0, _t242 + 0xc, _t242 + 0x14, 0, 0x63, _t242 - 0x10, _t242 - 0x18, _t239);
							 *_t241 = _t197;
							__eflags = _t197 & 0x00000002;
							if((_t197 & 0x00000002) != 0) {
								goto L70;
							}
							_t198 =  *(_t242 - 0x10);
							__eflags = _t198 - 0x45;
							if(_t198 < 0x45) {
								_t198 = _t198 + 0x64;
							}
							L19:
							 *( *((intOrPtr*)(_t242 + 0x24)) + 0x14) = _t198;
							goto L70;
						}
						L58:
						 *_t241 = _t113;
						goto L70;
					}
					if(__eflags == 0) {
						goto L64;
					}
					_t199 = _t185 - 0x62;
					__eflags = _t199;
					if(_t199 == 0) {
						L51:
						_t123 = E01343204( *((intOrPtr*)(_t242 - 0x18)), _t242 - 0x14,  *((intOrPtr*)(_t242 + 0xc)),  *((intOrPtr*)(_t242 + 0x10)),  *((intOrPtr*)(_t242 + 0x14)),  *((intOrPtr*)(_t242 + 0x18)), _t180, _t241,  *((intOrPtr*)(_t242 + 0x24)));
						goto L33;
					}
					_t201 = _t199 - 1;
					__eflags = _t201;
					if(__eflags == 0) {
						_push("%b %d %H : %M : %S %Y");
						goto L50;
					}
					_t202 = _t201 - 1;
					__eflags = _t202;
					if(_t202 == 0) {
						L46:
						_push(_t239);
						_push(_t242 - 0x18);
						_t140 =  *((intOrPtr*)(_t242 + 0x24)) + 0xc;
						__eflags = _t140;
						_push(_t140);
						_push(0x1f);
						L47:
						_push(1);
						goto L48;
					}
					_t203 = _t202 - 1;
					__eflags = _t203;
					if(_t203 == 0) {
						goto L46;
					}
					_t204 = _t203 - 3;
					__eflags = _t204;
					if(_t204 == 0) {
						goto L51;
					}
					_t205 = _t204 - _t113;
					__eflags = _t205;
					if(_t205 == 0) {
						_push(_t239);
						_push(_t242 - 0x18);
						_push( *((intOrPtr*)(_t242 + 0x24)) + 0x1c);
						_push(0x16e);
						goto L47;
					}
					__eflags = _t205 != 3;
					if(_t205 != 3) {
						goto L58;
					}
					_t208 =  *_t241 | E0134355C(0, _t242 + 0xc, _t242 + 0x14, 1, 0xc, _t242 - 0x10, _t242 - 0x18, _t239);
					 *_t241 = _t208;
					__eflags = _t208 & 0x00000002;
					if((_t208 & 0x00000002) == 0) {
						 *((intOrPtr*)( *((intOrPtr*)(_t242 + 0x24)) + 0x10)) =  *(_t242 - 0x10) - 1;
					}
					goto L70;
				}
				if(_t252 == 0) {
					L32:
					_t123 = E0134323C( *((intOrPtr*)(_t242 - 0x18)), _t242 - 0x14,  *((intOrPtr*)(_t242 + 0xc)),  *((intOrPtr*)(_t242 + 0x10)),  *((intOrPtr*)(_t242 + 0x14)),  *((intOrPtr*)(_t242 + 0x18)), _t180, _t241,  *((intOrPtr*)(_t242 + 0x24)));
					goto L33;
				}
				_t253 = _t185 - 0x52;
				if(_t253 > 0) {
					_t212 = _t185 - 0x53;
					__eflags = _t212;
					if(_t212 == 0) {
						_push(_t239);
						_push(_t242 - 0x18);
						_push( *((intOrPtr*)(_t242 + 0x24)));
						_push(0x3c);
						goto L15;
					}
					_t213 = _t212 - 1;
					__eflags = _t213;
					if(__eflags == 0) {
						L30:
						_push("%H : %M : %S");
						goto L50;
					}
					_t214 = _t213 - 1;
					__eflags = _t214;
					if(_t214 == 0) {
						L29:
						_push(_t239);
						_push(_t242 - 0x18);
						_push( *((intOrPtr*)(_t242 + 0x24)) + 0x1c);
						_push(0x35);
						goto L15;
					}
					_t215 = _t214 - _t113;
					__eflags = _t215;
					if(_t215 == 0) {
						goto L29;
					}
					_t216 = _t215 - 1;
					__eflags = _t216;
					if(__eflags == 0) {
						goto L30;
					}
					__eflags = _t216 != 1;
					if(_t216 != 1) {
						goto L58;
					}
					_t219 =  *_t241 | E0134355C(0, _t242 + 0xc, _t242 + 0x14, 0, 0x270f, _t242 - 0x10, _t242 - 0x18, _t239);
					 *_t241 = _t219;
					__eflags = _t219 & 0x00000002;
					if((_t219 & 0x00000002) != 0) {
						goto L70;
					}
					_t198 =  *(_t242 - 0x10) + 0xfffff894;
					goto L19;
				}
				if(_t253 == 0) {
					_push("%H : %M");
					goto L50;
				}
				_t221 = _t185 - 0x41;
				if(_t221 == 0) {
					goto L32;
				}
				_t222 = _t221 - 1;
				if(_t222 == 0) {
					goto L51;
				}
				_t223 = _t222 - 1;
				if(_t223 == 0) {
					_t225 =  *_t241 | E0134355C(0, _t242 + 0xc, _t242 + 0x14, 0, 0x63, _t242 - 0x10, _t242 - 0x18, _t239);
					 *_t241 = _t225;
					__eflags = _t225 & 0x00000002;
					if((_t225 & 0x00000002) != 0) {
						goto L70;
					}
					_t198 = ( *(_t242 - 0x10) + 0xffffffed) * 0x64;
					__eflags = _t198;
					goto L19;
				}
				_t226 = _t223 - 1;
				if(_t226 == 0) {
					_push("%m / %d / %y");
					goto L50;
				}
				_t227 = _t226 - 4;
				if(_t227 == 0) {
					_push(_t239);
					_push(_t242 - 0x18);
					_t169 =  *((intOrPtr*)(_t242 + 0x24)) + 8;
					__eflags = _t169;
					_push(_t169);
					_push(0x17);
					goto L15;
				}
				_t228 = _t227 - 1;
				if(_t228 == 0) {
					_t230 =  *_t241 | E0134355C(0, _t242 + 0xc, _t242 + 0x14, 1, 0xc, _t242 - 0x10, _t242 - 0x18, _t239);
					 *_t241 = _t230;
					__eflags = _t230 & 0x00000002;
					if((_t230 & 0x00000002) == 0) {
						asm("sbb ecx, ecx");
						 *( *((intOrPtr*)(_t242 + 0x24)) + 8) =  ~( *(_t242 - 0x10) - 0xc) &  *(_t242 - 0x10);
					}
					goto L70;
				}
				if(_t228 != 4) {
					goto L58;
				} else {
					_push(_t239);
					_push(_t242 - 0x18);
					_push( *((intOrPtr*)(_t242 + 0x24)) + 4);
					_push(0x3b);
					goto L15;
				}
			}

0x013459e2
0x013459e9
0x013459ee
0x013459f1
0x013459fa
0x013459ff
0x01345a07
0x01345a0c
0x01345a10
0x01345a16
0x01345a1b
0x01345a20
0x01345a24
0x01345a29
0x01345a2b
0x01345a2c
0x01345a2f
0x01345beb
0x01345bee
0x01345cea
0x01345cea
0x01345ced
0x01345d7d
0x01345d7e
0x01345d83
0x01345d87
0x01345d8b
0x01345d8c
0x01345d94
0x01345d96
0x01345d9d
0x01345da0
0x01345da2
0x01345da5
0x01345da5
0x01345da5
0x01345da5
0x01345d98
0x01345d98
0x01345d98
0x01345da9
0x01345db7
0x01345db9
0x01345db9
0x01345dbc
0x01345dc5
0x01345dc7
0x01345dcf
0x01345dcf
0x01345cf3
0x01345cf3
0x01345cf5
0x01345d73
0x01345ca6
0x01345ca6
0x01345caf
0x01345cb0
0x01345cb1
0x01345cb4
0x01345cb7
0x01345cba
0x01345cbd
0x01345cbe
0x01345bdb
0x01345be0
0x01345be3
0x00000000
0x01345be3
0x01345cf7
0x01345cf7
0x01345cf9
0x01345d69
0x01345d69
0x00000000
0x01345d69
0x01345cfb
0x01345cfb
0x01345cfe
0x01345d56
0x01345d5a
0x01345d61
0x01345d62
0x01345adf
0x01345adf
0x01345c8a
0x01345c8d
0x01345c91
0x01345c9a
0x00000000
0x01345c9a
0x01345d00
0x01345d00
0x01345d03
0x01345d4c
0x00000000
0x01345d4c
0x01345d05
0x01345d08
0x01345d2f
0x01345d31
0x01345d33
0x01345d36
0x00000000
0x00000000
0x01345d38
0x01345d3b
0x01345d3e
0x01345d44
0x01345d44
0x01345b23
0x01345b26
0x00000000
0x01345b26
0x01345d0a
0x01345d0a
0x00000000
0x01345d0a
0x01345bf4
0x00000000
0x00000000
0x01345bfa
0x01345bfa
0x01345bfd
0x01345cc8
0x01345ce0
0x00000000
0x01345ce0
0x01345c03
0x01345c03
0x01345c06
0x01345ca1
0x00000000
0x01345ca1
0x01345c0c
0x01345c0c
0x01345c0f
0x01345c7a
0x01345c7a
0x01345c7e
0x01345c82
0x01345c82
0x01345c85
0x01345c86
0x01345c88
0x01345c88
0x00000000
0x01345c88
0x01345c11
0x01345c11
0x01345c14
0x00000000
0x00000000
0x01345c16
0x01345c16
0x01345c19
0x00000000
0x00000000
0x01345c1f
0x01345c1f
0x01345c21
0x01345c67
0x01345c6b
0x01345c72
0x01345c73
0x00000000
0x01345c73
0x01345c23
0x01345c26
0x00000000
0x00000000
0x01345c4b
0x01345c4d
0x01345c4f
0x01345c52
0x01345c5f
0x01345c5f
0x00000000
0x01345c52
0x01345a35
0x01345bbe
0x01345bd6
0x00000000
0x01345bd6
0x01345a3b
0x01345a3e
0x01345b38
0x01345b38
0x01345b3b
0x01345baf
0x01345bb3
0x01345bb4
0x01345bb7
0x00000000
0x01345bb7
0x01345b3d
0x01345b3d
0x01345b40
0x01345ba5
0x01345ba5
0x00000000
0x01345ba5
0x01345b42
0x01345b42
0x01345b45
0x01345b92
0x01345b92
0x01345b96
0x01345b9d
0x01345b9e
0x00000000
0x01345b9e
0x01345b47
0x01345b47
0x01345b49
0x00000000
0x00000000
0x01345b4b
0x01345b4b
0x01345b4e
0x00000000
0x00000000
0x01345b50
0x01345b53
0x00000000
0x00000000
0x01345b7a
0x01345b7c
0x01345b7e
0x01345b81
0x00000000
0x00000000
0x01345b8a
0x00000000
0x01345b8a
0x01345a44
0x01345b2e
0x00000000
0x01345b2e
0x01345a4a
0x01345a4d
0x00000000
0x00000000
0x01345a53
0x01345a56
0x00000000
0x00000000
0x01345a5c
0x01345a5f
0x01345b0d
0x01345b0f
0x01345b11
0x01345b14
0x00000000
0x00000000
0x01345b20
0x01345b20
0x00000000
0x01345b20
0x01345a65
0x01345a68
0x01345ae5
0x00000000
0x01345ae5
0x01345a6a
0x01345a6d
0x01345ad1
0x01345ad5
0x01345ad9
0x01345ad9
0x01345adc
0x01345add
0x00000000
0x01345add
0x01345a6f
0x01345a72
0x01345aac
0x01345aae
0x01345ab0
0x01345ab3
0x01345ac4
0x01345ac9
0x01345ac9
0x00000000
0x01345ab3
0x01345a77
0x00000000
0x01345a7d
0x01345a7d
0x01345a81
0x01345a88
0x01345a89
0x00000000
0x01345a89

APIs

__EH_prolog3.LIBCMT ref: 013459E9

Part of subcall function 0132C590: std::_Lockit::_Lockit.LIBCPMT ref: 0132C5BD
Part of subcall function 0132C590: std::_Lockit::_Lockit.LIBCPMT ref: 0132C5E0
Part of subcall function 0132C590: std::_Lockit::~_Lockit.LIBCPMT ref: 0132C608
Part of subcall function 0132C590: std::_Lockit::~_Lockit.LIBCPMT ref: 0132C6A7

Strings

%m / %d / %y, xrefs: 01345AE5
%d / %m / %y, xrefs: 01345D4C
%b %d %H : %M : %S %Y, xrefs: 01345CA1
:AM:am:PM:pm, xrefs: 01345D7E
%H : %M : %S, xrefs: 01345BA5
%H : %M, xrefs: 01345B2E
%I : %M : %S %p, xrefs: 01345D73

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: ba068ded3d90f653800adb406f33be16ff9ed283d0cf0edff838a3f2bef7495f
Instruction ID: 5b9b6159fbae8f210ee2f2c9b50768e86a4798c74ff7d726e568c496f9127e91
Opcode Fuzzy Hash: ba068ded3d90f653800adb406f33be16ff9ed283d0cf0edff838a3f2bef7495f
Instruction Fuzzy Hash: 19C1607690010AAFEF19DF9CC999DFB3BFCEF05208F044619FA42A6655D630EA14CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013265B0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 258
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E013265B0(void* __ebx, short* __ecx, void* __edx, void* __edi, void* __eflags) {
				DWORD* _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				DWORD* _v28;
				void* _v44;
				void* _v48;
				signed int _v52;
				void _v116;
				void* _v572;
				void _v588;
				DWORD* _v592;
				long _v596;
				DWORD* _v600;
				char _v604;
				short* _v608;
				short* _v612;
				void* _v632;
				char _v636;
				void* __esi;
				signed int _t95;
				signed int _t96;
				struct HINSTANCE__* _t99;
				_Unknown_base(*)()* _t104;
				signed int _t116;
				signed int _t122;
				struct HINSTANCE__* _t125;
				signed int _t127;
				signed int _t132;
				struct HINSTANCE__* _t142;
				signed int _t149;
				void* _t154;
				DWORD* _t155;
				void* _t159;
				void* _t160;
				short* _t162;
				void* _t163;
				void* _t164;
				signed int _t169;

				_t156 = __edx;
				_t139 = __ebx;
				_t167 = _t169;
				_push(0xffffffff);
				_push(0x1369d2c);
				_push( *[fs:0x0]);
				_t95 =  *0x1383020; // 0xc9209188
				_t96 = _t95 ^ _t169;
				_v20 = _t96;
				_push(__edi);
				_push(_t96);
				 *[fs:0x0] =  &_v16;
				_t159 = __edx;
				_t162 = __ecx;
				_v608 = __ecx;
				_v612 = __ecx;
				_v592 = 0;
				E01326090(__ebx,  &_v604);
				_v8 = 1;
				asm("xorps xmm0, xmm0");
				_t99 = _v600;
				asm("movq [ebp-0x268], xmm0");
				asm("movups [ebp-0x278], xmm0");
				if(_t99 == 0) {
					L23:
					asm("xorps xmm0, xmm0");
					asm("movups [esi], xmm0");
					 *(_t162 + 0x10) = 0;
					 *(_t162 + 0x14) = 0;
					 *(_t162 + 0x10) = 0;
					 *(_t162 + 0x14) = 7;
					 *_t162 = 0;
					_v592 = 1;
					_v8 = 0;
					_t142 = _v600;
					_v604 = 0x13792b8;
					if(_t142 != 0) {
						FreeLibrary(_t142);
						goto L25;
					}
					goto L26;
				} else {
					_t104 = GetProcAddress(_t99, "NtQueryInformationProcess");
					if(_t104 == 0) {
						_v596 = GetLastError();
						goto L23;
					} else {
						_push(0);
						_push(0x18);
						_push( &_v636);
						_push(0);
						_push(_t159);
						if(( *_t104() & 0xc0000000) == 0xc0000000) {
							goto L23;
						} else {
							E01348E90(_t159,  &_v588, 0, 0x1d8);
							if((ReadProcessMemory(_t159, _v632,  &_v588, 0x1d8, 0) & 0xc0000000) != 0xc0000000) {
								E01348E90(_t159,  &_v116, 0, 0x48);
								_t116 = ReadProcessMemory(_t159, _v572,  &_v116, 0x48, 0);
								asm("xorps xmm0, xmm0");
								if((_t116 & 0xc0000000) != 0xc0000000) {
									if(_v52 != 0) {
										asm("movups [ebp-0x28], xmm0");
										_v28 = 0;
										_v24 = 0;
										_v28 = 0;
										_v24 = 7;
										_v44 = 0;
										_v8 = 6;
										_t119 = _v28;
										_t149 = (_v52 & 0x0000ffff) >> 1;
										if(_t149 > _v28) {
											E01324580( &_v44, _t167, _t149 - _t119, 0);
										} else {
											_v28 = _t149;
											_t136 =  >=  ? _v44 :  &_v44;
											_t156 = 0;
											 *((short*)(( >=  ? _v44 :  &_v44) + _t149 * 2)) = 0;
										}
										_t153 =  >=  ? _v44 :  &_v44;
										_t122 = ReadProcessMemory(_t159, _v48,  >=  ? _v44 :  &_v44, _v52 & 0x0000ffff, 0);
										_v592 = 1;
										asm("xorps xmm0, xmm0");
										asm("movups [esi], xmm0");
										 *(_t162 + 0x10) = 0;
										 *(_t162 + 0x14) = 0;
										if((_t122 & 0xc0000000) != 0xc0000000) {
											asm("movups xmm0, [ebp-0x28]");
											_v44 = 0;
											asm("movups [esi], xmm0");
											asm("movq xmm0, [ebp-0x18]");
											asm("movq [esi+0x10], xmm0");
											_v28 = 0;
											_v24 = 7;
											_v8 = 1;
											_v28 = 0;
											_v24 = 7;
											_v44 = 0;
											goto L5;
										} else {
											 *(_t162 + 0x10) = 0;
											 *(_t162 + 0x14) = 7;
											 *_t162 = 0;
											_v8 = 1;
											_t127 = _v24;
											if(_t127 < 8) {
												L20:
												_v28 = 0;
												_v24 = 7;
												_v44 = 0;
												goto L5;
											} else {
												_t154 = _v44;
												_t156 = _t154;
												if(2 + _t127 * 2 < 0x1000) {
													L18:
													if(_t154 != 0) {
														LocalFree(_t154);
													}
													goto L20;
												} else {
													_t154 =  *(_t156 - 4);
													if(_t156 - 4 > 0x1f) {
														_t132 = E0134C5C2(_t139, _t154, _t156, _t159);
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_push(_t162);
														_t164 = _t154;
														_t155 =  *(_t164 + 0x24);
														if(_t155 != 0) {
															_t132 =  *((intOrPtr*)( *_t155 + 0x10))((_t132 & 0xffffff00 | _t155 != _t164) & 0x000000ff);
															 *(_t164 + 0x24) = 0;
														}
														return _t132;
													} else {
														goto L18;
													}
												}
											}
										}
									} else {
										asm("movups [esi], xmm0");
										 *(_t162 + 0x10) = 0;
										 *(_t162 + 0x14) = 0;
										 *(_t162 + 0x10) = 0;
										 *(_t162 + 0x14) = 7;
										 *_t162 = 0;
										_v592 = 1;
										goto L5;
									}
								} else {
									asm("movups [esi], xmm0");
									 *(_t162 + 0x10) = 0;
									 *(_t162 + 0x14) = 0;
									 *(_t162 + 0x10) = 0;
									 *(_t162 + 0x14) = 7;
									 *_t162 = 0;
									_v592 = 1;
									goto L5;
								}
							} else {
								asm("xorps xmm0, xmm0");
								_v592 = 1;
								asm("movups [esi], xmm0");
								 *(_t162 + 0x10) = 0;
								 *(_t162 + 0x14) = 0;
								 *(_t162 + 0x10) = 0;
								 *(_t162 + 0x14) = 7;
								 *_t162 = 0;
								L5:
								_v8 = 0;
								_t125 = _v600;
								_v604 = 0x13792b8;
								if(_t125 != 0) {
									FreeLibrary(_t125);
									L25:
									_v600 = 0;
								}
								L26:
								 *[fs:0x0] = _v16;
								_pop(_t160);
								_pop(_t163);
								return E01347708(_t162, _t139, _v20 ^ _t167, _t156, _t160, _t163);
							}
						}
					}
				}
			}

0x013265b0
0x013265b0
0x013265b1
0x013265b3
0x013265b5
0x013265c0
0x013265c7
0x013265cc
0x013265ce
0x013265d2
0x013265d3
0x013265d7
0x013265dd
0x013265df
0x013265e1
0x013265ea
0x013265f6
0x01326600
0x01326605
0x0132660c
0x0132660f
0x01326615
0x0132661d
0x01326626
0x013268d5
0x013268d5
0x013268da
0x013268dd
0x013268e4
0x013268eb
0x013268f2
0x013268f9
0x013268fc
0x01326906
0x01326909
0x0132690f
0x0132691b
0x0132691e
0x00000000
0x0132691e
0x00000000
0x0132662c
0x01326632
0x0132663a
0x013268cf
0x00000000
0x01326640
0x01326640
0x01326642
0x0132664a
0x0132664b
0x0132664d
0x0132665a
0x00000000
0x01326660
0x0132666e
0x0132669b
0x013266fb
0x01326712
0x0132671d
0x01326725
0x01326760
0x01326787
0x0132678b
0x01326792
0x01326799
0x013267a0
0x013267a7
0x013267ab
0x013267b3
0x013267b6
0x013267ba
0x013267da
0x013267bc
0x013267c3
0x013267c6
0x013267ca
0x013267cc
0x013267cc
0x013267ea
0x013267f6
0x01326801
0x0132680b
0x0132680e
0x01326811
0x01326818
0x01326824
0x0132688d
0x01326893
0x01326897
0x0132689a
0x0132689f
0x013268a4
0x013268ab
0x013268b2
0x013268b6
0x013268b9
0x013268c0
0x00000000
0x01326826
0x01326826
0x0132682f
0x01326836
0x01326839
0x0132683d
0x01326843
0x01326874
0x01326876
0x0132687d
0x01326884
0x00000000
0x01326845
0x01326845
0x0132684f
0x01326856
0x01326869
0x0132686b
0x0132686e
0x0132686e
0x00000000
0x01326858
0x01326858
0x01326863
0x0132694b
0x01326950
0x01326951
0x01326952
0x01326953
0x01326954
0x01326955
0x01326956
0x01326957
0x01326958
0x01326959
0x0132695a
0x0132695b
0x0132695c
0x0132695d
0x0132695e
0x0132695f
0x01326960
0x01326961
0x01326963
0x01326968
0x01326975
0x01326978
0x01326978
0x01326980
0x00000000
0x00000000
0x00000000
0x01326863
0x01326856
0x01326843
0x01326762
0x01326762
0x01326765
0x01326768
0x0132676b
0x0132676e
0x01326775
0x01326778
0x00000000
0x01326778
0x01326727
0x01326727
0x0132672a
0x01326733
0x0132673a
0x01326741
0x01326748
0x0132674b
0x00000000
0x0132674b
0x0132669d
0x0132669d
0x013266a0
0x013266aa
0x013266ad
0x013266b6
0x013266bd
0x013266c4
0x013266cb
0x013266ce
0x013266ce
0x013266d5
0x013266db
0x013266e7
0x0132691e
0x0132691e
0x01326924
0x01326924
0x0132692e
0x01326933
0x0132693b
0x0132693c
0x0132694a
0x0132694a
0x0132669b
0x0132665a
0x0132663a

APIs

Part of subcall function 01326090: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 013260F4
Part of subcall function 01326090: GetLastError.KERNEL32 ref: 01326190

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 01326632
ReadProcessMemory.KERNEL32(00000000,?,?,000001D8,00000000,?,?,?,?,00000000), ref: 0132668B
ReadProcessMemory.KERNEL32(00000000,?,?,00000048,00000000,?,?,?,?,?,?,?,00000000), ref: 01326712
ReadProcessMemory.KERNEL32(00000000,?,?,?,00000000,?,00000000,?,?,?,?,?,?,?,00000000), ref: 013267F6
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 0132686E
GetLastError.KERNEL32(?,00000000), ref: 013268C9
FreeLibrary.KERNEL32(?,?,00000000), ref: 0132691E

Strings

NtQueryInformationProcess, xrefs: 0132662C

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: MemoryProcessRead$ErrorFreeLast$AddressDirectoryLibraryLocalProcSystem
String ID: NtQueryInformationProcess
API String ID: 253270903-2781105232
Opcode ID: 8d599546dee08421a3fdafe7a8324512905c661157324513594e3b597656732b
Instruction ID: 8fbedad21420301001b618d8fd92c91e9eb2507b363d7eabf1943bb59fb0e9e3
Opcode Fuzzy Hash: 8d599546dee08421a3fdafe7a8324512905c661157324513594e3b597656732b
Instruction Fuzzy Hash: 67B17EB0D10759CAEB20DF64C9497AEBBF4EF48308F10465DD449A6680E7B9A6C8CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0133D491 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E0133D491(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				intOrPtr _t37;
				intOrPtr _t42;
				intOrPtr _t51;
				signed int _t53;
				signed int _t58;
				void* _t65;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;
				void* _t74;
				void* _t78;

				_t78 = __eflags;
				_t61 = __edx;
				_push(0x64);
				E01348246(0x136c32b, __ebx, __edi, __esi);
				_t51 = __ecx;
				 *((intOrPtr*)(_t71 - 0x6c)) = E01356A36(__edx, __esi);
				_t32 = E01336203(_t78, _t71 - 0x68);
				_t53 = 0xb;
				_t69 = _t32;
				 *((intOrPtr*)(_t71 - 0x70)) = _t51;
				memcpy(_t71 - 0x3c, _t69, _t53 << 2);
				_t73 = _t72 + 0xc;
				_t65 = _t69 + _t53 + _t53;
				_t70 = 0;
				 *((intOrPtr*)(_t51 + 8)) = 0;
				 *((intOrPtr*)(_t51 + 0x10)) = 0;
				 *((intOrPtr*)(_t51 + 0x14)) = 0;
				 *((intOrPtr*)(_t71 - 4)) = 0;
				E01336203(_t78, _t71 - 0x68);
				if( *((char*)(_t71 + 0xc)) == 0) {
					_t13 =  *((intOrPtr*)(_t71 - 0x6c)) + 8; // 0xf883e845
					_t37 =  *_t13;
				} else {
					_t37 = 0x137b6c9;
				}
				_push(_t71 - 0x68);
				_push(_t70);
				 *((intOrPtr*)(_t51 + 8)) = E0132FB50(_t71, _t37);
				 *((intOrPtr*)(_t51 + 0x10)) = E0133725B(_t51, _t65, _t70, "false", _t70, _t71 - 0x3c);
				_t42 = E0133725B(_t51, _t65, _t70, "true", _t70, _t71 - 0x3c);
				_t74 = _t73 + 0x24;
				 *((intOrPtr*)(_t51 + 0x14)) = _t42;
				if( *((char*)(_t71 + 0xc)) == 0) {
					_t70 = _t71 - 0x3c;
					_t58 = 0xb;
					_push( *((intOrPtr*)(_t71 - 0x6c)));
					memcpy(_t74 - 0x2c, _t70, _t58 << 2);
					_t65 = _t70 + _t58 + _t58;
					_push(0);
					E0133708B(_t51, _t61, __eflags);
				} else {
					 *((short*)(_t51 + 0xc)) = E0133722A(0x2e, _t70, _t71 - 0x3c);
					 *((short*)(_t51 + 0xe)) = E0133722A(0x2c, _t70, _t71 - 0x3c);
				}
				return E01348204(_t51, _t65, _t70);
			}

0x0133d491
0x0133d491
0x0133d491
0x0133d498
0x0133d49d
0x0133d4a4
0x0133d4ab
0x0133d4b2
0x0133d4b3
0x0133d4b5
0x0133d4bb
0x0133d4bb
0x0133d4bb
0x0133d4bd
0x0133d4bf
0x0133d4c2
0x0133d4c5
0x0133d4cb
0x0133d4cf
0x0133d4da
0x0133d4e6
0x0133d4e6
0x0133d4dc
0x0133d4dc
0x0133d4dc
0x0133d4ec
0x0133d4ed
0x0133d4f4
0x0133d506
0x0133d513
0x0133d518
0x0133d51b
0x0133d522
0x0133d54c
0x0133d551
0x0133d554
0x0133d557
0x0133d557
0x0133d559
0x0133d55d
0x0133d524
0x0133d530
0x0133d543
0x0133d543
0x0133d567

APIs

__EH_prolog3_GS.LIBCMT ref: 0133D498
_Maklocstr.LIBCPMT ref: 0133D501
_Maklocstr.LIBCPMT ref: 0133D513
_Maklocchr.LIBCPMT ref: 0133D52B
_Maklocchr.LIBCPMT ref: 0133D53B
_Getvals.LIBCPMT ref: 0133D55D

Part of subcall function 0133708B: _Maklocchr.LIBCPMT ref: 013370BA
Part of subcall function 0133708B: _Maklocchr.LIBCPMT ref: 013370D0

Strings

false, xrefs: 0133D4FC
true, xrefs: 0133D50E

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: 9635f36e4c5842e7b6e778f1898a0ef0fbaab1dab2d2657690607424c73923c5
Instruction ID: 1ee76c55d7d51e155757ba11f6f7c77a4cf44278191fda98c50e132250253e46
Opcode Fuzzy Hash: 9635f36e4c5842e7b6e778f1898a0ef0fbaab1dab2d2657690607424c73923c5
Instruction Fuzzy Hash: F92181B1D00309BADF14EFE9D885EDEBBB8EF54618F00800AF9159F251EB749644CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0132C9C0 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 480
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0132C9C0(void* __ebx, int __ecx, void* __eflags, signed int _a4) {
				signed int _v4;
				int _v8;
				char _v16;
				char _v17;
				int _v24;
				int _v28;
				char _v32;
				signed int _v36;
				void* _v40;
				int _v42;
				int _v44;
				char _v48;
				int _v52;
				signed int _v56;
				int _v60;
				char _v64;
				int _v68;
				char _v72;
				int _v76;
				signed short _v80;
				intOrPtr* _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				int _v116;
				char _v124;
				signed int _v132;
				int _v136;
				int _v140;
				char _v144;
				intOrPtr _v148;
				char _v156;
				intOrPtr _v168;
				intOrPtr _v180;
				char _v188;
				signed int _v192;
				short _v196;
				int _v208;
				int _v212;
				short _v228;
				intOrPtr _v240;
				intOrPtr _v244;
				void* _v256;
				intOrPtr _v260;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t180;
				signed int _t189;
				intOrPtr _t192;
				int _t196;
				signed int _t204;
				signed int _t205;
				short _t210;
				int _t212;
				signed short* _t213;
				signed short* _t221;
				int _t226;
				intOrPtr* _t229;
				void* _t232;
				signed short _t234;
				signed int _t236;
				intOrPtr _t245;
				signed int _t246;
				int _t248;
				signed int _t253;
				signed int _t254;
				signed int _t258;
				void* _t267;
				signed int _t269;
				signed int _t277;
				int _t281;
				signed int _t284;
				signed int _t287;
				void* _t294;
				int _t295;
				int _t296;
				intOrPtr _t298;
				signed int _t306;
				signed int* _t309;
				signed int _t315;
				intOrPtr* _t319;
				void* _t325;
				signed int _t326;
				signed short* _t329;
				intOrPtr* _t330;
				void* _t331;
				void* _t332;
				void* _t336;
				signed int _t338;
				void* _t339;
				unsigned int _t340;
				signed int _t341;
				void* _t342;
				intOrPtr* _t343;
				signed int _t345;
				signed int _t348;
				signed int _t350;
				signed int _t352;
				signed int _t355;
				void* _t357;
				signed int _t360;
				signed int _t362;
				void* _t365;
				void* _t368;

				_t348 = _t355;
				_push(0xffffffff);
				_push(0x136ad25);
				_push( *[fs:0x0]);
				_push(__ebx);
				_push(_t336);
				_push(_t325);
				_t180 =  *0x1383020; // 0xc9209188
				_push(_t180 ^ _t348);
				 *[fs:0x0] =  &_v16;
				_t281 = __ecx;
				_v24 = __ecx;
				_push(0);
				_v17 = 0;
				E01335C66(__ecx, _t325, _t336, __eflags);
				_t357 = _t355 - 0x40 + 4;
				_v28 =  *(_t281 + 4);
				_v8 = 0;
				_t326 = _a4;
				_t337 = _t326;
				if( *((intOrPtr*)(_t326 + 0x14)) >= 0x10) {
					_t337 =  *_t326;
				}
				_t287 =  &_v80;
				E01335EA5(_t287, 0);
				_v8 = 1;
				_v76 = 0;
				_v72 = 0;
				_v8 = 2;
				_v68 = 0;
				_v64 = 0;
				_v8 = 3;
				_v60 = 0;
				_v56 = 0;
				_v8 = 4;
				_v52 = 0;
				_v48 = 0;
				_v8 = 5;
				_v44 = 0;
				_v40 = 0;
				_v8 = 6;
				_v36 = 0;
				_v32 = 0;
				_v8 = 7;
				if(_t337 == 0) {
					L40:
					E013320D0("bad locale name");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t281);
					_t282 = _t357;
					_t360 = (_t357 - 0x00000008 & 0xfffffff8) + 4;
					_push(_t348);
					_v108 =  *((intOrPtr*)(_t357 + 4));
					_t350 = _t360;
					_push(0xffffffff);
					_push(0x136ad5d);
					_t189 =  *0x1383020; // 0xc9209188
					_v132 = _t189 ^ _t350;
					 *[fs:0x0] =  &_v124;
					_t338 = _t287;
					_t192 = E01335DC8(0);
					_t362 = _t360 - 0x1c + 4;
					 *((intOrPtr*)(_t338 + 4)) = _t192;
					asm("xorps xmm0, xmm0");
					_v140 = 0;
					_v136 = 0;
					asm("movups [ebp-0x2c], xmm0");
					E01323330(_t357,  &_v156, _t323);
					_v116 = 0;
					E0132C9C0(_t357, _t338, __eflags,  &_v156,  &_v156, 0x137b6c9, 0, _t189 ^ _t350, _t337, _t282,  *[fs:0x0]);
					_v116 = 0xffffffff;
					_t196 = _v136;
					__eflags = _t196 - 0x10;
					if(_t196 < 0x10) {
						L46:
						_v44 = 0;
						_v40 = 0xf;
						_v60 = 0;
						 *[fs:0x0] = _v28;
						_pop(_t339);
						__eflags = _v36 ^ _t350;
						return E01347708(_t338, _t282, _v36 ^ _t350, _t323, _t326, _t339);
					} else {
						_t294 = _v60;
						_t323 = _t294;
						__eflags = _t196 + 1 - 0x1000;
						if(_t196 + 1 < 0x1000) {
							L44:
							__eflags = _t294;
							if(_t294 != 0) {
								LocalFree(_t294);
							}
							goto L46;
						} else {
							_t294 =  *(_t323 - 4);
							_t323 = _t323 - _t294;
							__eflags = _t323 - 4 - 0x1f;
							if(_t323 - 4 > 0x1f) {
								E0134C5C2(_t282, _t294, _t323, _t326);
								asm("int3");
								_push(_t350);
								_t352 = _t362;
								_push(0xffffffff);
								_push(0x136ad9d);
								_push( *[fs:0x0]);
								_t365 = _t362 - 0x48;
								_t204 =  *0x1383020; // 0xc9209188
								_t205 = _t204 ^ _t352;
								_v192 = _t205;
								_push(_t338);
								_push(_t326);
								_push(_t205);
								 *[fs:0x0] =  &_v188;
								_v256 = _t294;
								asm("movq xmm0, [0x137b710]");
								_v240 = _v168;
								_v244 = _v156;
								_v260 = _v148;
								_t210 =  *0x137b718; // 0x0
								asm("movq [ebp-0x1c], xmm0");
								asm("xorps xmm0, xmm0");
								_v196 = _t210;
								asm("movups [ebp-0x34], xmm0");
								_v212 = 0;
								_v208 = 0;
								_v212 = 0;
								_v208 = 7;
								_v228 = 0;
								_v180 = 0;
								_t212 = _v140;
								_t295 = _v144;
								__eflags = _t212;
								if(_t212 != 0) {
									asm("cbw");
									_v42 = _t295;
									_v44 = _t212;
								} else {
									_v44 = _t295;
								}
								_t213 = E0134C6B0();
								_v76 = _t213;
								_t340 = 0x10;
								_v80 =  *_t213;
								while(1) {
									_t296 = _v52;
									_t324 = _v56;
									__eflags = _t340 - _t296 - _t324;
									if(_t340 > _t296 - _t324) {
										_push(0);
										_push(_t340);
										_push(_v80);
										_push(_t340);
										E013248E0(_t282,  &_v72, _t326);
									} else {
										__eflags = _t296 - 8;
										_v56 = _t340 + _t324;
										_t245 =  >=  ? _v72 :  &_v72;
										_v96 = _t245;
										_t332 = _t245 + _t324 * 2;
										__eflags = _t340;
										if(_t340 != 0) {
											_t315 = _t340 >> 1;
											__eflags = _t315;
											_t248 = memset(_t332, 0, _t315 << 2);
											asm("adc ecx, ecx");
											memset(_t332 + _t315, _t248, 0);
											_t365 = _t365 + 0x18;
										}
										_t246 = _t324 + _t340;
										_t324 = 0;
										 *((short*)(_v96 + _t246 * 2)) = 0;
									}
									_t298 = _v100;
									__eflags = _v52 - 8;
									_t219 =  >=  ? _v72 :  &_v72;
									_t137 = _t298 + 8; // 0x6c61766e
									_t326 = E01356774( >=  ? _v72 :  &_v72, _v56,  &_v48, _v104,  *_t137);
									_t365 = _t365 + 0x14;
									_t221 = _v76;
									__eflags = _t326;
									if(_t326 != 0) {
										break;
									}
									__eflags =  *_t221 - 0x16;
									if( *_t221 == 0x16) {
										E01330A70(_t282, _v88, _t326, _t340,  *(_v88 + 0xc) | 0x00000004, 0);
										_t343 = _v84;
										_t324 = _v4;
										 *_t343 = _v8;
										 *((intOrPtr*)(_t343 + 4)) = _v4;
										_v24 = 0xffffffff;
										E01323CC0( &_v72);
										_t229 = _t343;
									} else {
										_t340 = _t340 + _t340;
										continue;
									}
									L70:
									 *[fs:0x0] = _v32;
									_pop(_t331);
									_pop(_t342);
									__eflags = _v36 ^ _t352;
									return E01347708(_t229, _t282, _v36 ^ _t352, _t324, _t331, _t342);
									goto L71;
								}
								 *_t221 = _v80;
								__eflags = _v52 - 8;
								_t341 = _v4;
								_t223 =  >=  ? _v72 :  &_v72;
								_v76 = ( >=  ? _v72 :  &_v72) + _t326 * 2;
								_t328 =  >=  ? _v72 :  &_v72;
								_t329 = ( >=  ? _v72 :  &_v72) + 2;
								_v92 = _v8;
								_t226 = _v76;
								__eflags = _t329 - _t226;
								while(_t329 != _t226) {
									_t306 =  *_t329 & 0x0000ffff;
									_v80 = _t306;
									__eflags = _t341;
									if(_t341 == 0) {
										L67:
										_v92 = 1;
									} else {
										__eflags =  *( *(_t341 + 0x20));
										if( *( *(_t341 + 0x20)) == 0) {
											L65:
											_t232 =  *_t341;
											_t169 = _t232 + 0xc; // 0x10c25d
											_t234 =  *((intOrPtr*)( *_t169))(_t306);
										} else {
											_t324 =  *(_t341 + 0x30);
											_t236 =  *_t324;
											__eflags = _t236;
											if(_t236 <= 0) {
												goto L65;
											} else {
												 *_t324 = _t236 - 1;
												_t309 =  *(_t341 + 0x20);
												_t324 =  *_t309;
												 *_t309 = _t324 + 2;
												_t234 = _v80;
												 *_t324 = _t234;
											}
										}
										__eflags = 0xffff - (_t234 & 0x0000ffff);
										_t226 = _v76;
										if(0xffff == (_t234 & 0x0000ffff)) {
											goto L67;
										}
									}
									_t329 =  &(_t329[1]);
									__eflags = _t329 - _t226;
								}
								_t330 = _v84;
								 *_t330 = _v92;
								 *(_t330 + 4) = _t341;
								_v24 = 0xffffffff;
								E01323CC0( &_v72);
								_t229 = _t330;
								goto L70;
							} else {
								goto L44;
							}
						}
					}
				} else {
					E01334571(_t281, _t287, _t326,  &_v80, 0x3f, _t337);
					_t368 = _t357 + 0xc;
					_v8 = 8;
					_t319 =  !=  ? _v36 :  &_v32;
					_t253 = "*";
					while(1) {
						_t323 =  *_t319;
						if(_t323 !=  *_t253) {
							break;
						}
						if(_t323 == 0) {
							L8:
							_t254 = 0;
						} else {
							_t323 =  *((intOrPtr*)(_t319 + 1));
							_t34 = _t253 + 1; // 0x62000000
							if(_t323 !=  *_t34) {
								break;
							} else {
								_t319 = _t319 + 2;
								_t253 = _t253 + 2;
								if(_t323 != 0) {
									continue;
								} else {
									goto L8;
								}
							}
						}
						L10:
						if(_t254 != 0) {
							_push(0);
							_push( *(_t281 + 4));
							_push(0x3f);
							_push( &_v80);
							E013345A7(_t281, _t323, _t326, _t337, __eflags);
							_t368 = _t368 + 0x10;
							 *((intOrPtr*)( *(_t281 + 4) + 0x10)) = 0x3f;
							__eflags =  *((intOrPtr*)(_t326 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t326 + 0x14)) >= 0x10) {
								_t326 =  *_t326;
							}
							_t284 =  *(_t281 + 4);
							_t258 =  *(_t284 + 0x18);
							__eflags = _t258 - _t326;
							if(_t258 != _t326) {
								__eflags = _t258;
								if(_t258 != 0) {
									E0134C213(_t258);
									_t368 = _t368 + 4;
								}
								 *(_t284 + 0x18) = 0;
								__eflags = _t326;
								if(_t326 != 0) {
									__eflags =  *_t326;
									_t345 = _t326;
									if( *_t326 != 0) {
										do {
											_t345 = _t345 + 1;
											__eflags =  *_t345;
										} while ( *_t345 != 0);
									}
									_t337 = _t345 + 1 - _t326;
									_push(_t345 + 1 - _t326);
									_t277 = E01350DEB();
									_t368 = _t368 + 4;
									 *(_t284 + 0x18) = _t277;
									__eflags = _t277;
									if(_t277 != 0) {
										E01348FF0(_t277, _t326, _t337);
										_t368 = _t368 + 0xc;
									}
								}
							}
							_t281 = _v24;
						} else {
							_v17 = 1;
						}
						_v8 = 0xf;
						E01335DAE(_t319,  &_v80);
						_t357 = _t368 + 4;
						_v8 = 0xe;
						_t261 = _v36;
						if(_v36 != 0) {
							E0134C213(_t261);
							_t357 = _t357 + 4;
						}
						_v36 = 0;
						_v8 = 0xd;
						_t262 = _v44;
						if(_v44 != 0) {
							E0134C213(_t262);
							_t357 = _t357 + 4;
						}
						_v44 = 0;
						_v8 = 0xc;
						_t263 = _v52;
						if(_v52 != 0) {
							E0134C213(_t263);
							_t357 = _t357 + 4;
						}
						_v52 = 0;
						_v8 = 0xb;
						_t264 = _v60;
						if(_v60 != 0) {
							E0134C213(_t264);
							_t357 = _t357 + 4;
						}
						_v60 = 0;
						_v8 = 0xa;
						_t265 = _v68;
						if(_v68 != 0) {
							E0134C213(_t265);
							_t357 = _t357 + 4;
						}
						_v68 = 0;
						_v8 = 9;
						_t266 = _v76;
						if(_v76 != 0) {
							E0134C213(_t266);
							_t357 = _t357 + 4;
						}
						_v76 = 0;
						_v8 = 0;
						_t267 = E01335EFD( &_v80);
						_v28 = 0;
						_v8 = 0xffffffff;
						if(_v17 != 0) {
							_t72 = _t281 + 4; // 0x8bffffff
							_t287 =  *_t72;
							_t269 =  *((intOrPtr*)( *_t287 + 8))();
							__eflags = _t269;
							if(_t269 != 0) {
								_t323 =  *_t269;
								_t287 = _t269;
								 *( *_t269)(1);
							}
							goto L40;
						} else {
							 *[fs:0x0] = _v16;
							return _t267;
						}
						goto L71;
					}
					asm("sbb eax, eax");
					_t254 = _t253 | 0x00000001;
					__eflags = _t254;
					goto L10;
				}
				L71:
			}

0x0132c9c1
0x0132c9c3
0x0132c9c5
0x0132c9d0
0x0132c9d4
0x0132c9d5
0x0132c9d6
0x0132c9d7
0x0132c9de
0x0132c9e2
0x0132c9e8
0x0132c9ea
0x0132c9ed
0x0132c9ef
0x0132c9f3
0x0132c9fb
0x0132c9fe
0x0132ca01
0x0132ca08
0x0132ca0b
0x0132ca11
0x0132ca13
0x0132ca13
0x0132ca17
0x0132ca1a
0x0132ca1f
0x0132ca23
0x0132ca2a
0x0132ca2e
0x0132ca32
0x0132ca39
0x0132ca3d
0x0132ca43
0x0132ca4a
0x0132ca4e
0x0132ca52
0x0132ca55
0x0132ca59
0x0132ca5d
0x0132ca60
0x0132ca63
0x0132ca67
0x0132ca6a
0x0132ca6d
0x0132ca73
0x0132cc41
0x0132cc46
0x0132cc4b
0x0132cc4c
0x0132cc4d
0x0132cc4e
0x0132cc4f
0x0132cc50
0x0132cc51
0x0132cc59
0x0132cc5c
0x0132cc60
0x0132cc64
0x0132cc66
0x0132cc68
0x0132cc78
0x0132cc7f
0x0132cc87
0x0132cc8d
0x0132cc91
0x0132cc96
0x0132cc99
0x0132cc9c
0x0132cc9f
0x0132cca9
0x0132ccb0
0x0132ccbb
0x0132ccc0
0x0132ccce
0x0132ccd3
0x0132ccda
0x0132ccdd
0x0132cce0
0x0132cd07
0x0132cd07
0x0132cd10
0x0132cd17
0x0132cd1e
0x0132cd26
0x0132cd2a
0x0132cd37
0x0132cce2
0x0132cce2
0x0132cce6
0x0132cce8
0x0132cced
0x0132ccfc
0x0132ccfc
0x0132ccfe
0x0132cd01
0x0132cd01
0x00000000
0x0132ccef
0x0132ccef
0x0132ccf2
0x0132ccf7
0x0132ccfa
0x0132cd3a
0x0132cd3f
0x0132cd40
0x0132cd41
0x0132cd43
0x0132cd45
0x0132cd50
0x0132cd51
0x0132cd54
0x0132cd59
0x0132cd5b
0x0132cd5e
0x0132cd5f
0x0132cd60
0x0132cd64
0x0132cd6a
0x0132cd70
0x0132cd78
0x0132cd7e
0x0132cd84
0x0132cd87
0x0132cd8d
0x0132cd92
0x0132cd95
0x0132cd9b
0x0132cd9f
0x0132cda6
0x0132cdad
0x0132cdb4
0x0132cdbb
0x0132cdbf
0x0132cdc2
0x0132cdc5
0x0132cdca
0x0132cdcc
0x0132cdd4
0x0132cdd6
0x0132cdda
0x0132cdce
0x0132cdce
0x0132cdce
0x0132cdde
0x0132cde3
0x0132cde6
0x0132cded
0x0132cdf0
0x0132cdf0
0x0132cdf5
0x0132cdfa
0x0132cdfc
0x0132ce33
0x0132ce35
0x0132ce36
0x0132ce3c
0x0132ce3d
0x0132cdfe
0x0132ce01
0x0132ce04
0x0132ce0a
0x0132ce0e
0x0132ce11
0x0132ce14
0x0132ce16
0x0132ce1c
0x0132ce1c
0x0132ce1e
0x0132ce20
0x0132ce22
0x0132ce22
0x0132ce22
0x0132ce28
0x0132ce2b
0x0132ce2d
0x0132ce2d
0x0132ce42
0x0132ce48
0x0132ce4c
0x0132ce50
0x0132ce63
0x0132ce65
0x0132ce68
0x0132ce6b
0x0132ce6d
0x00000000
0x00000000
0x0132ce6f
0x0132ce72
0x0132ce87
0x0132ce8c
0x0132ce92
0x0132ce95
0x0132ce97
0x0132ce9a
0x0132cea4
0x0132cea9
0x0132ce74
0x0132ce74
0x00000000
0x0132ce74
0x0132cf51
0x0132cf54
0x0132cf5c
0x0132cf5d
0x0132cf61
0x0132cf6b
0x00000000
0x0132cf6b
0x0132ceb3
0x0132ceb8
0x0132cebc
0x0132cebf
0x0132cec9
0x0132cecc
0x0132ced3
0x0132ced6
0x0132ced9
0x0132cedc
0x0132cede
0x0132cee0
0x0132cee3
0x0132cee6
0x0132cee8
0x0132cf2a
0x0132cf2a
0x0132ceea
0x0132ceed
0x0132cef0
0x0132cf10
0x0132cf10
0x0132cf15
0x0132cf18
0x0132cef2
0x0132cef2
0x0132cef5
0x0132cef7
0x0132cef9
0x00000000
0x0132cefb
0x0132cefc
0x0132cefe
0x0132cf01
0x0132cf06
0x0132cf08
0x0132cf0b
0x0132cf0b
0x0132cef9
0x0132cf22
0x0132cf25
0x0132cf28
0x00000000
0x00000000
0x0132cf28
0x0132cf2e
0x0132cf31
0x0132cf31
0x0132cf35
0x0132cf3b
0x0132cf3d
0x0132cf40
0x0132cf4a
0x0132cf4f
0x00000000
0x00000000
0x00000000
0x00000000
0x0132ccfa
0x0132cced
0x0132ca79
0x0132ca80
0x0132ca85
0x0132ca88
0x0132ca94
0x0132ca97
0x0132caa0
0x0132caa0
0x0132caa4
0x00000000
0x00000000
0x0132caa8
0x0132cabc
0x0132cabc
0x0132caaa
0x0132caaa
0x0132caad
0x0132cab0
0x00000000
0x0132cab2
0x0132cab2
0x0132cab5
0x0132caba
0x00000000
0x00000000
0x00000000
0x00000000
0x0132caba
0x0132cab0
0x0132cac5
0x0132cac7
0x0132cacf
0x0132cad1
0x0132cad7
0x0132cad9
0x0132cada
0x0132cae2
0x0132cae5
0x0132caec
0x0132caf0
0x0132caf2
0x0132caf2
0x0132caf4
0x0132caf7
0x0132cafa
0x0132cafc
0x0132cafe
0x0132cb00
0x0132cb03
0x0132cb08
0x0132cb08
0x0132cb0b
0x0132cb12
0x0132cb14
0x0132cb16
0x0132cb19
0x0132cb1b
0x0132cb20
0x0132cb20
0x0132cb21
0x0132cb21
0x0132cb20
0x0132cb27
0x0132cb29
0x0132cb2a
0x0132cb2f
0x0132cb32
0x0132cb35
0x0132cb37
0x0132cb3c
0x0132cb41
0x0132cb41
0x0132cb37
0x0132cb14
0x0132cb44
0x0132cac9
0x0132cac9
0x0132cac9
0x0132cb47
0x0132cb4f
0x0132cb54
0x0132cb57
0x0132cb5b
0x0132cb60
0x0132cb63
0x0132cb68
0x0132cb68
0x0132cb6b
0x0132cb72
0x0132cb76
0x0132cb7b
0x0132cb7e
0x0132cb83
0x0132cb83
0x0132cb86
0x0132cb8d
0x0132cb91
0x0132cb96
0x0132cb99
0x0132cb9e
0x0132cb9e
0x0132cba1
0x0132cba8
0x0132cbac
0x0132cbb1
0x0132cbb4
0x0132cbb9
0x0132cbb9
0x0132cbbc
0x0132cbc3
0x0132cbc7
0x0132cbcc
0x0132cbcf
0x0132cbd4
0x0132cbd4
0x0132cbd7
0x0132cbde
0x0132cbe2
0x0132cbe7
0x0132cbea
0x0132cbef
0x0132cbef
0x0132cbf2
0x0132cbf9
0x0132cc00
0x0132cc05
0x0132cc0c
0x0132cc17
0x0132cc2d
0x0132cc2d
0x0132cc32
0x0132cc35
0x0132cc37
0x0132cc39
0x0132cc3b
0x0132cc3f
0x0132cc3f
0x00000000
0x0132cc19
0x0132cc1c
0x0132cc2a
0x0132cc2a
0x00000000
0x0132cc17
0x0132cac0
0x0132cac2
0x0132cac2
0x00000000
0x0132cac2
0x00000000

APIs

Part of subcall function 01335C66: __EH_prolog3.LIBCMT ref: 01335C6D
Part of subcall function 01335C66: std::_Lockit::_Lockit.LIBCPMT ref: 01335C78
Part of subcall function 01335C66: std::locale::_Setgloballocale.LIBCPMT ref: 01335C93
Part of subcall function 01335C66: std::_Lockit::~_Lockit.LIBCPMT ref: 01335CE6

std::_Lockit::_Lockit.LIBCPMT ref: 0132CA1A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0132CA80
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0132CB4F

Part of subcall function 013345A7: __EH_prolog3.LIBCMT ref: 013345AE

std::_Lockit::~_Lockit.LIBCPMT ref: 0132CC00
LocalFree.KERNEL32(?,?,?,0137B6C9,00000000,0137B6C9), ref: 0132CD01
__cftoe.LIBCMT ref: 0132CE5E

Strings

bad locale name, xrefs: 0132CC41

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$H_prolog3Locinfo::_Lockit::_Lockit::~_$FreeLocalLocinfo_ctorLocinfo_dtorSetgloballocale__cftoestd::locale::_
String ID: bad locale name
API String ID: 2085124900-1405518554
Opcode ID: 78ccc08b5355500b47854ae6f604ab6bbce6ea0d818911fdca9d6ff49b51e7fe
Instruction ID: cb74f0bec29ded4a42ff4e7e00ec38040c12f88bc8c9555601bd2d67e3c19e64
Opcode Fuzzy Hash: 78ccc08b5355500b47854ae6f604ab6bbce6ea0d818911fdca9d6ff49b51e7fe
Instruction Fuzzy Hash: B1129F71D01259DFDF11DFA8C844BAEBBF5EF14308F144169E855AB380E775AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0134B22C Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 73%

			E0134B22C(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t201;
				signed int _t202;
				char _t203;
				signed int _t205;
				signed int _t207;
				signed char* _t208;
				signed int _t209;
				signed int _t210;
				signed int _t214;
				void* _t217;
				signed char* _t220;
				void* _t222;
				void* _t224;
				signed char _t228;
				signed int _t229;
				void* _t231;
				void* _t234;
				void* _t237;
				signed int _t247;
				void* _t250;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr _t253;
				signed int _t254;
				void* _t259;
				void* _t264;
				void* _t265;
				signed int _t269;
				signed char* _t270;
				intOrPtr* _t271;
				signed char _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr* _t276;
				signed int _t277;
				signed int _t278;
				signed int _t283;
				signed int _t290;
				signed int _t291;
				signed int _t294;
				signed int _t296;
				signed char* _t297;
				signed int _t298;
				signed char _t299;
				signed int* _t301;
				signed char* _t304;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t327;
				void* _t329;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;

				_t296 = __edx;
				_push(_t315);
				_t301 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t275 = E0134C1B0(_a8, _a16, _t301);
				_t332 = _t331 + 0xc;
				_v12 = _t275;
				if(_t275 < 0xffffffff || _t275 >= _t301[1]) {
					L67:
					_t201 = E01358037(_t270, _t275, _t296, _t301, _t315);
					asm("int3");
					_t329 = _t332;
					_t333 = _t332 - 0x38;
					_push(_t270);
					_t271 = _v112;
					__eflags =  *_t271 - 0x80000003;
					if( *_t271 == 0x80000003) {
						return _t201;
					} else {
						_t202 = E0134AEE7(_t271, _t275, _t296, _t301, _t315, _t301, _t315);
						__eflags =  *(_t202 + 8);
						if( *(_t202 + 8) != 0) {
							__imp__EncodePointer(0);
							_t315 = _t202;
							_t222 = E0134AEE7(_t271, _t275, _t296, 0, _t315);
							__eflags =  *((intOrPtr*)(_t222 + 8)) - _t315;
							if( *((intOrPtr*)(_t222 + 8)) != _t315) {
								__eflags =  *_t271 - 0xe0434f4d;
								if( *_t271 != 0xe0434f4d) {
									__eflags =  *_t271 - 0xe0434352;
									if( *_t271 != 0xe0434352) {
										_t214 = E01348868(_t296, 0, _t315, _t271, _a4, _a8, _a12, _a16, _a24, _a28);
										_t333 = _t333 + 0x1c;
										__eflags = _t214;
										if(_t214 != 0) {
											L84:
											return _t214;
										}
									}
								}
							}
						}
						_t203 = _a16;
						_v28 = _t203;
						_v24 = 0;
						__eflags =  *(_t203 + 0xc);
						if( *(_t203 + 0xc) > 0) {
							_push(_a24);
							E0134879B(_t271, _t275, 0, _t315,  &_v44,  &_v28, _a20, _a12, _t203);
							_t298 = _v40;
							_t334 = _t333 + 0x18;
							_t214 = _v44;
							_v20 = _t214;
							_v12 = _t298;
							__eflags = _t298 - _v32;
							if(_t298 >= _v32) {
								goto L84;
							}
							_t277 = _t298 * 0x14;
							__eflags = _t277;
							_v16 = _t277;
							do {
								_t278 = 5;
								_t217 = memcpy( &_v64,  *((intOrPtr*)( *_t214 + 0x10)) + _t277, _t278 << 2);
								_t334 = _t334 + 0xc;
								__eflags = _v64 - _t217;
								if(_v64 > _t217) {
									goto L83;
								}
								__eflags = _t217 - _v60;
								if(_t217 > _v60) {
									goto L83;
								}
								_t220 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t283 = _t220[4];
								__eflags = _t283;
								if(_t283 == 0) {
									L81:
									__eflags =  *_t220 & 0x00000040;
									if(( *_t220 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E0134B1AC(_t298, _t271, _a4, _a8, _a12, _a16, _t220, 0,  &_v64, _a24, _a28);
										_t298 = _v12;
										_t334 = _t334 + 0x30;
									}
									goto L83;
								}
								__eflags =  *((char*)(_t283 + 8));
								if( *((char*)(_t283 + 8)) != 0) {
									goto L83;
								}
								goto L81;
								L83:
								_t298 = _t298 + 1;
								_t214 = _v20;
								_t277 = _v16 + 0x14;
								_v12 = _t298;
								_v16 = _t277;
								__eflags = _t298 - _v32;
							} while (_t298 < _v32);
							goto L84;
						}
						E01358037(_t271, _t275, _t296, 0, _t315);
						asm("int3");
						_push(_t329);
						_t297 = _v184;
						_push(_t271);
						_push(_t315);
						_push(0);
						_t205 = _t297[4];
						__eflags = _t205;
						if(_t205 == 0) {
							L109:
							_t207 = 1;
							__eflags = 1;
						} else {
							_t276 = _t205 + 8;
							__eflags =  *_t276;
							if( *_t276 == 0) {
								goto L109;
							} else {
								__eflags =  *_t297 & 0x00000080;
								_t304 = _v0;
								if(( *_t297 & 0x00000080) == 0) {
									L91:
									_t272 = _t304[4];
									_t317 = 0;
									__eflags = _t205 - _t272;
									if(_t205 == _t272) {
										L101:
										__eflags =  *_t304 & 0x00000002;
										if(( *_t304 & 0x00000002) == 0) {
											L103:
											_t208 = _a4;
											__eflags =  *_t208 & 0x00000001;
											if(( *_t208 & 0x00000001) == 0) {
												L105:
												__eflags =  *_t208 & 0x00000002;
												if(( *_t208 & 0x00000002) == 0) {
													L107:
													_t317 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t297 & 0x00000002;
													if(( *_t297 & 0x00000002) != 0) {
														goto L107;
													}
												}
											} else {
												__eflags =  *_t297 & 0x00000001;
												if(( *_t297 & 0x00000001) != 0) {
													goto L105;
												}
											}
										} else {
											__eflags =  *_t297 & 0x00000008;
											if(( *_t297 & 0x00000008) != 0) {
												goto L103;
											}
										}
										_t207 = _t317;
									} else {
										_t209 = _t272 + 8;
										while(1) {
											_t273 =  *_t276;
											__eflags = _t273 -  *_t209;
											if(_t273 !=  *_t209) {
												break;
											}
											__eflags = _t273;
											if(_t273 == 0) {
												L97:
												_t210 = _t317;
											} else {
												_t274 =  *((intOrPtr*)(_t276 + 1));
												__eflags = _t274 -  *((intOrPtr*)(_t209 + 1));
												if(_t274 !=  *((intOrPtr*)(_t209 + 1))) {
													break;
												} else {
													_t276 = _t276 + 2;
													_t209 = _t209 + 2;
													__eflags = _t274;
													if(_t274 != 0) {
														continue;
													} else {
														goto L97;
													}
												}
											}
											L99:
											__eflags = _t210;
											if(_t210 == 0) {
												goto L101;
											} else {
												_t207 = 0;
											}
											goto L110;
										}
										asm("sbb eax, eax");
										_t210 = _t209 | 0x00000001;
										__eflags = _t210;
										goto L99;
									}
								} else {
									__eflags =  *_t304 & 0x00000010;
									if(( *_t304 & 0x00000010) != 0) {
										goto L109;
									} else {
										goto L91;
									}
								}
							}
						}
						L110:
						return _t207;
					}
				} else {
					_t270 = _a4;
					if( *_t270 != 0xe06d7363 || _t270[0x10] != 3 || _t270[0x14] != 0x19930520 && _t270[0x14] != 0x19930521 && _t270[0x14] != 0x19930522) {
						L22:
						_t296 = _a12;
						_v8 = _t296;
						goto L24;
					} else {
						_t315 = 0;
						if(_t270[0x1c] != 0) {
							goto L22;
						} else {
							_t224 = E0134AEE7(_t270, _t275, _t296, _t301, 0);
							if( *((intOrPtr*)(_t224 + 0x10)) == 0) {
								L61:
								return _t224;
							} else {
								_t270 =  *(E0134AEE7(_t270, _t275, _t296, _t301, 0) + 0x10);
								_t259 = E0134AEE7(_t270, _t275, _t296, _t301, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t259 + 0x14));
								if(_t270 == 0 ||  *_t270 == 0xe06d7363 && _t270[0x10] == 3 && (_t270[0x14] == 0x19930520 || _t270[0x14] == 0x19930521 || _t270[0x14] == 0x19930522) && _t270[0x1c] == _t315) {
									goto L67;
								} else {
									if( *((intOrPtr*)(E0134AEE7(_t270, _t275, _t296, _t301, _t315) + 0x1c)) == _t315) {
										L23:
										_t296 = _v8;
										_t275 = _v12;
										L24:
										_v52 = _t301;
										_v48 = 0;
										__eflags =  *_t270 - 0xe06d7363;
										if( *_t270 != 0xe06d7363) {
											L57:
											__eflags = _t301[3];
											if(_t301[3] <= 0) {
												goto L60;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L67;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t275);
													_push(_t301);
													_push(_a16);
													_push(_t296);
													_push(_a8);
													_push(_t270);
													L68();
													_t332 = _t332 + 0x20;
													goto L60;
												}
											}
										} else {
											__eflags = _t270[0x10] - 3;
											if(_t270[0x10] != 3) {
												goto L57;
											} else {
												__eflags = _t270[0x14] - 0x19930520;
												if(_t270[0x14] == 0x19930520) {
													L29:
													_t315 = _a32;
													__eflags = _t301[3];
													if(_t301[3] > 0) {
														_push(_a28);
														E0134879B(_t270, _t275, _t301, _t315,  &_v68,  &_v52, _t275, _a16, _t301);
														_t296 = _v64;
														_t332 = _t332 + 0x18;
														_t247 = _v68;
														_v44 = _t247;
														_v16 = _t296;
														__eflags = _t296 - _v56;
														if(_t296 < _v56) {
															_t290 = _t296 * 0x14;
															__eflags = _t290;
															_v32 = _t290;
															do {
																_t291 = 5;
																_t250 = memcpy( &_v104,  *((intOrPtr*)( *_t247 + 0x10)) + _t290, _t291 << 2);
																_t332 = _t332 + 0xc;
																__eflags = _v104 - _t250;
																if(_v104 <= _t250) {
																	__eflags = _t250 - _v100;
																	if(_t250 <= _v100) {
																		_t294 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t299 = _t270[0x1c];
																			_t251 =  *((intOrPtr*)(_t299 + 0xc));
																			_t252 = _t251 + 4;
																			__eflags = _t252;
																			_v36 = _t252;
																			_t253 = _v88;
																			_v40 =  *_t251;
																			_v24 = _t253;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t327 = _v40;
																				_t314 = _v36;
																				__eflags = _t327;
																				if(_t327 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t299);
																						_push( *_t314);
																						_t254 =  &_v84;
																						_push(_t254);
																						L87();
																						_t332 = _t332 + 0xc;
																						__eflags = _t254;
																						if(_t254 != 0) {
																							break;
																						}
																						_t299 = _t270[0x1c];
																						_t327 = _t327 - 1;
																						_t314 = _t314 + 4;
																						__eflags = _t327;
																						if(_t327 > 0) {
																							continue;
																						} else {
																							_t294 = _v20;
																							_t253 = _v24;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E0134B1AC(_t299, _t270, _a8, _v8, _a16, _a20,  &_v84,  *_t314,  &_v104, _a28, _a32);
																					_t332 = _t332 + 0x30;
																				}
																				L43:
																				_t296 = _v16;
																				goto L44;
																				L40:
																				_t294 = _t294 + 1;
																				_t253 = _t253 + 0x10;
																				_v20 = _t294;
																				_v24 = _t253;
																				__eflags = _t294 - _v92;
																			} while (_t294 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t296 = _t296 + 1;
																_t247 = _v44;
																_t290 = _v32 + 0x14;
																_v16 = _t296;
																_v32 = _t290;
																__eflags = _t296 - _v56;
															} while (_t296 < _v56);
															_t301 = _a20;
															_t315 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E01349564(_t270, _t301, _t315, __eflags);
														_t275 = _t270;
													}
													__eflags = ( *_t301 & 0x1fffffff) - 0x19930521;
													if(( *_t301 & 0x1fffffff) < 0x19930521) {
														L60:
														_t224 = E0134AEE7(_t270, _t275, _t296, _t301, _t315);
														__eflags =  *(_t224 + 0x1c);
														if( *(_t224 + 0x1c) != 0) {
															goto L67;
														} else {
															goto L61;
														}
													} else {
														_t228 = _t301[8] >> 2;
														__eflags = _t301[7];
														if(_t301[7] != 0) {
															__eflags = _t228 & 0x00000001;
															if((_t228 & 0x00000001) == 0) {
																_push(_t301[7]);
																_t229 = E0134BC4A(_t270, _t301, _t315, _t270);
																_pop(_t275);
																__eflags = _t229;
																if(_t229 == 0) {
																	goto L64;
																} else {
																	goto L60;
																}
															} else {
																goto L54;
															}
														} else {
															__eflags = _t228 & 0x00000001;
															if((_t228 & 0x00000001) == 0) {
																goto L60;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L60;
																} else {
																	L54:
																	 *(E0134AEE7(_t270, _t275, _t296, _t301, _t315) + 0x10) = _t270;
																	_t237 = E0134AEE7(_t270, _t275, _t296, _t301, _t315);
																	_t286 = _v8;
																	 *((intOrPtr*)(_t237 + 0x14)) = _v8;
																	goto L62;
																}
															}
														}
													}
												} else {
													__eflags = _t270[0x14] - 0x19930521;
													if(_t270[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t270[0x14] - 0x19930522;
														if(_t270[0x14] != 0x19930522) {
															goto L57;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E0134AEE7(_t270, _t275, _t296, _t301, _t315) + 0x1c));
										_t264 = E0134AEE7(_t270, _t275, _t296, _t301, _t315);
										_push(_v16);
										 *(_t264 + 0x1c) = _t315;
										_t265 = E0134BC4A(_t270, _t301, _t315, _t270);
										_pop(_t286);
										if(_t265 != 0) {
											goto L23;
										} else {
											_t301 = _v16;
											_t353 =  *_t301 - _t315;
											if( *_t301 <= _t315) {
												L62:
												E01358FF2(_t270, _t286, _t296, _t301, _t315, __eflags);
											} else {
												while(1) {
													_t286 =  *((intOrPtr*)(_t315 + _t301[1] + 4));
													if(E0134B8D3( *((intOrPtr*)(_t315 + _t301[1] + 4)), _t353, 0x1383b40) != 0) {
														goto L63;
													}
													_t315 = _t315 + 0x10;
													_t269 = _v20 + 1;
													_v20 = _t269;
													_t353 = _t269 -  *_t301;
													if(_t269 >=  *_t301) {
														goto L62;
													} else {
														continue;
													}
													goto L63;
												}
											}
											L63:
											_push(1);
											_push(_t270);
											E01349564(_t270, _t301, _t315, __eflags);
											_t275 =  &_v64;
											E0134B8BB( &_v64);
											E01348C83( &_v64, 0x1380e44);
											L64:
											 *(E0134AEE7(_t270, _t275, _t296, _t301, _t315) + 0x10) = _t270;
											_t231 = E0134AEE7(_t270, _t275, _t296, _t301, _t315);
											_t275 = _v8;
											 *(_t231 + 0x14) = _v8;
											__eflags = _t315;
											if(_t315 == 0) {
												_t315 = _a8;
											}
											E0134898E(_t275, _t315, _t270);
											E0134BB4A(_a8, _a16, _t301);
											_t234 = E0134BD07(_t301);
											_t332 = _t332 + 0x10;
											_push(_t234);
											E0134BAC1(_t270, _t275, _t296, _t301, _t315, __eflags);
											goto L67;
										}
									}
								}
							}
						}
					}
				}
			}

0x0134b22c
0x0134b233
0x0134b235
0x0134b23e
0x0134b244
0x0134b24c
0x0134b24e
0x0134b251
0x0134b257
0x0134b5cb
0x0134b5cb
0x0134b5d0
0x0134b5d2
0x0134b5d4
0x0134b5d7
0x0134b5d8
0x0134b5db
0x0134b5e1
0x0134b700
0x0134b5e7
0x0134b5e9
0x0134b5f0
0x0134b5f3
0x0134b5f6
0x0134b5fc
0x0134b5fe
0x0134b603
0x0134b606
0x0134b608
0x0134b60e
0x0134b610
0x0134b616
0x0134b62b
0x0134b630
0x0134b633
0x0134b635
0x0134b6fc
0x00000000
0x0134b6fd
0x0134b635
0x0134b616
0x0134b60e
0x0134b606
0x0134b63b
0x0134b63e
0x0134b641
0x0134b644
0x0134b647
0x0134b64d
0x0134b65f
0x0134b664
0x0134b667
0x0134b66a
0x0134b66d
0x0134b670
0x0134b673
0x0134b676
0x00000000
0x00000000
0x0134b67c
0x0134b67c
0x0134b67f
0x0134b682
0x0134b691
0x0134b692
0x0134b692
0x0134b694
0x0134b697
0x00000000
0x00000000
0x0134b699
0x0134b69c
0x00000000
0x00000000
0x0134b6aa
0x0134b6ac
0x0134b6af
0x0134b6b1
0x0134b6b9
0x0134b6b9
0x0134b6bc
0x0134b6be
0x0134b6c0
0x0134b6dc
0x0134b6e1
0x0134b6e4
0x0134b6e4
0x00000000
0x0134b6bc
0x0134b6b3
0x0134b6b7
0x00000000
0x00000000
0x00000000
0x0134b6e7
0x0134b6ea
0x0134b6eb
0x0134b6ee
0x0134b6f1
0x0134b6f4
0x0134b6f7
0x0134b6f7
0x00000000
0x0134b682
0x0134b701
0x0134b706
0x0134b707
0x0134b70a
0x0134b70d
0x0134b70e
0x0134b70f
0x0134b710
0x0134b713
0x0134b715
0x0134b78d
0x0134b78f
0x0134b78f
0x0134b717
0x0134b717
0x0134b71a
0x0134b71d
0x00000000
0x0134b71f
0x0134b71f
0x0134b722
0x0134b725
0x0134b72c
0x0134b72c
0x0134b72f
0x0134b731
0x0134b733
0x0134b765
0x0134b765
0x0134b768
0x0134b76f
0x0134b76f
0x0134b772
0x0134b775
0x0134b77c
0x0134b77c
0x0134b77f
0x0134b786
0x0134b788
0x0134b788
0x0134b781
0x0134b781
0x0134b784
0x00000000
0x00000000
0x0134b784
0x0134b777
0x0134b777
0x0134b77a
0x00000000
0x00000000
0x0134b77a
0x0134b76a
0x0134b76a
0x0134b76d
0x00000000
0x00000000
0x0134b76d
0x0134b789
0x0134b735
0x0134b735
0x0134b738
0x0134b738
0x0134b73a
0x0134b73c
0x00000000
0x00000000
0x0134b73e
0x0134b740
0x0134b754
0x0134b754
0x0134b742
0x0134b742
0x0134b745
0x0134b748
0x00000000
0x0134b74a
0x0134b74a
0x0134b74d
0x0134b750
0x0134b752
0x00000000
0x00000000
0x00000000
0x00000000
0x0134b752
0x0134b748
0x0134b75d
0x0134b75d
0x0134b75f
0x00000000
0x0134b761
0x0134b761
0x0134b761
0x00000000
0x0134b75f
0x0134b758
0x0134b75a
0x0134b75a
0x00000000
0x0134b75a
0x0134b727
0x0134b727
0x0134b72a
0x00000000
0x00000000
0x00000000
0x00000000
0x0134b72a
0x0134b725
0x0134b71d
0x0134b790
0x0134b794
0x0134b794
0x0134b266
0x0134b266
0x0134b26f
0x0134b36c
0x0134b36c
0x0134b36f
0x00000000
0x0134b29e
0x0134b29e
0x0134b2a3
0x00000000
0x0134b2a9
0x0134b2a9
0x0134b2b1
0x0134b565
0x0134b569
0x0134b2b7
0x0134b2bc
0x0134b2bf
0x0134b2c4
0x0134b2cb
0x0134b2d0
0x00000000
0x0134b308
0x0134b310
0x0134b374
0x0134b374
0x0134b377
0x0134b37a
0x0134b37c
0x0134b37f
0x0134b382
0x0134b388
0x0134b534
0x0134b534
0x0134b537
0x00000000
0x0134b539
0x0134b539
0x0134b53c
0x00000000
0x0134b542
0x0134b542
0x0134b545
0x0134b548
0x0134b549
0x0134b54a
0x0134b54d
0x0134b54e
0x0134b551
0x0134b552
0x0134b557
0x00000000
0x0134b557
0x0134b53c
0x0134b38e
0x0134b38e
0x0134b392
0x00000000
0x0134b398
0x0134b398
0x0134b39f
0x0134b3b7
0x0134b3b7
0x0134b3ba
0x0134b3bd
0x0134b3c3
0x0134b3d3
0x0134b3d8
0x0134b3db
0x0134b3de
0x0134b3e1
0x0134b3e4
0x0134b3e7
0x0134b3ea
0x0134b3f0
0x0134b3f0
0x0134b3f3
0x0134b3f6
0x0134b405
0x0134b406
0x0134b406
0x0134b408
0x0134b40b
0x0134b411
0x0134b414
0x0134b41a
0x0134b41c
0x0134b41f
0x0134b422
0x0134b428
0x0134b42b
0x0134b430
0x0134b430
0x0134b433
0x0134b436
0x0134b439
0x0134b43c
0x0134b43f
0x0134b444
0x0134b445
0x0134b446
0x0134b447
0x0134b448
0x0134b44b
0x0134b44e
0x0134b450
0x00000000
0x0134b452
0x0134b452
0x0134b452
0x0134b453
0x0134b455
0x0134b458
0x0134b459
0x0134b45e
0x0134b461
0x0134b463
0x00000000
0x00000000
0x0134b465
0x0134b468
0x0134b469
0x0134b46c
0x0134b46e
0x00000000
0x0134b470
0x0134b470
0x0134b473
0x00000000
0x0134b473
0x00000000
0x0134b46e
0x0134b487
0x0134b48d
0x0134b4aa
0x0134b4af
0x0134b4af
0x0134b4b2
0x0134b4b2
0x00000000
0x0134b476
0x0134b476
0x0134b477
0x0134b47a
0x0134b47d
0x0134b480
0x0134b480
0x00000000
0x0134b485
0x0134b422
0x0134b414
0x0134b4b5
0x0134b4b8
0x0134b4b9
0x0134b4bc
0x0134b4bf
0x0134b4c2
0x0134b4c5
0x0134b4c5
0x0134b4ce
0x0134b4d1
0x0134b4d1
0x0134b3ea
0x0134b4d4
0x0134b4d8
0x0134b4da
0x0134b4dd
0x0134b4e3
0x0134b4e3
0x0134b4eb
0x0134b4f0
0x0134b55a
0x0134b55a
0x0134b55f
0x0134b563
0x00000000
0x00000000
0x00000000
0x00000000
0x0134b4f2
0x0134b4f5
0x0134b4f8
0x0134b4fc
0x0134b50a
0x0134b50c
0x0134b523
0x0134b527
0x0134b52d
0x0134b52e
0x0134b530
0x00000000
0x0134b532
0x00000000
0x0134b532
0x00000000
0x00000000
0x00000000
0x0134b4fe
0x0134b4fe
0x0134b500
0x00000000
0x0134b502
0x0134b502
0x0134b506
0x00000000
0x0134b508
0x0134b50e
0x0134b513
0x0134b516
0x0134b51b
0x0134b51e
0x00000000
0x0134b51e
0x0134b506
0x0134b500
0x0134b4fc
0x0134b3a1
0x0134b3a1
0x0134b3a8
0x00000000
0x0134b3aa
0x0134b3aa
0x0134b3b1
0x00000000
0x00000000
0x00000000
0x00000000
0x0134b3b1
0x0134b3a8
0x0134b39f
0x0134b392
0x0134b312
0x0134b31a
0x0134b31d
0x0134b322
0x0134b326
0x0134b329
0x0134b32f
0x0134b332
0x00000000
0x0134b334
0x0134b334
0x0134b337
0x0134b339
0x0134b56a
0x0134b56a
0x00000000
0x0134b33f
0x0134b347
0x0134b352
0x00000000
0x00000000
0x0134b35b
0x0134b35e
0x0134b35f
0x0134b362
0x0134b364
0x00000000
0x0134b36a
0x00000000
0x0134b36a
0x00000000
0x0134b364
0x0134b33f
0x0134b56f
0x0134b56f
0x0134b571
0x0134b572
0x0134b579
0x0134b57c
0x0134b58a
0x0134b58f
0x0134b594
0x0134b597
0x0134b59c
0x0134b59f
0x0134b5a2
0x0134b5a4
0x0134b5a6
0x0134b5a6
0x0134b5ab
0x0134b5b7
0x0134b5bd
0x0134b5c2
0x0134b5c5
0x0134b5c6
0x00000000
0x0134b5c6
0x0134b332
0x0134b310
0x0134b2d0
0x0134b2b1
0x0134b2a3
0x0134b26f

APIs

type_info::operator==.LIBVCRUNTIME ref: 0134B34B
___TypeMatch.LIBVCRUNTIME ref: 0134B459
_UnwindNestedFrames.LIBCMT ref: 0134B5AB
CallUnexpected.LIBVCRUNTIME ref: 0134B5C6

Strings

csm, xrefs: 0134B269
csm, xrefs: 0134B2D6
csm, xrefs: 0134B382

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 9779ecbf016589b195c9319bfc4d8b3ab410dfa1677d9242855ca54a89331819
Instruction ID: 6eb9f1663deff97572e3c53f5faccd796feeb4430023480462bb4c60e5de4172
Opcode Fuzzy Hash: 9779ecbf016589b195c9319bfc4d8b3ab410dfa1677d9242855ca54a89331819
Instruction Fuzzy Hash: D4B1397180020AEFDF25DFA9C8809AEFBF5FF14318B14419AE9156B21AD731FA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01330260 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 269
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E01330260(void* __ebx, void* __ecx, void* __edi, signed int __esi) {
				intOrPtr _v8;
				long _v16;
				signed int _v24;
				long _v28;
				signed int _v32;
				signed int _v36;
				long _v40;
				signed int _v44;
				signed int _v48;
				long _v52;
				void* _v56;
				signed int* _v60;
				intOrPtr _v64;
				void* _v68;
				signed int* _v72;
				char _v76;
				void* _v80;
				signed int _v128;
				char _v144;
				void* _v152;
				long _v156;
				long _v160;
				long _v180;
				intOrPtr _v184;
				long _v188;
				signed int _t89;
				signed int _t90;
				signed int* _t92;
				signed int _t97;
				void* _t98;
				signed int _t100;
				void* _t103;
				signed int _t107;
				intOrPtr* _t118;
				signed int _t122;
				long _t129;
				void* _t130;
				void* _t134;
				signed int* _t135;
				long _t139;
				void* _t140;
				void* _t148;
				signed int _t150;
				void* _t151;
				void* _t157;
				void* _t160;
				void* _t163;
				intOrPtr* _t165;
				void* _t166;
				void* _t167;
				void* _t168;
				signed int _t169;
				long _t170;
				void* _t171;
				signed int _t173;
				void* _t174;
				signed int _t177;
				signed int _t179;
				void* _t182;
				signed int _t185;
				signed int* _t187;
				signed int* _t195;

				_t169 = __esi;
				_push(__ebx);
				_t134 = _t182;
				_t185 = (_t182 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t134 + 4));
				_t177 = _t185;
				_push(0xffffffff);
				_push(0x136b405);
				_push( *[fs:0x0]);
				_push(_t134);
				_t89 =  *0x1383020; // 0xc9209188
				_t90 = _t89 ^ _t177;
				_v32 = _t90;
				_push(__esi);
				_push(__edi);
				_push(_t90);
				 *[fs:0x0] =  &_v24;
				_t165 = __ecx;
				_v68 = __ecx;
				_t159 =  *((intOrPtr*)(_t134 + 0x10));
				_t187 = _t185 - 0x20;
				_t92 = _t187;
				_v80 = __ecx;
				asm("xorps xmm0, xmm0");
				_v64 = _t159;
				_v72 = _t187;
				_v60 = _t92;
				asm("movups [eax], xmm0");
				_t92[4] = 0;
				_t92[5] = 0;
				_t139 =  *(_t159 + 0x10);
				_v68 = _t139;
				if( *((intOrPtr*)(_t159 + 0x14)) >= 0x10) {
					_v64 = _t159;
				}
				if(_t139 > 0x7fffffff) {
					E01323680(_t134, _t139, _t159, _t165, _t177);
					goto L25;
				} else {
					_t92[5] = 0xf;
					if(_t139 >= 0x10) {
						_t173 = _t139 | 0x0000000f;
						__eflags = _t173 - 0x7fffffff;
						if(_t173 <= 0x7fffffff) {
							__eflags = _t173 - 0x16;
							_t169 =  <  ? 0x16 : _t173;
							_t139 = _t169 + 1;
							__eflags = _t139 - 0x1000;
							if(_t139 < 0x1000) {
								__eflags = _t139;
								if(_t139 == 0) {
									_t150 = 0;
									__eflags = 0;
								} else {
									_t150 = LocalAlloc(0x40, _t139);
									_t92 = _v60;
								}
								goto L15;
							} else {
								_t129 = _t139 + 0x23;
								__eflags = _t129 - _t139;
								if(__eflags <= 0) {
									L25:
									E01323AF0(__eflags);
									goto L26;
								} else {
									goto L7;
								}
							}
						} else {
							_t169 = 0x7fffffff;
							_t129 = 0xffffffff80000023;
							__eflags = 0x80000000;
							L7:
							_t130 = LocalAlloc(0x40, _t129);
							__eflags = _t130;
							if(_t130 == 0) {
								goto L26;
							} else {
								_t19 = _t130 + 0x23; // 0x23
								_t150 = _t19 & 0xffffffe0;
								 *(_t150 - 4) = _t130;
								_t92 = _v60;
								L15:
								 *_t92 = _t150;
								_t92[4] = _v68;
								_t92[5] = _t169;
								E01348FF0(_t150, _v64, _v68 + 1);
								goto L16;
							}
						}
					} else {
						_t92[4] = _t139;
						E01348FF0(_t92, _t159, 0x10);
						L16:
						_v16 = 0;
						_push( *((intOrPtr*)(_t134 + 0xc)));
						_v16 = 0xffffffff;
						_t118 = E0132FF90(_t134, _t165, _t169,  &_v56,  *((intOrPtr*)(_t134 + 8)));
						_t195 =  &(_t187[0xc]);
						_t151 = _t118;
						_v16 = 1;
						if( *((intOrPtr*)(_t151 + 0x14)) >= 0x10) {
							_t151 =  *_t151;
						}
						 *_t165 = 0x136d3c0;
						asm("xorps xmm0, xmm0");
						_v76 = _t151;
						asm("movq [eax], xmm0");
						_v72 = 1;
						E01348C01( &_v76, _t165 + 4);
						_t187 =  &(_t195[2]);
						_v16 = 2;
						 *_t165 = 0x136d42c;
						_v16 = 4;
						_t122 = _v36;
						if(_t122 < 0x10) {
							L23:
							_v40 = 0;
							_v36 = 0xf;
							_v56 = 0;
							 *_t165 = 0x136e264;
							 *((intOrPtr*)(_t165 + 0xc)) =  *((intOrPtr*)(_t134 + 8));
							 *((intOrPtr*)(_t165 + 0x10)) =  *((intOrPtr*)(_t134 + 0xc));
							_v16 = 0xffffffff;
							 *[fs:0x0] = _v24;
							_pop(_t168);
							_pop(_t174);
							return E01347708(_t165, _t134, _v32 ^ _t177,  *((intOrPtr*)(_t134 + 0xc)), _t168, _t174);
						} else {
							_t157 = _v56;
							_t163 = _t157;
							if(_t122 + 1 < 0x1000) {
								L21:
								if(_t157 != 0) {
									LocalFree(_t157);
								}
								goto L23;
							} else {
								_t139 =  *(_t163 - 4);
								_t159 = _t163 - _t139;
								if(_t163 - _t139 - 4 > 0x1f) {
									L26:
									E0134C5C2(_t134, _t139, _t159, _t165);
									asm("int3");
									asm("int3");
									asm("int3");
									_push(_t134);
									_t135 = _t187;
									_push(_t177);
									_v128 = _t135[1];
									_t179 = (_t187 - 0x00000008 & 0xfffffff8) + 4;
									_push(0xffffffff);
									_push(0x136b44d);
									_push( *[fs:0x0]);
									_push(_t135);
									_t97 =  *0x1383020; // 0xc9209188
									_t98 = _t97 ^ _t179;
									__eflags = _t98;
									_v152 = _t98;
									_push(_t169);
									_push(_t165);
									_push(_t98);
									 *[fs:0x0] =  &_v144;
									_t170 = _t139;
									_v180 = _t170;
									_t100 = _t135[3];
									asm("xorps xmm0, xmm0");
									_t160 = _t135[2];
									_t140 = _t160;
									_v188 = _t170;
									asm("movups [ebp-0x2c], xmm0");
									_t166 =  *_t100;
									_v180 =  *(_t100 + 4);
									_v160 = 0;
									_v156 = 0;
									_v184 = _t140 + 1;
									do {
										_t103 =  *_t140;
										_t140 = _t140 + 1;
										__eflags = _t103;
									} while (_t103 != 0);
									_push(_t140 - _v76);
									_push(_t160);
									E01323330(_t135,  &_v68, _t160);
									_v28 = 0;
									_push( &_v68);
									E01330260(_t135, _t170, _t166, _t170, _t166, _v72);
									_v28 = 2;
									_t107 = _v48;
									__eflags = _t107 - 0x10;
									if(_t107 < 0x10) {
										L34:
										_v52 = 0;
										_v48 = 0xf;
										_v68 = 0;
										 *_t170 = 0x136e270;
										_v28 = 3;
										 *_t170 = 0x136e614;
										_v28 = 0xffffffff;
										 *[fs:0x0] = _v36;
										_pop(_t167);
										_pop(_t171);
										__eflags = _v44 ^ _t179;
										return E01347708(_t170, _t135, _v44 ^ _t179, _t160, _t167, _t171);
									} else {
										_t148 = _v68;
										_t160 = _t148;
										__eflags = _t107 + 1 - 0x1000;
										if(_t107 + 1 < 0x1000) {
											L32:
											__eflags = _t148;
											if(_t148 != 0) {
												LocalFree(_t148);
											}
											goto L34;
										} else {
											_t148 =  *(_t160 - 4);
											_t80 = _t160 - 4; // -2
											__eflags = _t80 - 0x1f;
											if(_t80 > 0x1f) {
												E0134C5C2(_t135, _t148, _t160, _t166);
												asm("int3");
												return "iostream";
											} else {
												goto L32;
											}
										}
									}
								} else {
									goto L21;
								}
							}
						}
					}
				}
			}

0x01330260
0x01330260
0x01330261
0x01330269
0x01330270
0x01330274
0x01330276
0x01330278
0x01330283
0x01330284
0x01330288
0x0133028d
0x0133028f
0x01330292
0x01330293
0x01330294
0x01330298
0x0133029e
0x013302a0
0x013302a3
0x013302a6
0x013302a9
0x013302ab
0x013302ae
0x013302b1
0x013302b4
0x013302b7
0x013302ba
0x013302bd
0x013302c4
0x013302cf
0x013302d2
0x013302d5
0x013302d9
0x013302d9
0x013302e2
0x0133046e
0x00000000
0x013302e8
0x013302e8
0x013302f2
0x01330307
0x0133030a
0x01330310
0x01330343
0x01330345
0x01330348
0x0133034b
0x01330351
0x01330360
0x01330362
0x01330374
0x01330374
0x01330364
0x0133036d
0x0133036f
0x0133036f
0x00000000
0x01330353
0x01330353
0x01330356
0x01330358
0x01330473
0x01330473
0x00000000
0x0133035e
0x00000000
0x0133035e
0x01330358
0x01330312
0x01330317
0x0133031c
0x0133031c
0x0133031f
0x01330322
0x01330328
0x0133032a
0x00000000
0x01330330
0x01330330
0x01330333
0x01330336
0x01330339
0x01330376
0x01330379
0x0133037b
0x0133037e
0x01330389
0x00000000
0x01330389
0x0133032a
0x013302f4
0x013302f8
0x013302fb
0x0133038e
0x01330391
0x0133039b
0x013303a2
0x013303a9
0x013303ae
0x013303b1
0x013303b3
0x013303be
0x013303c0
0x013303c0
0x013303c5
0x013303cb
0x013303ce
0x013303d2
0x013303da
0x013303de
0x013303e3
0x013303e6
0x013303ea
0x013303f0
0x013303f4
0x013303fa
0x01330421
0x01330427
0x0133042e
0x01330435
0x01330439
0x0133043f
0x01330442
0x01330445
0x01330451
0x01330459
0x0133045a
0x0133046b
0x013303fc
0x013303fc
0x01330400
0x01330407
0x01330416
0x01330418
0x0133041b
0x0133041b
0x00000000
0x01330409
0x01330409
0x0133040c
0x01330414
0x01330478
0x01330478
0x0133047d
0x0133047e
0x0133047f
0x01330480
0x01330481
0x0133048c
0x01330490
0x01330494
0x01330496
0x01330498
0x013304a3
0x013304a4
0x013304a8
0x013304ad
0x013304ad
0x013304af
0x013304b2
0x013304b3
0x013304b4
0x013304b8
0x013304be
0x013304c0
0x013304c3
0x013304c6
0x013304c9
0x013304cc
0x013304ce
0x013304d1
0x013304d5
0x013304da
0x013304e0
0x013304e7
0x013304ee
0x013304f1
0x013304f1
0x013304f3
0x013304f4
0x013304f4
0x013304fb
0x013304fc
0x01330500
0x01330505
0x0133050f
0x01330516
0x0133051b
0x0133051f
0x01330522
0x01330525
0x0133054c
0x0133054c
0x01330553
0x0133055a
0x0133055e
0x01330564
0x0133056b
0x01330571
0x0133057d
0x01330585
0x01330586
0x0133058a
0x01330597
0x01330527
0x01330527
0x0133052b
0x0133052d
0x01330532
0x01330541
0x01330541
0x01330543
0x01330546
0x01330546
0x00000000
0x01330534
0x01330534
0x01330539
0x0133053c
0x0133053f
0x0133059a
0x0133059f
0x013305a5
0x00000000
0x00000000
0x00000000
0x0133053f
0x01330532
0x00000000
0x00000000
0x00000000
0x01330414
0x01330407
0x013303fa
0x013302f2

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 01330322
LocalAlloc.KERNEL32(00000040,?), ref: 01330367
___std_exception_copy.LIBVCRUNTIME ref: 013303DE
LocalFree.KERNEL32(?), ref: 0133041B
LocalFree.KERNEL32(?,?,?,?,?,C9209188,C9209188,?,?), ref: 01330546

Strings

iostream, xrefs: 013305A0
ios_base::failbit set, xrefs: 013304B2

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Local$AllocFree$___std_exception_copy
String ID: ios_base::failbit set$iostream
API String ID: 2276494016-302468714
Opcode ID: 842d74c724ebbf0cb14e82459b8b3cd245ed1ae1eefee7e04d6bd4f22cd2c47f
Instruction ID: 950c7cdf4774427fbea63b5852ba097b9df2722ff236052cff740c3e85934ed7
Opcode Fuzzy Hash: 842d74c724ebbf0cb14e82459b8b3cd245ed1ae1eefee7e04d6bd4f22cd2c47f
Instruction Fuzzy Hash: 4CA1A0B1D00209DFDB18DFA8D484BAEFBB9FB48314F14825DE915AB381D7709A44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0132BA30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 195
memoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0132BA30(void* __ebx, void* __edi) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr* _v36;
				char _v52;
				char _v100;
				char _v104;
				intOrPtr _v108;
				char _v112;
				intOrPtr _v116;
				short _v120;
				intOrPtr _v124;
				short _v128;
				intOrPtr _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v188;
				void* __esi;
				void* __ebp;
				signed int _t81;
				intOrPtr* _t85;
				signed int _t89;
				intOrPtr _t107;
				signed int _t112;
				intOrPtr _t118;
				intOrPtr _t119;
				void* _t126;
				void* _t129;
				intOrPtr* _t131;
				intOrPtr _t141;
				intOrPtr* _t144;
				intOrPtr* _t145;
				signed int _t149;
				void* _t153;
				signed int _t156;
				signed int _t157;
				void* _t160;

				_t129 = _t153;
				_t156 = (_t153 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t129 + 4));
				_t149 = _t156;
				_push(0xffffffff);
				_push(0x136a924);
				_push( *[fs:0x0]);
				_push(_t129);
				_t157 = _t156 - 0x80;
				_t81 =  *0x1383020; // 0xc9209188
				_push(_t81 ^ _t149);
				 *[fs:0x0] =  &_v24;
				_v32 = 0;
				_t85 =  *((intOrPtr*)(_t129 + 8));
				if(_t85 == 0 ||  *_t85 != 0) {
					L24:
					 *[fs:0x0] = _v24;
					return 2;
				} else {
					_t144 = LocalAlloc(0x40, 0x44);
					_v36 = _t144;
					_v16 = 0;
					if(_t144 == 0) {
						_t144 = 0;
						__eflags = 0;
						goto L10;
					} else {
						_t107 =  *((intOrPtr*)( *((intOrPtr*)(_t129 + 0xc)) + 4));
						if(_t107 == 0) {
							_t141 = 0x137b6c9;
						} else {
							_t141 =  *((intOrPtr*)(_t107 + 0x18));
							if(_t141 == 0) {
								_t141 = _t107 + 0x1c;
							}
						}
						_t131 =  &_v152;
						E01335EA5(_t131, 0);
						_v16 = 1;
						_v148 = 0;
						_v144 = 0;
						_v16 = 2;
						_v140 = 0;
						_v136 = 0;
						_v16 = 3;
						_v132 = 0;
						_v128 = 0;
						_v16 = 4;
						_v124 = 0;
						_v120 = 0;
						_v16 = 5;
						_v116 = 0;
						_v112 = 0;
						_v16 = 6;
						_v108 = 0;
						_v104 = 0;
						_v16 = 7;
						_t169 = _t141;
						if(_t141 == 0) {
							E013320D0("bad locale name");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t149);
							_push(0xffffffff);
							_push(0x136a95d);
							_push( *[fs:0x0]);
							_push(_t131);
							_push(_t144);
							_t112 =  *0x1383020; // 0xc9209188
							_push(_t112 ^ _t157);
							 *[fs:0x0] =  &_v188;
							_t145 = _t131;
							__eflags =  *_t145;
							if( *_t145 == 0) {
								E01335EA5( &_v32, 0);
								_v20 = 0;
								__eflags =  *_t145;
								if( *_t145 == 0) {
									_t118 =  *0x138488c; // 0x0
									_t119 = _t118 + 1;
									__eflags = _t119;
									 *0x138488c = _t119;
									 *_t145 = _t119;
								}
								_v20 = 0xffffffff;
								E01335EFD( &_v32);
							}
							 *[fs:0x0] = _v28;
							return  *_t145;
						} else {
							E01335D63(_t131,  &_v152, _t141);
							_v16 = 8;
							_v32 = 1;
							 *_t144 = 0x136e0d8;
							_v16 = 9;
							 *_t144 = 0x136e0e8;
							 *((intOrPtr*)(_t144 + 4)) = 0;
							_v16 = 0xa;
							 *_t144 = 0x136e0fc;
							_v16 = 0xb;
							 *_t144 = 0x136e594;
							E0133608C(_t141, _t144, _t169,  &_v52);
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							_t126 = E01336203(_t169,  &_v100);
							_t157 = _t157 + 0x10;
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x18], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [esi+0x28], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [esi+0x38], xmm0");
							 *((intOrPtr*)(_t144 + 0x40)) =  *((intOrPtr*)(_t126 + 0x28));
							_v16 = 8;
							L10:
							_v16 = 0xc;
							 *((intOrPtr*)( *((intOrPtr*)(_t129 + 8)))) = _t144;
							_v16 = 0xffffffff;
							_t89 = _v32;
							if((_t89 & 0x00000001) != 0) {
								_v32 = _t89 & 0xfffffffe;
								_v16 = 0x13;
								E01335DAE(_t131,  &_v152);
								_t160 = _t157 + 4;
								_v16 = 0x12;
								_t93 = _v108;
								if(_v108 != 0) {
									E0134C213(_t93);
									_t160 = _t160 + 4;
								}
								_v108 = 0;
								_v16 = 0x11;
								_t94 = _v116;
								if(_v116 != 0) {
									E0134C213(_t94);
									_t160 = _t160 + 4;
								}
								_v116 = 0;
								_v16 = 0x10;
								_t95 = _v124;
								if(_v124 != 0) {
									E0134C213(_t95);
									_t160 = _t160 + 4;
								}
								_v124 = 0;
								_v16 = 0xf;
								_t96 = _v132;
								if(_v132 != 0) {
									E0134C213(_t96);
									_t160 = _t160 + 4;
								}
								_v132 = 0;
								_v16 = 0xe;
								_t97 = _v140;
								if(_v140 != 0) {
									E0134C213(_t97);
									_t160 = _t160 + 4;
								}
								_v140 = 0;
								_v16 = 0xd;
								_t98 = _v148;
								if(_v148 != 0) {
									E0134C213(_t98);
								}
								_v148 = 0;
								_v16 = 0xffffffff;
								E01335EFD( &_v152);
							}
							goto L24;
						}
					}
				}
			}

0x0132ba31
0x0132ba39
0x0132ba40
0x0132ba44
0x0132ba46
0x0132ba48
0x0132ba53
0x0132ba54
0x0132ba55
0x0132ba5d
0x0132ba64
0x0132ba68
0x0132ba70
0x0132ba73
0x0132ba78
0x0132bcb4
0x0132bcbc
0x0132bccc
0x0132ba87
0x0132ba91
0x0132ba93
0x0132ba96
0x0132ba9f
0x0132bbbe
0x0132bbbe
0x00000000
0x0132baa5
0x0132baa8
0x0132baad
0x0132babb
0x0132baaf
0x0132baaf
0x0132bab4
0x0132bab6
0x0132bab6
0x0132bab4
0x0132bac2
0x0132bac8
0x0132bacd
0x0132bad1
0x0132badb
0x0132bae2
0x0132bae6
0x0132baed
0x0132baf1
0x0132baf7
0x0132bafe
0x0132bb02
0x0132bb06
0x0132bb09
0x0132bb0d
0x0132bb11
0x0132bb14
0x0132bb17
0x0132bb1b
0x0132bb1e
0x0132bb21
0x0132bb25
0x0132bb27
0x0132bcd2
0x0132bcd7
0x0132bcd8
0x0132bcd9
0x0132bcda
0x0132bcdb
0x0132bcdc
0x0132bcdd
0x0132bcde
0x0132bcdf
0x0132bce0
0x0132bce3
0x0132bce5
0x0132bcf0
0x0132bcf1
0x0132bcf2
0x0132bcf3
0x0132bcfa
0x0132bcfe
0x0132bd04
0x0132bd06
0x0132bd09
0x0132bd10
0x0132bd15
0x0132bd1c
0x0132bd1f
0x0132bd21
0x0132bd26
0x0132bd26
0x0132bd27
0x0132bd2c
0x0132bd2c
0x0132bd2e
0x0132bd38
0x0132bd38
0x0132bd42
0x0132bd4e
0x0132bb2d
0x0132bb35
0x0132bb3a
0x0132bb43
0x0132bb46
0x0132bb4c
0x0132bb53
0x0132bb59
0x0132bb60
0x0132bb67
0x0132bb6d
0x0132bb78
0x0132bb7e
0x0132bb86
0x0132bb8d
0x0132bb91
0x0132bb96
0x0132bb99
0x0132bb9c
0x0132bba0
0x0132bba4
0x0132bba8
0x0132bbad
0x0132bbb5
0x0132bbb8
0x0132bbc0
0x0132bbc0
0x0132bbca
0x0132bbcc
0x0132bbd3
0x0132bbd8
0x0132bbe1
0x0132bbe4
0x0132bbf2
0x0132bbf7
0x0132bbfa
0x0132bbfe
0x0132bc03
0x0132bc06
0x0132bc0b
0x0132bc0b
0x0132bc0e
0x0132bc15
0x0132bc19
0x0132bc1e
0x0132bc21
0x0132bc26
0x0132bc26
0x0132bc29
0x0132bc30
0x0132bc34
0x0132bc39
0x0132bc3c
0x0132bc41
0x0132bc41
0x0132bc44
0x0132bc4b
0x0132bc4f
0x0132bc54
0x0132bc57
0x0132bc5c
0x0132bc5c
0x0132bc5f
0x0132bc66
0x0132bc6a
0x0132bc6f
0x0132bc72
0x0132bc77
0x0132bc77
0x0132bc7a
0x0132bc81
0x0132bc85
0x0132bc8d
0x0132bc90
0x0132bc95
0x0132bc98
0x0132bca2
0x0132bcaf
0x0132bcaf
0x00000000
0x0132bbd8
0x0132bb27
0x0132ba9f

APIs

LocalAlloc.KERNEL32(00000040,00000044,C9209188,?,00000000), ref: 0132BA8B
std::_Lockit::_Lockit.LIBCPMT ref: 0132BAC8
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0132BB35
__Getctype.LIBCPMT ref: 0132BB7E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0132BBF2
std::_Lockit::~_Lockit.LIBCPMT ref: 0132BCAF

Strings

bad locale name, xrefs: 0132BCCD

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: c383364f8bcea0535fac01a2ff2fa11e19ee0ab00624b0773025055f47f2430e
Instruction ID: 2d3465521ba61b546599fea88fd52015107dac4e75b6c3fdf2b239becedf6be0
Opcode Fuzzy Hash: c383364f8bcea0535fac01a2ff2fa11e19ee0ab00624b0773025055f47f2430e
Instruction Fuzzy Hash: 788175B0D05358DFEF20DFA8C94478EFBF4AF14308F148199D548AB281EB75AA48CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0132C220 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 170
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0132C220(void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr* _v24;
				char _v40;
				char _v44;
				intOrPtr _v48;
				char _v52;
				intOrPtr _v56;
				short _v60;
				intOrPtr _v64;
				short _v68;
				intOrPtr _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				intOrPtr _v116;
				char _v124;
				intOrPtr* _v128;
				void* __ebp;
				signed int _t76;
				intOrPtr* _t80;
				signed int _t84;
				intOrPtr _t102;
				signed int _t107;
				signed int _t108;
				intOrPtr* _t116;
				intOrPtr _t124;
				intOrPtr* _t127;
				void* _t130;
				signed int _t131;
				void* _t132;

				_push(0xffffffff);
				_push(0x136abc5);
				_push( *[fs:0x0]);
				_t131 = _t130 - 0x4c;
				_t76 =  *0x1383020; // 0xc9209188
				_push(_t76 ^ _t128);
				 *[fs:0x0] =  &_v16;
				_v20 = 0;
				_t80 = _a4;
				if(_t80 == 0 ||  *_t80 != 0) {
					L24:
					 *[fs:0x0] = _v16;
					return 2;
				} else {
					_t127 = LocalAlloc(0x40, 0x18);
					_v24 = _t127;
					_v8 = 0;
					if(_t127 == 0) {
						_t127 = 0;
						__eflags = 0;
						goto L10;
					} else {
						_t102 =  *((intOrPtr*)(_a8 + 4));
						if(_t102 == 0) {
							_t124 = 0x137b6c9;
						} else {
							_t124 =  *((intOrPtr*)(_t102 + 0x18));
							if(_t124 == 0) {
								_t124 = _t102 + 0x1c;
							}
						}
						_t116 =  &_v92;
						E01335EA5(_t116, 0);
						_v8 = 1;
						_v88 = 0;
						_v84 = 0;
						_v8 = 2;
						_v80 = 0;
						_v76 = 0;
						_v8 = 3;
						_v72 = 0;
						_v68 = 0;
						_v8 = 4;
						_v64 = 0;
						_v60 = 0;
						_v8 = 5;
						_v56 = 0;
						_v52 = 0;
						_v8 = 6;
						_v48 = 0;
						_v44 = 0;
						_v8 = 7;
						_t139 = _t124;
						if(_t124 == 0) {
							E013320D0("bad locale name");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(0xffffffff);
							_push(0x13695ed);
							_push( *[fs:0x0]);
							_push(_t116);
							_t107 =  *0x1383020; // 0xc9209188
							_t108 = _t107 ^ _t131;
							__eflags = _t108;
							_push(_t108);
							 *[fs:0x0] =  &_v124;
							_v128 = _t116;
							asm("xorps xmm0, xmm0");
							 *_t116 = 0x136d3c0;
							asm("movq [ecx+0x4], xmm0");
							 *(_t116 + 4) = "bad cast";
							_v116 = 0;
							 *_t116 = 0x136e0cc;
							_v116 = 0xffffffff;
							 *[fs:0x0] = _v124;
							return _t116;
						} else {
							E01335D63(_t116,  &_v92, _t124);
							_v8 = 8;
							_v20 = 1;
							 *_t127 = 0x136e0d8;
							_v8 = 9;
							 *_t127 = 0x136e0e8;
							 *((intOrPtr*)(_t127 + 4)) = 0;
							_v8 = 0xa;
							 *_t127 = 0x136e0fc;
							_v8 = 0xb;
							 *_t127 = 0x136e10c;
							E0133608C(_t124, _t127, _t139,  &_v40);
							_t131 = _t131 + 0xc;
							asm("movups xmm0, [eax]");
							asm("movups [esi+0x8], xmm0");
							_v8 = 8;
							L10:
							_v8 = 0xc;
							 *_a4 = _t127;
							_v8 = 0xffffffff;
							_t84 = _v20;
							if((_t84 & 0x00000001) != 0) {
								_v20 = _t84 & 0xfffffffe;
								_v8 = 0x13;
								E01335DAE(_t116,  &_v92);
								_t132 = _t131 + 4;
								_v8 = 0x12;
								_t88 = _v48;
								if(_v48 != 0) {
									E0134C213(_t88);
									_t132 = _t132 + 4;
								}
								_v48 = 0;
								_v8 = 0x11;
								_t89 = _v56;
								if(_v56 != 0) {
									E0134C213(_t89);
									_t132 = _t132 + 4;
								}
								_v56 = 0;
								_v8 = 0x10;
								_t90 = _v64;
								if(_v64 != 0) {
									E0134C213(_t90);
									_t132 = _t132 + 4;
								}
								_v64 = 0;
								_v8 = 0xf;
								_t91 = _v72;
								if(_v72 != 0) {
									E0134C213(_t91);
									_t132 = _t132 + 4;
								}
								_v72 = 0;
								_v8 = 0xe;
								_t92 = _v80;
								if(_v80 != 0) {
									E0134C213(_t92);
									_t132 = _t132 + 4;
								}
								_v80 = 0;
								_v8 = 0xd;
								_t93 = _v88;
								if(_v88 != 0) {
									E0134C213(_t93);
								}
								_v88 = 0;
								_v8 = 0xffffffff;
								E01335EFD( &_v92);
							}
							goto L24;
						}
					}
				}
			}

0x0132c223
0x0132c225
0x0132c230
0x0132c231
0x0132c236
0x0132c23d
0x0132c241
0x0132c249
0x0132c24c
0x0132c251
0x0132c44a
0x0132c452
0x0132c45f
0x0132c260
0x0132c26a
0x0132c26c
0x0132c26f
0x0132c278
0x0132c360
0x0132c360
0x00000000
0x0132c27e
0x0132c281
0x0132c286
0x0132c294
0x0132c288
0x0132c288
0x0132c28d
0x0132c28f
0x0132c28f
0x0132c28d
0x0132c29b
0x0132c29e
0x0132c2a3
0x0132c2a7
0x0132c2ae
0x0132c2b2
0x0132c2b6
0x0132c2bd
0x0132c2c1
0x0132c2c7
0x0132c2ce
0x0132c2d2
0x0132c2d6
0x0132c2d9
0x0132c2dd
0x0132c2e1
0x0132c2e4
0x0132c2e7
0x0132c2eb
0x0132c2ee
0x0132c2f1
0x0132c2f5
0x0132c2f7
0x0132c465
0x0132c46a
0x0132c46b
0x0132c46c
0x0132c46d
0x0132c46e
0x0132c46f
0x0132c473
0x0132c475
0x0132c480
0x0132c481
0x0132c482
0x0132c487
0x0132c487
0x0132c489
0x0132c48d
0x0132c493
0x0132c496
0x0132c499
0x0132c49f
0x0132c4a4
0x0132c4ab
0x0132c4b2
0x0132c4b8
0x0132c4c4
0x0132c4cf
0x0132c2fd
0x0132c302
0x0132c307
0x0132c310
0x0132c313
0x0132c319
0x0132c320
0x0132c326
0x0132c32d
0x0132c334
0x0132c33a
0x0132c345
0x0132c34b
0x0132c350
0x0132c353
0x0132c356
0x0132c35a
0x0132c362
0x0132c362
0x0132c36c
0x0132c36e
0x0132c375
0x0132c37a
0x0132c383
0x0132c386
0x0132c391
0x0132c396
0x0132c399
0x0132c39d
0x0132c3a2
0x0132c3a5
0x0132c3aa
0x0132c3aa
0x0132c3ad
0x0132c3b4
0x0132c3b8
0x0132c3bd
0x0132c3c0
0x0132c3c5
0x0132c3c5
0x0132c3c8
0x0132c3cf
0x0132c3d3
0x0132c3d8
0x0132c3db
0x0132c3e0
0x0132c3e0
0x0132c3e3
0x0132c3ea
0x0132c3ee
0x0132c3f3
0x0132c3f6
0x0132c3fb
0x0132c3fb
0x0132c3fe
0x0132c405
0x0132c409
0x0132c40e
0x0132c411
0x0132c416
0x0132c416
0x0132c419
0x0132c420
0x0132c424
0x0132c429
0x0132c42c
0x0132c431
0x0132c434
0x0132c43b
0x0132c445
0x0132c445
0x00000000
0x0132c37a
0x0132c2f7
0x0132c278

APIs

LocalAlloc.KERNEL32(00000040,00000018,C9209188,?,00000000,?,?,?,?,?,?,?,00000000,0136ABC5,000000FF), ref: 0132C264
std::_Lockit::_Lockit.LIBCPMT ref: 0132C29E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0132C302
__Getctype.LIBCPMT ref: 0132C34B
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0132C391
std::_Lockit::~_Lockit.LIBCPMT ref: 0132C445

Strings

bad locale name, xrefs: 0132C460

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: f8e507a159ab48f49991343263210aea50b4496b7fb272521dfd067e70d26ac7
Instruction ID: 5f1eb98a99035d9a37c0b00b775f53095adf6756463393faa4e5ac2c8f49f0e9
Opcode Fuzzy Hash: f8e507a159ab48f49991343263210aea50b4496b7fb272521dfd067e70d26ac7
Instruction Fuzzy Hash: 6A614CB0D01288EBEB21DFE8C5047DEBFF4AF15708F248559D454AB281E7B99A08DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0134743E Relevance: 12.2, APIs: 8, Instructions: 224
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E0134743E(intOrPtr _a4, intOrPtr _a8, short* _a12, short* _a16, char* _a20, int _a24, int _a28) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				int _v32;
				char* _v36;
				short* _v40;
				int _v44;
				short* _v48;
				short* _v52;
				intOrPtr _v56;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t54;
				short* _t58;
				signed int _t63;
				signed int _t64;
				short* _t66;
				signed int _t68;
				signed int _t69;
				short* _t72;
				char* _t75;
				char* _t76;
				int _t79;
				intOrPtr _t88;
				intOrPtr _t89;
				short* _t96;
				signed int _t97;
				short* _t98;

				_t54 =  *0x1383020; // 0xc9209188
				_v8 = _t54 ^ _t97;
				_t96 = _a12;
				_t95 = _a16;
				_v56 = _a4;
				_t57 = _a20;
				_v32 = _t96;
				_v36 = _a20;
				if(_t95 <= 0) {
					if(_t95 < 0xffffffff) {
						goto L56;
					}
					goto L3;
				} else {
					_t95 = E0135807B(_t96, _t95);
					_t57 = _v36;
					L3:
					_t79 = _a24;
					if(_t79 <= 0) {
						if(_t79 < 0xffffffff) {
							L56:
							_t58 = 0;
							L57:
							return E01347708(_t58, _t79, _v8 ^ _t97, _t94, _t95, _t96);
						}
						L6:
						if(_t95 == 0 || _t79 == 0) {
							if(_t95 == _t79) {
								L55:
								_push(2);
								L20:
								_pop(_t58);
								goto L57;
							}
							if(_t79 > 1) {
								L29:
								_t58 = 1;
								goto L57;
							}
							if(_t95 > 1) {
								L19:
								_push(3);
								goto L20;
							}
							if(GetCPInfo(_a28,  &_v28) == 0) {
								goto L56;
							}
							if(_t95 <= 0) {
								if(_t79 <= 0) {
									goto L30;
								}
								if(_v28 < 2) {
									goto L29;
								}
								_t75 =  &_v22;
								if(_v22 == 0) {
									goto L29;
								}
								_t95 = _v36;
								while(1) {
									_t88 =  *((intOrPtr*)(_t75 + 1));
									if(_t88 == 0) {
										goto L29;
									}
									_t94 =  *_t95;
									if(_t94 <  *_t75 || _t94 > _t88) {
										_t75 = _t75 + 2;
										if( *_t75 != 0) {
											continue;
										}
										goto L29;
									} else {
										goto L55;
									}
								}
								goto L29;
							}
							if(_v28 < 2) {
								goto L19;
							}
							_t76 =  &_v22;
							if(_v22 == 0) {
								goto L19;
							} else {
								goto L15;
							}
							while(1) {
								L15:
								_t89 =  *((intOrPtr*)(_t76 + 1));
								if(_t89 == 0) {
									goto L19;
								}
								_t94 =  *_t96;
								if(_t94 <  *_t76 || _t94 > _t89) {
									_t76 = _t76 + 2;
									if( *_t76 != 0) {
										continue;
									}
									goto L19;
								} else {
									goto L55;
								}
							}
							goto L19;
						} else {
							L30:
							_t96 = 0;
							_t63 = MultiByteToWideChar(_a28, 9, _v32, _t95, 0, 0);
							_v44 = _t63;
							if(_t63 == 0) {
								goto L56;
							}
							_t94 = _t63 + _t63 + 8;
							asm("sbb eax, eax");
							_t64 = _t63 & _t63 + _t63 + 0x00000008;
							if(_t64 == 0) {
								_v52 = 0;
								L54:
								E01346F0A( &_v52);
								_t58 = _t96;
								goto L57;
							}
							if(_t64 > 0x400) {
								_push(_t64);
								_t66 = E01350DEB();
								_v40 = _t66;
								if(_t66 == 0) {
									L38:
									_v52 = _t66;
									if(_t66 == 0 || MultiByteToWideChar(_a28, 1, _v32, _t95, _t66, _v44) == 0) {
										goto L54;
									} else {
										_t95 = _v36;
										_t68 = MultiByteToWideChar(_a28, 9, _v36, _t79, _t96, _t96);
										_v32 = _t68;
										if(_t68 == 0) {
											goto L54;
										}
										_t94 = _t68 + _t68 + 8;
										asm("sbb eax, eax");
										_t69 = _t68 & _t68 + _t68 + 0x00000008;
										if(_t69 == 0) {
											_v48 = _t96;
											L52:
											E01346F0A( &_v48);
											goto L54;
										}
										if(_t69 > 0x400) {
											_push(_t69);
											_t95 = E01350DEB();
											if(_t95 == 0) {
												L48:
												_v48 = _t95;
												if(_t95 != 0) {
													_t72 = MultiByteToWideChar(_a28, 1, _v36, _t79, _t95, _v32);
													if(_t72 != 0) {
														__imp__CompareStringEx(_v56, _a8, _v40, _v44, _t95, _v32, _t96, _t96, _t96);
														_t96 = _t72;
													}
												}
												goto L52;
											}
											 *_t95 = 0xdddd;
											L47:
											_t95 =  &(_t95[4]);
											goto L48;
										}
										E01347FF0(_t69);
										_t95 = _t98;
										if(_t95 == 0) {
											goto L48;
										}
										 *_t95 = 0xcccc;
										goto L47;
									}
								}
								 *_t66 = 0xdddd;
								L37:
								_t66 =  &(_t66[4]);
								_v40 = _t66;
								goto L38;
							}
							E01347FF0(_t64);
							_t66 = _t98;
							_v40 = _t66;
							if(_t66 == 0) {
								goto L38;
							}
							 *_t66 = 0xcccc;
							goto L37;
						}
					}
					_t79 = E0135807B(_t57, _t79);
					goto L6;
				}
			}

0x01347444
0x0134744b
0x01347453
0x01347457
0x0134745a
0x0134745d
0x01347460
0x01347463
0x01347468
0x0134747d
0x00000000
0x00000000
0x00000000
0x0134746a
0x01347472
0x01347474
0x01347483
0x01347483
0x01347488
0x0134749a
0x01347690
0x01347690
0x01347692
0x013476a3
0x013476a3
0x013474a0
0x013474a2
0x013474ae
0x01347689
0x01347689
0x01347509
0x01347509
0x00000000
0x01347509
0x013474b7
0x01347542
0x01347544
0x00000000
0x01347544
0x013474c0
0x01347507
0x01347507
0x00000000
0x01347507
0x013474d1
0x00000000
0x00000000
0x013474d9
0x01347511
0x00000000
0x00000000
0x01347517
0x00000000
0x00000000
0x0134751d
0x01347520
0x00000000
0x00000000
0x01347522
0x01347525
0x01347525
0x0134752a
0x00000000
0x00000000
0x0134752c
0x01347530
0x0134753a
0x01347540
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01347530
0x00000000
0x01347525
0x013474df
0x00000000
0x00000000
0x013474e5
0x013474e8
0x00000000
0x00000000
0x00000000
0x00000000
0x013474ea
0x013474ea
0x013474ea
0x013474ef
0x00000000
0x00000000
0x013474f1
0x013474f5
0x013474ff
0x01347505
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x013474f5
0x00000000
0x0134754a
0x0134754a
0x0134754a
0x01347557
0x0134755d
0x01347562
0x00000000
0x00000000
0x0134756b
0x01347570
0x01347572
0x01347574
0x0134767a
0x0134767d
0x01347680
0x01347685
0x00000000
0x01347685
0x0134757f
0x01347597
0x01347598
0x0134759d
0x013475a3
0x013475b1
0x013475b1
0x013475b6
0x00000000
0x013475d7
0x013475d7
0x013475e3
0x013475e9
0x013475ee
0x00000000
0x00000000
0x013475f7
0x013475fc
0x013475fe
0x01347600
0x0134766d
0x01347670
0x01347673
0x00000000
0x01347673
0x01347607
0x0134761c
0x01347622
0x01347627
0x01347632
0x01347632
0x01347637
0x01347646
0x0134764e
0x01347663
0x01347669
0x01347669
0x0134764e
0x00000000
0x01347637
0x01347629
0x0134762f
0x0134762f
0x00000000
0x0134762f
0x01347609
0x0134760e
0x01347612
0x00000000
0x00000000
0x01347614
0x00000000
0x01347614
0x013475b6
0x013475a5
0x013475ab
0x013475ab
0x013475ae
0x00000000
0x013475ae
0x01347581
0x01347586
0x01347588
0x0134758d
0x00000000
0x00000000
0x0134758f
0x00000000
0x0134758f
0x013474a2
0x01347493
0x00000000
0x01347493

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 013474C9
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 01347557
__alloca_probe_16.LIBCMT ref: 01347581
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 013475C9
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 013475E3
__alloca_probe_16.LIBCMT ref: 01347609
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 01347646
CompareStringEx.KERNEL32 ref: 01347663

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 726ca5a311717bf29de00267f0b4ba5503b7fdcfc9f55fd9b194ffbcaccd40ab
Instruction ID: b86c9ea65646cba15c7cc2a15e2260229e6f0dae9edaf17aa73a055608cf90f5
Opcode Fuzzy Hash: 726ca5a311717bf29de00267f0b4ba5503b7fdcfc9f55fd9b194ffbcaccd40ab
Instruction Fuzzy Hash: 5D71B67190024ADFDF218FACCC44AEE7FFAEF49368F184455E945A6250D735E440CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01346F23 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,CCCCCCCC,0132C6DF,?,00000001,00000000,?,00000000,?,0132C6DF,?), ref: 01346F6C
__alloca_probe_16.LIBCMT ref: 01346F98
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,0132C6DF,?,?,00000000,0132CCD3,0000003F,?), ref: 01346FD7
LCMapStringEx.KERNEL32 ref: 01346FF4
LCMapStringEx.KERNEL32 ref: 01347033
__alloca_probe_16.LIBCMT ref: 01347050
LCMapStringEx.KERNEL32 ref: 01347092
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,0132C6DF,?,?,00000000,0132CCD3,0000003F,?), ref: 013470B5

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 47d561a3673a41a8247bc3258a8c198e521d88acb9a1146920d98ca325ca8b78
Instruction ID: 79709739d2479570bd3f06780353f08a899c1a500abb29634141f98aa42b7eff
Opcode Fuzzy Hash: 47d561a3673a41a8247bc3258a8c198e521d88acb9a1146920d98ca325ca8b78
Instruction Fuzzy Hash: B051BE7660120AAFEF209FA8CC44FAB7BE9EF44758F114029FE0496190DB75E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01325940 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 389
fileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E01325940(void* __ebx, signed int __ecx, void* __edx, void* __edi) {
				int _v8;
				char _v16;
				signed int _v20;
				short _v540;
				int _v544;
				int _v548;
				char _v564;
				signed int _v568;
				int _v572;
				void* _v588;
				signed int _v592;
				int _v596;
				intOrPtr _v604;
				intOrPtr _v608;
				signed int _v612;
				signed int _v616;
				int _v620;
				void* _v624;
				intOrPtr _v628;
				signed int _v632;
				void* _v636;
				void* __esi;
				signed int _t173;
				signed int _t174;
				WCHAR* _t176;
				int _t177;
				intOrPtr _t178;
				signed int _t185;
				signed int _t190;
				WCHAR* _t196;
				signed int _t201;
				signed int _t212;
				signed int _t220;
				void* _t256;
				intOrPtr* _t259;
				void* _t267;
				signed int _t268;
				signed int _t269;
				void* _t282;
				void* _t285;
				void* _t293;
				void* _t295;
				int _t297;
				signed int _t298;
				void* _t301;
				int* _t303;
				void* _t304;
				intOrPtr _t305;
				signed int _t310;
				int _t312;
				char _t313;
				signed int _t314;
				void* _t315;
				intOrPtr _t316;
				void* _t320;
				int _t321;
				int _t322;
				signed int _t326;
				void* _t327;
				int _t328;
				intOrPtr _t329;
				void* _t330;

				_t294 = __edx;
				_t256 = __ebx;
				_t324 = _t326;
				_push(0xffffffff);
				_push(0x1369b03);
				_push( *[fs:0x0]);
				_t327 = _t326 - 0x26c;
				_t173 =  *0x1383020; // 0xc9209188
				_t174 = _t173 ^ _t326;
				_v20 = _t174;
				_push(__edi);
				_push(_t174);
				 *[fs:0x0] =  &_v16;
				_v636 = __edx;
				_t303 = __ecx;
				_v616 = __ecx;
				_v624 = __ecx;
				_v632 = __ecx;
				_t176 = __edx;
				_v620 = 0;
				if( *((intOrPtr*)(__edx + 0x14)) >= 8) {
					_t176 =  *__edx;
				}
				_t177 = GetTempFileNameW(_t176, L"URL", 0,  &_v540);
				if(_t177 != 0) {
					_t259 =  &_v540;
					_t295 = _t259 + 2;
					do {
						_t178 =  *_t259;
						_t259 = _t259 + 2;
					} while (_t178 != 0);
					_v596 = 0;
					_push(_t259 - _t295 >> 1);
					asm("xorps xmm0, xmm0");
					_v592 = 0;
					_push( &_v540);
					asm("movups [ebp-0x260], xmm0");
					E01323B40(_t256,  &_v612, _t303);
					_v8 = 3;
					_push(1);
					_t328 = _t327 - 0x18;
					_v624 = _t328;
					_t312 = _t328;
					_t329 = _t328 - 0x18;
					_v628 = _t329;
					_push( &_v612);
					E01322A10(_t256, _t329);
					_v8 = 4;
					_v8 = 3;
					E013298D0(_t256, _t312);
					_t330 = _t329 + 0x18;
					_v8 = 5;
					_v8 = 3;
					E01329BF0(_t256,  &_v564);
					_v8 = 8;
					_t185 = _v592;
					if(_t185 < 8) {
						L11:
						_v596 = 0;
						_push(3);
						asm("xorps xmm0, xmm0");
						_v592 = 7;
						_push(L"url");
						_v612 = 0;
						asm("movups [ebp-0x248], xmm0");
						_v572 = 0;
						_v568 = 0;
						E01323B40(_t256,  &_v588, _t303);
						_v8 = 9;
						_t267 = _v588;
						_t189 =  >=  ? _t267 :  &_v588;
						__eflags =  *((short*)( >=  ? _t267 :  &_v588)) - 0x2e;
						if( *((short*)( >=  ? _t267 :  &_v588)) == 0x2e) {
							_t321 = _v572;
							_t244 =  >=  ? _t267 :  &_v588;
							_t308 =  >=  ? _t267 :  &_v588;
							_t309 = ( >=  ? _t267 :  &_v588) - ( >=  ? _t267 :  &_v588);
							_t310 = ( >=  ? _t267 :  &_v588) - ( >=  ? _t267 :  &_v588) >> 1;
							_t291 =  <  ? _t321 - _t310 : 1;
							_t248 =  >=  ? _v588 :  &_v588;
							_t322 = _t321 - 1;
							_t300 = ( >=  ? _v588 :  &_v588) + _t310 * 2;
							E01348FF0(( >=  ? _v588 :  &_v588) + _t310 * 2, ( >=  ? _v588 :  &_v588) + _t310 * 2 + ( <  ? _t321 - _t310 : 1) * 2, 2 + (_t322 - _t310) * 2);
							_t303 = _v616;
							_t330 = _t330 + 0xc;
							_v572 = _t322;
						}
						_t190 = _v548;
						_t268 = _t190;
						_t297 = _v544;
						_t313 = _v564;
						_v616 = _t190;
						if(_t268 == 0) {
							L23:
							if(_t268 == 0xffffffff) {
								goto L19;
							} else {
								if(_t268 > _t190) {
									E01324580( &_v564, _t324, _t268 - _t190, 0);
									_t297 = _v544;
									_t269 = _v548;
									_t313 = _v564;
								} else {
									_v548 = _t268;
									_t238 =  >=  ? _t313 :  &_v564;
									 *((short*)(( >=  ? _t313 :  &_v564) + _t268 * 2)) = 0;
									_t297 = _v544;
									_t269 = _v548;
									_t313 = _v564;
								}
							}
						} else {
							_t268 = _t268 - 1;
							if(_t268 == 0xffffffff) {
								_t269 = _t190;
							} else {
								asm("o16 nop [eax+eax]");
								while(1) {
									_t240 =  >=  ? _t313 :  &_v564;
									if( *((short*)(( >=  ? _t313 :  &_v564) + _t268 * 2)) == 0x5c) {
										break;
									}
									_t242 =  >=  ? _t313 :  &_v564;
									if( *((short*)(( >=  ? _t313 :  &_v564) + _t268 * 2)) == 0x2e) {
										_t190 = _v616;
										goto L23;
									} else {
										_t268 = _t268 - 1;
										if(_t268 != 0xffffffff) {
											continue;
										} else {
											break;
										}
									}
									goto L20;
								}
								L19:
								_t269 = _v616;
							}
						}
						L20:
						if(_t269 >= _t297) {
							_push(0x2e);
							_push(_v632);
							_push(1);
							E01324660(_t256,  &_v564, _t303);
						} else {
							_v548 = _t269 + 1;
							_t235 =  >=  ? _t313 :  &_v564;
							 *((intOrPtr*)(( >=  ? _t313 :  &_v564) + _t269 * 2)) = 0x2e;
						}
						_t314 = _v548;
						_t272 =  >=  ? _v588 :  &_v588;
						_t294 = _v572;
						_v624 = _t294;
						_v628 =  >=  ? _v588 :  &_v588;
						_v616 = _t314;
						if(_t294 > _v544 - _t314) {
							E01324A80(_t256, _t303, _t294, _v632, _t272, _t294);
						} else {
							_v548 = _t294 + _t314;
							_t320 =  >=  ? _v564 :  &_v564;
							E01348FF0(_t320 + _v616 * 2, _v628, _t294 + _t294);
							_t330 = _t330 + 0xc;
							 *((short*)(_t320 + (_v624 + _v616) * 2)) = 0;
						}
						_t196 = E01329620(_t256,  &_v564, _t294,  &_v612);
						_v8 = 0xa;
						if(_t196[0xa] >= 8) {
							_t196 =  *_t196;
						}
						_t312 = MoveFileW( &_v540, _t196);
						_v8 = 9;
						E01323CC0( &_v612);
						if(_t312 != 0) {
							asm("xorps xmm0, xmm0");
							asm("movups [edi], xmm0");
							_t303[4] = 0;
							asm("movups xmm0, [ebp-0x230]");
							_t303[5] = 0;
							_v564 = 0;
							asm("movups [edi], xmm0");
							asm("movq xmm0, [ebp-0x220]");
							asm("movq [edi+0x10], xmm0");
							_v548 = 0;
							_v544 = 7;
							_v8 = 9;
							_v620 = 1;
							_v8 = 8;
							_t201 = _v568;
							if(_t201 < 8) {
								L46:
								_v572 = 0;
								_v568 = 7;
								_v588 = 0;
								goto L47;
							} else {
								_t281 = _v588;
								_t294 = _t281;
								if(2 + _t201 * 2 < 0x1000) {
									L44:
									if(_t281 != 0) {
										LocalFree(_t281);
									}
									goto L46;
								} else {
									_t281 =  *(_t294 - 4);
									if(_t294 - 4 > 0x1f) {
										goto L50;
									} else {
										goto L44;
									}
								}
							}
						} else {
							_t294 = _v636;
							_push(L"url");
							_push(L"URL");
							E01325940(_t256,  &_v612, _v636, _t303);
							_v8 = 0xb;
							DeleteFileW( &_v540);
							asm("xorps xmm0, xmm0");
							asm("movups [edi], xmm0");
							_t303[4] = _t312;
							asm("movups xmm0, [ebp-0x260]");
							_t303[5] = _t312;
							_v612 = 0;
							asm("movups [edi], xmm0");
							asm("movq xmm0, [ebp-0x250]");
							asm("movq [edi+0x10], xmm0");
							_v596 = _t312;
							_v592 = 7;
							_v8 = 0xb;
							_v620 = 1;
							_v8 = 9;
							E01323CC0( &_v612);
							_v8 = 8;
							_t220 = _v568;
							if(_t220 < 8) {
								L40:
								_v572 = 0;
								_v568 = 7;
								_v588 = 0;
								L47:
								_v8 = 0;
								E01323CC0( &_v564);
								goto L48;
							} else {
								_t285 = _v588;
								_t294 = _t285;
								if(2 + _t220 * 2 < 0x1000) {
									L38:
									if(_t285 != 0) {
										LocalFree(_t285);
									}
									goto L40;
								} else {
									_t281 =  *(_t294 - 4);
									if(_t294 - 4 > 0x1f) {
										E0134C5C2(_t256, _t281, _t294, _t303);
										goto L50;
									} else {
										goto L38;
									}
								}
							}
						}
					} else {
						_t293 = _v612;
						_t301 = _t293;
						if(2 + _t185 * 2 < 0x1000) {
							L9:
							if(_t293 != 0) {
								LocalFree(_t293);
							}
							goto L11;
						} else {
							_t281 =  *(_t301 - 4);
							_t294 = _t301 -  *(_t301 - 4);
							if(_t301 -  *(_t301 - 4) - 4 > 0x1f) {
								L50:
								E0134C5C2(_t256, _t281, _t294, _t303);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t312);
								_t316 = _v604;
								_t282 = 0;
								if(_t316 == 0) {
									return _v612;
								} else {
									_t298 = _v612;
									_push(_t303);
									_t305 = _v608;
									do {
										_t212 =  *(_t282 + _t305) & 0x000000ff;
										_t282 = _t282 + 1;
										_t298 = (_t212 ^ _t298) * 0x1000193;
									} while (_t282 < _t316);
									return _t298;
								}
							} else {
								goto L9;
							}
						}
					}
				} else {
					asm("xorps xmm0, xmm0");
					asm("movups [edi], xmm0");
					asm("movq [edi+0x10], xmm0");
					_t303[4] = _t177;
					_t303[5] = _t177;
					_t303[4] = _t177;
					_t303[5] = 7;
					 *_t303 = _t177;
					_v8 = _t177;
					_v620 = 1;
					L48:
					 *[fs:0x0] = _v16;
					_pop(_t304);
					_pop(_t315);
					return E01347708(_t303, _t256, _v20 ^ _t324, _t294, _t304, _t315);
				}
			}

0x01325940
0x01325940
0x01325941
0x01325943
0x01325945
0x01325950
0x01325951
0x01325957
0x0132595c
0x0132595e
0x01325962
0x01325963
0x01325967
0x0132596d
0x01325973
0x01325975
0x0132597b
0x01325981
0x01325987
0x01325989
0x01325997
0x01325999
0x01325999
0x013259aa
0x013259b2
0x013259e4
0x013259ea
0x013259f0
0x013259f0
0x013259f3
0x013259f6
0x013259fd
0x01325a0f
0x01325a10
0x01325a13
0x01325a1d
0x01325a24
0x01325a2b
0x01325a30
0x01325a3d
0x01325a3f
0x01325a42
0x01325a48
0x01325a4a
0x01325a4f
0x01325a55
0x01325a56
0x01325a5b
0x01325a5f
0x01325a65
0x01325a6a
0x01325a6d
0x01325a71
0x01325a7b
0x01325a80
0x01325a84
0x01325a8d
0x01325ac1
0x01325ac3
0x01325acd
0x01325acf
0x01325ad2
0x01325adc
0x01325ae7
0x01325aee
0x01325af5
0x01325afb
0x01325b01
0x01325b06
0x01325b19
0x01325b1f
0x01325b22
0x01325b26
0x01325b28
0x01325b3d
0x01325b40
0x01325b43
0x01325b4a
0x01325b52
0x01325b5e
0x01325b65
0x01325b67
0x01325b7b
0x01325b80
0x01325b86
0x01325b89
0x01325b89
0x01325b8f
0x01325b95
0x01325b97
0x01325b9d
0x01325ba3
0x01325bab
0x01325c1e
0x01325c21
0x00000000
0x01325c23
0x01325c25
0x01325c5e
0x01325c63
0x01325c69
0x01325c6f
0x01325c27
0x01325c2a
0x01325c36
0x01325c3b
0x01325c3f
0x01325c45
0x01325c4b
0x01325c4b
0x01325c25
0x01325bad
0x01325bad
0x01325bb1
0x01325c7a
0x01325bb7
0x01325bb7
0x01325bc0
0x01325bc9
0x01325bd1
0x00000000
0x00000000
0x01325bdc
0x01325be4
0x01325c18
0x00000000
0x01325be6
0x01325be6
0x01325bea
0x00000000
0x00000000
0x00000000
0x00000000
0x01325bea
0x00000000
0x01325be4
0x01325bec
0x01325bec
0x01325bec
0x01325bb1
0x01325bf2
0x01325bf4
0x01325c81
0x01325c83
0x01325c8f
0x01325c91
0x01325bfa
0x01325c00
0x01325c0c
0x01325c0f
0x01325c0f
0x01325ca3
0x01325ca9
0x01325cb6
0x01325cbe
0x01325cc4
0x01325cca
0x01325cd2
0x01325d30
0x01325cd4
0x01325cde
0x01325cea
0x01325d05
0x01325d10
0x01325d1b
0x01325d1b
0x01325d42
0x01325d47
0x01325d4f
0x01325d51
0x01325d51
0x01325d61
0x01325d63
0x01325d6d
0x01325d74
0x01325e66
0x01325e6b
0x01325e6e
0x01325e75
0x01325e7c
0x01325e83
0x01325e8a
0x01325e8d
0x01325e95
0x01325e9a
0x01325ea4
0x01325eae
0x01325eb2
0x01325ebc
0x01325ec0
0x01325ec9
0x01325efa
0x01325efc
0x01325f06
0x01325f10
0x00000000
0x01325ecb
0x01325ecb
0x01325ed8
0x01325edf
0x01325eee
0x01325ef0
0x01325ef8
0x01325ef8
0x00000000
0x01325ee1
0x01325ee1
0x01325eec
0x00000000
0x00000000
0x00000000
0x00000000
0x01325eec
0x01325edf
0x01325d7a
0x01325d7a
0x01325d86
0x01325d8b
0x01325d90
0x01325d98
0x01325da3
0x01325da9
0x01325dae
0x01325db1
0x01325db4
0x01325dbb
0x01325dbe
0x01325dc5
0x01325dc8
0x01325dd0
0x01325dd5
0x01325ddb
0x01325de5
0x01325de9
0x01325df3
0x01325dfd
0x01325e02
0x01325e06
0x01325e0f
0x01325e44
0x01325e46
0x01325e50
0x01325e5a
0x01325f17
0x01325f17
0x01325f24
0x00000000
0x01325e11
0x01325e11
0x01325e1e
0x01325e25
0x01325e38
0x01325e3a
0x01325e42
0x01325e42
0x00000000
0x01325e27
0x01325e27
0x01325e32
0x01325f46
0x00000000
0x00000000
0x00000000
0x00000000
0x01325e32
0x01325e25
0x01325e0f
0x01325a8f
0x01325a8f
0x01325a9c
0x01325aa3
0x01325ab6
0x01325ab8
0x01325abb
0x01325abb
0x00000000
0x01325aa5
0x01325aa5
0x01325aa8
0x01325ab0
0x01325f4b
0x01325f4b
0x01325f50
0x01325f51
0x01325f52
0x01325f53
0x01325f54
0x01325f55
0x01325f56
0x01325f57
0x01325f58
0x01325f59
0x01325f5a
0x01325f5b
0x01325f5c
0x01325f5d
0x01325f5e
0x01325f5f
0x01325f60
0x01325f61
0x01325f65
0x01325f69
0x01325f8f
0x01325f6b
0x01325f6b
0x01325f6f
0x01325f70
0x01325f74
0x01325f74
0x01325f78
0x01325f7b
0x01325f81
0x01325f89
0x01325f89
0x00000000
0x00000000
0x00000000
0x01325ab0
0x01325aa3
0x013259b4
0x013259b4
0x013259b7
0x013259ba
0x013259bf
0x013259c2
0x013259c5
0x013259c8
0x013259cf
0x013259d2
0x013259d5
0x01325f29
0x01325f2e
0x01325f36
0x01325f37
0x01325f45
0x01325f45

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,C9209188,?,00000004), ref: 013259AA
LocalFree.KERNEL32(?), ref: 01325ABB
MoveFileW.KERNEL32(?,00000000), ref: 01325D5B
DeleteFileW.KERNEL32(?), ref: 01325DA3

Strings

url, xrefs: 01325ADC, 01325D86
URL, xrefs: 013259A4, 01325D8B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: File$DeleteFreeLocalMoveNameTemp
String ID: URL$url
API String ID: 1622375482-346267919
Opcode ID: c0d6c2e28c1ff5197dcd1acaf42677d56b26931b6e14cb0d3bd3ed5e91cff727
Instruction ID: b1bbc47d302bd2dc8bf22e66be25ee3446208bcc4286458af7f9e32afec2f766
Opcode Fuzzy Hash: c0d6c2e28c1ff5197dcd1acaf42677d56b26931b6e14cb0d3bd3ed5e91cff727
Instruction Fuzzy Hash: 2A022770E14269DADB24EF28C998BDDBBB5BF54308F5042D9D409A7250EB74ABC4CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0132F5E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 189
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E0132F5E0(void* __ebx, intOrPtr* _a4, intOrPtr _a8) {
				char _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr* _v28;
				char _v32;
				signed int _v36;
				char _v40;
				signed int _v44;
				short _v48;
				signed int _v52;
				short _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				char _v72;
				signed int _v76;
				char _v80;
				char _v84;
				signed int _v88;
				intOrPtr _v92;
				char _v96;
				signed int _v100;
				signed int _v104;
				intOrPtr _v108;
				signed int _v116;
				char _v124;
				signed int _v132;
				intOrPtr _v136;
				intOrPtr _v188;
				intOrPtr _v200;
				char _v248;
				signed int _v268;
				char _v276;
				signed int _v280;
				char _v284;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t139;
				intOrPtr* _t142;
				intOrPtr _t162;
				signed int _t167;
				signed int _t168;
				void* _t172;
				signed int _t176;
				signed short _t177;
				signed int _t181;
				void* _t188;
				signed int _t190;
				signed int _t198;
				signed int _t219;
				void* _t222;
				signed int* _t224;
				char* _t226;
				intOrPtr* _t230;
				void* _t231;
				signed int _t232;
				intOrPtr _t235;
				void* _t240;
				void* _t241;
				intOrPtr* _t244;
				intOrPtr _t245;
				intOrPtr* _t246;
				signed int _t247;
				intOrPtr* _t248;
				void* _t250;
				intOrPtr* _t253;
				intOrPtr _t254;
				char _t255;
				void* _t257;
				signed int _t258;
				signed int _t260;
				signed int _t263;
				signed int _t267;
				void* _t268;
				void* _t270;
				signed int _t274;
				void* _t277;
				signed int _t278;
				void* _t279;
				void* _t288;

				_t260 = _t267;
				_push(0xffffffff);
				_push(0x136b2d1);
				_push( *[fs:0x0]);
				_t268 = _t267 - 0x40;
				_push(__ebx);
				_t139 =  *0x1383020; // 0xc9209188
				_push(_t139 ^ _t260);
				 *[fs:0x0] =  &_v16;
				_t142 = _a4;
				_t219 = 0;
				_v20 = 0;
				if(_t142 == 0 ||  *_t142 != 0) {
					L26:
					 *[fs:0x0] = _v16;
					return 5;
				} else {
					_t244 = LocalAlloc(0x40, 0xc);
					_v28 = _t244;
					_v8 = 0;
					if(_t244 == 0) {
						_t244 = 0;
						__eflags = 0;
						goto L12;
					} else {
						_t162 =  *((intOrPtr*)(_a8 + 4));
						if(_t162 == 0) {
							_t253 = 0x137b6c9;
						} else {
							_t253 =  *((intOrPtr*)(_t162 + 0x18));
							if(_t253 == 0) {
								_t253 = _t162 + 0x1c;
							}
						}
						_t226 =  &_v80;
						E01335EA5(_t226, 0);
						_v8 = 1;
						_v76 = 0;
						_v72 = 0;
						_v8 = 2;
						_v68 = 0;
						_v64 = 0;
						_v8 = 3;
						_v60 = 0;
						_v56 = 0;
						_v8 = 4;
						_v52 = 0;
						_v48 = 0;
						_v8 = 5;
						_v44 = 0;
						_v40 = 0;
						_v8 = 6;
						_v36 = 0;
						_v32 = 0;
						_v8 = 7;
						if(_t253 == 0) {
							E013320D0("bad locale name");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t219);
							_t222 = _t268;
							_t274 = (_t268 - 0x00000008 & 0xfffffff8) + 4;
							_push(_t260);
							_v108 =  *((intOrPtr*)(_t222 + 4));
							_t263 = _t274;
							_push(0xffffffff);
							_push(0x136b2fd);
							_push( *[fs:0x0]);
							_push(_t222);
							_t167 =  *0x1383020; // 0xc9209188
							_t168 = _t167 ^ _t263;
							_v132 = _t168;
							_push(_t253);
							_push(_t244);
							_push(_t168);
							 *[fs:0x0] =  &_v124;
							_t254 = _t226;
							_t245 = E01356A36(_t240, _t254);
							_v188 = _t245;
							_t172 = E01336203(__eflags,  &_v248);
							_v200 = _t254;
							asm("movups xmm0, [eax]");
							asm("movups [ebp-0x40], xmm0");
							asm("movups xmm0, [eax+0x10]");
							asm("movups [ebp-0x30], xmm0");
							asm("movq xmm0, [eax+0x20]");
							asm("movq [ebp-0x20], xmm0");
							_v136 =  *((intOrPtr*)(_t172 + 0x28));
							 *(_t254 + 8) = 0;
							 *(_t254 + 0x10) = 0;
							 *(_t254 + 0x14) = 0;
							_v116 = 0;
							E01336203(__eflags,  &_v248);
							_t277 = _t274 - 0x78 + 8;
							__eflags =  *((char*)(_t222 + 0xc));
							if( *((char*)(_t222 + 0xc)) == 0) {
								_t246 =  *((intOrPtr*)(_t245 + 8));
							} else {
								_t246 = 0x137b6c9;
							}
							_t230 = _t246;
							_t91 = _t230 + 1; // 0x137b6ca
							_t241 = _t91;
							do {
								_t176 =  *_t230;
								_t230 = _t230 + 1;
								__eflags = _t176;
							} while (_t176 != 0);
							_t231 = _t230 - _t241;
							_push(1);
							_t92 = _t231 + 1; // 0x137b6cb
							_t177 = _t92;
							_push(_t177);
							_v88 = _t177;
							_t232 = E01356A5E();
							_t278 = _t277 + 8;
							_v100 = _t232;
							__eflags = _t232;
							if(__eflags == 0) {
								E01332056(__eflags);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t263);
								_push(0xffffffff);
								_push(0x136b34e);
								_push( *[fs:0x0]);
								_t279 = _t278 - 8;
								_push(_t254);
								_push(_t246);
								_t181 =  *0x1383020; // 0xc9209188
								_push(_t181 ^ _t278);
								 *[fs:0x0] =  &_v276;
								_t247 = _t232;
								_v280 = 0;
								_v268 = 0;
								_t255 = E01356078(_t222, _t247, _t254);
								_t248 = _t247 + 8;
								_v284 = _t255;
								_v280 = 1;
								__eflags = _t248 -  &_v284;
								if(_t248 !=  &_v284) {
									E0134C213( *_t248);
									_t279 = _t279 + 4;
									 *_t248 = _t255;
									_t255 = 0;
									__eflags = 0;
									_v40 = 0;
								}
								_v36 = 1;
								__eflags = 1;
								_v36 = 0;
								_v24 = 0xffffffff;
								_t188 = E0134C213(_t255);
								 *[fs:0x0] = _v32;
								return _t188;
							} else {
								_t190 = _v88;
								__eflags = _t190;
								if(_t190 != 0) {
									E01348FF0(_t232, _t246, _t190);
									_t232 = _v100;
									_t278 = _t278 + 0xc;
								}
								 *(_t254 + 8) = _t232;
								_push( &_v80);
								 *(_t254 + 0x10) = E0132FBD0("false", 0);
								_push( &_v80);
								 *(_t254 + 0x14) = E0132FBD0("true", 0);
								__eflags =  *((char*)(_t222 + 0xc));
								_v104 = 0;
								if( *((char*)(_t222 + 0xc)) == 0) {
									_t235 = _v92;
									 *((short*)(_t254 + 0xc)) =  *( *(_t235 + 0x30)) & 0x0000ffff;
									_t198 =  *( *(_t235 + 0x34)) & 0x0000ffff;
								} else {
									_v84 = 0x2e;
									_v88 = 0;
									asm("xorps xmm0, xmm0");
									asm("movlpd [ebp-0x50], xmm0");
									E013362D2(_t232,  &_v88,  &_v84, 1,  &_v96,  &_v80);
									 *((short*)(_t254 + 0xc)) = _v88 & 0x0000ffff;
									asm("xorps xmm0, xmm0");
									_v84 = 0x2c;
									_v88 = 0;
									asm("movlpd [ebp-0x50], xmm0");
									E013362D2(_t232,  &_v88,  &_v84, 1,  &_v96,  &_v80);
									_t198 = _v88 & 0x0000ffff;
								}
								 *(_t254 + 0xe) = _t198;
								_v20 = 0xffffffff;
								 *[fs:0x0] = _v28;
								_pop(_t250);
								_pop(_t257);
								__eflags = _v36 ^ _t263;
								return E01347708(_t198, _t222, _v36 ^ _t263, _t241, _t250, _t257);
							}
						} else {
							E01335D63(_t226,  &_v80, _t253);
							_t288 = _t268 + 8;
							_v8 = 8;
							_v20 = 1;
							 *_t244 = 0x136e0d8;
							_v8 = 9;
							 *_t244 = 0x136e0e8;
							 *(_t244 + 4) = 0;
							_v8 = 0xa;
							_t36 = _t244 + 8; // 0x8
							_t224 = _t36;
							 *_t244 = 0x136e620;
							 *_t224 = 0;
							_v8 = 0xc;
							_t258 = E01356078(_t224, _t244, _t253);
							_v24 = _t258;
							_v20 = 3;
							if(_t224 !=  &_v24) {
								E0134C213( *_t224);
								_t288 = _t288 + 4;
								 *_t224 = _t258;
								_t258 = 0;
								_v24 = 0;
							}
							_v20 = 3;
							_t219 = 1;
							_v20 = 3;
							_v8 = 0xb;
							E0134C213(_t258);
							_t268 = _t288 + 4;
							_v8 = 8;
							L12:
							_v8 = 0xd;
							 *_a4 = _t244;
							_v8 = 0xffffffff;
							if((_t219 & 0x00000001) != 0) {
								_v20 = _t219 & 0xfffffffe;
								_v8 = 0x14;
								E01335DAE(_t226,  &_v80);
								_t270 = _t268 + 4;
								_v8 = 0x13;
								_t148 = _v36;
								if(_v36 != 0) {
									E0134C213(_t148);
									_t270 = _t270 + 4;
								}
								_v36 = 0;
								_v8 = 0x12;
								_t149 = _v44;
								if(_v44 != 0) {
									E0134C213(_t149);
									_t270 = _t270 + 4;
								}
								_v44 = 0;
								_v8 = 0x11;
								_t150 = _v52;
								if(_v52 != 0) {
									E0134C213(_t150);
									_t270 = _t270 + 4;
								}
								_v52 = 0;
								_v8 = 0x10;
								_t151 = _v60;
								if(_v60 != 0) {
									E0134C213(_t151);
									_t270 = _t270 + 4;
								}
								_v60 = 0;
								_v8 = 0xf;
								_t152 = _v68;
								if(_v68 != 0) {
									E0134C213(_t152);
									_t270 = _t270 + 4;
								}
								_v68 = 0;
								_v8 = 0xe;
								_t153 = _v76;
								if(_v76 != 0) {
									E0134C213(_t153);
								}
								_v76 = 0;
								_v8 = 0xffffffff;
								E01335EFD( &_v80);
							}
							goto L26;
						}
					}
				}
			}

0x0132f5e1
0x0132f5e3
0x0132f5e5
0x0132f5f0
0x0132f5f1
0x0132f5f4
0x0132f5f7
0x0132f5fe
0x0132f602
0x0132f608
0x0132f60b
0x0132f60d
0x0132f612
0x0132f837
0x0132f83f
0x0132f84d
0x0132f620
0x0132f62a
0x0132f62c
0x0132f62f
0x0132f634
0x0132f74f
0x0132f74f
0x00000000
0x0132f63a
0x0132f63d
0x0132f642
0x0132f650
0x0132f644
0x0132f644
0x0132f649
0x0132f64b
0x0132f64b
0x0132f649
0x0132f657
0x0132f65a
0x0132f65f
0x0132f663
0x0132f66a
0x0132f66e
0x0132f672
0x0132f679
0x0132f67d
0x0132f683
0x0132f68a
0x0132f68e
0x0132f692
0x0132f695
0x0132f699
0x0132f69d
0x0132f6a0
0x0132f6a3
0x0132f6a7
0x0132f6aa
0x0132f6ad
0x0132f6b3
0x0132f853
0x0132f858
0x0132f859
0x0132f85a
0x0132f85b
0x0132f85c
0x0132f85d
0x0132f85e
0x0132f85f
0x0132f860
0x0132f861
0x0132f869
0x0132f86c
0x0132f870
0x0132f874
0x0132f876
0x0132f878
0x0132f883
0x0132f884
0x0132f888
0x0132f88d
0x0132f88f
0x0132f892
0x0132f893
0x0132f894
0x0132f898
0x0132f89e
0x0132f8a5
0x0132f8ae
0x0132f8b1
0x0132f8b9
0x0132f8bc
0x0132f8bf
0x0132f8c3
0x0132f8c7
0x0132f8cb
0x0132f8d0
0x0132f8d8
0x0132f8db
0x0132f8e2
0x0132f8e9
0x0132f8f0
0x0132f8fe
0x0132f903
0x0132f906
0x0132f90a
0x0132f913
0x0132f90c
0x0132f90c
0x0132f90c
0x0132f916
0x0132f918
0x0132f918
0x0132f920
0x0132f920
0x0132f922
0x0132f923
0x0132f923
0x0132f927
0x0132f929
0x0132f92b
0x0132f92b
0x0132f92e
0x0132f92f
0x0132f937
0x0132f939
0x0132f93c
0x0132f93f
0x0132f941
0x0132fa3e
0x0132fa43
0x0132fa44
0x0132fa45
0x0132fa46
0x0132fa47
0x0132fa48
0x0132fa49
0x0132fa4a
0x0132fa4b
0x0132fa4c
0x0132fa4d
0x0132fa4e
0x0132fa4f
0x0132fa50
0x0132fa53
0x0132fa55
0x0132fa60
0x0132fa61
0x0132fa64
0x0132fa65
0x0132fa66
0x0132fa6d
0x0132fa71
0x0132fa77
0x0132fa79
0x0132fa80
0x0132fa8c
0x0132fa8e
0x0132fa94
0x0132fa97
0x0132fa9e
0x0132faa0
0x0132faa4
0x0132faa9
0x0132faac
0x0132faae
0x0132faae
0x0132fab0
0x0132fab0
0x0132fab8
0x0132fabb
0x0132fabe
0x0132fac1
0x0132fac9
0x0132fad4
0x0132fae1
0x0132f947
0x0132f947
0x0132f94a
0x0132f94c
0x0132f951
0x0132f956
0x0132f959
0x0132f959
0x0132f95f
0x0132f962
0x0132f972
0x0132f978
0x0132f988
0x0132f98b
0x0132f98f
0x0132f996
0x0132fa00
0x0132fa09
0x0132fa10
0x0132f998
0x0132f99b
0x0132f9a3
0x0132f9b0
0x0132f9b7
0x0132f9bd
0x0132f9c9
0x0132f9cd
0x0132f9d3
0x0132f9d7
0x0132f9e2
0x0132f9f2
0x0132f9f7
0x0132f9fb
0x0132fa13
0x0132fa17
0x0132fa21
0x0132fa29
0x0132fa2a
0x0132fa2e
0x0132fa3b
0x0132fa3b
0x0132f6b9
0x0132f6be
0x0132f6c3
0x0132f6c6
0x0132f6ca
0x0132f6d1
0x0132f6d7
0x0132f6de
0x0132f6e4
0x0132f6eb
0x0132f6f2
0x0132f6f2
0x0132f6f5
0x0132f6fb
0x0132f701
0x0132f70a
0x0132f70f
0x0132f712
0x0132f71b
0x0132f71f
0x0132f724
0x0132f727
0x0132f729
0x0132f72b
0x0132f72b
0x0132f733
0x0132f736
0x0132f739
0x0132f73c
0x0132f741
0x0132f746
0x0132f749
0x0132f751
0x0132f751
0x0132f75b
0x0132f75d
0x0132f767
0x0132f770
0x0132f773
0x0132f77e
0x0132f783
0x0132f786
0x0132f78a
0x0132f78f
0x0132f792
0x0132f797
0x0132f797
0x0132f79a
0x0132f7a1
0x0132f7a5
0x0132f7aa
0x0132f7ad
0x0132f7b2
0x0132f7b2
0x0132f7b5
0x0132f7bc
0x0132f7c0
0x0132f7c5
0x0132f7c8
0x0132f7cd
0x0132f7cd
0x0132f7d0
0x0132f7d7
0x0132f7db
0x0132f7e0
0x0132f7e3
0x0132f7e8
0x0132f7e8
0x0132f7eb
0x0132f7f2
0x0132f7f6
0x0132f7fb
0x0132f7fe
0x0132f803
0x0132f803
0x0132f806
0x0132f80d
0x0132f811
0x0132f816
0x0132f819
0x0132f81e
0x0132f821
0x0132f828
0x0132f832
0x0132f832
0x00000000
0x0132f767
0x0132f6b3
0x0132f634

APIs

LocalAlloc.KERNEL32(00000040,0000000C,C9209188,?,00000000,00000000,?,?,?,?,00000000,0136B2D1,000000FF,?,0132EBCA,00000000), ref: 0132F624
std::_Lockit::_Lockit.LIBCPMT ref: 0132F65A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0132F6BE
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0132F77E
std::_Lockit::~_Lockit.LIBCPMT ref: 0132F832

Strings

bad locale name, xrefs: 0132F84E

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: 33084df9f3f6a9aa87eea0fd7dccaefd6b141f9024beaecaaae302fedb29fb7d
Instruction ID: 232ec2cdf0eb73be60796392667ba7d194e6d6934023379dcaf154672dad76e3
Opcode Fuzzy Hash: 33084df9f3f6a9aa87eea0fd7dccaefd6b141f9024beaecaaae302fedb29fb7d
Instruction Fuzzy Hash: 14718CB0D01399EBEF11DFA8C94478EBFF8AF11358F144169D454AB380E7B59A08CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0132F3B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E0132F3B0(void* __ebx, intOrPtr* _a4, intOrPtr _a8) {
				signed int* _v0;
				char _v8;
				char _v12;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				short _v52;
				signed int _v56;
				short _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				char _v76;
				signed int _v80;
				char _v84;
				char _v88;
				signed int _v92;
				intOrPtr _v96;
				char _v100;
				signed int _v104;
				signed int _v108;
				char _v112;
				intOrPtr _v116;
				intOrPtr _v204;
				signed int _v212;
				char _v220;
				signed int _v228;
				intOrPtr _v232;
				intOrPtr _v284;
				intOrPtr _v296;
				char _v344;
				signed int _v364;
				char _v372;
				signed int _v376;
				char _v380;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				intOrPtr* _t207;
				intOrPtr _t226;
				signed int _t231;
				signed int _t234;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t254;
				signed int _t259;
				signed int _t260;
				void* _t264;
				signed int _t268;
				signed short _t269;
				signed int _t273;
				void* _t280;
				signed int _t282;
				signed int _t290;
				signed int _t313;
				signed int _t316;
				void* _t319;
				signed int* _t321;
				signed int _t331;
				void* _t332;
				signed int _t333;
				intOrPtr _t336;
				void* _t341;
				void* _t342;
				signed int _t345;
				signed int _t347;
				intOrPtr _t348;
				signed int _t349;
				signed int _t350;
				intOrPtr* _t351;
				void* _t353;
				intOrPtr* _t356;
				signed int _t358;
				intOrPtr _t359;
				char _t360;
				void* _t362;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				signed int _t370;
				signed int _t374;
				signed int _t375;
				void* _t377;
				void* _t379;
				void* _t381;
				signed int _t385;
				void* _t388;
				signed int _t389;
				void* _t390;
				void* _t399;

				_t365 = _t374;
				_push(0xffffffff);
				_push(0x136b1dd);
				_push( *[fs:0x0]);
				_t375 = _t374 - 0x3c;
				_push(__ebx);
				_t204 =  *0x1383020; // 0xc9209188
				_push(_t204 ^ _t365);
				 *[fs:0x0] =  &_v16;
				_t207 = _a4;
				_t313 = 0;
				_v20 = 0;
				if(_t207 == 0 ||  *_t207 != 0) {
					L24:
					 *[fs:0x0] = _v16;
					return 4;
				} else {
					_t356 = LocalAlloc(0x40, 8);
					_v24 = _t356;
					_v8 = 0;
					if(_t356 == 0) {
						_t356 = 0;
						__eflags = 0;
						goto L10;
					} else {
						_t226 =  *((intOrPtr*)(_a8 + 4));
						if(_t226 == 0) {
							_t345 = 0x137b6c9;
						} else {
							_t345 =  *(_t226 + 0x18);
							if(_t345 == 0) {
								_t345 = _t226 + 0x1c;
							}
						}
						_t323 =  &_v76;
						E01335EA5( &_v76, 0);
						_v8 = 1;
						_v72 = 0;
						_v68 = 0;
						_v8 = 2;
						_v64 = 0;
						_v60 = 0;
						_v8 = 3;
						_v56 = 0;
						_v52 = 0;
						_v8 = 4;
						_v48 = 0;
						_v44 = 0;
						_v8 = 5;
						_v40 = 0;
						_v36 = 0;
						_v8 = 6;
						_v32 = 0;
						_v28 = 0;
						_v8 = 7;
						if(_t345 == 0) {
							E013320D0("bad locale name");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t365);
							_t367 = _t375;
							_push(0xffffffff);
							_push(0x136b2d1);
							_push( *[fs:0x0]);
							_t379 = _t375 - 0x40;
							_push(_t313);
							_push(_t356);
							_push(_t345);
							_t231 =  *0x1383020; // 0xc9209188
							_push(_t231 ^ _t367);
							 *[fs:0x0] =  &_v112;
							_t234 = _v92;
							_t316 = 0;
							_v116 = 0;
							__eflags = _t234;
							if(_t234 == 0) {
								L52:
								 *[fs:0x0] = _v20;
								return 5;
							} else {
								__eflags =  *_t234;
								if( *_t234 != 0) {
									goto L52;
								} else {
									_t347 = LocalAlloc(0x40, 0xc);
									_v32 = _t347;
									_v12 = 0;
									__eflags = _t347;
									if(_t347 == 0) {
										_t347 = 0;
										__eflags = 0;
										goto L38;
									} else {
										_t254 =  *(_a4 + 4);
										__eflags = _t254;
										if(_t254 == 0) {
											_t358 = 0x137b6c9;
										} else {
											_t358 =  *(_t254 + 0x18);
											__eflags = _t358;
											if(_t358 == 0) {
												_t358 = _t254 + 0x1c;
											}
										}
										_t323 =  &_v84;
										E01335EA5(_t323, 0);
										_v12 = 1;
										_v80 = 0;
										_v76 = 0;
										_v12 = 2;
										_v72 = 0;
										_v68 = 0;
										_v12 = 3;
										_v64 = 0;
										_v60 = 0;
										_v12 = 4;
										_v56 = 0;
										_v52 = 0;
										_v12 = 5;
										_v48 = 0;
										_v44 = 0;
										_v12 = 6;
										_v40 = 0;
										_v36 = 0;
										_v12 = 7;
										__eflags = _t358;
										if(__eflags == 0) {
											E013320D0("bad locale name");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t316);
											_t319 = _t379;
											_t385 = (_t379 - 0x00000008 & 0xfffffff8) + 4;
											_push(_t367);
											_v204 =  *((intOrPtr*)(_t319 + 4));
											_t370 = _t385;
											_push(0xffffffff);
											_push(0x136b2fd);
											_push( *[fs:0x0]);
											_push(_t319);
											_t259 =  *0x1383020; // 0xc9209188
											_t260 = _t259 ^ _t370;
											_v228 = _t260;
											_push(_t358);
											_push(_t347);
											_push(_t260);
											 *[fs:0x0] =  &_v220;
											_t359 = _t323;
											_t348 = E01356A36(_t341, _t359);
											_v284 = _t348;
											_t264 = E01336203(__eflags,  &_v344);
											_v296 = _t359;
											asm("movups xmm0, [eax]");
											asm("movups [ebp-0x40], xmm0");
											asm("movups xmm0, [eax+0x10]");
											asm("movups [ebp-0x30], xmm0");
											asm("movq xmm0, [eax+0x20]");
											asm("movq [ebp-0x20], xmm0");
											_v232 =  *((intOrPtr*)(_t264 + 0x28));
											 *(_t359 + 8) = 0;
											 *(_t359 + 0x10) = 0;
											 *(_t359 + 0x14) = 0;
											_v212 = 0;
											E01336203(__eflags,  &_v344);
											_t388 = _t385 - 0x78 + 8;
											__eflags =  *((char*)(_t319 + 0xc));
											if( *((char*)(_t319 + 0xc)) == 0) {
												_t349 =  *(_t348 + 8);
											} else {
												_t349 = 0x137b6c9;
											}
											_t331 = _t349;
											_t156 = _t331 + 1; // 0x137b6ca
											_t342 = _t156;
											do {
												_t268 =  *_t331;
												_t331 = _t331 + 1;
												__eflags = _t268;
											} while (_t268 != 0);
											_t332 = _t331 - _t342;
											_push(1);
											_t157 = _t332 + 1; // 0x137b6cb
											_t269 = _t157;
											_push(_t269);
											_v92 = _t269;
											_t333 = E01356A5E();
											_t389 = _t388 + 8;
											_v104 = _t333;
											__eflags = _t333;
											if(__eflags == 0) {
												E01332056(__eflags);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t370);
												_push(0xffffffff);
												_push(0x136b34e);
												_push( *[fs:0x0]);
												_t390 = _t389 - 8;
												_push(_t359);
												_push(_t349);
												_t273 =  *0x1383020; // 0xc9209188
												_push(_t273 ^ _t389);
												 *[fs:0x0] =  &_v372;
												_t350 = _t333;
												_v376 = 0;
												_v364 = 0;
												_t360 = E01356078(_t319, _t350, _t359);
												_t351 = _t350 + 8;
												_v380 = _t360;
												_v376 = 1;
												__eflags = _t351 -  &_v380;
												if(_t351 !=  &_v380) {
													E0134C213( *_t351);
													_t390 = _t390 + 4;
													 *_t351 = _t360;
													_t360 = 0;
													__eflags = 0;
													_v44 = 0;
												}
												_v40 = 1;
												__eflags = 1;
												_v40 = 0;
												_v28 = 0xffffffff;
												_t280 = E0134C213(_t360);
												 *[fs:0x0] = _v36;
												return _t280;
											} else {
												_t282 = _v92;
												__eflags = _t282;
												if(_t282 != 0) {
													E01348FF0(_t333, _t349, _t282);
													_t333 = _v104;
													_t389 = _t389 + 0xc;
												}
												 *(_t359 + 8) = _t333;
												_push( &_v84);
												 *(_t359 + 0x10) = E0132FBD0("false", 0);
												_push( &_v84);
												 *(_t359 + 0x14) = E0132FBD0("true", 0);
												__eflags =  *((char*)(_t319 + 0xc));
												_v108 = 0;
												if( *((char*)(_t319 + 0xc)) == 0) {
													_t336 = _v96;
													 *((short*)(_t359 + 0xc)) =  *( *(_t336 + 0x30)) & 0x0000ffff;
													_t290 =  *( *(_t336 + 0x34)) & 0x0000ffff;
												} else {
													_v88 = 0x2e;
													_v92 = 0;
													asm("xorps xmm0, xmm0");
													asm("movlpd [ebp-0x50], xmm0");
													E013362D2(_t333,  &_v92,  &_v88, 1,  &_v100,  &_v84);
													 *((short*)(_t359 + 0xc)) = _v92 & 0x0000ffff;
													asm("xorps xmm0, xmm0");
													_v88 = 0x2c;
													_v92 = 0;
													asm("movlpd [ebp-0x50], xmm0");
													E013362D2(_t333,  &_v92,  &_v88, 1,  &_v100,  &_v84);
													_t290 = _v92 & 0x0000ffff;
												}
												 *(_t359 + 0xe) = _t290;
												_v24 = 0xffffffff;
												 *[fs:0x0] = _v32;
												_pop(_t353);
												_pop(_t362);
												__eflags = _v40 ^ _t370;
												return E01347708(_t290, _t319, _v40 ^ _t370, _t342, _t353, _t362);
											}
										} else {
											E01335D63(_t323,  &_v84, _t358);
											_t399 = _t379 + 8;
											_v12 = 8;
											_v24 = 1;
											 *_t347 = 0x136e0d8;
											_v12 = 9;
											 *_t347 = 0x136e0e8;
											 *(_t347 + 4) = 0;
											_v12 = 0xa;
											_t101 = _t347 + 8; // 0x8
											_t321 = _t101;
											 *_t347 = 0x136e620;
											 *_t321 = 0;
											_v12 = 0xc;
											_t363 = E01356078(_t321, _t347, _t358);
											_v28 = _t363;
											_v24 = 3;
											__eflags = _t321 -  &_v28;
											if(_t321 !=  &_v28) {
												E0134C213( *_t321);
												_t399 = _t399 + 4;
												 *_t321 = _t363;
												_t363 = 0;
												__eflags = 0;
												_v28 = 0;
											}
											_v24 = 3;
											_t316 = 1;
											_v24 = 3;
											_v12 = 0xb;
											E0134C213(_t363);
											_t379 = _t399 + 4;
											_v12 = 8;
											L38:
											_v12 = 0xd;
											 *_v0 = _t347;
											_v12 = 0xffffffff;
											__eflags = _t316 & 0x00000001;
											if((_t316 & 0x00000001) != 0) {
												_v24 = _t316 & 0xfffffffe;
												_v12 = 0x14;
												E01335DAE(_t323,  &_v84);
												_t381 = _t379 + 4;
												_v12 = 0x13;
												_t240 = _v40;
												__eflags = _t240;
												if(_t240 != 0) {
													E0134C213(_t240);
													_t381 = _t381 + 4;
												}
												_v40 = 0;
												_v12 = 0x12;
												_t241 = _v48;
												__eflags = _t241;
												if(_t241 != 0) {
													E0134C213(_t241);
													_t381 = _t381 + 4;
												}
												_v48 = 0;
												_v12 = 0x11;
												_t242 = _v56;
												__eflags = _t242;
												if(_t242 != 0) {
													E0134C213(_t242);
													_t381 = _t381 + 4;
												}
												_v56 = 0;
												_v12 = 0x10;
												_t243 = _v64;
												__eflags = _t243;
												if(_t243 != 0) {
													E0134C213(_t243);
													_t381 = _t381 + 4;
												}
												_v64 = 0;
												_v12 = 0xf;
												_t244 = _v72;
												__eflags = _t244;
												if(_t244 != 0) {
													E0134C213(_t244);
													_t381 = _t381 + 4;
												}
												_v72 = 0;
												_v12 = 0xe;
												_t245 = _v80;
												__eflags = _t245;
												if(_t245 != 0) {
													E0134C213(_t245);
												}
												_v80 = 0;
												_v12 = 0xffffffff;
												E01335EFD( &_v84);
											}
											goto L52;
										}
									}
								}
							}
						} else {
							E01335D63( &_v76,  &_v76, _t345);
							_t375 = _t375 + 8;
							_v8 = 8;
							_t313 = 1;
							_v20 = 1;
							 *_t356 = 0x136e0d8;
							_v8 = 9;
							 *_t356 = 0x136e0e8;
							 *(_t356 + 4) = 0;
							_v8 = 0xa;
							 *_t356 = 0x136e670;
							_v8 = 8;
							L10:
							_v8 = 0xb;
							 *_a4 = _t356;
							_v8 = 0xffffffff;
							if((_t313 & 0x00000001) != 0) {
								_v20 = _t313 & 0xfffffffe;
								_v8 = 0x12;
								E01335DAE(_t323,  &_v76);
								_t377 = _t375 + 4;
								_v8 = 0x11;
								_t213 = _v32;
								if(_v32 != 0) {
									E0134C213(_t213);
									_t377 = _t377 + 4;
								}
								_v32 = 0;
								_v8 = 0x10;
								_t214 = _v40;
								if(_v40 != 0) {
									E0134C213(_t214);
									_t377 = _t377 + 4;
								}
								_v40 = 0;
								_v8 = 0xf;
								_t215 = _v48;
								if(_v48 != 0) {
									E0134C213(_t215);
									_t377 = _t377 + 4;
								}
								_v48 = 0;
								_v8 = 0xe;
								_t216 = _v56;
								if(_v56 != 0) {
									E0134C213(_t216);
									_t377 = _t377 + 4;
								}
								_v56 = 0;
								_v8 = 0xd;
								_t217 = _v64;
								if(_v64 != 0) {
									E0134C213(_t217);
									_t377 = _t377 + 4;
								}
								_v64 = 0;
								_v8 = 0xc;
								_t218 = _v72;
								if(_v72 != 0) {
									E0134C213(_t218);
								}
								_v72 = 0;
								_v8 = 0xffffffff;
								E01335EFD( &_v76);
							}
							goto L24;
						}
					}
				}
			}

0x0132f3b1
0x0132f3b3
0x0132f3b5
0x0132f3c0
0x0132f3c1
0x0132f3c4
0x0132f3c7
0x0132f3ce
0x0132f3d2
0x0132f3d8
0x0132f3db
0x0132f3dd
0x0132f3e2
0x0132f5b7
0x0132f5bf
0x0132f5cd
0x0132f3f0
0x0132f3fa
0x0132f3fc
0x0132f3ff
0x0132f404
0x0132f4cf
0x0132f4cf
0x00000000
0x0132f40a
0x0132f40d
0x0132f412
0x0132f420
0x0132f414
0x0132f414
0x0132f419
0x0132f41b
0x0132f41b
0x0132f419
0x0132f427
0x0132f42a
0x0132f42f
0x0132f433
0x0132f43a
0x0132f43e
0x0132f442
0x0132f449
0x0132f44d
0x0132f453
0x0132f45a
0x0132f45e
0x0132f462
0x0132f465
0x0132f469
0x0132f46d
0x0132f470
0x0132f473
0x0132f477
0x0132f47a
0x0132f47d
0x0132f483
0x0132f5d3
0x0132f5d8
0x0132f5d9
0x0132f5da
0x0132f5db
0x0132f5dc
0x0132f5dd
0x0132f5de
0x0132f5df
0x0132f5e0
0x0132f5e1
0x0132f5e3
0x0132f5e5
0x0132f5f0
0x0132f5f1
0x0132f5f4
0x0132f5f5
0x0132f5f6
0x0132f5f7
0x0132f5fe
0x0132f602
0x0132f608
0x0132f60b
0x0132f60d
0x0132f610
0x0132f612
0x0132f837
0x0132f83f
0x0132f84d
0x0132f618
0x0132f618
0x0132f61a
0x00000000
0x0132f620
0x0132f62a
0x0132f62c
0x0132f62f
0x0132f632
0x0132f634
0x0132f74f
0x0132f74f
0x00000000
0x0132f63a
0x0132f63d
0x0132f640
0x0132f642
0x0132f650
0x0132f644
0x0132f644
0x0132f647
0x0132f649
0x0132f64b
0x0132f64b
0x0132f649
0x0132f657
0x0132f65a
0x0132f65f
0x0132f663
0x0132f66a
0x0132f66e
0x0132f672
0x0132f679
0x0132f67d
0x0132f683
0x0132f68a
0x0132f68e
0x0132f692
0x0132f695
0x0132f699
0x0132f69d
0x0132f6a0
0x0132f6a3
0x0132f6a7
0x0132f6aa
0x0132f6ad
0x0132f6b1
0x0132f6b3
0x0132f853
0x0132f858
0x0132f859
0x0132f85a
0x0132f85b
0x0132f85c
0x0132f85d
0x0132f85e
0x0132f85f
0x0132f860
0x0132f861
0x0132f869
0x0132f86c
0x0132f870
0x0132f874
0x0132f876
0x0132f878
0x0132f883
0x0132f884
0x0132f888
0x0132f88d
0x0132f88f
0x0132f892
0x0132f893
0x0132f894
0x0132f898
0x0132f89e
0x0132f8a5
0x0132f8ae
0x0132f8b1
0x0132f8b9
0x0132f8bc
0x0132f8bf
0x0132f8c3
0x0132f8c7
0x0132f8cb
0x0132f8d0
0x0132f8d8
0x0132f8db
0x0132f8e2
0x0132f8e9
0x0132f8f0
0x0132f8fe
0x0132f903
0x0132f906
0x0132f90a
0x0132f913
0x0132f90c
0x0132f90c
0x0132f90c
0x0132f916
0x0132f918
0x0132f918
0x0132f920
0x0132f920
0x0132f922
0x0132f923
0x0132f923
0x0132f927
0x0132f929
0x0132f92b
0x0132f92b
0x0132f92e
0x0132f92f
0x0132f937
0x0132f939
0x0132f93c
0x0132f93f
0x0132f941
0x0132fa3e
0x0132fa43
0x0132fa44
0x0132fa45
0x0132fa46
0x0132fa47
0x0132fa48
0x0132fa49
0x0132fa4a
0x0132fa4b
0x0132fa4c
0x0132fa4d
0x0132fa4e
0x0132fa4f
0x0132fa50
0x0132fa53
0x0132fa55
0x0132fa60
0x0132fa61
0x0132fa64
0x0132fa65
0x0132fa66
0x0132fa6d
0x0132fa71
0x0132fa77
0x0132fa79
0x0132fa80
0x0132fa8c
0x0132fa8e
0x0132fa94
0x0132fa97
0x0132fa9e
0x0132faa0
0x0132faa4
0x0132faa9
0x0132faac
0x0132faae
0x0132faae
0x0132fab0
0x0132fab0
0x0132fab8
0x0132fabb
0x0132fabe
0x0132fac1
0x0132fac9
0x0132fad4
0x0132fae1
0x0132f947
0x0132f947
0x0132f94a
0x0132f94c
0x0132f951
0x0132f956
0x0132f959
0x0132f959
0x0132f95f
0x0132f962
0x0132f972
0x0132f978
0x0132f988
0x0132f98b
0x0132f98f
0x0132f996
0x0132fa00
0x0132fa09
0x0132fa10
0x0132f998
0x0132f99b
0x0132f9a3
0x0132f9b0
0x0132f9b7
0x0132f9bd
0x0132f9c9
0x0132f9cd
0x0132f9d3
0x0132f9d7
0x0132f9e2
0x0132f9f2
0x0132f9f7
0x0132f9fb
0x0132fa13
0x0132fa17
0x0132fa21
0x0132fa29
0x0132fa2a
0x0132fa2e
0x0132fa3b
0x0132fa3b
0x0132f6b9
0x0132f6be
0x0132f6c3
0x0132f6c6
0x0132f6ca
0x0132f6d1
0x0132f6d7
0x0132f6de
0x0132f6e4
0x0132f6eb
0x0132f6f2
0x0132f6f2
0x0132f6f5
0x0132f6fb
0x0132f701
0x0132f70a
0x0132f70f
0x0132f712
0x0132f719
0x0132f71b
0x0132f71f
0x0132f724
0x0132f727
0x0132f729
0x0132f729
0x0132f72b
0x0132f72b
0x0132f733
0x0132f736
0x0132f739
0x0132f73c
0x0132f741
0x0132f746
0x0132f749
0x0132f751
0x0132f751
0x0132f75b
0x0132f75d
0x0132f764
0x0132f767
0x0132f770
0x0132f773
0x0132f77e
0x0132f783
0x0132f786
0x0132f78a
0x0132f78d
0x0132f78f
0x0132f792
0x0132f797
0x0132f797
0x0132f79a
0x0132f7a1
0x0132f7a5
0x0132f7a8
0x0132f7aa
0x0132f7ad
0x0132f7b2
0x0132f7b2
0x0132f7b5
0x0132f7bc
0x0132f7c0
0x0132f7c3
0x0132f7c5
0x0132f7c8
0x0132f7cd
0x0132f7cd
0x0132f7d0
0x0132f7d7
0x0132f7db
0x0132f7de
0x0132f7e0
0x0132f7e3
0x0132f7e8
0x0132f7e8
0x0132f7eb
0x0132f7f2
0x0132f7f6
0x0132f7f9
0x0132f7fb
0x0132f7fe
0x0132f803
0x0132f803
0x0132f806
0x0132f80d
0x0132f811
0x0132f814
0x0132f816
0x0132f819
0x0132f81e
0x0132f821
0x0132f828
0x0132f832
0x0132f832
0x00000000
0x0132f767
0x0132f6b3
0x0132f634
0x0132f61a
0x0132f489
0x0132f48e
0x0132f493
0x0132f496
0x0132f49a
0x0132f49f
0x0132f4a2
0x0132f4a8
0x0132f4af
0x0132f4b5
0x0132f4bc
0x0132f4c3
0x0132f4c9
0x0132f4d1
0x0132f4d1
0x0132f4db
0x0132f4dd
0x0132f4e7
0x0132f4f0
0x0132f4f3
0x0132f4fe
0x0132f503
0x0132f506
0x0132f50a
0x0132f50f
0x0132f512
0x0132f517
0x0132f517
0x0132f51a
0x0132f521
0x0132f525
0x0132f52a
0x0132f52d
0x0132f532
0x0132f532
0x0132f535
0x0132f53c
0x0132f540
0x0132f545
0x0132f548
0x0132f54d
0x0132f54d
0x0132f550
0x0132f557
0x0132f55b
0x0132f560
0x0132f563
0x0132f568
0x0132f568
0x0132f56b
0x0132f572
0x0132f576
0x0132f57b
0x0132f57e
0x0132f583
0x0132f583
0x0132f586
0x0132f58d
0x0132f591
0x0132f596
0x0132f599
0x0132f59e
0x0132f5a1
0x0132f5a8
0x0132f5b2
0x0132f5b2
0x00000000
0x0132f4e7
0x0132f483
0x0132f404

APIs

LocalAlloc.KERNEL32(00000040,00000008,C9209188,?,00000000,00000000,?,?,?,00000000,0136B1DD,000000FF,?,0132ED0A,00000000,?), ref: 0132F3F4
std::_Lockit::_Lockit.LIBCPMT ref: 0132F42A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0132F48E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0132F4FE
std::_Lockit::~_Lockit.LIBCPMT ref: 0132F5B2

Strings

bad locale name, xrefs: 0132F5CE

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: 37845b81bd6796ea74710387902cdc2bbc67016f678b229776b7fc9add5441da
Instruction ID: 0763dbcf5b738f422cf35830591e5570d5027b6b09a7238cfa874855910a75b9
Opcode Fuzzy Hash: 37845b81bd6796ea74710387902cdc2bbc67016f678b229776b7fc9add5441da
Instruction Fuzzy Hash: 0C616EB0D01389EBEF11DFA8C54478EBFF8AF15318F248169D454AB381D7B99A08CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01348D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E01348D30(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				signed char _v36;
				void* _v40;
				signed int _t77;
				signed int _t84;
				intOrPtr _t85;
				void* _t86;
				intOrPtr* _t87;
				intOrPtr _t89;
				signed int _t91;
				int _t93;
				signed int _t98;
				intOrPtr* _t102;
				intOrPtr _t103;
				signed int _t107;
				char _t109;
				signed int _t113;
				void* _t114;
				intOrPtr _t123;
				void* _t125;
				intOrPtr _t133;
				signed int _t135;
				void* _t139;
				void* _t141;
				void* _t149;

				_t118 = __edx;
				_t102 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t102 = E013691B0(__ecx,  *_t102);
				_t103 = _a8;
				_t6 = _t103 + 0x10; // 0x11
				_t133 = _t6;
				_push(_t133);
				_v20 = _t133;
				_v12 =  *(_t103 + 8) ^  *0x1383020;
				E01348CF0(_t103, __edx, __edi, _t133,  *(_t103 + 8) ^  *0x1383020);
				E0134BD6C(_a12);
				_t77 = _a4;
				_t141 = _t139 - 0x1c + 0x10;
				_t123 =  *((intOrPtr*)(_t103 + 0xc));
				if(( *(_t77 + 4) & 0x00000066) != 0) {
					__eflags = _t123 - 0xfffffffe;
					if(_t123 != 0xfffffffe) {
						_t118 = 0xfffffffe;
						E0134BEF0(_t103, 0xfffffffe, _t133, 0x1383020);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t77;
					_v28 = _a12;
					 *((intOrPtr*)(_t103 - 4)) =  &_v32;
					if(_t123 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t107 = _v12;
							_t84 = _t123 + (_t123 + 2) * 2;
							_t103 =  *((intOrPtr*)(_t107 + _t84 * 4));
							_t85 = _t107 + _t84 * 4;
							_t108 =  *((intOrPtr*)(_t85 + 4));
							_v24 = _t85;
							if( *((intOrPtr*)(_t85 + 4)) == 0) {
								_t109 = _v5;
								goto L7;
							} else {
								_t118 = _t133;
								_t86 = E0134BE90(_t108, _t133);
								_t109 = 1;
								_v5 = 1;
								_t149 = _t86;
								if(_t149 < 0) {
									_v16 = 0;
									L13:
									_push(_t133);
									E01348CF0(_t103, _t118, _t123, _t133, _v12);
									goto L14;
								} else {
									if(_t149 > 0) {
										_t87 = _a4;
										__eflags =  *_t87 - 0xe06d7363;
										if( *_t87 == 0xe06d7363) {
											__eflags =  *0x136ee80;
											if(__eflags != 0) {
												_t98 = E01368D20(__eflags, 0x136ee80);
												_t141 = _t141 + 4;
												__eflags = _t98;
												if(_t98 != 0) {
													_t135 =  *0x136ee80; // 0x1349564
													 *0x136d26c(_a4, 1);
													 *_t135();
													_t133 = _v20;
													_t141 = _t141 + 8;
												}
												_t87 = _a4;
											}
										}
										_t119 = _t87;
										E0134BED0(_t87, _a8, _t87);
										_t89 = _a8;
										__eflags =  *((intOrPtr*)(_t89 + 0xc)) - _t123;
										if( *((intOrPtr*)(_t89 + 0xc)) != _t123) {
											_t119 = _t123;
											E0134BEF0(_t89, _t123, _t133, 0x1383020);
											_t89 = _a8;
										}
										_push(_t133);
										 *((intOrPtr*)(_t89 + 0xc)) = _t103;
										E01348CF0(_t103, _t119, _t123, _t133, _v12);
										E0134BEB0();
										asm("int3");
										asm("int3");
										asm("int3");
										_t113 = _v32;
										_t91 = _v36 & 0x000000ff;
										_t125 = _v40;
										__eflags = _t113;
										if(_t113 == 0) {
											L46:
											return _v40;
										} else {
											_t93 = _t91 * 0x1010101;
											__eflags = _t113 - 0x20;
											if(_t113 <= 0x20) {
												L39:
												__eflags = _t113 & 0x00000003;
												while((_t113 & 0x00000003) != 0) {
													 *_t125 = _t93;
													_t125 = _t125 + 1;
													_t113 = _t113 - 1;
													__eflags = _t113 & 0x00000003;
												}
												__eflags = _t113 & 0x00000004;
												if((_t113 & 0x00000004) != 0) {
													 *_t125 = _t93;
													_t125 = _t125 + 4;
													_t113 = _t113 - 4;
													__eflags = _t113;
												}
												__eflags = _t113 & 0xfffffff8;
												while((_t113 & 0xfffffff8) != 0) {
													 *_t125 = _t93;
													 *(_t125 + 4) = _t93;
													_t125 = _t125 + 8;
													_t113 = _t113 - 8;
													__eflags = _t113 & 0xfffffff8;
												}
												goto L46;
											} else {
												__eflags = _t113 - 0x80;
												if(__eflags < 0) {
													L33:
													asm("bt dword [0x138302c], 0x1");
													if(__eflags >= 0) {
														goto L39;
													} else {
														asm("movd xmm0, eax");
														asm("pshufd xmm0, xmm0, 0x0");
														goto L35;
													}
												} else {
													asm("bt dword [0x1384e60], 0x1");
													if(__eflags >= 0) {
														asm("bt dword [0x138302c], 0x1");
														if(__eflags >= 0) {
															goto L39;
														} else {
															asm("movd xmm0, eax");
															asm("pshufd xmm0, xmm0, 0x0");
															_t114 = _t125 + _t113;
															asm("movups [edi], xmm0");
															_t125 = _t125 + 0x00000010 & 0xfffffff0;
															_t113 = _t114 - _t125;
															__eflags = _t113 - 0x80;
															if(__eflags <= 0) {
																goto L33;
															} else {
																do {
																	asm("movdqa [edi], xmm0");
																	asm("movdqa [edi+0x10], xmm0");
																	asm("movdqa [edi+0x20], xmm0");
																	asm("movdqa [edi+0x30], xmm0");
																	asm("movdqa [edi+0x40], xmm0");
																	asm("movdqa [edi+0x50], xmm0");
																	asm("movdqa [edi+0x60], xmm0");
																	asm("movdqa [edi+0x70], xmm0");
																	_t125 = _t125 + 0x80;
																	_t113 = _t113 - 0x80;
																	__eflags = _t113 & 0xffffff00;
																} while ((_t113 & 0xffffff00) != 0);
																L35:
																__eflags = _t113 - 0x20;
																if(_t113 < 0x20) {
																	L38:
																	asm("movdqu [edi], xmm0");
																	asm("movdqu [edi+0x10], xmm0");
																	return _v40;
																} else {
																	do {
																		asm("movdqu [edi], xmm0");
																		asm("movdqu [edi+0x10], xmm0");
																		_t125 = _t125 + 0x20;
																		_t113 = _t113 - 0x20;
																		__eflags = _t113 - 0x20;
																	} while (_t113 >= 0x20);
																	__eflags = _t113 & 0x0000001f;
																	if((_t113 & 0x0000001f) == 0) {
																		goto L46;
																	} else {
																		goto L38;
																	}
																}
															}
														}
													} else {
														memset(_t125, _t93, _t113 << 0);
														return _v40;
													}
												}
											}
										}
									} else {
										goto L7;
									}
								}
							}
							goto L47;
							L7:
							_t123 = _t103;
						} while (_t103 != 0xfffffffe);
						if(_t109 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L47:
			}

0x01348d30
0x01348d37
0x01348d3b
0x01348d3c
0x01348d42
0x01348d4e
0x01348d50
0x01348d56
0x01348d56
0x01348d5f
0x01348d61
0x01348d64
0x01348d67
0x01348d6f
0x01348d74
0x01348d77
0x01348d7a
0x01348d81
0x01348ddd
0x01348de0
0x01348de8
0x01348def
0x00000000
0x01348def
0x00000000
0x01348d83
0x01348d83
0x01348d89
0x01348d8f
0x01348d95
0x01348e00
0x01348e09
0x01348d97
0x01348d97
0x01348d97
0x01348d9d
0x01348da0
0x01348da3
0x01348da6
0x01348da9
0x01348dae
0x01348dc4
0x00000000
0x01348db0
0x01348db0
0x01348db2
0x01348db7
0x01348db9
0x01348dbc
0x01348dbe
0x01348dd4
0x01348df4
0x01348df4
0x01348df8
0x00000000
0x01348dc0
0x01348dc0
0x01348e0a
0x01348e0d
0x01348e13
0x01348e15
0x01348e1c
0x01348e23
0x01348e28
0x01348e2b
0x01348e2d
0x01348e2f
0x01348e3c
0x01348e42
0x01348e44
0x01348e47
0x01348e47
0x01348e4a
0x01348e4a
0x01348e1c
0x01348e50
0x01348e52
0x01348e57
0x01348e5a
0x01348e5d
0x01348e65
0x01348e69
0x01348e6e
0x01348e6e
0x01348e71
0x01348e75
0x01348e78
0x01348e88
0x01348e8d
0x01348e8e
0x01348e8f
0x01348e90
0x01348e94
0x01348e9b
0x01348e9f
0x01348ea1
0x01348fe3
0x01348fe9
0x01348ea7
0x01348ea7
0x01348ead
0x01348eb0
0x01348f95
0x01348f95
0x01348f9b
0x01348f9d
0x01348f9f
0x01348fa0
0x01348fa3
0x01348fa3
0x01348fab
0x01348fb1
0x01348fb3
0x01348fb5
0x01348fb8
0x01348fb8
0x01348fb8
0x01348fbb
0x01348fc1
0x01348fd0
0x01348fd2
0x01348fd5
0x01348fd8
0x01348fdb
0x01348fdb
0x00000000
0x01348eb6
0x01348eb6
0x01348ebc
0x01348f4d
0x01348f4d
0x01348f55
0x00000000
0x01348f57
0x01348f57
0x01348f5b
0x00000000
0x01348f5b
0x01348ec2
0x01348ec2
0x01348eca
0x01348ed5
0x01348edd
0x00000000
0x01348ee3
0x01348ee3
0x01348ee7
0x01348eec
0x01348eee
0x01348ef4
0x01348ef7
0x01348ef9
0x01348eff
0x00000000
0x01348f10
0x01348f10
0x01348f10
0x01348f14
0x01348f19
0x01348f1e
0x01348f23
0x01348f28
0x01348f2d
0x01348f32
0x01348f37
0x01348f3d
0x01348f43
0x01348f43
0x01348f60
0x01348f60
0x01348f63
0x01348f81
0x01348f85
0x01348f89
0x01348f94
0x01348f65
0x01348f65
0x01348f65
0x01348f69
0x01348f6e
0x01348f71
0x01348f74
0x01348f74
0x01348f79
0x01348f7f
0x00000000
0x00000000
0x00000000
0x00000000
0x01348f7f
0x01348f63
0x01348eff
0x01348ecc
0x01348ecc
0x01348ed4
0x01348ed4
0x01348eca
0x01348ebc
0x01348eb0
0x01348dc2
0x00000000
0x01348dc2
0x01348dc0
0x01348dbe
0x00000000
0x01348dc7
0x01348dc7
0x01348dc9
0x01348dd0
0x00000000
0x01348dd2
0x00000000
0x01348dd0
0x01348d95
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 01348D67
___except_validate_context_record.LIBVCRUNTIME ref: 01348D6F
_ValidateLocalCookies.LIBCMT ref: 01348DF8
__IsNonwritableInCurrentImage.LIBCMT ref: 01348E23
_ValidateLocalCookies.LIBCMT ref: 01348E78

Strings

csm, xrefs: 01348E0D

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 47d448a42a753ae4b109f5fdf0ffa6ec122935982a20b7b7658c6c9d052cd0d1
Instruction ID: 5cea3ba6abb22a4b1e3bfe2089ca112ddd864c1aad5b4af7889fa2c9f45f25dc
Opcode Fuzzy Hash: 47d448a42a753ae4b109f5fdf0ffa6ec122935982a20b7b7658c6c9d052cd0d1
Instruction Fuzzy Hash: 6841B334A01209ABCF20DFACC844A9EBFF6AF5531CF148495DA185B355D731F945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0135C96B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0135C96B(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x1385500 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x13717e0 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0x1385500 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x1385500 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E01350B03(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E01350B03(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x0135c974
0x0135ca09
0x0135c97c
0x0135c97e
0x0135c988
0x0135c98d
0x0135c99a
0x0135c9af
0x0135c9b3
0x0135ca19
0x0135ca1e
0x0135ca25
0x0135ca29
0x0135ca2c
0x0135ca2c
0x0135ca32
0x0135ca32
0x0135ca14
0x0135ca18
0x0135ca18
0x0135c9b5
0x0135c9be
0x0135c9f7
0x0135ca04
0x0135ca06
0x0135ca06
0x00000000
0x0135ca06
0x0135c9c8
0x0135c9cd
0x0135c9d2
0x00000000
0x00000000
0x0135c9dc
0x0135c9e1
0x0135c9e6
0x00000000
0x00000000
0x0135c9eb
0x0135c9f1
0x0135c9f5
0x00000000
0x00000000
0x00000000
0x0135c9f5
0x0135c992
0x00000000
0x00000000
0x00000000
0x0135c998
0x0135ca12
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,0135CA78,?,?,?,00000000,?,?,0135CCA2,00000021,FlsSetValue,01371E00,01371E08,?), ref: 0135CA2C

Strings

ext-ms-, xrefs: 0135C9D6
api-ms-, xrefs: 0135C9C2

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2fed8d5ab76aa0a187cef2f9f1fb6f34537c860c330ad068c646dc2c9ce1f66e
Instruction ID: 7067b72326032bead1681154518959b37330dc4308611b776f0508251952ac9c
Opcode Fuzzy Hash: 2fed8d5ab76aa0a187cef2f9f1fb6f34537c860c330ad068c646dc2c9ce1f66e
Instruction Fuzzy Hash: D921D832601311EBDB72DB69AC44E5A3B6C9B41FACF151210ED45B7295E770E900C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0133D8F6 Relevance: 9.4, APIs: 6, Instructions: 433
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0133D8F6(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				signed char _t109;
				intOrPtr _t114;
				intOrPtr* _t117;
				intOrPtr _t119;
				intOrPtr _t123;
				intOrPtr* _t125;
				intOrPtr* _t128;
				intOrPtr _t133;
				intOrPtr* _t141;
				intOrPtr _t142;
				intOrPtr* _t147;
				intOrPtr* _t150;
				intOrPtr _t152;
				intOrPtr _t158;
				intOrPtr* _t165;
				signed int _t167;
				void* _t198;
				signed int _t215;
				signed char _t216;
				intOrPtr _t218;
				void* _t220;
				void* _t221;
				intOrPtr* _t223;
				void* _t224;
				intOrPtr* _t226;
				intOrPtr* _t228;
				void* _t229;
				intOrPtr* _t231;
				intOrPtr* _t233;
				intOrPtr* _t234;
				void* _t235;
				void* _t236;
				void* _t239;
				void* _t240;
				void* _t241;
				void* _t242;
				void* _t243;
				void* _t244;

				_t219 = __esi;
				_t211 = __edx;
				_push(0xc);
				E01348213(0x136c419, __ebx, __edi, __esi);
				_t109 =  *(_t235 + 0xc);
				_t165 = 0;
				_t218 =  *((intOrPtr*)(_t235 + 0x14));
				_t167 = _t109 & 0x00000002;
				 *(_t235 - 0x14) = _t167;
				if(_t167 != 0) {
					_t158 = E0132BCE0();
					if(_t218 != 0) {
						_push(_t218);
						_t219 = _t158;
						E01334403(0, _t218, _t219, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E0133780A(0, __edx, _t218, _t158, __eflags), _t219);
						_t236 = _t236 + 0x10;
					} else {
						 *((intOrPtr*)(_t235 - 0x10)) = _t158;
						_t234 = E013284C0(0x44);
						 *((intOrPtr*)(_t235 - 0x18)) = _t234;
						_t248 = _t234;
						if(_t234 == 0) {
							_t219 = 0;
						} else {
							 *((intOrPtr*)(_t234 + 4)) = 0;
							 *_t234 = 0x136e5d4;
							E0133D458(_t234,  *((intOrPtr*)(_t235 + 8)));
						}
						E01334403(_t165, _t218, _t219, _t248,  *((intOrPtr*)(_t235 + 0x10)), _t219,  *((intOrPtr*)(_t235 - 0x10)));
						_t236 = _t236 + 0xc;
					}
					_t109 =  *(_t235 + 0xc);
				}
				if((_t109 & 0x00000008) == 0) {
					L25:
					_push(_t165);
					_push(_t165);
					_t215 = 1 << E01338C83(_t165, _t211, _t218, _t219, _t255) >> 1;
					if(( *(_t235 + 0xc) & 1) != 0) {
						_t142 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t230 = _t142;
							_t110 = E01334403(_t165, _t218, _t230, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E013376E0(_t165, _t215, _t218, _t142, __eflags), _t230);
							_t236 = _t236 + 0x10;
						} else {
							 *((intOrPtr*)(_t235 - 0x10)) = _t142;
							_t231 = E013284C0(0x10);
							 *((intOrPtr*)(_t235 - 0x18)) = _t231;
							_pop(_t198);
							_t258 = _t231;
							if(_t231 == 0) {
								_t231 = _t165;
							} else {
								 *((intOrPtr*)(_t231 + 4)) = _t165;
								 *_t231 = 0x136e884;
								 *((intOrPtr*)(_t231 + 8)) = E0134710D(_t165, _t198, _t258);
								 *(_t231 + 0xc) = _t215;
							}
							_t110 = E01334403(_t165, _t218, _t231, _t258,  *((intOrPtr*)(_t235 + 0x10)), _t231,  *((intOrPtr*)(_t235 - 0x10)));
							_t236 = _t236 + 0xc;
						}
					}
					_t216 =  *(_t235 + 0xc);
					if((_t216 & 0x00000020) != 0) {
						_t229 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t110 = E01334403(_t165, _t218, _t229, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E0133789F(_t165, _t216, _t218, _t229, __eflags), _t229);
							_t236 = _t236 + 0x10;
						} else {
							_t141 = E013284C0(8);
							 *((intOrPtr*)(_t235 - 0x18)) = _t141;
							_t261 = _t141;
							if(_t141 == 0) {
								_t141 = _t165;
							} else {
								 *((intOrPtr*)(_t141 + 4)) = _t165;
								 *_t141 = 0x136e8a0;
							}
							_t110 = E01334403(_t165, _t218, _t229, _t261,  *((intOrPtr*)(_t235 + 0x10)), _t141, _t229);
							_t236 = _t236 + 0xc;
						}
						_t216 =  *(_t235 + 0xc);
					}
					if((_t216 & 0x00000004) != 0) {
						_t224 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t125 = E013379C9(_t165, _t216, _t218, _t224, __eflags);
						} else {
							_t125 = E013284C0(8);
							 *((intOrPtr*)(_t235 - 0x18)) = _t125;
							_t264 = _t125;
							if(_t125 == 0) {
								_t125 = _t165;
							} else {
								 *((intOrPtr*)(_t125 + 4)) = _t165;
								 *_t125 = 0x136e8bc;
							}
						}
						E01334403(_t165, _t218,  *((intOrPtr*)(_t235 + 0x10)), _t264,  *((intOrPtr*)(_t235 + 0x10)), _t125, _t224);
						_t240 = _t236 + 0xc;
						 *((intOrPtr*)(_t235 - 0x10)) = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t128 = E01337AF3(_t165, _t216, _t218, _t225, __eflags);
						} else {
							_t128 = E013284C0(8);
							 *((intOrPtr*)(_t235 - 0x18)) = _t128;
							_t266 = _t128;
							if(_t128 == 0) {
								_t128 = _t165;
							} else {
								 *((intOrPtr*)(_t128 + 4)) = _t165;
								 *_t128 = 0x136e8d4;
							}
						}
						E01334403(_t165, _t218, _t225, _t266, _t225, _t128,  *((intOrPtr*)(_t235 - 0x10)));
						_t241 = _t240 + 0xc;
						 *((intOrPtr*)(_t235 - 0x10)) = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t226 = E01337CB2(_t165, _t216, _t218, _t225, __eflags);
						} else {
							_t226 = E013284C0(0x58);
							 *((intOrPtr*)(_t235 - 0x18)) = _t226;
							 *(_t235 - 4) = 0x10;
							_t268 = _t226;
							if(_t226 == 0) {
								_t226 = _t165;
							} else {
								 *((intOrPtr*)(_t226 + 4)) = _t165;
								_push(_t165);
								_push( *((intOrPtr*)(_t235 + 8)));
								 *(_t235 - 4) = 0x11;
								 *_t226 = 0x136e8ec;
								 *((char*)(_t226 + 0x28)) = _t165;
								E0133D2C2(_t165, _t226, _t218, _t226, _t268);
								 *_t226 = 0x136e920;
							}
							 *(_t235 - 4) =  *(_t235 - 4) | 0xffffffff;
						}
						E01334403(_t165, _t218, _t226, _t268,  *((intOrPtr*)(_t235 + 0x10)), _t226,  *((intOrPtr*)(_t235 - 0x10)));
						_t242 = _t241 + 0xc;
						_t133 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t227 = _t133;
							_t110 = E01334403(_t165, _t218, _t227, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E01337C1D(_t165, _t216, _t218, _t133, __eflags), _t227);
							_t236 = _t242 + 0x10;
						} else {
							 *((intOrPtr*)(_t235 - 0x10)) = _t133;
							_t228 = E013284C0(0x58);
							 *((intOrPtr*)(_t235 - 0x18)) = _t228;
							 *(_t235 - 4) = 0x16;
							_t270 = _t228;
							if(_t228 == 0) {
								_t228 = _t165;
							} else {
								 *((intOrPtr*)(_t228 + 4)) = _t165;
								_push(_t165);
								_push( *((intOrPtr*)(_t235 + 8)));
								 *(_t235 - 4) = 0x17;
								 *_t228 = 0x136e8ec;
								 *((char*)(_t228 + 0x28)) = 1;
								E0133D2C2(_t165, _t228, _t218, _t228, _t270);
								 *_t228 = 0x136e954;
							}
							 *(_t235 - 4) =  *(_t235 - 4) | 0xffffffff;
							_t110 = E01334403(_t165, _t218, _t228, _t270,  *((intOrPtr*)(_t235 + 0x10)), _t228,  *((intOrPtr*)(_t235 - 0x10)));
							_t236 = _t242 + 0xc;
						}
						_t216 =  *(_t235 + 0xc);
					}
					if((_t216 & 0x00000010) != 0) {
						_t221 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t117 = E013380C5(_t165, _t216, _t218, _t221, __eflags);
						} else {
							_t123 = E013284C0(0x44);
							 *((intOrPtr*)(_t235 - 0x18)) = _t123;
							 *(_t235 - 4) = 0x1b;
							_t273 = _t123;
							if(_t123 == 0) {
								_t117 = _t165;
							} else {
								_push(_t165);
								_push( *((intOrPtr*)(_t235 + 8)));
								_t117 = E0133838F(_t123, _t221, _t273);
							}
							 *(_t235 - 4) =  *(_t235 - 4) | 0xffffffff;
						}
						E01334403(_t165, _t218, _t221, _t273,  *((intOrPtr*)(_t235 + 0x10)), _t117, _t221);
						_t239 = _t236 + 0xc;
						_t119 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t222 = _t119;
							_t110 = E01334403(_t165, _t218, _t222, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E013381EF(_t165, _t216, _t218, _t119, __eflags), _t222);
							_t236 = _t239 + 0x10;
						} else {
							 *((intOrPtr*)(_t235 - 0x10)) = _t119;
							_t223 = E013284C0(0xc);
							 *((intOrPtr*)(_t235 - 0x18)) = _t223;
							_t275 = _t223;
							if(_t223 == 0) {
								_t223 = _t165;
							} else {
								 *((intOrPtr*)(_t223 + 4)) = _t165;
								 *_t223 = 0x136e9b4;
								 *((intOrPtr*)(_t223 + 8)) = _t165;
								E0133D5DA(_t165, _t218,  *((intOrPtr*)(_t235 + 8)));
							}
							_t110 = E01334403(_t165, _t218, _t223, _t275,  *((intOrPtr*)(_t235 + 0x10)), _t223,  *((intOrPtr*)(_t235 - 0x10)));
							_t236 = _t239 + 0xc;
						}
					}
					if( *(_t235 - 0x14) != 0) {
						_t220 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t110 = E01334403(_t165, _t218, _t220, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E013375B6(_t165, _t216, _t218, _t220, __eflags), _t220);
						} else {
							_t114 = E013284C0(0x34);
							 *((intOrPtr*)(_t235 - 0x18)) = _t114;
							_t278 = _t114;
							if(_t114 != 0) {
								_t165 = E01338321(_t114,  *((intOrPtr*)(_t235 + 8)), _t165);
							}
							_t110 = E01334403(_t165, _t218, _t220, _t278,  *((intOrPtr*)(_t235 + 0x10)), _t165, _t220);
						}
					}
					return E013481F0(_t110);
				} else {
					 *((intOrPtr*)(_t235 - 0x10)) = E0132BCE0();
					if(_t218 != 0) {
						_push(_t218);
						_t147 = E01337E71(_t165, _t211, _t218, _t219, __eflags);
					} else {
						_t147 = E013284C0(8);
						 *((intOrPtr*)(_t235 - 0x18)) = _t147;
						_t251 = _t147;
						if(_t147 == 0) {
							_t147 = _t165;
						} else {
							 *((intOrPtr*)(_t147 + 4)) = _t165;
							 *_t147 = 0x136e7f4;
						}
					}
					E01334403(_t165, _t218,  *((intOrPtr*)(_t235 + 0x10)), _t251,  *((intOrPtr*)(_t235 + 0x10)), _t147,  *((intOrPtr*)(_t235 - 0x10)));
					_t243 = _t236 + 0xc;
					 *((intOrPtr*)(_t235 - 0x10)) = E0132BCE0();
					if(_t218 != 0) {
						_push(_t218);
						_t150 = E01337F9B(_t165, _t211, _t218, _t232, __eflags);
					} else {
						_t150 = E013284C0(8);
						 *((intOrPtr*)(_t235 - 0x18)) = _t150;
						_t253 = _t150;
						if(_t150 == 0) {
							_t150 = _t165;
						} else {
							 *((intOrPtr*)(_t150 + 4)) = _t165;
							 *_t150 = 0x136e830;
						}
					}
					E01334403(_t165, _t218, _t232, _t253, _t232, _t150,  *((intOrPtr*)(_t235 - 0x10)));
					_t244 = _t243 + 0xc;
					_t152 = E0132BCE0();
					if(_t218 != 0) {
						_push(_t218);
						_t219 = _t152;
						E01334403(_t165, _t218, _t219, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E01338030(_t165, _t211, _t218, _t152, __eflags), _t219);
						_t236 = _t244 + 0x10;
					} else {
						 *((intOrPtr*)(_t235 - 0x10)) = _t152;
						_t233 = E013284C0(0x18);
						 *((intOrPtr*)(_t235 - 0x18)) = _t233;
						 *(_t235 - 4) = 7;
						_t255 = _t233;
						if(_t233 == 0) {
							_t219 = _t165;
						} else {
							 *((intOrPtr*)(_t233 + 4)) = _t165;
							 *(_t235 - 4) = 8;
							 *_t233 = 0x136e860;
							E0133D491(_t165, _t233, _t211, _t218, _t233, _t255,  *((intOrPtr*)(_t235 + 8)), _t165);
						}
						 *(_t235 - 4) =  *(_t235 - 4) | 0xffffffff;
						E01334403(_t165, _t218, _t219, _t255,  *((intOrPtr*)(_t235 + 0x10)), _t219,  *((intOrPtr*)(_t235 - 0x10)));
						_t236 = _t244 + 0xc;
					}
					goto L25;
				}
			}

0x0133d8f6
0x0133d8f6
0x0133d8f6
0x0133d8fd
0x0133d902
0x0133d905
0x0133d907
0x0133d90c
0x0133d90f
0x0133d912
0x0133d919
0x0133d920
0x0133d95e
0x0133d95f
0x0133d96b
0x0133d970
0x0133d922
0x0133d924
0x0133d92c
0x0133d92e
0x0133d932
0x0133d934
0x0133d94b
0x0133d936
0x0133d93b
0x0133d93e
0x0133d944
0x0133d944
0x0133d954
0x0133d959
0x0133d959
0x0133d973
0x0133d973
0x0133d978
0x0133da76
0x0133da76
0x0133da77
0x0133da86
0x0133da8b
0x0133da92
0x0133da99
0x0133dad8
0x0133dad9
0x0133dae5
0x0133daea
0x0133da9b
0x0133da9d
0x0133daa5
0x0133daa7
0x0133daaa
0x0133daab
0x0133daad
0x0133dac5
0x0133daaf
0x0133daaf
0x0133dab2
0x0133dabd
0x0133dac0
0x0133dac0
0x0133dace
0x0133dad3
0x0133dad3
0x0133da99
0x0133daed
0x0133daf3
0x0133daff
0x0133db03
0x0133db30
0x0133db3b
0x0133db40
0x0133db05
0x0133db07
0x0133db0c
0x0133db10
0x0133db12
0x0133db1f
0x0133db14
0x0133db14
0x0133db17
0x0133db17
0x0133db26
0x0133db2b
0x0133db2b
0x0133db43
0x0133db43
0x0133db49
0x0133db59
0x0133db5d
0x0133db7d
0x0133db7e
0x0133db5f
0x0133db61
0x0133db66
0x0133db6a
0x0133db6c
0x0133db79
0x0133db6e
0x0133db6e
0x0133db71
0x0133db71
0x0133db6c
0x0133db8a
0x0133db8f
0x0133db9c
0x0133dba1
0x0133dbc1
0x0133dbc2
0x0133dba3
0x0133dba5
0x0133dbaa
0x0133dbae
0x0133dbb0
0x0133dbbd
0x0133dbb2
0x0133dbb2
0x0133dbb5
0x0133dbb5
0x0133dbb0
0x0133dbcd
0x0133dbd2
0x0133dbdf
0x0133dbe4
0x0133dc29
0x0133dc30
0x0133dbe6
0x0133dbed
0x0133dbf0
0x0133dbf3
0x0133dbfa
0x0133dbfc
0x0133dc21
0x0133dbfe
0x0133dbfe
0x0133dc01
0x0133dc02
0x0133dc07
0x0133dc0b
0x0133dc11
0x0133dc14
0x0133dc19
0x0133dc19
0x0133dc23
0x0133dc23
0x0133dc39
0x0133dc3e
0x0133dc46
0x0133dc4d
0x0133dca5
0x0133dca6
0x0133dcb2
0x0133dcb7
0x0133dc4f
0x0133dc51
0x0133dc59
0x0133dc5c
0x0133dc5f
0x0133dc66
0x0133dc68
0x0133dc8e
0x0133dc6a
0x0133dc6a
0x0133dc6d
0x0133dc6e
0x0133dc73
0x0133dc77
0x0133dc7d
0x0133dc81
0x0133dc86
0x0133dc86
0x0133dc93
0x0133dc9b
0x0133dca0
0x0133dca0
0x0133dcba
0x0133dcba
0x0133dcc0
0x0133dcd0
0x0133dcd4
0x0133dd01
0x0133dd02
0x0133dcd6
0x0133dcd8
0x0133dcde
0x0133dce1
0x0133dce8
0x0133dcea
0x0133dcf9
0x0133dcec
0x0133dcec
0x0133dced
0x0133dcf2
0x0133dcf2
0x0133dcfb
0x0133dcfb
0x0133dd0e
0x0133dd13
0x0133dd1b
0x0133dd22
0x0133dd63
0x0133dd64
0x0133dd70
0x0133dd75
0x0133dd24
0x0133dd26
0x0133dd2e
0x0133dd30
0x0133dd34
0x0133dd36
0x0133dd50
0x0133dd38
0x0133dd3b
0x0133dd40
0x0133dd46
0x0133dd49
0x0133dd49
0x0133dd59
0x0133dd5e
0x0133dd5e
0x0133dd22
0x0133dd7c
0x0133dd88
0x0133dd8c
0x0133ddb9
0x0133ddc4
0x0133dd8e
0x0133dd90
0x0133dd95
0x0133dd99
0x0133dd9b
0x0133dda8
0x0133dda8
0x0133ddaf
0x0133ddb4
0x0133dd8c
0x0133ddd1
0x0133d97e
0x0133d988
0x0133d98d
0x0133d9ad
0x0133d9ae
0x0133d98f
0x0133d991
0x0133d996
0x0133d99a
0x0133d99c
0x0133d9a9
0x0133d99e
0x0133d99e
0x0133d9a1
0x0133d9a1
0x0133d99c
0x0133d9bc
0x0133d9c1
0x0133d9ce
0x0133d9d3
0x0133d9f3
0x0133d9f4
0x0133d9d5
0x0133d9d7
0x0133d9dc
0x0133d9e0
0x0133d9e2
0x0133d9ef
0x0133d9e4
0x0133d9e4
0x0133d9e7
0x0133d9e7
0x0133d9e2
0x0133d9ff
0x0133da04
0x0133da0c
0x0133da13
0x0133da61
0x0133da62
0x0133da6e
0x0133da73
0x0133da15
0x0133da17
0x0133da1f
0x0133da22
0x0133da25
0x0133da2c
0x0133da2e
0x0133da4a
0x0133da30
0x0133da30
0x0133da39
0x0133da3d
0x0133da43
0x0133da43
0x0133da4f
0x0133da57
0x0133da5c
0x0133da5c
0x00000000
0x0133da13

APIs

__EH_prolog3.LIBCMT ref: 0133D8FD
ctype.LIBCPMT ref: 0133D944

Part of subcall function 0133D458: __Getctype.LIBCPMT ref: 0133D467

Part of subcall function 013379C9: __EH_prolog3.LIBCMT ref: 013379D0
Part of subcall function 013379C9: std::_Lockit::_Lockit.LIBCPMT ref: 013379DA
Part of subcall function 013379C9: std::_Lockit::~_Lockit.LIBCPMT ref: 01337A4B

Part of subcall function 01337AF3: __EH_prolog3.LIBCMT ref: 01337AFA
Part of subcall function 01337AF3: std::_Lockit::_Lockit.LIBCPMT ref: 01337B04
Part of subcall function 01337AF3: std::_Lockit::~_Lockit.LIBCPMT ref: 01337B75

Part of subcall function 01337CB2: __EH_prolog3.LIBCMT ref: 01337CB9
Part of subcall function 01337CB2: std::_Lockit::_Lockit.LIBCPMT ref: 01337CC3
Part of subcall function 01337CB2: std::_Lockit::~_Lockit.LIBCPMT ref: 01337D34

Part of subcall function 01337C1D: __EH_prolog3.LIBCMT ref: 01337C24
Part of subcall function 01337C1D: std::_Lockit::_Lockit.LIBCPMT ref: 01337C2E
Part of subcall function 01337C1D: std::_Lockit::~_Lockit.LIBCPMT ref: 01337C9F

Part of subcall function 01334403: __EH_prolog3.LIBCMT ref: 0133440A
Part of subcall function 01334403: std::_Lockit::_Lockit.LIBCPMT ref: 01334414
Part of subcall function 01334403: std::_Lockit::~_Lockit.LIBCPMT ref: 013344BB

collate.LIBCPMT ref: 0133DA78
numpunct.LIBCPMT ref: 0133DCF2

Part of subcall function 0133838F: __EH_prolog3.LIBCMT ref: 01338396

Part of subcall function 013380C5: __EH_prolog3.LIBCMT ref: 013380CC
Part of subcall function 013380C5: std::_Lockit::_Lockit.LIBCPMT ref: 013380D6
Part of subcall function 013380C5: std::_Lockit::~_Lockit.LIBCPMT ref: 01338147

Part of subcall function 013381EF: __EH_prolog3.LIBCMT ref: 013381F6
Part of subcall function 013381EF: std::_Lockit::_Lockit.LIBCPMT ref: 01338200
Part of subcall function 013381EF: std::_Lockit::~_Lockit.LIBCPMT ref: 01338271

Part of subcall function 01334403: Concurrency::cancel_current_task.LIBCPMT ref: 013344C6

Part of subcall function 013375B6: __EH_prolog3.LIBCMT ref: 013375BD
Part of subcall function 013375B6: std::_Lockit::_Lockit.LIBCPMT ref: 013375C7
Part of subcall function 013375B6: std::_Lockit::~_Lockit.LIBCPMT ref: 01337638

__Getcoll.LIBCPMT ref: 0133DAB8

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

Part of subcall function 013284C0: LocalAlloc.KERNEL32(00000040,00000000,0134839D,00000000,C9209188,?,00000000,?,00000000,?,0136CB8D,000000FF,?,013217D5,00000000,0136D3BA), ref: 013284C6

codecvt.LIBCPMT ref: 0133DDA3

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_Lockit::~_$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatectypenumpunct
String ID:
API String ID: 613171289-0
Opcode ID: fff04345a23196edfc4bf2c2c711c49bc34fc26e33275722ab601337516619f9
Instruction ID: 93d7c81a3c958e36a191e467d1953000a29adbfbed5b141ec3ee5ee1af3e51e4
Opcode Fuzzy Hash: fff04345a23196edfc4bf2c2c711c49bc34fc26e33275722ab601337516619f9
Instruction Fuzzy Hash: E3E1F5B580021B9BDF15BFAC8C0167FBEA9FFD126CF44442DE9546B290EA31891487D9

Uniqueness

Uniqueness Score: -1.00%

Function 01322BD0 Relevance: 9.2, APIs: 6, Instructions: 225
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E01322BD0(void* __ebx, void* __ecx, void* __edx, void* _a8) {
				signed int _v8;
				void* _v16;
				signed int _v20;
				signed int _v24;
				void* _v28;
				void* _v44;
				signed int _v48;
				void* _v52;
				void* _v68;
				signed int _v72;
				void* _v76;
				intOrPtr _v80;
				void* _v84;
				void* _v88;
				void* _v92;
				char _v136;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t105;
				signed int _t106;
				intOrPtr* _t110;
				short* _t111;
				signed int _t114;
				signed int _t122;
				void* _t124;
				signed int _t133;
				intOrPtr _t138;
				signed int _t141;
				void* _t143;
				signed int _t148;
				void* _t151;
				void* _t153;
				intOrPtr* _t158;
				void* _t162;
				void* _t168;
				void* _t176;
				void* _t177;
				void* _t183;
				void* _t184;
				void* _t185;
				void* _t187;
				void* _t188;
				short* _t189;
				void* _t190;
				void _t191;
				void* _t193;
				signed int _t194;
				void* _t195;
				signed int _t196;

				_t153 = __ebx;
				_t196 = _t195 - 0x4c;
				_t105 =  *0x1383020; // 0xc9209188
				_t106 = _t105 ^ _t194;
				_v20 = _t106;
				 *[fs:0x0] =  &_v16;
				_v88 = __edx;
				_t189 = __ecx;
				_v84 = __ecx;
				_t184 = _a8;
				_v92 = __ecx;
				_v72 = 0;
				_v80 = 0x1379744;
				_v76 = 0;
				_v8 = 1;
				 *((intOrPtr*)(_v80 + 4))(_t106, _t183, _t188,  *[fs:0x0], 0x13694a7, 0xffffffff);
				_t110 = _v88;
				if( *((intOrPtr*)(_t110 + 0x14)) >= 8) {
					_t110 =  *_t110;
				}
				__imp__#224(_t110, 1,  &_v76, 0, 0);
				_t158 = _t110;
				if(_t158 == 0) {
					_t111 = E01323D60(_t153,  &_v44, _v76, _t184, _t189);
					_v8 = 3;
					_v72 = 2;
					asm("xorps xmm0, xmm0");
					asm("movups [esi], xmm0");
					 *(_t189 + 0x10) = 0;
					_t180 = 0;
					 *(_t189 + 0x14) = 0;
					_t161 = 3;
					asm("movups xmm0, [eax]");
					asm("movups [esi], xmm0");
					asm("movq xmm0, [eax+0x10]");
					asm("movq [esi+0x10], xmm0");
					 *(_t111 + 0x10) = 0;
					 *(_t111 + 0x14) = 7;
					 *_t111 = 0;
					_v72 = 2;
					_v8 = 3;
					_t184 = LocalFree;
					if(0 == 0) {
						L25:
						_v8 = 1;
						if((_t161 & 0x00000002) == 0) {
							L32:
							_v8 = 0;
							_t162 = _v76;
							_v80 = 0x1379744;
							if(_t162 != 0) {
								_push(_t162);
								goto L34;
							}
							goto L35;
						} else {
							_v72 = _t161 & 0xfffffffd;
							_t114 = _v24;
							if(_t114 < 8) {
								L31:
								_v28 = 0;
								_v24 = 7;
								_v44 = 0;
								goto L32;
							} else {
								_t168 = _v44;
								_t180 = _t168;
								if(2 + _t114 * 2 < 0x1000) {
									L29:
									if(_t168 != 0) {
										LocalFree(_t168);
									}
									goto L31;
								} else {
									_t168 =  *(_t180 - 4);
									if(_t180 - 4 > 0x1f) {
										goto L37;
									} else {
										goto L29;
									}
								}
							}
						}
					} else {
						_t133 = _v48;
						_t161 = 3;
						_v84 = 2;
						_v72 = 2;
						if(_t133 < 8) {
							L24:
							_v52 = 0;
							_v48 = 7;
							_v68 = 0;
							goto L25;
						} else {
							_t180 = _v68;
							_t187 = _t180;
							if(2 + _t133 * 2 < 0x1000) {
								L22:
								_t184 = LocalFree;
								if(_t180 != 0) {
									LocalFree(_t180);
									_t161 = _v84;
								}
								goto L24;
							} else {
								_t180 =  *(_t187 - 4);
								_t184 = _t187 - _t180;
								if(_t184 - 4 > 0x1f) {
									goto L37;
								} else {
									goto L22;
								}
							}
						}
					}
				} else {
					_t138 =  *0x1383a48; // 0x1379784
					_t18 = _t138 + 8; // 0x1323230
					_t180 =  *((intOrPtr*)( *_t18))( &_v44, _t158);
					_v84 = _t180;
					_v8 = 2;
					if(_t184 == _t180) {
						L11:
						_v8 = 1;
						_t141 = _v24;
						if(_t141 < 0x10) {
							L16:
							asm("xorps xmm0, xmm0");
							_v28 = 0;
							asm("movups [esi], xmm0");
							 *(_t189 + 0x10) = 0;
							 *(_t189 + 0x14) = 0;
							 *(_t189 + 0x10) = 0;
							 *(_t189 + 0x14) = 7;
							_v24 = 0xf;
							_v44 = 0;
							 *_t189 = 0;
							_v72 = 1;
							_v8 = 0;
							_t143 = _v76;
							_v80 = 0x1379744;
							if(_t143 != 0) {
								_push(_t143);
								L34:
								__imp__CertFreeCertificateContext();
							}
							L35:
							_v76 = 0;
							 *[fs:0x0] = _v16;
							_pop(_t185);
							_pop(_t190);
							return E01347708(_t189, _t153, _v20 ^ _t194, _t180, _t185, _t190);
						} else {
							_t176 = _v44;
							_t180 = _t176;
							if(_t141 + 1 < 0x1000) {
								L14:
								if(_t176 != 0) {
									LocalFree(_t176);
								}
								goto L16;
							} else {
								_t168 =  *(_t180 - 4);
								if(_t180 - 4 > 0x1f) {
									goto L36;
								} else {
									goto L14;
								}
							}
						}
					} else {
						_t148 =  *(_t184 + 0x14);
						if(_t148 < 0x10) {
							L10:
							 *(_t184 + 0x10) = 0;
							 *(_t184 + 0x14) = 0xf;
							 *_t184 = 0;
							asm("movups xmm0, [edx]");
							asm("movups [edi], xmm0");
							asm("movq xmm0, [edx+0x10]");
							asm("movq [edi+0x10], xmm0");
							 *(_t180 + 0x10) = 0;
							 *(_t180 + 0x14) = 0xf;
							 *_t180 = 0;
							goto L11;
						} else {
							_t177 =  *_t184;
							if(_t148 + 1 < 0x1000) {
								L8:
								if(_t177 != 0) {
									LocalFree(_t177);
									_t180 = _v84;
								}
								goto L10;
							} else {
								_t151 =  *((intOrPtr*)(_t177 - 4));
								_t168 = _t177 - _t151;
								_v88 = _t151;
								if(_t168 - 4 > 0x1f) {
									L36:
									E0134C5C2(_t153, _t168, _t180, _t184);
									L37:
									E0134C5C2(_t153, _t168, _t180, _t184);
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									_push("vector too long");
									E01332090();
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									while(1) {
										_push(_t194);
										_t194 = _t196;
										_push(0xffffffff);
										_push(0x1369360);
										_push( *[fs:0x0]);
										_push(_t153);
										_push(_t189);
										_push(_t184);
										_t122 =  *0x1383020; // 0xc9209188
										_push(_t122 ^ _t194);
										_t124 =  &_v136;
										 *[fs:0x0] = _t124;
										_t184 = _t168;
										_t191 =  *_t184;
										if(_t191 == 0) {
											break;
										}
										_t153 =  *(_t184 + 4);
										while(_t191 != _t153) {
											E01323CC0(_t191);
											_t191 = _t191 + 0x18;
										}
										_t193 =  *_t184;
										_t182 = 0x2aaaaaab * ( *(_t184 + 8) - _t193) >> 0x20 >> 2;
										_t124 = (0x2aaaaaab * ( *(_t184 + 8) - _t193) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *(_t184 + 8) - _t193) >> 0x20 >> 2) + ((0x2aaaaaab * ( *(_t184 + 8) - _t193) >> 0x20 >> 2 >> 0x1f) + (0x2aaaaaab * ( *(_t184 + 8) - _t193) >> 0x20 >> 2)) * 2 << 3;
										if(_t124 < 0x1000) {
											L45:
											if(_t193 != 0) {
												_t124 = LocalFree(_t193);
											}
											 *_t184 = 0;
											 *(_t184 + 4) = 0;
											 *(_t184 + 8) = 0;
										} else {
											_t168 =  *(_t193 - 4);
											_t189 = _t193 - _t168;
											_t124 = _t189 - 4;
											if(_t124 > 0x1f) {
												E0134C5C2(_t153, _t168, _t182, _t184);
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												continue;
											} else {
												_t193 = _t168;
												goto L45;
											}
										}
										break;
									}
									 *[fs:0x0] = _v20;
									return _t124;
								} else {
									_t177 = _v88;
									goto L8;
								}
							}
						}
					}
				}
			}

0x01322bd0
0x01322be1
0x01322be4
0x01322be9
0x01322beb
0x01322bf4
0x01322bfa
0x01322bfd
0x01322bff
0x01322c02
0x01322c05
0x01322c08
0x01322c0f
0x01322c16
0x01322c1d
0x01322c2a
0x01322c2d
0x01322c34
0x01322c36
0x01322c36
0x01322c43
0x01322c49
0x01322c4d
0x01322d73
0x01322d78
0x01322d81
0x01322d84
0x01322d87
0x01322d8a
0x01322d91
0x01322d93
0x01322d9a
0x01322d9d
0x01322da0
0x01322da3
0x01322da8
0x01322dad
0x01322db4
0x01322dbb
0x01322dbe
0x01322dc1
0x01322dc8
0x01322dd1
0x01322e2c
0x01322e2c
0x01322e36
0x01322e81
0x01322e81
0x01322e85
0x01322e88
0x01322e91
0x01322e93
0x00000000
0x01322e93
0x00000000
0x01322e38
0x01322e3b
0x01322e3e
0x01322e44
0x01322e6d
0x01322e6f
0x01322e76
0x01322e7d
0x00000000
0x01322e46
0x01322e46
0x01322e50
0x01322e57
0x01322e66
0x01322e68
0x01322e6b
0x01322e6b
0x00000000
0x01322e59
0x01322e59
0x01322e64
0x00000000
0x00000000
0x00000000
0x00000000
0x01322e64
0x01322e57
0x01322e44
0x01322dd3
0x01322dd3
0x01322dd6
0x01322dd9
0x01322ddc
0x01322de2
0x01322e18
0x01322e1a
0x01322e21
0x01322e28
0x00000000
0x01322de4
0x01322de4
0x01322dee
0x01322df5
0x01322e08
0x01322e08
0x01322e10
0x01322e13
0x01322e15
0x01322e15
0x00000000
0x01322df7
0x01322df7
0x01322dfa
0x01322e02
0x00000000
0x00000000
0x00000000
0x00000000
0x01322e02
0x01322df5
0x01322de2
0x01322c53
0x01322c53
0x01322c5d
0x01322c67
0x01322c69
0x01322c6c
0x01322c72
0x01322cdd
0x01322cdd
0x01322ce1
0x01322ce7
0x01322d12
0x01322d12
0x01322d15
0x01322d1c
0x01322d1f
0x01322d28
0x01322d2f
0x01322d36
0x01322d3d
0x01322d44
0x01322d48
0x01322d4b
0x01322d52
0x01322d55
0x01322d58
0x01322d61
0x01322d67
0x01322e94
0x01322e94
0x01322e94
0x01322e9a
0x01322e9a
0x01322ea6
0x01322eae
0x01322eaf
0x01322ebd
0x01322ce9
0x01322ce9
0x01322ced
0x01322cf4
0x01322d07
0x01322d09
0x01322d0c
0x01322d0c
0x00000000
0x01322cf6
0x01322cf6
0x01322d01
0x00000000
0x00000000
0x00000000
0x00000000
0x01322d01
0x01322cf4
0x01322c74
0x01322c74
0x01322c7a
0x01322cab
0x01322cab
0x01322cb2
0x01322cb9
0x01322cbc
0x01322cbf
0x01322cc2
0x01322cc7
0x01322ccc
0x01322cd3
0x01322cda
0x00000000
0x01322c7c
0x01322c7c
0x01322c84
0x01322c9d
0x01322c9f
0x01322ca2
0x01322ca8
0x01322ca8
0x00000000
0x01322c86
0x01322c86
0x01322c89
0x01322c8b
0x01322c94
0x01322ebe
0x01322ebe
0x01322ec3
0x01322ec3
0x01322ec8
0x01322ec9
0x01322eca
0x01322ecb
0x01322ecc
0x01322ecd
0x01322ece
0x01322ecf
0x01322ed0
0x01322ed5
0x01322eda
0x01322edb
0x01322edc
0x01322edd
0x01322ede
0x01322edf
0x01322ee0
0x01322ee0
0x01322ee1
0x01322ee3
0x01322ee5
0x01322ef0
0x01322ef1
0x01322ef2
0x01322ef3
0x01322ef4
0x01322efb
0x01322efc
0x01322eff
0x01322f05
0x01322f07
0x01322f0b
0x00000000
0x00000000
0x01322f0d
0x01322f12
0x01322f16
0x01322f1b
0x01322f1e
0x01322f2a
0x01322f30
0x01322f3d
0x01322f45
0x01322f56
0x01322f58
0x01322f5b
0x01322f5b
0x01322f61
0x01322f67
0x01322f6e
0x01322f47
0x01322f47
0x01322f4a
0x01322f4c
0x01322f52
0x01322f87
0x01322f8c
0x01322f8d
0x01322f8e
0x01322f8f
0x01322f90
0x01322f91
0x01322f92
0x01322f93
0x01322f94
0x01322f95
0x01322f96
0x01322f97
0x01322f98
0x01322f99
0x01322f9a
0x01322f9b
0x01322f9c
0x01322f9d
0x01322f9e
0x01322f9f
0x00000000
0x01322f54
0x01322f54
0x00000000
0x01322f54
0x01322f52
0x00000000
0x01322f45
0x01322f78
0x01322f86
0x01322c9a
0x01322c9a
0x00000000
0x01322c9a
0x01322c94
0x01322c84
0x01322c7a
0x01322c72

APIs

#224.MSI(?,00000001,00000000,00000000,00000000), ref: 01322C43
LocalFree.KERNEL32(?), ref: 01322CA2
LocalFree.KERNEL32(?), ref: 01322D0C
CertFreeCertificateContext.CRYPT32(00000000), ref: 01322E94

Part of subcall function 01323D60: CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 01323DA3

LocalFree.KERNEL32(?), ref: 01322E13
LocalFree.KERNEL32(?), ref: 01322E6B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Free$Local$Cert$#224CertificateContextNameString
String ID:
API String ID: 2665452496-0
Opcode ID: 42796b2e2ed1e678aacb87543df25f234fbe41cf3f72e19323067c783e347843
Instruction ID: 779f0bc1305ee80379a40b8b6e288cdf2486e5f5fbe36946661c9667b36b7479
Opcode Fuzzy Hash: 42796b2e2ed1e678aacb87543df25f234fbe41cf3f72e19323067c783e347843
Instruction Fuzzy Hash: 5C919D70910259CFEB18DFA8C94879EFBB5FF44308F14861DD055AB391DBB5AA88CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0132B500 Relevance: 9.2, APIs: 6, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0132B500(void* __ebx, void* __edi, void* _a4) {
				signed int _v0;
				char _v8;
				intOrPtr _v12;
				char _v16;
				void* _v20;
				void* _v24;
				char _v28;
				char _v56;
				char _v64;
				void* _v68;
				signed int _t47;
				void* _t54;
				signed int _t57;
				void* _t67;
				signed int _t72;
				signed int _t73;
				char _t75;
				void* _t78;
				intOrPtr _t88;
				signed int _t90;
				intOrPtr* _t93;
				void* _t95;
				void* _t100;
				void* _t101;
				signed int _t102;
				void* _t106;

				_push(0xffffffff);
				_push(0x136a7fd);
				_push( *[fs:0x0]);
				_t101 = _t100 - 0x10;
				_push(__ebx);
				_push(__edi);
				_t47 =  *0x1383020; // 0xc9209188
				_push(_t47 ^ _t98);
				 *[fs:0x0] =  &_v16;
				E01335EA5( &_v28, 0);
				_v8 = 0;
				_t90 =  *0x13848a0; // 0x0
				_t75 =  *0x1385748; // 0x0
				_v24 = _t75;
				if(_t90 == 0) {
					E01335EA5( &_v20, _t90);
					_v8 = 1;
					_t106 =  *0x13848a0 - _t90; // 0x0
					if(_t106 == 0) {
						_t72 =  *0x138488c; // 0x0
						_t73 = _t72 + 1;
						 *0x138488c = _t73;
						 *0x13848a0 = _t73;
					}
					_v8 = 0;
					E01335EFD( &_v20);
					_t90 =  *0x13848a0; // 0x0
				}
				_t78 = _t90 * 4;
				_v20 = _t78;
				_t88 =  *((intOrPtr*)(_a4 + 4));
				if(_t90 >=  *((intOrPtr*)(_t88 + 0xc))) {
					_t93 = 0;
					__eflags = 0;
					_v20 = _t78;
					goto L8;
				} else {
					_t93 =  *((intOrPtr*)(_t78 +  *((intOrPtr*)(_t88 + 8))));
					if(_t93 != 0) {
						L16:
						_v8 = 0xffffffff;
						E01335EFD( &_v28);
						 *[fs:0x0] = _v16;
						return _t93;
					} else {
						L8:
						if( *((char*)(_t88 + 0x14)) == 0) {
							L11:
							if(_t93 != 0) {
								goto L16;
							} else {
								goto L12;
							}
						} else {
							_t67 = E01335C60();
							if(_t90 >=  *((intOrPtr*)(_t67 + 0xc))) {
								L12:
								if(_t75 == 0) {
									_push(_a4);
									_push( &_v24);
									_t54 = E0132BA30(_t75, _t90);
									_t102 = _t101 + 8;
									__eflags = _t54 - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(0xffffffff);
										_push(0x136a83d);
										_push( *[fs:0x0]);
										_push(_t78);
										_push(_t93);
										_t57 =  *0x1383020; // 0xc9209188
										_push(_t57 ^ _t102);
										 *[fs:0x0] =  &_v64;
										_t95 = _t78;
										_v68 = _t95;
										 *_t95 = 0x136e594;
										_v56 = 0;
										__eflags =  *(_t95 + 0x10);
										if( *(_t95 + 0x10) != 0) {
											E0134C213( *((intOrPtr*)(_t95 + 0xc)));
											_t102 = _t102 + 4;
										}
										E0134C213( *((intOrPtr*)(_t95 + 0x14)));
										_v12 = 0xffffffff;
										 *_t95 = 0x136e0fc;
										_v12 = 0xffffffff;
										 *_t95 = 0x136e0e8;
										_v12 = 0xffffffff;
										__eflags = _v0 & 0x00000001;
										 *_t95 = 0x136e0d8;
										if((_v0 & 0x00000001) != 0) {
											LocalFree(_t95);
										}
										 *[fs:0x0] = _v20;
										return _t95;
									} else {
										_t93 = _v24;
										_a4 = _t93;
										_v8 = 2;
										E01335C34(_t93);
										 *((intOrPtr*)( *_t93 + 4))();
										 *0x1385748 = _t93;
										_a4 = 0;
										_v8 = 0;
										goto L16;
									}
								} else {
									_t93 = _t75;
									goto L16;
								}
							} else {
								_t93 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(_t67 + 8))));
								goto L11;
							}
						}
					}
				}
			}

0x0132b503
0x0132b505
0x0132b510
0x0132b511
0x0132b514
0x0132b516
0x0132b517
0x0132b51e
0x0132b522
0x0132b52d
0x0132b532
0x0132b539
0x0132b53f
0x0132b545
0x0132b54a
0x0132b550
0x0132b555
0x0132b559
0x0132b55f
0x0132b561
0x0132b566
0x0132b567
0x0132b56c
0x0132b56c
0x0132b571
0x0132b578
0x0132b57d
0x0132b57d
0x0132b586
0x0132b58d
0x0132b590
0x0132b596
0x0132b5a4
0x0132b5a4
0x0132b5a6
0x00000000
0x0132b598
0x0132b59b
0x0132b5a0
0x0132b60d
0x0132b60d
0x0132b617
0x0132b621
0x0132b62f
0x0132b5a2
0x0132b5a9
0x0132b5ad
0x0132b5c2
0x0132b5c4
0x00000000
0x00000000
0x00000000
0x00000000
0x0132b5af
0x0132b5af
0x0132b5b7
0x0132b5c6
0x0132b5c8
0x0132b5ce
0x0132b5d4
0x0132b5d5
0x0132b5da
0x0132b5dd
0x0132b5e0
0x0132b630
0x0132b635
0x0132b636
0x0132b637
0x0132b638
0x0132b639
0x0132b63a
0x0132b63b
0x0132b63c
0x0132b63d
0x0132b63e
0x0132b63f
0x0132b643
0x0132b645
0x0132b650
0x0132b651
0x0132b652
0x0132b653
0x0132b65a
0x0132b65e
0x0132b664
0x0132b666
0x0132b669
0x0132b66f
0x0132b676
0x0132b67a
0x0132b67f
0x0132b684
0x0132b684
0x0132b68a
0x0132b692
0x0132b699
0x0132b69f
0x0132b6a6
0x0132b6ac
0x0132b6b3
0x0132b6b7
0x0132b6bd
0x0132b6c0
0x0132b6c0
0x0132b6cb
0x0132b6d7
0x0132b5e2
0x0132b5e2
0x0132b5e5
0x0132b5e8
0x0132b5ed
0x0132b5f9
0x0132b5fc
0x0132b602
0x0132b609
0x00000000
0x0132b609
0x0132b5ca
0x0132b5ca
0x00000000
0x0132b5ca
0x0132b5b9
0x0132b5bf
0x00000000
0x0132b5bf
0x0132b5b7
0x0132b5ad
0x0132b5a0

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0132B52D
std::_Lockit::_Lockit.LIBCPMT ref: 0132B550
std::_Lockit::~_Lockit.LIBCPMT ref: 0132B578
std::_Facet_Register.LIBCPMT ref: 0132B5ED
std::_Lockit::~_Lockit.LIBCPMT ref: 0132B617
LocalFree.KERNEL32 ref: 0132B6C0

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_FreeLocalRegister
String ID:
API String ID: 1378673503-0
Opcode ID: 2786ae16ff0c76aa4da2184cbea9c7160be9f6bca278cded9d585a5de1c25d2b
Instruction ID: e4f5f90bf91ff802c6b3cab25a579e0ab1684d2b630f94c819b24e0cc511fe2a
Opcode Fuzzy Hash: 2786ae16ff0c76aa4da2184cbea9c7160be9f6bca278cded9d585a5de1c25d2b
Instruction Fuzzy Hash: 2051AF71800259DFDB21EF5CD844B9EFBF8FB04728F248659E855A7384E771AA04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01355981 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 369
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 55%

			E01355981(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, signed int** _a16, signed int* _a20, intOrPtr _a24) {
				signed int _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v22;
				char _v24;
				signed int** _v28;
				char _v32;
				signed int _v36;
				signed int* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t80;
				intOrPtr _t85;
				char _t86;
				signed char _t88;
				signed int _t89;
				void* _t90;
				signed int _t91;
				signed int _t96;
				signed int _t98;
				signed short _t100;
				signed int _t105;
				signed int _t108;
				signed int _t109;
				signed int _t110;
				signed int _t112;
				signed int _t114;
				signed int _t115;
				signed int _t117;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				intOrPtr _t132;
				signed int* _t133;
				signed int _t135;
				intOrPtr _t139;
				void* _t140;
				signed int _t142;
				signed int* _t146;
				signed int _t147;
				intOrPtr _t148;
				signed int _t151;
				signed int _t155;
				signed int _t156;
				intOrPtr _t157;
				signed int _t161;
				signed int _t171;
				intOrPtr* _t172;
				signed short _t173;
				signed short* _t174;
				signed int** _t175;
				signed int _t178;
				signed int** _t179;
				signed int _t180;
				intOrPtr* _t181;
				signed int _t182;
				signed int _t183;

				_t80 =  *0x1383020; // 0xc9209188
				_v8 = _t80 ^ _t182;
				_t172 = _a12;
				_t148 = _a24;
				_v52 = _a4;
				_t146 = _a20;
				_v28 = _a16;
				_v48 = _t172;
				_v40 = _t146;
				_v44 = _t148;
				_t85 = _a8;
				if(_t85 == 0) {
					_t178 =  *(_t148 + 0x154);
				} else {
					if(_t85 == 1) {
						_t178 =  *(_t148 + 0x158);
					} else {
						_t178 =  *(_t148 + 0x15c);
					}
				}
				if( *((intOrPtr*)(_t148 + 0xac)) == 1) {
					goto L108;
				} else {
					_v24 = 0x76c +  *((intOrPtr*)(_t172 + 0x14));
					_v22 =  *((intOrPtr*)(_t172 + 0x10)) + 1;
					_v18 =  *((intOrPtr*)(_t172 + 0xc));
					_v16 =  *((intOrPtr*)(_t172 + 8));
					_v14 =  *((intOrPtr*)(_t172 + 4));
					_v12 =  *_t172;
					_v10 = 0;
					_t132 =  *((intOrPtr*)(_t148 + 0x160));
					_push(0);
					_push(0);
					if(_a8 != 2) {
						_push(0);
						_push(_t178);
						_push( &_v24);
						_push(0);
						_push(_t132);
						_t133 = E0135CCC8();
					} else {
						_push(_t178);
						_push( &_v24);
						_push(0);
						_push(_t132);
						_t133 = E0135CD5E();
					}
					_t146 = _t133;
					if(_t146 == 0) {
						L29:
						_t146 = _v40;
						while(1) {
							L108:
							_t173 =  *_t178 & 0x0000ffff;
							__eflags = _t173;
							if(_t173 == 0) {
								break;
							}
							_t180 =  *_t146;
							__eflags = _t180;
							if(_t180 == 0) {
								goto L26;
							}
							_v32 = 0;
							_t88 = 0;
							__eflags = 0;
							_v36 = _t178;
							_t147 = _t178;
							_t151 = _t173 & 0x0000ffff;
							do {
								_t147 = _t147 + 2;
								_t88 = _t88 + 1;
								__eflags =  *_t147 - _t151;
							} while ( *_t147 == _t151);
							_t152 = _t173 & 0x0000ffff;
							_v36 = _t147;
							_t146 = _v40;
							__eflags = _t152 - 0x64;
							if(__eflags > 0) {
								_t152 = _t152 - 0x68;
								__eflags = _t152;
								if(_t152 == 0) {
									_t89 = _t88 - 1;
									__eflags = _t89;
									if(_t89 == 0) {
										_v32 = 1;
										L105:
										_push(0x49);
										L106:
										_pop(_t90);
										_t91 = E01354E96(_t152, _v52, _t90, _v48, _v28, _t146, _v44, _v32);
										_t183 = _t183 + 0x1c;
										__eflags = _t91;
										if(_t91 == 0) {
											 *((intOrPtr*)(E0134C6B0())) = 0x16;
											_t86 = 0;
											goto L27;
										}
										L107:
										_t178 = _v36;
										continue;
									}
									__eflags = _t89 == 1;
									if(_t89 == 1) {
										goto L105;
									}
									L103:
									_t178 = _t178 + 2;
									 *( *_v28) = _t173 & 0x0000ffff;
									 *_v28 =  &(( *_v28)[0]);
									 *_t146 =  *_t146 - 1;
									continue;
								}
								_t152 = _t152 - 5;
								__eflags = _t152;
								if(_t152 == 0) {
									_t96 = _t88 - 1;
									__eflags = _t96;
									if(_t96 == 0) {
										_v32 = 1;
										L100:
										_push(0x4d);
										goto L106;
									}
									__eflags = _t96 == 1;
									if(_t96 == 1) {
										goto L100;
									}
									goto L103;
								}
								_t152 = _t152 - 6;
								__eflags = _t152;
								if(_t152 == 0) {
									_t98 = _t88 - 1;
									__eflags = _t98;
									if(_t98 == 0) {
										_v32 = 1;
										L95:
										_push(0x53);
										goto L106;
									}
									__eflags = _t98 == 1;
									if(_t98 == 1) {
										goto L95;
									}
									goto L103;
								}
								_t155 = _t152 - 1;
								__eflags = _t155;
								if(_t155 == 0) {
									_t156 = _v48;
									__eflags =  *((intOrPtr*)(_t156 + 8)) - 0xb;
									_t157 = _v44;
									if( *((intOrPtr*)(_t156 + 8)) > 0xb) {
										_t174 =  *(_t157 + 0x150);
									} else {
										_t174 =  *(_t157 + 0x14c);
									}
									__eflags = _t88 - 1;
									if(_t88 != 1) {
										while(1) {
											_t100 =  *_t174 & 0x0000ffff;
											__eflags = _t100;
											if(_t100 == 0) {
												break;
											}
											__eflags = _t180;
											if(_t180 == 0) {
												goto L107;
											}
											_t181 = _v28;
											_t174 =  &(_t174[1]);
											 *((short*)( *_t181)) = _t100 & 0x0000ffff;
											 *_t181 =  *_t181 + 2;
											 *_t146 =  *_t146 - 1;
											__eflags =  *_t146;
											_t180 =  *_t146;
										}
									} else {
										 *( *_v28) =  *_t174;
										 *_v28 =  &(( *_v28)[0]);
										 *_t146 =  *_t146 - 1;
									}
									goto L107;
								}
								_t152 = _t155 != 5;
								__eflags = _t155 != 5;
								if(_t155 != 5) {
									goto L103;
								}
								_t105 = _t88;
								__eflags = _t105;
								if(_t105 == 0) {
									_push(0x79);
									goto L106;
								}
								__eflags = _t105 != 0;
								if(_t105 != 0) {
									goto L103;
								}
								_push(0x59);
								goto L106;
							}
							if(__eflags == 0) {
								_t108 = _t88 - 1;
								__eflags = _t108;
								if(_t108 == 0) {
									_v32 = 1;
									L72:
									_push(0x64);
									goto L106;
								}
								_t109 = _t108 - 1;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L72;
								}
								_t110 = _t109 - 1;
								__eflags = _t110;
								if(_t110 == 0) {
									_push(0x61);
									goto L106;
								}
								__eflags = _t110 != 1;
								if(_t110 != 1) {
									goto L103;
								}
								_push(0x41);
								goto L106;
							}
							__eflags = _t152 - 0x27;
							if(_t152 == 0x27) {
								_t178 = _t178 + _t88 * 2;
								__eflags = _t88 & 0x00000001;
								if((_t88 & 0x00000001) == 0) {
									continue;
								}
								_t112 =  *_t178 & 0x0000ffff;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L26;
								}
								_t175 = _v28;
								while(1) {
									__eflags = _t180;
									if(_t180 == 0) {
										goto L108;
									}
									_t180 = 0x27;
									_t178 = _t178 + 2;
									_t161 = _t112 & 0x0000ffff;
									__eflags = _t112 - _t180;
									if(_t112 == _t180) {
										goto L108;
									}
									 *( *_t175) = _t161;
									 *_t175 =  &(( *_t175)[0]);
									 *_t146 =  *_t146 - 1;
									_t112 =  *_t178 & 0x0000ffff;
									_t180 =  *_t146;
									__eflags = _t112;
									if(_t112 != 0) {
										continue;
									}
									goto L108;
								}
								continue;
							}
							__eflags = _t152 - 0x41;
							if(_t152 == 0x41) {
								L40:
								_t114 = E01350A02(_t178, _t180, _t178,  &M01370824);
								__eflags = _t114;
								if(_t114 != 0) {
									_t115 = E01350A02(_t178, _t180, _t178, L"a/p");
									_pop(_t152);
									__eflags = _t115;
									if(_t115 == 0) {
										_v36 = _t178 + 6;
									}
								} else {
									_t152 = _t178 + 0xa;
									_v36 = _t178 + 0xa;
								}
								_push(0x70);
								goto L106;
							}
							__eflags = _t152 - 0x48;
							if(_t152 == 0x48) {
								_t117 = _t88 - 1;
								__eflags = _t117;
								if(_t117 == 0) {
									_v32 = 1;
									L54:
									_push(0x48);
									goto L106;
								}
								__eflags = _t117 == 1;
								if(_t117 == 1) {
									goto L54;
								}
								goto L103;
							}
							__eflags = _t152 - 0x4d;
							if(_t152 == 0x4d) {
								_t119 = _t88 - 1;
								__eflags = _t119;
								if(_t119 == 0) {
									_v32 = 1;
									L49:
									_push(0x6d);
									goto L106;
								}
								_t120 = _t119 - 1;
								__eflags = _t120;
								if(_t120 == 0) {
									goto L49;
								}
								_t121 = _t120 - 1;
								__eflags = _t121;
								if(_t121 == 0) {
									_push(0x62);
									goto L106;
								}
								__eflags = _t121 != 1;
								if(_t121 != 1) {
									goto L103;
								}
								_push(0x42);
								goto L106;
							}
							__eflags = _t152 - 0x61;
							if(_t152 != 0x61) {
								goto L103;
							}
							goto L40;
						}
						goto L26;
					} else {
						_t33 = _t146 + _t146 + 8; // 0x8
						asm("sbb eax, eax");
						_t135 = _t146 + _t146 & _t33;
						if(_t135 == 0) {
							L28:
							E013470EF(0);
							goto L29;
						}
						if(_t135 > 0x400) {
							_t180 = E0135B127(_t135);
							__eflags = _t180;
							if(_t180 == 0) {
								goto L28;
							}
							 *_t180 = 0xdddd;
							L16:
							_t180 = _t180 + 8;
							if(_t180 == 0) {
								goto L28;
							}
							_t139 =  *((intOrPtr*)(_v44 + 0x160));
							if(_a8 != 2) {
								_t140 = E0135CCC8(_t139, 0,  &_v24, _t178, _t180, _t146, 0);
							} else {
								_t140 = E0135CD5E(_t139, 0,  &_v24, _t178, _t180, _t146);
							}
							_t178 = _t180;
							_t173 = _t140 - 1;
							if(_t173 <= 0) {
								L25:
								E013470EF(_t178);
								L26:
								_t86 = 1;
								L27:
								return E01347708(_t86, _t146, _v8 ^ _t182, _t173, _t178, _t180);
							} else {
								_t146 = _v40;
								_t179 = _v28;
								_v48 = _t180;
								_t142 =  *_t146;
								while(_t142 != 0) {
									_t171 =  *_t180 & 0x0000ffff;
									_t180 = _t180 + 2;
									 *( *_t179) = _t171;
									 *_t179 =  &(( *_t179)[0]);
									 *_t146 =  *_t146 - 1;
									_t173 = _t173 - 1;
									_t142 =  *_t146;
									if(_t173 > 0) {
										continue;
									}
									break;
								}
								_t178 = _v48;
								goto L25;
							}
						}
						E01347FF0(_t135);
						_t180 = _t183;
						if(_t180 == 0) {
							goto L28;
						}
						 *_t180 = 0xcccc;
						goto L16;
					}
				}
			}

0x01355989
0x01355990
0x01355996
0x01355999
0x0135599c
0x013559a3
0x013559a6
0x013559ac
0x013559af
0x013559b2
0x013559b7
0x013559ba
0x013559d1
0x013559bc
0x013559bf
0x013559c9
0x013559c1
0x013559c1
0x013559c1
0x013559bf
0x013559de
0x00000000
0x013559e4
0x013559ed
0x013559f7
0x013559ff
0x01355a07
0x01355a0f
0x01355a18
0x01355a22
0x01355a26
0x01355a2f
0x01355a30
0x01355a31
0x01355a3e
0x01355a3f
0x01355a40
0x01355a41
0x01355a42
0x01355a43
0x01355a33
0x01355a33
0x01355a34
0x01355a35
0x01355a36
0x01355a37
0x01355a37
0x01355a48
0x01355a4c
0x01355b23
0x01355b23
0x01355d97
0x01355d97
0x01355d97
0x01355d9a
0x01355d9d
0x00000000
0x00000000
0x01355b2b
0x01355b2d
0x01355b2f
0x00000000
0x00000000
0x01355b31
0x01355b35
0x01355b35
0x01355b37
0x01355b3a
0x01355b3c
0x01355b3f
0x01355b3f
0x01355b42
0x01355b43
0x01355b43
0x01355b48
0x01355b4b
0x01355b4e
0x01355b51
0x01355b54
0x01355c81
0x01355c81
0x01355c84
0x01355d4e
0x01355d4e
0x01355d51
0x01355d70
0x01355d74
0x01355d74
0x01355d76
0x01355d76
0x01355d88
0x01355d8d
0x01355d90
0x01355d92
0x01355dad
0x01355db3
0x00000000
0x01355db3
0x01355d94
0x01355d94
0x00000000
0x01355d94
0x01355d53
0x01355d56
0x00000000
0x00000000
0x01355d58
0x01355d5b
0x01355d63
0x01355d69
0x01355d6c
0x00000000
0x01355d6c
0x01355c8a
0x01355c8a
0x01355c8d
0x01355d3a
0x01355d3a
0x01355d3d
0x01355d46
0x01355d4a
0x01355d4a
0x00000000
0x01355d4a
0x01355d3f
0x01355d42
0x00000000
0x00000000
0x00000000
0x01355d44
0x01355c93
0x01355c93
0x01355c96
0x01355d26
0x01355d26
0x01355d29
0x01355d32
0x01355d36
0x01355d36
0x00000000
0x01355d36
0x01355d2b
0x01355d2e
0x00000000
0x00000000
0x00000000
0x01355d30
0x01355c9c
0x01355c9c
0x01355c9f
0x01355cc8
0x01355ccb
0x01355ccf
0x01355cd2
0x01355cdc
0x01355cd4
0x01355cd4
0x01355cd4
0x01355ce2
0x01355ce5
0x01355d1c
0x01355d1c
0x01355d1f
0x01355d22
0x00000000
0x00000000
0x01355cff
0x01355d01
0x00000000
0x00000000
0x01355d07
0x01355d0a
0x01355d12
0x01355d15
0x01355d18
0x01355d18
0x01355d1a
0x01355d1a
0x01355ce7
0x01355cef
0x01355cf5
0x01355cf8
0x01355cf8
0x00000000
0x01355ce5
0x01355ca1
0x01355ca1
0x01355ca4
0x00000000
0x00000000
0x01355cab
0x01355cab
0x01355cae
0x01355cc1
0x00000000
0x01355cc1
0x01355cb1
0x01355cb4
0x00000000
0x00000000
0x01355cba
0x00000000
0x01355cba
0x01355b5a
0x01355c50
0x01355c50
0x01355c53
0x01355c76
0x01355c7a
0x01355c7a
0x00000000
0x01355c7a
0x01355c55
0x01355c55
0x01355c58
0x00000000
0x00000000
0x01355c5a
0x01355c5a
0x01355c5d
0x01355c6f
0x00000000
0x01355c6f
0x01355c5f
0x01355c62
0x00000000
0x00000000
0x01355c68
0x00000000
0x01355c68
0x01355b60
0x01355b63
0x01355c03
0x01355c06
0x01355c08
0x00000000
0x00000000
0x01355c0e
0x01355c11
0x01355c14
0x00000000
0x00000000
0x01355c1a
0x01355c1d
0x01355c1d
0x01355c1f
0x00000000
0x00000000
0x01355c27
0x01355c28
0x01355c2b
0x01355c2e
0x01355c31
0x00000000
0x00000000
0x01355c39
0x01355c3c
0x01355c3f
0x01355c41
0x01355c44
0x01355c46
0x01355c49
0x00000000
0x00000000
0x00000000
0x01355c4b
0x00000000
0x01355c1d
0x01355b69
0x01355b6c
0x01355b81
0x01355b87
0x01355b8e
0x01355b90
0x01355beb
0x01355bf1
0x01355bf2
0x01355bf4
0x01355bf9
0x01355bf9
0x01355b92
0x01355b92
0x01355b95
0x01355b95
0x01355bfc
0x00000000
0x01355bfc
0x01355b6e
0x01355b71
0x01355bcb
0x01355bcb
0x01355bce
0x01355bda
0x01355bde
0x01355bde
0x00000000
0x01355bde
0x01355bd0
0x01355bd3
0x00000000
0x00000000
0x00000000
0x01355bd5
0x01355b73
0x01355b76
0x01355b9a
0x01355b9a
0x01355b9d
0x01355bc0
0x01355bc4
0x01355bc4
0x00000000
0x01355bc4
0x01355b9f
0x01355b9f
0x01355ba2
0x00000000
0x00000000
0x01355ba4
0x01355ba4
0x01355ba7
0x01355bb9
0x00000000
0x01355bb9
0x01355ba9
0x01355bac
0x00000000
0x00000000
0x01355bb2
0x00000000
0x01355bb2
0x01355b78
0x01355b7b
0x00000000
0x00000000
0x00000000
0x01355b7b
0x00000000
0x01355a52
0x01355a55
0x01355a5a
0x01355a5c
0x01355a5e
0x01355b1b
0x01355b1d
0x00000000
0x01355b22
0x01355a69
0x01355a88
0x01355a8b
0x01355a8d
0x00000000
0x00000000
0x01355a93
0x01355a99
0x01355a99
0x01355a9e
0x00000000
0x00000000
0x01355aaa
0x01355ab0
0x01355ac9
0x01355ab2
0x01355ab9
0x01355ab9
0x01355ad0
0x01355ad2
0x01355ad5
0x01355b00
0x01355b01
0x01355b07
0x01355b07
0x01355b09
0x01355b1a
0x01355ad7
0x01355ad7
0x01355ada
0x01355add
0x01355ae0
0x01355ae2
0x01355ae8
0x01355aeb
0x01355aee
0x01355af1
0x01355af4
0x01355af6
0x01355af7
0x01355afb
0x00000000
0x00000000
0x00000000
0x01355afb
0x01355afd
0x00000000
0x01355afd
0x01355ad5
0x01355a6b
0x01355a70
0x01355a74
0x00000000
0x00000000
0x01355a7a
0x00000000
0x01355a7a
0x01355a4c

APIs

__alloca_probe_16.LIBCMT ref: 01355A6B
__freea.LIBCMT ref: 01355B01
__freea.LIBCMT ref: 01355B1D

Strings

am/pm, xrefs: 01355B81
a/p, xrefs: 01355BE5

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 98d6bf28460a84bc79ba51d41c8218576cd04fc872c7a21713cbf4f7cb71be50
Instruction ID: 25d4413bf847e8d5faa568f46f19aaa0ef9f9f58d9b44776a3b81c5b358a5f11
Opcode Fuzzy Hash: 98d6bf28460a84bc79ba51d41c8218576cd04fc872c7a21713cbf4f7cb71be50
Instruction Fuzzy Hash: EBC1C53690021ADBEBA58F6CC48CEBA7BB4FF16B1CF144149EE05AB650D335B942CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0134AEF5 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E0134AEF5(void* __ecx) {
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x1383040 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E0134C0D3(_t13,  *0x1383040);
					_t14 = _t23;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						if(_t11 == 0) {
							if(E0134C10E(_t14,  *0x1383040, 0xffffffff) != 0) {
								_push(0x28);
								_t27 = E01356A5E();
								_t18 = 1;
								if(_t27 == 0) {
									L8:
									_t11 = 0;
									E0134C10E(_t18,  *0x1383040, 0);
								} else {
									_t8 = E0134C10E(_t18,  *0x1383040, _t27);
									_pop(_t18);
									if(_t8 != 0) {
										_t11 = _t27;
										_t27 = 0;
									} else {
										goto L8;
									}
								}
								E0134C213(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x0134aef5
0x0134aefc
0x0134af0f
0x0134af16
0x0134af18
0x0134af1c
0x0134af35
0x0134af35
0x0134af1e
0x0134af20
0x0134af33
0x0134af3a
0x0134af43
0x0134af46
0x0134af49
0x0134af5d
0x0134af5d
0x0134af66
0x0134af4b
0x0134af52
0x0134af58
0x0134af5b
0x0134af6f
0x0134af71
0x00000000
0x00000000
0x00000000
0x0134af5b
0x0134af74
0x00000000
0x00000000
0x00000000
0x0134af33
0x0134af20
0x0134af7c
0x0134af86
0x0134aefe
0x0134af00
0x0134af00

APIs

GetLastError.KERNEL32(?,?,0134AEEC,01349710,013485A3), ref: 0134AF03
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0134AF11
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0134AF2A
SetLastError.KERNEL32(00000000,0134AEEC,01349710,013485A3), ref: 0134AF7C

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4d50a17cc39872cbfe686219e200895608a3b66d1b44457dcb3b3c52076aec7a
Instruction ID: c08bd5166c2055e4fc2fe9022a07b95c4679fe10a7e24fd18c1c5a053c06130b
Opcode Fuzzy Hash: 4d50a17cc39872cbfe686219e200895608a3b66d1b44457dcb3b3c52076aec7a
Instruction Fuzzy Hash: BE01D8B224E3125FE73526BE6C84A5A76D8EB11B7DB200229E112535E4EF51A9055340

Uniqueness

Uniqueness Score: -1.00%

Function 0133D38D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0133D38D(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				void* _t34;
				signed int _t38;
				signed int _t39;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t51;
				intOrPtr* _t52;
				signed int _t54;
				void* _t60;
				void* _t65;
				intOrPtr _t68;
				void* _t69;
				void* _t73;

				_t73 = __eflags;
				_push(0x30);
				E01348213(0x136c301, __ebx, __edi, __esi);
				_t50 = __ecx;
				 *((intOrPtr*)(_t69 - 0x10)) = __ecx;
				_t32 = E01336203(_t73, _t69 - 0x3c);
				_t51 = _t50 + 0x2c;
				_t54 = 0xb;
				memcpy(_t51, _t32, _t54 << 2);
				_t34 = E01356A36(_t60, _t32);
				_t68 =  *((intOrPtr*)(_t69 - 0x10));
				_t65 = _t34;
				 *((intOrPtr*)(_t69 - 0x10)) = _t68;
				 *((intOrPtr*)(_t68 + 8)) = 0;
				 *((intOrPtr*)(_t68 + 0x10)) = 0;
				 *((intOrPtr*)(_t68 + 0x14)) = 0;
				 *((intOrPtr*)(_t68 + 0x18)) = 0;
				_push(_t51);
				_push(0);
				 *((intOrPtr*)(_t69 - 4)) = 0;
				 *((intOrPtr*)(_t68 + 8)) = E0132FB50(_t69,  *((intOrPtr*)(_t65 + 0x1c)));
				E0133D230(_t68, 0, _t65);
				if( *((char*)(_t68 + 0x28)) == 0) {
					_t38 =  *((intOrPtr*)(_t65 + 0x29));
				} else {
					_t38 =  *((intOrPtr*)(_t65 + 0x28));
				}
				_t39 = _t38;
				 *(_t68 + 0x1c) = _t39;
				if(_t39 < 0 || _t39 >= 0x7f) {
					 *(_t68 + 0x1c) =  *(_t68 + 0x1c) & 0x00000000;
				}
				_t52 = _t68 + 0x20;
				E0133E2F7(_t68, _t52,  *((char*)(_t65 + 0x2b)),  *((char*)(_t65 + 0x2a)),  *((char*)(_t65 + 0x2e)));
				_t47 = E0133E2F7(_t68, _t68 + 0x24,  *((char*)(_t65 + 0x2d)),  *((char*)(_t65 + 0x2c)),  *((char*)(_t65 + 0x2f)));
				if( *((char*)(_t69 + 0xc)) != 0) {
					_t47 = 0x76782b24;
					 *_t52 = 0x76782b24;
					 *((intOrPtr*)(_t68 + 0x24)) = 0x76782b24;
				}
				return E013481F0(_t47);
			}

0x0133d38d
0x0133d38d
0x0133d394
0x0133d399
0x0133d39b
0x0133d3a2
0x0133d3a7
0x0133d3ae
0x0133d3b1
0x0133d3b3
0x0133d3b8
0x0133d3bb
0x0133d3bf
0x0133d3c2
0x0133d3c5
0x0133d3c8
0x0133d3cb
0x0133d3ce
0x0133d3cf
0x0133d3d3
0x0133d3de
0x0133d3e6
0x0133d3ef
0x0133d3f6
0x0133d3f1
0x0133d3f1
0x0133d3f1
0x0133d3f9
0x0133d3fc
0x0133d401
0x0133d408
0x0133d408
0x0133d410
0x0133d421
0x0133d43b
0x0133d444
0x0133d446
0x0133d44b
0x0133d44d
0x0133d44d
0x0133d455

APIs

__EH_prolog3.LIBCMT ref: 0133D394
_Getvals.LIBCPMT ref: 0133D3E6
_Mpunct.LIBCPMT ref: 0133D421
_Mpunct.LIBCPMT ref: 0133D43B

Strings

$+xv, xrefs: 0133D446

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: f8dcf30cb562ddc87735e05c1a89c29f0762df9ffce456bf0c9da18dadeb5ecd
Instruction ID: a0d9c1705898b2ffa3864705706a8bb3ac949d497d54c55110195576b1106fa3
Opcode Fuzzy Hash: f8dcf30cb562ddc87735e05c1a89c29f0762df9ffce456bf0c9da18dadeb5ecd
Instruction Fuzzy Hash: DF21C1B1904B926FD721DFB88490B7BBFFCAB4C208F04465AE599C7A01D734EA01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 013283E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E013283E0() {
				char _v8;
				char _v16;
				char _v20;
				signed int _t13;
				intOrPtr _t17;
				signed int _t21;
				intOrPtr* _t34;
				signed int _t37;

				_push(0xffffffff);
				_push(0x136a221);
				_push( *[fs:0x0]);
				_t13 =  *0x1383020; // 0xc9209188
				_push(_t13 ^ _t37);
				 *[fs:0x0] =  &_v16;
				_t17 =  *0x138577c; // 0x0
				if(_t17 >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c])) + 4))) {
					E01347875(_t17, 0x138577c);
					if( *0x138577c == 0xffffffff) {
						_v8 = 0;
						 *0x1385780 = GetProcAddress(GetModuleHandleW(L"kernel32"), "IsWow64Process");
						_v8 = 0xffffffff;
						E0134782B(0x138577c);
					}
				}
				_t34 =  *0x1385780; // 0x0
				if(_t34 == 0) {
					L6:
					 *[fs:0x0] = _v16;
					return 0;
				} else {
					_v20 = 0;
					_t21 =  *_t34(GetCurrentProcess(),  &_v20);
					if(_t21 == 0) {
						goto L6;
					} else {
						 *[fs:0x0] = _v16;
						return _t21 & 0xffffff00 | _v20 == 0x00000001;
					}
				}
			}

0x013283e3
0x013283e5
0x013283f0
0x013283f3
0x013283fa
0x013283fe
0x0132840c
0x01328417
0x0132841e
0x0132842d
0x0132842f
0x0132844d
0x01328452
0x0132845e
0x01328463
0x0132842d
0x01328466
0x0132846e
0x0132849f
0x013284a4
0x013284b0
0x01328470
0x01328473
0x01328482
0x01328486
0x00000000
0x01328488
0x01328492
0x0132849e
0x0132849e
0x01328486

APIs

GetCurrentProcess.KERNEL32(C9209188,C9209188,?,?,00000000,0136A221,000000FF), ref: 0132847B

Part of subcall function 01347875: EnterCriticalSection.KERNEL32(01384AF8,00000000,?,?,013225B6,0138571C,C9209188,?,00000000,013693ED,000000FF,?,01321A26), ref: 01347880
Part of subcall function 01347875: LeaveCriticalSection.KERNEL32(01384AF8,?,?,013225B6,0138571C,C9209188,?,00000000,013693ED,000000FF,?,01321A26,?,?,?,C9209188), ref: 013478BD

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 01328440
GetProcAddress.KERNEL32(00000000), ref: 01328447

Part of subcall function 0134782B: EnterCriticalSection.KERNEL32(01384AF8,?,?,01322627,0138571C,0136CCC0), ref: 01347835
Part of subcall function 0134782B: LeaveCriticalSection.KERNEL32(01384AF8,?,?,01322627,0138571C,0136CCC0), ref: 01347868
Part of subcall function 0134782B: RtlWakeAllConditionVariable.NTDLL ref: 013478DF

Strings

IsWow64Process, xrefs: 01328436
kernel32, xrefs: 0132843B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 2056477612-3789238822
Opcode ID: cf7b9cc6ec113b092a0ef4e27a7fd8cd931b0452eadc369a83a329a1954ded90
Instruction ID: 9a61cd705963bd85e7095192aa39de378b621fb304cf64b9c83f29845d691bf3
Opcode Fuzzy Hash: cf7b9cc6ec113b092a0ef4e27a7fd8cd931b0452eadc369a83a329a1954ded90
Instruction Fuzzy Hash: CC1172B2944754EFDB20EFA8E805B9DBBACF708724F10866EE911A3784D7756500CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01358461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E01358461(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x1383020; // 0xc9209188
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], E0136CBE4, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x136d26c(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x01358476
0x01358481
0x01358487
0x0135848b
0x01358496
0x0135849e
0x013584a8
0x013584ae
0x013584b2
0x013584b9
0x013584bf
0x013584bf
0x013584b2
0x013584c5
0x013584ca
0x013584ca
0x013584d3
0x013584dd

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C9209188,?,?,00000000,0136CBE4,000000FF,?,013583F1,?,?,013583C5,?), ref: 01358496
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 013584A8
FreeLibrary.KERNEL32(00000000,?,00000000,0136CBE4,000000FF,?,013583F1,?,?,013583C5,?), ref: 013584CA

Strings

mscoree.dll, xrefs: 0135848F
CorExitProcess, xrefs: 013584A0

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ca9bcd2397727cba17cdf56912da285dab296687937054bbfe7304ec2e6cec9f
Instruction ID: 3302bb141615b63a6898958b2e04a2d3257d0370b5f2f12c2fea9c5ad8281558
Opcode Fuzzy Hash: ca9bcd2397727cba17cdf56912da285dab296687937054bbfe7304ec2e6cec9f
Instruction Fuzzy Hash: 2401A771A04615EBDB219F95DC05FAEBFBCFB04F18F008129EC11A2690D7749400CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0133DDD2 Relevance: 7.9, APIs: 5, Instructions: 433
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0133DDD2(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				signed char _t109;
				intOrPtr _t114;
				intOrPtr* _t117;
				intOrPtr _t119;
				intOrPtr _t123;
				intOrPtr* _t125;
				intOrPtr* _t128;
				intOrPtr _t133;
				intOrPtr* _t141;
				intOrPtr _t142;
				intOrPtr* _t147;
				intOrPtr* _t150;
				intOrPtr _t152;
				intOrPtr _t158;
				intOrPtr* _t165;
				signed int _t167;
				void* _t198;
				void* _t211;
				signed int _t215;
				signed char _t216;
				intOrPtr _t218;
				void* _t220;
				void* _t221;
				intOrPtr* _t223;
				void* _t224;
				intOrPtr* _t226;
				intOrPtr* _t228;
				void* _t229;
				intOrPtr* _t231;
				intOrPtr* _t233;
				intOrPtr* _t234;
				void* _t235;
				void* _t236;
				void* _t239;
				void* _t240;
				void* _t241;
				void* _t242;
				void* _t243;
				void* _t244;

				_t219 = __esi;
				_t211 = __edx;
				_push(0xc);
				E01348213(0x136c419, __ebx, __edi, __esi);
				_t109 =  *(_t235 + 0xc);
				_t165 = 0;
				_t218 =  *((intOrPtr*)(_t235 + 0x14));
				_t167 = _t109 & 0x00000002;
				 *(_t235 - 0x14) = _t167;
				if(_t167 != 0) {
					_t158 = E0132BCE0();
					if(_t218 != 0) {
						_t219 = _t158;
						E01334403(0, _t218, _t158, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E0132B500(0, _t218, _t218), _t158);
						_t236 = _t236 + 0x10;
					} else {
						 *((intOrPtr*)(_t235 - 0x10)) = _t158;
						_t234 = E013284C0(0x44);
						 *((intOrPtr*)(_t235 - 0x18)) = _t234;
						_t248 = _t234;
						if(_t234 == 0) {
							_t219 = 0;
						} else {
							 *((intOrPtr*)(_t234 + 4)) = 0;
							 *_t234 = 0x136e594;
							E0132B9E0(_t234, _t218,  *((intOrPtr*)(_t235 + 8)));
						}
						E01334403(_t165, _t218, _t219, _t248,  *((intOrPtr*)(_t235 + 0x10)), _t219,  *((intOrPtr*)(_t235 - 0x10)));
						_t236 = _t236 + 0xc;
					}
					_t109 =  *(_t235 + 0xc);
				}
				if((_t109 & 0x00000008) == 0) {
					L25:
					_push(_t165);
					_push(_t165);
					_t215 = 1 << E01338D25(_t165, _t211, _t218, _t219, _t255) >> 1;
					if(( *(_t235 + 0xc) & 1) != 0) {
						_t142 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t230 = _t142;
							_t110 = E01334403(_t165, _t218, _t142, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E01337775(_t165, _t215, _t218, _t142, __eflags), _t230);
							_t236 = _t236 + 0x10;
						} else {
							 *((intOrPtr*)(_t235 - 0x10)) = _t142;
							_t231 = E013284C0(0x10);
							 *((intOrPtr*)(_t235 - 0x18)) = _t231;
							_pop(_t198);
							_t258 = _t231;
							if(_t231 == 0) {
								_t231 = _t165;
							} else {
								 *((intOrPtr*)(_t231 + 4)) = _t165;
								 *_t231 = 0x136e6c4;
								 *((intOrPtr*)(_t231 + 8)) = E0134710D(_t165, _t198, _t258);
								 *(_t231 + 0xc) = _t215;
							}
							_t110 = E01334403(_t165, _t218, _t231, _t258,  *((intOrPtr*)(_t235 + 0x10)), _t231,  *((intOrPtr*)(_t235 - 0x10)));
							_t236 = _t236 + 0xc;
						}
					}
					_t216 =  *(_t235 + 0xc);
					if((_t216 & 0x00000020) != 0) {
						_t229 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t110 = E01334403(_t165, _t218, _t229, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E01337934(_t165, _t216, _t218, _t229, __eflags), _t229);
							_t236 = _t236 + 0x10;
						} else {
							_t141 = E013284C0(8);
							 *((intOrPtr*)(_t235 - 0x18)) = _t141;
							_t261 = _t141;
							if(_t141 == 0) {
								_t141 = _t165;
							} else {
								 *((intOrPtr*)(_t141 + 4)) = _t165;
								 *_t141 = 0x136e6e0;
							}
							_t110 = E01334403(_t165, _t218, _t229, _t261,  *((intOrPtr*)(_t235 + 0x10)), _t141, _t229);
							_t236 = _t236 + 0xc;
						}
						_t216 =  *(_t235 + 0xc);
					}
					if((_t216 & 0x00000004) != 0) {
						_t224 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t125 = E01337A5E(_t165, _t216, _t218, _t224, __eflags);
						} else {
							_t125 = E013284C0(8);
							 *((intOrPtr*)(_t235 - 0x18)) = _t125;
							_t264 = _t125;
							if(_t125 == 0) {
								_t125 = _t165;
							} else {
								 *((intOrPtr*)(_t125 + 4)) = _t165;
								 *_t125 = 0x136e6fc;
							}
						}
						_t225 =  *((intOrPtr*)(_t235 + 0x10));
						E01334403(_t165, _t218,  *((intOrPtr*)(_t235 + 0x10)), _t264,  *((intOrPtr*)(_t235 + 0x10)), _t125, _t224);
						_t240 = _t236 + 0xc;
						 *((intOrPtr*)(_t235 - 0x10)) = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t128 = E01337B88(_t165, _t216, _t218, _t225, __eflags);
						} else {
							_t128 = E013284C0(8);
							 *((intOrPtr*)(_t235 - 0x18)) = _t128;
							_t266 = _t128;
							if(_t128 == 0) {
								_t128 = _t165;
							} else {
								 *((intOrPtr*)(_t128 + 4)) = _t165;
								 *_t128 = 0x136e714;
							}
						}
						E01334403(_t165, _t218, _t225, _t266, _t225, _t128,  *((intOrPtr*)(_t235 - 0x10)));
						_t241 = _t240 + 0xc;
						 *((intOrPtr*)(_t235 - 0x10)) = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t226 = E01337DDC(_t165, _t216, _t218, _t225, __eflags);
						} else {
							_t226 = E013284C0(0x58);
							 *((intOrPtr*)(_t235 - 0x18)) = _t226;
							 *(_t235 - 4) = 0x10;
							_t268 = _t226;
							if(_t226 == 0) {
								_t226 = _t165;
							} else {
								 *((intOrPtr*)(_t226 + 4)) = _t165;
								 *(_t235 - 4) = 0x11;
								 *_t226 = 0x136e72c;
								 *((char*)(_t226 + 0x28)) = _t165;
								E0133D38D(_t165, _t226, _t218, _t226, _t268,  *((intOrPtr*)(_t235 + 8)), _t165);
								 *_t226 = 0x136e760;
							}
							 *(_t235 - 4) =  *(_t235 - 4) | 0xffffffff;
						}
						E01334403(_t165, _t218, _t226, _t268,  *((intOrPtr*)(_t235 + 0x10)), _t226,  *((intOrPtr*)(_t235 - 0x10)));
						_t242 = _t241 + 0xc;
						_t133 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t227 = _t133;
							_t110 = E01334403(_t165, _t218, _t133, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E01337D47(_t165, _t216, _t218, _t133, __eflags), _t227);
							_t236 = _t242 + 0x10;
						} else {
							 *((intOrPtr*)(_t235 - 0x10)) = _t133;
							_t228 = E013284C0(0x58);
							 *((intOrPtr*)(_t235 - 0x18)) = _t228;
							 *(_t235 - 4) = 0x16;
							_t270 = _t228;
							if(_t228 == 0) {
								_t228 = _t165;
							} else {
								 *((intOrPtr*)(_t228 + 4)) = _t165;
								 *(_t235 - 4) = 0x17;
								 *_t228 = 0x136e72c;
								 *((char*)(_t228 + 0x28)) = 1;
								E0133D38D(_t165, _t228, _t218, _t228, _t270,  *((intOrPtr*)(_t235 + 8)), _t165);
								 *_t228 = 0x136e794;
							}
							 *(_t235 - 4) =  *(_t235 - 4) | 0xffffffff;
							_t110 = E01334403(_t165, _t218, _t228, _t270,  *((intOrPtr*)(_t235 + 0x10)), _t228,  *((intOrPtr*)(_t235 - 0x10)));
							_t236 = _t242 + 0xc;
						}
						_t216 =  *(_t235 + 0xc);
					}
					if((_t216 & 0x00000010) != 0) {
						_t221 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t117 = E0133815A(_t165, _t216, _t218, _t221, __eflags);
						} else {
							_t123 = E013284C0(0x44);
							 *((intOrPtr*)(_t235 - 0x18)) = _t123;
							 *(_t235 - 4) = 0x1b;
							_t273 = _t123;
							if(_t123 == 0) {
								_t117 = _t165;
							} else {
								_push(_t165);
								_push( *((intOrPtr*)(_t235 + 8)));
								_t117 = E013383C2(_t123, _t221, _t273);
							}
							 *(_t235 - 4) =  *(_t235 - 4) | 0xffffffff;
						}
						E01334403(_t165, _t218, _t221, _t273,  *((intOrPtr*)(_t235 + 0x10)), _t117, _t221);
						_t239 = _t236 + 0xc;
						_t119 = E0132BCE0();
						if(_t218 != 0) {
							_t110 = E01334403(_t165, _t218, _t119, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E0132EAF0(_t165, _t218), _t119);
							_t236 = _t239 + 0x10;
						} else {
							 *((intOrPtr*)(_t235 - 0x10)) = _t119;
							_t223 = E013284C0(0xc);
							 *((intOrPtr*)(_t235 - 0x18)) = _t223;
							_t275 = _t223;
							if(_t223 == 0) {
								_t223 = _t165;
							} else {
								 *((intOrPtr*)(_t223 + 4)) = _t165;
								 *_t223 = 0x136e620;
								 *((intOrPtr*)(_t223 + 8)) = _t165;
								E0132FA50(_t165, _t223,  *((intOrPtr*)(_t235 + 8)));
							}
							_t110 = E01334403(_t165, _t218, _t223, _t275,  *((intOrPtr*)(_t235 + 0x10)), _t223,  *((intOrPtr*)(_t235 - 0x10)));
							_t236 = _t239 + 0xc;
						}
					}
					if( *(_t235 - 0x14) != 0) {
						_t220 = E0132BCE0();
						if(_t218 != 0) {
							_push(_t218);
							_t110 = E01334403(_t165, _t218, _t220, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E0133764B(_t165, _t216, _t218, _t220, __eflags), _t220);
						} else {
							_t114 = E013284C0(0x34);
							 *((intOrPtr*)(_t235 - 0x18)) = _t114;
							_t278 = _t114;
							if(_t114 != 0) {
								_t165 = E01338358(_t114,  *((intOrPtr*)(_t235 + 8)), _t165);
							}
							_t110 = E01334403(_t165, _t218, _t220, _t278,  *((intOrPtr*)(_t235 + 0x10)), _t165, _t220);
						}
					}
					return E013481F0(_t110);
				} else {
					 *((intOrPtr*)(_t235 - 0x10)) = E0132BCE0();
					if(_t218 != 0) {
						_push(_t218);
						_t147 = E01337F06(_t165, _t211, _t218, _t219, __eflags);
					} else {
						_t147 = E013284C0(8);
						 *((intOrPtr*)(_t235 - 0x18)) = _t147;
						_t251 = _t147;
						if(_t147 == 0) {
							_t147 = _t165;
						} else {
							 *((intOrPtr*)(_t147 + 4)) = _t165;
							 *_t147 = 0x136e634;
						}
					}
					_t232 =  *((intOrPtr*)(_t235 + 0x10));
					E01334403(_t165, _t218,  *((intOrPtr*)(_t235 + 0x10)), _t251,  *((intOrPtr*)(_t235 + 0x10)), _t147,  *((intOrPtr*)(_t235 - 0x10)));
					_t243 = _t236 + 0xc;
					 *((intOrPtr*)(_t235 - 0x10)) = E0132BCE0();
					if(_t218 != 0) {
						_t150 = E0132EC30(_t165, _t218);
					} else {
						_t150 = E013284C0(8);
						 *((intOrPtr*)(_t235 - 0x18)) = _t150;
						_t253 = _t150;
						if(_t150 == 0) {
							_t150 = _t165;
						} else {
							 *((intOrPtr*)(_t150 + 4)) = _t165;
							 *_t150 = 0x136e670;
						}
					}
					E01334403(_t165, _t218, _t232, _t253, _t232, _t150,  *((intOrPtr*)(_t235 - 0x10)));
					_t244 = _t243 + 0xc;
					_t152 = E0132BCE0();
					if(_t218 != 0) {
						_t219 = _t152;
						E01334403(_t165, _t218, _t152, __eflags,  *((intOrPtr*)(_t235 + 0x10)), E0132ED70(_t165, _t218), _t152);
						_t236 = _t244 + 0x10;
					} else {
						 *((intOrPtr*)(_t235 - 0x10)) = _t152;
						_t233 = E013284C0(0x18);
						 *((intOrPtr*)(_t235 - 0x18)) = _t233;
						 *(_t235 - 4) = 7;
						_t255 = _t233;
						if(_t233 == 0) {
							_t219 = _t165;
						} else {
							 *((intOrPtr*)(_t233 + 4)) = _t165;
							_push(_t165);
							 *(_t235 - 4) = 8;
							 *_t233 = 0x136e6a0;
							E0132F860(_t165, _t233,  *((intOrPtr*)(_t235 + 8)));
						}
						 *(_t235 - 4) =  *(_t235 - 4) | 0xffffffff;
						E01334403(_t165, _t218, _t219, _t255,  *((intOrPtr*)(_t235 + 0x10)), _t219,  *((intOrPtr*)(_t235 - 0x10)));
						_t236 = _t244 + 0xc;
					}
					goto L25;
				}
			}

0x0133ddd2
0x0133ddd2
0x0133ddd2
0x0133ddd9
0x0133ddde
0x0133dde1
0x0133dde3
0x0133dde8
0x0133ddeb
0x0133ddee
0x0133ddf5
0x0133ddfc
0x0133de3b
0x0133de47
0x0133de4c
0x0133ddfe
0x0133de00
0x0133de08
0x0133de0a
0x0133de0e
0x0133de10
0x0133de27
0x0133de12
0x0133de17
0x0133de1a
0x0133de20
0x0133de20
0x0133de30
0x0133de35
0x0133de35
0x0133de4f
0x0133de4f
0x0133de54
0x0133df52
0x0133df52
0x0133df53
0x0133df62
0x0133df67
0x0133df6e
0x0133df75
0x0133dfb4
0x0133dfb5
0x0133dfc1
0x0133dfc6
0x0133df77
0x0133df79
0x0133df81
0x0133df83
0x0133df86
0x0133df87
0x0133df89
0x0133dfa1
0x0133df8b
0x0133df8b
0x0133df8e
0x0133df99
0x0133df9c
0x0133df9c
0x0133dfaa
0x0133dfaf
0x0133dfaf
0x0133df75
0x0133dfc9
0x0133dfcf
0x0133dfdb
0x0133dfdf
0x0133e00c
0x0133e017
0x0133e01c
0x0133dfe1
0x0133dfe3
0x0133dfe8
0x0133dfec
0x0133dfee
0x0133dffb
0x0133dff0
0x0133dff0
0x0133dff3
0x0133dff3
0x0133e002
0x0133e007
0x0133e007
0x0133e01f
0x0133e01f
0x0133e025
0x0133e035
0x0133e039
0x0133e059
0x0133e05a
0x0133e03b
0x0133e03d
0x0133e042
0x0133e046
0x0133e048
0x0133e055
0x0133e04a
0x0133e04a
0x0133e04d
0x0133e04d
0x0133e048
0x0133e061
0x0133e066
0x0133e06b
0x0133e078
0x0133e07d
0x0133e09d
0x0133e09e
0x0133e07f
0x0133e081
0x0133e086
0x0133e08a
0x0133e08c
0x0133e099
0x0133e08e
0x0133e08e
0x0133e091
0x0133e091
0x0133e08c
0x0133e0a9
0x0133e0ae
0x0133e0bb
0x0133e0c0
0x0133e105
0x0133e10c
0x0133e0c2
0x0133e0c9
0x0133e0cc
0x0133e0cf
0x0133e0d6
0x0133e0d8
0x0133e0fd
0x0133e0da
0x0133e0da
0x0133e0e3
0x0133e0e7
0x0133e0ed
0x0133e0f0
0x0133e0f5
0x0133e0f5
0x0133e0ff
0x0133e0ff
0x0133e115
0x0133e11a
0x0133e122
0x0133e129
0x0133e181
0x0133e182
0x0133e18e
0x0133e193
0x0133e12b
0x0133e12d
0x0133e135
0x0133e138
0x0133e13b
0x0133e142
0x0133e144
0x0133e16a
0x0133e146
0x0133e146
0x0133e14f
0x0133e153
0x0133e159
0x0133e15d
0x0133e162
0x0133e162
0x0133e16f
0x0133e177
0x0133e17c
0x0133e17c
0x0133e196
0x0133e196
0x0133e19c
0x0133e1ac
0x0133e1b0
0x0133e1dd
0x0133e1de
0x0133e1b2
0x0133e1b4
0x0133e1ba
0x0133e1bd
0x0133e1c4
0x0133e1c6
0x0133e1d5
0x0133e1c8
0x0133e1c8
0x0133e1c9
0x0133e1ce
0x0133e1ce
0x0133e1d7
0x0133e1d7
0x0133e1ea
0x0133e1ef
0x0133e1f7
0x0133e1fe
0x0133e24c
0x0133e251
0x0133e200
0x0133e202
0x0133e20a
0x0133e20c
0x0133e210
0x0133e212
0x0133e22c
0x0133e214
0x0133e217
0x0133e21c
0x0133e222
0x0133e225
0x0133e225
0x0133e235
0x0133e23a
0x0133e23a
0x0133e1fe
0x0133e258
0x0133e264
0x0133e268
0x0133e295
0x0133e2a0
0x0133e26a
0x0133e26c
0x0133e271
0x0133e275
0x0133e277
0x0133e284
0x0133e284
0x0133e28b
0x0133e290
0x0133e268
0x0133e2ad
0x0133de5a
0x0133de64
0x0133de69
0x0133de89
0x0133de8a
0x0133de6b
0x0133de6d
0x0133de72
0x0133de76
0x0133de78
0x0133de85
0x0133de7a
0x0133de7a
0x0133de7d
0x0133de7d
0x0133de78
0x0133de93
0x0133de98
0x0133de9d
0x0133deaa
0x0133deaf
0x0133ded0
0x0133deb1
0x0133deb3
0x0133deb8
0x0133debc
0x0133debe
0x0133decb
0x0133dec0
0x0133dec0
0x0133dec3
0x0133dec3
0x0133debe
0x0133dedb
0x0133dee0
0x0133dee8
0x0133deef
0x0133df3e
0x0133df4a
0x0133df4f
0x0133def1
0x0133def3
0x0133defb
0x0133defe
0x0133df01
0x0133df08
0x0133df0a
0x0133df26
0x0133df0c
0x0133df0c
0x0133df0f
0x0133df15
0x0133df19
0x0133df1f
0x0133df1f
0x0133df2b
0x0133df33
0x0133df38
0x0133df38
0x00000000
0x0133deef

APIs

__EH_prolog3.LIBCMT ref: 0133DDD9
collate.LIBCPMT ref: 0133DF54
numpunct.LIBCPMT ref: 0133E1CE

Part of subcall function 013383C2: __EH_prolog3.LIBCMT ref: 013383C9

Part of subcall function 0133815A: __EH_prolog3.LIBCMT ref: 01338161
Part of subcall function 0133815A: std::_Lockit::_Lockit.LIBCPMT ref: 0133816B
Part of subcall function 0133815A: std::_Lockit::~_Lockit.LIBCPMT ref: 013381DC

Part of subcall function 0132EAF0: std::_Lockit::_Lockit.LIBCPMT ref: 0132EB1D
Part of subcall function 0132EAF0: std::_Lockit::_Lockit.LIBCPMT ref: 0132EB40
Part of subcall function 0132EAF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132EB68
Part of subcall function 0132EAF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132EC07

Part of subcall function 01334403: Concurrency::cancel_current_task.LIBCPMT ref: 013344C6

Part of subcall function 0133764B: __EH_prolog3.LIBCMT ref: 01337652
Part of subcall function 0133764B: std::_Lockit::_Lockit.LIBCPMT ref: 0133765C
Part of subcall function 0133764B: std::_Lockit::~_Lockit.LIBCPMT ref: 013376CD

__Getcoll.LIBCPMT ref: 0133DF94

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

Part of subcall function 013284C0: LocalAlloc.KERNEL32(00000040,00000000,0134839D,00000000,C9209188,?,00000000,?,00000000,?,0136CB8D,000000FF,?,013217D5,00000000,0136D3BA), ref: 013284C6

Part of subcall function 0132B9E0: __Getctype.LIBCPMT ref: 0132B9EB

Part of subcall function 01337A5E: __EH_prolog3.LIBCMT ref: 01337A65
Part of subcall function 01337A5E: std::_Lockit::_Lockit.LIBCPMT ref: 01337A6F
Part of subcall function 01337A5E: std::_Lockit::~_Lockit.LIBCPMT ref: 01337AE0

Part of subcall function 01337B88: __EH_prolog3.LIBCMT ref: 01337B8F
Part of subcall function 01337B88: std::_Lockit::_Lockit.LIBCPMT ref: 01337B99
Part of subcall function 01337B88: std::_Lockit::~_Lockit.LIBCPMT ref: 01337C0A

Part of subcall function 01337DDC: __EH_prolog3.LIBCMT ref: 01337DE3
Part of subcall function 01337DDC: std::_Lockit::_Lockit.LIBCPMT ref: 01337DED
Part of subcall function 01337DDC: std::_Lockit::~_Lockit.LIBCPMT ref: 01337E5E

Part of subcall function 01337D47: __EH_prolog3.LIBCMT ref: 01337D4E
Part of subcall function 01337D47: std::_Lockit::_Lockit.LIBCPMT ref: 01337D58
Part of subcall function 01337D47: std::_Lockit::~_Lockit.LIBCPMT ref: 01337DC9

Part of subcall function 01334403: __EH_prolog3.LIBCMT ref: 0133440A
Part of subcall function 01334403: std::_Lockit::_Lockit.LIBCPMT ref: 01334414
Part of subcall function 01334403: std::_Lockit::~_Lockit.LIBCPMT ref: 013344BB

codecvt.LIBCPMT ref: 0133E27F

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalcodecvtcollatenumpunct
String ID:
API String ID: 2252558201-0
Opcode ID: 5e99f1b00a501207e39f559ea0df88e2ee33039a949a38cf562be83caae15a0f
Instruction ID: 306db026023284d1f76afec34f437303ff1474f3066158646d9a62bceb2e9058
Opcode Fuzzy Hash: 5e99f1b00a501207e39f559ea0df88e2ee33039a949a38cf562be83caae15a0f
Instruction Fuzzy Hash: 4DE1E7B5C0022B9FDB11BFAC8C4167FBEA9FF9126CF04443DE95867280EA31891487D5

Uniqueness

Uniqueness Score: -1.00%

Function 0135C382 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E0135C382(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				intOrPtr _t46;
				signed int _t49;
				void* _t52;
				signed int _t56;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t73;
				void* _t74;
				intOrPtr _t75;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				intOrPtr* _t96;
				intOrPtr* _t98;
				signed int _t99;
				void* _t100;
				intOrPtr* _t101;
				intOrPtr* _t103;
				void* _t106;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0x1383020; // 0xc9209188
				_v8 = _t41 ^ _t99;
				_t73 = _a20;
				if(_t73 > 0) {
					_t71 = E0135807B(_a16, _t73);
					_t106 = _t71 - _t73;
					_t4 = _t71 + 1; // 0x1
					_t73 = _t4;
					if(_t106 >= 0) {
						_t73 = _t71;
					}
				}
				_t77 = _a32;
				if(_a32 == 0) {
					_t70 =  *((intOrPtr*)( *_a4 + 8));
					_t77 = _t70;
					_a32 = _t70;
				}
				_t46 = E0135FFAF(_t77, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t73, 0, 0);
				_t101 = _t100 + 0x18;
				_v12 = _t46;
				if(_t46 == 0) {
					L41:
					_pop(_t92);
					_pop(_t95);
					_pop(_t74);
					return E01347708(_t46, _t74, _v8 ^ _t99, 0x400, _t92, _t95);
				} else {
					_t16 = _t46 + _t46 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t46 + _t46 & _t16;
					if(_t49 == 0) {
						_t96 = 0;
						L39:
						_t75 = 0;
						L40:
						E013470EF(_t96);
						_t46 = _t75;
						goto L41;
					}
					if(_t49 > 0x400) {
						_t93 = E0135B127(_t49);
						if(_t93 == 0) {
							L13:
							_t96 = _t93;
							if(_t93 == 0) {
								goto L39;
							}
							_t52 = E0135FFAF(_a32, 1, _a16, _t73, _t93, _v12);
							_t103 = _t101 + 0x18;
							if(_t52 == 0) {
								goto L39;
							}
							_t97 = _v12;
							_t75 = E0135CEA1(_a8, _a12, _t93, _v12, 0, 0, 0, 0, 0);
							if(_t75 == 0) {
								L19:
								_t96 = _t93;
								goto L39;
							}
							if((_a12 & 0x00000400) == 0) {
								_t31 = _t75 + _t75 + 8; // 0x8
								asm("sbb eax, eax");
								_t56 = _t75 + _t75 & _t31;
								if(_t56 == 0) {
									_t98 = 0;
									L37:
									E013470EF(_t98);
									goto L19;
								}
								if(_t56 > 0x400) {
									_t98 = E0135B127(_t56);
									if(_t98 == 0) {
										goto L37;
									}
									 *_t98 = 0xdddd;
									L28:
									_t98 = _t98 + 8;
									if(_t98 == 0 || E0135CEA1(_a8, _a12, _t93, _v12, _t98, _t75, 0, 0, 0) == 0) {
										goto L37;
									} else {
										_push(0);
										_push(0);
										if(_a28 != 0) {
											_push(_a28);
											_push(_a24);
										} else {
											_push(0);
											_push(0);
										}
										_push(_t75);
										_push(_t98);
										_push(0);
										_push(_a32);
										_t75 = E0136002B();
										if(_t75 == 0) {
											goto L37;
										} else {
											E013470EF(_t98);
											L34:
											_t96 = _t93;
											goto L40;
										}
									}
								}
								E01347FF0(_t56);
								_t98 = _t103;
								if(_t98 == 0) {
									goto L37;
								}
								 *_t98 = 0xcccc;
								goto L28;
							}
							_t65 = _a28;
							if(_t65 == 0) {
								goto L34;
							}
							if(_t75 <= _t65) {
								_t75 = E0135CEA1(_a8, _a12, _t93, _t97, _a24, _t65, 0, 0, 0);
								if(_t75 != 0) {
									goto L34;
								}
							}
							goto L19;
						}
						 *_t93 = 0xdddd;
						L12:
						_t93 = _t93 + 8;
						goto L13;
					}
					E01347FF0(_t49);
					_t93 = _t101;
					if(_t93 == 0) {
						goto L13;
					}
					 *_t93 = 0xcccc;
					goto L12;
				}
			}

0x0135c387
0x0135c388
0x0135c389
0x0135c390
0x0135c394
0x0135c39b
0x0135c3a1
0x0135c3a7
0x0135c3aa
0x0135c3aa
0x0135c3ad
0x0135c3af
0x0135c3af
0x0135c3ad
0x0135c3b1
0x0135c3b6
0x0135c3bd
0x0135c3c0
0x0135c3c2
0x0135c3c2
0x0135c3de
0x0135c3e3
0x0135c3e6
0x0135c3eb
0x0135c55e
0x0135c561
0x0135c562
0x0135c563
0x0135c56f
0x0135c3f1
0x0135c3f3
0x0135c3f8
0x0135c3fa
0x0135c3fc
0x0135c551
0x0135c553
0x0135c553
0x0135c555
0x0135c556
0x0135c55c
0x00000000
0x0135c55c
0x0135c407
0x0135c422
0x0135c427
0x0135c432
0x0135c432
0x0135c436
0x00000000
0x00000000
0x0135c449
0x0135c44e
0x0135c453
0x00000000
0x00000000
0x0135c459
0x0135c470
0x0135c474
0x0135c48f
0x0135c48f
0x00000000
0x0135c48f
0x0135c47e
0x0135c4bb
0x0135c4c0
0x0135c4c2
0x0135c4c4
0x0135c543
0x0135c545
0x0135c546
0x00000000
0x0135c54b
0x0135c4c8
0x0135c4e3
0x0135c4e8
0x00000000
0x00000000
0x0135c4ea
0x0135c4f0
0x0135c4f0
0x0135c4f5
0x00000000
0x0135c511
0x0135c513
0x0135c514
0x0135c518
0x0135c53b
0x0135c53e
0x0135c51a
0x0135c51a
0x0135c51b
0x0135c51b
0x0135c51c
0x0135c51d
0x0135c51e
0x0135c51f
0x0135c527
0x0135c52e
0x00000000
0x0135c530
0x0135c531
0x0135c537
0x0135c537
0x00000000
0x0135c537
0x0135c52e
0x0135c4f5
0x0135c4ca
0x0135c4cf
0x0135c4d3
0x00000000
0x00000000
0x0135c4d5
0x00000000
0x0135c4d5
0x0135c480
0x0135c485
0x00000000
0x00000000
0x0135c48d
0x0135c4ac
0x0135c4b0
0x00000000
0x00000000
0x0135c4b6
0x00000000
0x0135c48d
0x0135c429
0x0135c42f
0x0135c42f
0x00000000
0x0135c42f
0x0135c409
0x0135c40e
0x0135c412
0x00000000
0x00000000
0x0135c414
0x00000000
0x0135c414

APIs

__alloca_probe_16.LIBCMT ref: 0135C409
__alloca_probe_16.LIBCMT ref: 0135C4CA
__freea.LIBCMT ref: 0135C531

Part of subcall function 0135B127: HeapAlloc.KERNEL32(00000000,?,?,?,0135AAAA,?,00000000,?,0134C282,?,?,?,?,?,?,01321668), ref: 0135B159

__freea.LIBCMT ref: 0135C546
__freea.LIBCMT ref: 0135C556

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 6ec63a0fdda1b0ffe53e6afbc595a4bbe77ab72c93c51ca498ae3ea24cdc3709
Instruction ID: 41bb7c7214c2f19f39510e70362d4f422b34ab3e3d591631b42b935dd7eb6f02
Opcode Fuzzy Hash: 6ec63a0fdda1b0ffe53e6afbc595a4bbe77ab72c93c51ca498ae3ea24cdc3709
Instruction Fuzzy Hash: 5451C6B260030AAFEF615FADCC80EBB7AADEF44A5CB151529FE04E6140E774DD1087A0

Uniqueness

Uniqueness Score: -1.00%

Function 0132C590 Relevance: 7.6, APIs: 5, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0132C590(void* __ebx, void* __edi, void* __esi, void* _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				void* _v24;
				char _v28;
				signed char _v40;
				signed int _t36;
				void* _t51;
				signed int _t56;
				signed int _t57;
				char _t59;
				signed int _t62;
				intOrPtr _t70;
				signed int _t72;
				intOrPtr* _t75;
				signed int _t81;
				void* _t88;

				_push(0xffffffff);
				_push(0x136ac0d);
				_push( *[fs:0x0]);
				_push(__esi);
				_push(__edi);
				_t36 =  *0x1383020; // 0xc9209188
				_push(_t36 ^ _t81);
				 *[fs:0x0] =  &_v16;
				E01335EA5( &_v28, 0);
				_v8 = 0;
				_t72 =  *0x13848a4; // 0x0
				_t59 =  *0x138574c; // 0x0
				_v24 = _t59;
				if(_t72 == 0) {
					E01335EA5( &_v20, _t72);
					_v8 = 1;
					_t88 =  *0x13848a4 - _t72; // 0x0
					if(_t88 == 0) {
						_t56 =  *0x138488c; // 0x0
						_t57 = _t56 + 1;
						 *0x138488c = _t57;
						 *0x13848a4 = _t57;
					}
					_v8 = 0;
					E01335EFD( &_v20);
					_t72 =  *0x13848a4; // 0x0
				}
				_t62 = _t72 * 4;
				_v20 = _t62;
				_t70 =  *((intOrPtr*)(_a4 + 4));
				if(_t72 >=  *((intOrPtr*)(_t70 + 0xc))) {
					_t75 = 0;
					__eflags = 0;
					_v20 = _t62;
					goto L8;
				} else {
					_t75 =  *((intOrPtr*)(_t62 +  *((intOrPtr*)(_t70 + 8))));
					if(_t75 != 0) {
						L16:
						_v8 = 0xffffffff;
						E01335EFD( &_v28);
						 *[fs:0x0] = _v16;
						return _t75;
					} else {
						L8:
						if( *((char*)(_t70 + 0x14)) == 0) {
							L11:
							if(_t75 != 0) {
								goto L16;
							} else {
								goto L12;
							}
						} else {
							_t51 = E01335C60();
							if(_t72 >=  *((intOrPtr*)(_t51 + 0xc))) {
								L12:
								if(_t59 == 0) {
									__eflags = E0132C220(_t72, _t75,  &_v24, _a4) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										return E01335F80(_t62, _v40 & 0x000000ff, _t62 + 8);
									} else {
										_t75 = _v24;
										_a4 = _t75;
										_v8 = 2;
										E01335C34(_t75);
										 *((intOrPtr*)( *_t75 + 4))();
										 *0x138574c = _t75;
										_a4 = 0;
										_v8 = 0;
										goto L16;
									}
								} else {
									_t75 = _t59;
									goto L16;
								}
							} else {
								_t75 =  *((intOrPtr*)(_v20 +  *((intOrPtr*)(_t51 + 8))));
								goto L11;
							}
						}
					}
				}
			}

0x0132c593
0x0132c595
0x0132c5a0
0x0132c5a5
0x0132c5a6
0x0132c5a7
0x0132c5ae
0x0132c5b2
0x0132c5bd
0x0132c5c2
0x0132c5c9
0x0132c5cf
0x0132c5d5
0x0132c5da
0x0132c5e0
0x0132c5e5
0x0132c5e9
0x0132c5ef
0x0132c5f1
0x0132c5f6
0x0132c5f7
0x0132c5fc
0x0132c5fc
0x0132c601
0x0132c608
0x0132c60d
0x0132c60d
0x0132c616
0x0132c61d
0x0132c620
0x0132c626
0x0132c634
0x0132c634
0x0132c636
0x00000000
0x0132c628
0x0132c62b
0x0132c630
0x0132c69d
0x0132c69d
0x0132c6a7
0x0132c6b1
0x0132c6bf
0x0132c632
0x0132c639
0x0132c63d
0x0132c652
0x0132c654
0x00000000
0x00000000
0x00000000
0x00000000
0x0132c63f
0x0132c63f
0x0132c647
0x0132c656
0x0132c658
0x0132c66d
0x0132c670
0x0132c6c0
0x0132c6c5
0x0132c6c6
0x0132c6c7
0x0132c6c8
0x0132c6c9
0x0132c6ca
0x0132c6cb
0x0132c6cc
0x0132c6cd
0x0132c6ce
0x0132c6cf
0x0132c6e2
0x0132c672
0x0132c672
0x0132c675
0x0132c678
0x0132c67d
0x0132c689
0x0132c68c
0x0132c692
0x0132c699
0x00000000
0x0132c699
0x0132c65a
0x0132c65a
0x00000000
0x0132c65a
0x0132c649
0x0132c64f
0x00000000
0x0132c64f
0x0132c647
0x0132c63d
0x0132c630

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0132C5BD
std::_Lockit::_Lockit.LIBCPMT ref: 0132C5E0
std::_Lockit::~_Lockit.LIBCPMT ref: 0132C608
std::_Facet_Register.LIBCPMT ref: 0132C67D
std::_Lockit::~_Lockit.LIBCPMT ref: 0132C6A7

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 2ffa94d207fe179a7190507225ec9e14bbc605aad3f3827c5a12a0311fa94b1d
Instruction ID: 54280816e940bc32ee777aae790c0ecb3a2cff8649fb8928f7672e5735a81653
Opcode Fuzzy Hash: 2ffa94d207fe179a7190507225ec9e14bbc605aad3f3827c5a12a0311fa94b1d
Instruction Fuzzy Hash: 9C419F7180026ADFCF21EF58D440BAEBBB8EF54728F288259D815A7381D731AA04CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0132EAF0 Relevance: 7.6, APIs: 5, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0132EAF0(void* __ebx, void* _a4) {
				void* _v0;
				void* _v4;
				void* _v8;
				char _v12;
				char _v16;
				void** _v20;
				void** _v24;
				long _v28;
				void* _v32;
				void* _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				void* _v52;
				void* _v56;
				char _v60;
				signed int _v64;
				void* _v68;
				signed int _v72;
				short _v76;
				signed int _v80;
				short _v84;
				void* _v88;
				char _v92;
				void* _v96;
				signed int _v100;
				signed short _v104;
				signed short _v108;
				void* _v112;
				void* _v116;
				char _v120;
				void* _v124;
				void* _v128;
				void* _v132;
				short _v136;
				void* _v140;
				char _v144;
				void* _v148;
				char _v152;
				void* _v156;
				char _v160;
				void* _v164;
				void** _v168;
				void* _v172;
				signed int _v180;
				char _v188;
				intOrPtr _v236;
				char _v240;
				char _v288;
				void* _v304;
				void* _v436;
				char _v456;
				void* _v460;
				void* _v532;
				char _v552;
				intOrPtr _v556;
				intOrPtr _v644;
				void* _v652;
				char _v660;
				signed int _v668;
				intOrPtr _v672;
				intOrPtr _v724;
				void* _v736;
				char _v784;
				void* _v804;
				char _v812;
				signed int _v816;
				char _v820;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t431;
				signed int* _t437;
				signed int _t440;
				long* _t446;
				signed int _t449;
				void** _t455;
				signed int _t463;
				signed int _t464;
				signed int _t471;
				void* _t475;
				void* _t476;
				void* _t477;
				void* _t478;
				void* _t479;
				void* _t480;
				void* _t488;
				signed int _t493;
				void* _t496;
				void* _t502;
				void* _t503;
				void* _t504;
				void* _t505;
				void* _t506;
				void* _t507;
				void* _t515;
				signed int _t520;
				void* _t523;
				void* _t529;
				void* _t530;
				void* _t531;
				void* _t532;
				void* _t533;
				void* _t534;
				void* _t543;
				signed int _t548;
				signed int _t549;
				void* _t553;
				void* _t557;
				void* _t558;
				signed int _t562;
				void* _t569;
				void* _t571;
				signed int _t579;
				void* _t606;
				void* _t610;
				signed int _t628;
				unsigned int _t630;
				void* _t631;
				long _t650;
				void* _t651;
				void* _t656;
				void* _t661;
				void* _t662;
				void* _t666;
				void* _t671;
				void* _t672;
				void* _t676;
				void* _t681;
				signed int _t682;
				signed int _t684;
				void* _t686;
				void* _t688;
				void** _t690;
				void* _t691;
				signed int _t693;
				signed int _t696;
				void* _t699;
				void** _t701;
				signed int _t706;
				signed int _t711;
				signed int _t716;
				void* _t734;
				void* _t735;
				void* _t736;
				intOrPtr _t739;
				void* _t755;
				intOrPtr _t756;
				intOrPtr _t758;
				intOrPtr _t760;
				void* _t761;
				void* _t762;
				signed int _t764;
				signed int _t766;
				signed int _t768;
				intOrPtr _t770;
				void* _t771;
				void* _t772;
				void* _t774;
				void* _t776;
				intOrPtr _t777;
				void* _t778;
				void* _t779;
				intOrPtr* _t780;
				void* _t782;
				signed int _t787;
				void* _t789;
				void* _t791;
				void* _t793;
				void* _t794;
				void* _t796;
				void* _t798;
				void* _t799;
				char _t800;
				void* _t802;
				void* _t803;
				signed int _t805;
				void* _t808;
				signed int _t814;
				signed int _t816;
				signed int _t818;
				void* _t820;
				signed int _t822;
				signed int _t824;
				signed int _t826;
				signed int _t829;
				signed int _t835;
				void* _t836;
				signed int _t838;
				void* _t839;
				signed int _t841;
				void* _t842;
				void* _t844;
				signed int _t847;
				signed int _t848;
				void* _t851;
				signed int _t853;
				void* _t855;
				void* _t857;
				void* _t859;
				signed int _t863;
				void* _t866;
				signed int _t867;
				void* _t868;
				void* _t877;

				_t814 = _t835;
				_push(0xffffffff);
				_push(0x136ac0d);
				_push( *[fs:0x0]);
				_t836 = _t835 - 0xc;
				_push(__ebx);
				_t431 =  *0x1383020; // 0xc9209188
				_push(_t431 ^ _t814);
				 *[fs:0x0] =  &_v16;
				E01335EA5( &_v28, 0);
				_v8 = 0;
				_t764 =  *0x13867c4;
				_t684 =  *0x1385758; // 0x0
				_v24 = _t684;
				if(_t764 == 0) {
					E01335EA5( &_v20, _t764);
					_v8 = 1;
					if( *0x13867c4 == _t764) {
						_t681 =  *0x138488c; // 0x0
						_t682 = _t681 + 1;
						 *0x138488c = _t682;
						 *0x13867c4 = _t682;
					}
					_v8 = 0;
					E01335EFD( &_v20);
					_t764 =  *0x13867c4;
				}
				_t755 = _a4;
				_t706 = _t764 * 4;
				_v20 = _t706;
				_t12 = _t755 + 4; // 0x61b2e810
				_t756 =  *_t12;
				if(_t764 >=  *((intOrPtr*)(_t756 + 0xc))) {
					_t787 = 0;
					__eflags = 0;
					_v20 = _t706;
					goto L8;
				} else {
					_t787 =  *(_t706 +  *((intOrPtr*)(_t756 + 8)));
					if(_t787 != 0) {
						L16:
						_v8 = 0xffffffff;
						E01335EFD( &_v28);
						 *[fs:0x0] = _v16;
						return _t787;
					} else {
						L8:
						if( *((char*)(_t756 + 0x14)) == 0) {
							L11:
							if(_t787 != 0) {
								goto L16;
							} else {
								goto L12;
							}
						} else {
							_t676 = E01335C60();
							if(_t764 >=  *((intOrPtr*)(_t676 + 0xc))) {
								L12:
								if(_t684 == 0) {
									_push(_a4);
									_t437 =  &_v24;
									_push(_t437);
									L133();
									_t838 = _t836 + 8;
									__eflags = _t437 - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t814);
										_t816 = _t838;
										_push(0xffffffff);
										_push(0x136ac0d);
										_push( *[fs:0x0]);
										_t839 = _t838 - 0xc;
										_push(_t684);
										_push(_t787);
										_push(_t764);
										_t440 =  *0x1383020; // 0xc9209188
										_push(_t440 ^ _t816);
										 *[fs:0x0] =  &_v60;
										E01335EA5( &_v72, 0);
										_v52 = 0;
										_t766 =  *0x13867c0;
										_t686 =  *0x1385754; // 0x0
										_v68 = _t686;
										__eflags = _t766;
										if(_t766 == 0) {
											E01335EA5( &_v24, _t766);
											_v12 = 1;
											__eflags =  *0x13867c0 - _t766;
											if( *0x13867c0 == _t766) {
												_t671 =  *0x138488c; // 0x0
												_t672 = _t671 + 1;
												__eflags = _t672;
												 *0x138488c = _t672;
												 *0x13867c0 = _t672;
											}
											_v12 = 0;
											E01335EFD( &_v24);
											_t766 =  *0x13867c0;
										}
										_t711 = _t766 * 4;
										_v24 = _t711;
										_t758 =  *((intOrPtr*)(_v0 + 4));
										__eflags = _t766 -  *((intOrPtr*)(_t758 + 0xc));
										if(_t766 >=  *((intOrPtr*)(_t758 + 0xc))) {
											_t789 = 0;
											__eflags = 0;
											_v24 = _t711;
											goto L26;
										} else {
											_t789 =  *(_t711 +  *((intOrPtr*)(_t758 + 8)));
											__eflags = _t789;
											if(_t789 != 0) {
												L34:
												_v12 = 0xffffffff;
												E01335EFD( &_v32);
												 *[fs:0x0] = _v20;
												return _t789;
											} else {
												L26:
												__eflags =  *((char*)(_t758 + 0x14));
												if( *((char*)(_t758 + 0x14)) == 0) {
													L29:
													__eflags = _t789;
													if(_t789 != 0) {
														goto L34;
													} else {
														goto L30;
													}
												} else {
													_t666 = E01335C60();
													__eflags = _t766 -  *((intOrPtr*)(_t666 + 0xc));
													if(_t766 >=  *((intOrPtr*)(_t666 + 0xc))) {
														L30:
														__eflags = _t686;
														if(_t686 == 0) {
															_push(_v0);
															_t446 =  &_v28;
															_push(_t446);
															L107();
															_t841 = _t839 + 8;
															__eflags = _t446 - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t816);
																_t818 = _t841;
																_push(0xffffffff);
																_push(0x136a7fd);
																_push( *[fs:0x0]);
																_t842 = _t841 - 0x10;
																_push(_t686);
																_push(_t789);
																_push(_t766);
																_t449 =  *0x1383020; // 0xc9209188
																_push(_t449 ^ _t818);
																 *[fs:0x0] =  &_v104;
																E01335EA5( &_v116, 0);
																_v96 = 0;
																_t768 =  *0x13867c8;
																_t688 =  *0x1385750; // 0x0
																_v112 = _t688;
																__eflags = _t768;
																if(_t768 == 0) {
																	E01335EA5( &_v28, _t768);
																	_v16 = 1;
																	__eflags =  *0x13867c8 - _t768;
																	if( *0x13867c8 == _t768) {
																		_t661 =  *0x138488c; // 0x0
																		_t662 = _t661 + 1;
																		__eflags = _t662;
																		 *0x138488c = _t662;
																		 *0x13867c8 = _t662;
																	}
																	_v16 = 0;
																	E01335EFD( &_v28);
																	_t768 =  *0x13867c8;
																}
																_t716 = _t768 * 4;
																_v28 = _t716;
																_t760 =  *((intOrPtr*)(_v4 + 4));
																__eflags = _t768 -  *((intOrPtr*)(_t760 + 0xc));
																if(_t768 >=  *((intOrPtr*)(_t760 + 0xc))) {
																	_t791 = 0;
																	__eflags = 0;
																	_v28 = _t716;
																	goto L44;
																} else {
																	_t791 =  *(_t716 +  *((intOrPtr*)(_t760 + 8)));
																	__eflags = _t791;
																	if(_t791 != 0) {
																		L52:
																		_v16 = 0xffffffff;
																		E01335EFD( &_v36);
																		 *[fs:0x0] = _v24;
																		return _t791;
																	} else {
																		L44:
																		__eflags =  *((char*)(_t760 + 0x14));
																		if( *((char*)(_t760 + 0x14)) == 0) {
																			L47:
																			__eflags = _t791;
																			if(_t791 != 0) {
																				goto L52;
																			} else {
																				goto L48;
																			}
																		} else {
																			_t656 = E01335C60();
																			__eflags = _t768 -  *((intOrPtr*)(_t656 + 0xc));
																			if(_t768 >=  *((intOrPtr*)(_t656 + 0xc))) {
																				L48:
																				__eflags = _t688;
																				if(_t688 == 0) {
																					_push(_v4);
																					_t455 =  &_v32;
																					_push(_t455);
																					L79();
																					_t844 = _t842 + 8;
																					__eflags = _t455 - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						asm("int3");
																						_push(_t716);
																						_t761 = _v132;
																						_push(_t688);
																						_t690 = _t716;
																						_t720 = 0x7fffffff;
																						_push(_t818);
																						_t820 = _t690[4];
																						__eflags = 0x7fffffff - _t820 - _t761;
																						if(0x7fffffff - _t820 < _t761) {
																							E01323680(_t690, 0x7fffffff, _t761, _t768, _t820);
																							goto L77;
																						} else {
																							_push(_t791);
																							_t628 = _t761 + _t820;
																							_v140 = _t628;
																							_t805 = _t628 | 0x0000000f;
																							_push(_t768);
																							_t768 = _t690[5];
																							_v132 = _t768;
																							__eflags = _t805 - 0x7fffffff;
																							if(_t805 <= 0x7fffffff) {
																								_t630 = _t768 >> 1;
																								_t720 = 0x7fffffff - _t630;
																								__eflags = _t768 - 0x7fffffff;
																								if(_t768 <= 0x7fffffff) {
																									_t631 = _t630 + _t768;
																									__eflags = _t805 - _t631;
																									_t791 =  <  ? _t631 : _t805;
																									_t105 = _t791 + 1; // 0x80000000
																									_t720 = _t105;
																									__eflags = _t720 - 0x1000;
																									if(_t720 < 0x1000) {
																										__eflags = _t720;
																										if(_t720 == 0) {
																											_t768 = 0;
																											__eflags = 0;
																										} else {
																											_t768 = LocalAlloc(0x40, _t720);
																										}
																										goto L68;
																									} else {
																										_t106 = _t720 + 0x23; // 0x80000023
																										_t650 = _t106;
																										__eflags = _t650 - _t720;
																										if(__eflags <= 0) {
																											L77:
																											E01323AF0(__eflags);
																											goto L78;
																										} else {
																											goto L58;
																										}
																									}
																								} else {
																									_t791 = 0x7fffffff;
																									goto L57;
																								}
																							} else {
																								_t791 = 0x7fffffff;
																								L57:
																								_t650 = 0xffffffff80000023;
																								__eflags = 0x80000000;
																								L58:
																								_t651 = LocalAlloc(0x40, _t650);
																								__eflags = _t651;
																								if(_t651 == 0) {
																									L78:
																									E0134C5C2(_t690, _t720, _t761, _t768);
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_push(_t690);
																									_t691 = _t844;
																									_t847 = (_t844 - 0x00000008 & 0xfffffff8) + 4;
																									_push(_t820);
																									_v156 =  *((intOrPtr*)(_t691 + 4));
																									_t822 = _t847;
																									_push(0xffffffff);
																									_push(0x136b100);
																									_push( *[fs:0x0]);
																									_push(_t691);
																									_t848 = _t847 - 0xf8;
																									_t463 =  *0x1383020; // 0xc9209188
																									_t464 = _t463 ^ _t822;
																									_v180 = _t464;
																									_push(_t791);
																									_push(_t768);
																									_push(_t464);
																									 *[fs:0x0] =  &_v172;
																									_t721 =  *(_t691 + 8);
																									_t770 =  *((intOrPtr*)(_t691 + 0xc));
																									_v304 = _t721;
																									_v236 = 0;
																									__eflags = _t721;
																									if(_t721 == 0) {
																										L104:
																										 *[fs:0x0] = _v36;
																										_pop(_t771);
																										_pop(_t793);
																										__eflags = _v44 ^ _t822;
																										return E01347708(4, _t691, _v44 ^ _t822, _t761, _t771, _t793);
																									} else {
																										__eflags =  *_t721;
																										if( *_t721 != 0) {
																											goto L104;
																										} else {
																											_t794 = LocalAlloc(0x40, 0x18);
																											_v172 = _t794;
																											_v28 = 0;
																											__eflags = _t794;
																											if(_t794 == 0) {
																												_t794 = 0;
																												__eflags = 0;
																												goto L90;
																											} else {
																												_t488 =  *(_t770 + 4);
																												__eflags = _t488;
																												if(_t488 == 0) {
																													_t772 = 0x137b6c9;
																												} else {
																													_t772 =  *(_t488 + 0x18);
																													__eflags = _t772;
																													if(_t772 == 0) {
																														_t772 = _t488 + 0x1c;
																													}
																												}
																												_t721 =  &_v160;
																												E01335EA5( &_v160, 0);
																												_v28 = 1;
																												_v156 = 0;
																												_v152 = 0;
																												_v28 = 2;
																												_v148 = 0;
																												_v144 = 0;
																												_v28 = 3;
																												_v140 = 0;
																												_v136 = 0;
																												_v28 = 4;
																												_v132 = 0;
																												_v128 = 0;
																												_v28 = 5;
																												_v124 = 0;
																												_v120 = 0;
																												_v28 = 6;
																												_v116 = 0;
																												_v112 = 0;
																												_v28 = 7;
																												__eflags = _t772;
																												if(_t772 == 0) {
																													L106:
																													E013320D0("bad locale name");
																													asm("int3");
																													asm("int3");
																													asm("int3");
																													_push(_t822);
																													_t824 = _t848;
																													_push(0xffffffff);
																													_push(0x136b1dd);
																													_push( *[fs:0x0]);
																													_t853 = _t848 - 0x3c;
																													_push(_t691);
																													_push(_t794);
																													_push(_t772);
																													_t493 =  *0x1383020; // 0xc9209188
																													_push(_t493 ^ _t824);
																													 *[fs:0x0] =  &_v456;
																													_t496 = _v436;
																													_t693 = 0;
																													_v460 = 0;
																													__eflags = _t496;
																													if(_t496 == 0) {
																														L131:
																														 *[fs:0x0] = _v40;
																														return 4;
																													} else {
																														__eflags =  *_t496;
																														if( *_t496 != 0) {
																															goto L131;
																														} else {
																															_t796 = LocalAlloc(0x40, 8);
																															_v48 = _t796;
																															_v32 = 0;
																															__eflags = _t796;
																															if(_t796 == 0) {
																																_t796 = 0;
																																__eflags = 0;
																																goto L117;
																															} else {
																																_t515 =  *(_v16 + 4);
																																__eflags = _t515;
																																if(_t515 == 0) {
																																	_t774 = 0x137b6c9;
																																} else {
																																	_t774 =  *(_t515 + 0x18);
																																	__eflags = _t774;
																																	if(_t774 == 0) {
																																		_t774 = _t515 + 0x1c;
																																	}
																																}
																																_t721 =  &_v100;
																																E01335EA5( &_v100, 0);
																																_v32 = 1;
																																_v96 = 0;
																																_v92 = 0;
																																_v32 = 2;
																																_v88 = 0;
																																_v84 = 0;
																																_v32 = 3;
																																_v80 = 0;
																																_v76 = 0;
																																_v32 = 4;
																																_v72 = 0;
																																_v68 = 0;
																																_v32 = 5;
																																_v64 = 0;
																																_v60 = 0;
																																_v32 = 6;
																																_v56 = 0;
																																_v52 = 0;
																																_v32 = 7;
																																__eflags = _t774;
																																if(_t774 == 0) {
																																	E013320D0("bad locale name");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	asm("int3");
																																	_push(_t824);
																																	_t826 = _t853;
																																	_push(0xffffffff);
																																	_push(0x136b2d1);
																																	_push( *[fs:0x0]);
																																	_t857 = _t853 - 0x40;
																																	_push(_t693);
																																	_push(_t796);
																																	_push(_t774);
																																	_t520 =  *0x1383020; // 0xc9209188
																																	_push(_t520 ^ _t826);
																																	 *[fs:0x0] =  &_v552;
																																	_t523 = _v532;
																																	_t696 = 0;
																																	_v556 = 0;
																																	__eflags = _t523;
																																	if(_t523 == 0) {
																																		L159:
																																		 *[fs:0x0] = _v44;
																																		return 5;
																																	} else {
																																		__eflags =  *_t523;
																																		if( *_t523 != 0) {
																																			goto L159;
																																		} else {
																																			_t776 = LocalAlloc(0x40, 0xc);
																																			_v56 = _t776;
																																			_v36 = 0;
																																			__eflags = _t776;
																																			if(_t776 == 0) {
																																				_t776 = 0;
																																				__eflags = 0;
																																				goto L145;
																																			} else {
																																				_t543 = _v20[1];
																																				__eflags = _t543;
																																				if(_t543 == 0) {
																																					_t798 = 0x137b6c9;
																																				} else {
																																					_t798 =  *(_t543 + 0x18);
																																					__eflags = _t798;
																																					if(_t798 == 0) {
																																						_t798 = _t543 + 0x1c;
																																					}
																																				}
																																				_t721 =  &_v108;
																																				E01335EA5(_t721, 0);
																																				_v36 = 1;
																																				_v104 = 0;
																																				_v100 = 0;
																																				_v36 = 2;
																																				_v96 = 0;
																																				_v92 = 0;
																																				_v36 = 3;
																																				_v88 = 0;
																																				_v84 = 0;
																																				_v36 = 4;
																																				_v80 = 0;
																																				_v76 = 0;
																																				_v36 = 5;
																																				_v72 = 0;
																																				_v68 = 0;
																																				_v36 = 6;
																																				_v64 = 0;
																																				_v60 = 0;
																																				_v36 = 7;
																																				__eflags = _t798;
																																				if(__eflags == 0) {
																																					E013320D0("bad locale name");
																																					asm("int3");
																																					asm("int3");
																																					asm("int3");
																																					asm("int3");
																																					asm("int3");
																																					asm("int3");
																																					asm("int3");
																																					asm("int3");
																																					_push(_t696);
																																					_t699 = _t857;
																																					_t863 = (_t857 - 0x00000008 & 0xfffffff8) + 4;
																																					_push(_t826);
																																					_v644 =  *((intOrPtr*)(_t699 + 4));
																																					_t829 = _t863;
																																					_push(0xffffffff);
																																					_push(0x136b2fd);
																																					_push( *[fs:0x0]);
																																					_push(_t699);
																																					_t548 =  *0x1383020; // 0xc9209188
																																					_t549 = _t548 ^ _t829;
																																					_v668 = _t549;
																																					_push(_t798);
																																					_push(_t776);
																																					_push(_t549);
																																					 *[fs:0x0] =  &_v660;
																																					_t799 = _t721;
																																					_t777 = E01356A36(_t761, _t799);
																																					_v724 = _t777;
																																					_t553 = E01336203(__eflags,  &_v784);
																																					_v736 = _t799;
																																					asm("movups xmm0, [eax]");
																																					asm("movups [ebp-0x40], xmm0");
																																					asm("movups xmm0, [eax+0x10]");
																																					asm("movups [ebp-0x30], xmm0");
																																					asm("movq xmm0, [eax+0x20]");
																																					asm("movq [ebp-0x20], xmm0");
																																					_v672 =  *((intOrPtr*)(_t553 + 0x28));
																																					 *(_t799 + 8) = 0;
																																					 *(_t799 + 0x10) = 0;
																																					 *(_t799 + 0x14) = 0;
																																					_v652 = 0;
																																					E01336203(__eflags,  &_v784);
																																					_t866 = _t863 - 0x78 + 8;
																																					__eflags =  *((char*)(_t699 + 0xc));
																																					if( *((char*)(_t699 + 0xc)) == 0) {
																																						_t778 =  *(_t777 + 8);
																																					} else {
																																						_t778 = 0x137b6c9;
																																					}
																																					_t734 = _t778;
																																					_t383 = _t734 + 1; // 0x137b6ca
																																					_t762 = _t383;
																																					do {
																																						_t557 =  *_t734;
																																						_t734 = _t734 + 1;
																																						__eflags = _t557;
																																					} while (_t557 != 0);
																																					_t735 = _t734 - _t762;
																																					_push(1);
																																					_t384 = _t735 + 1; // 0x137b6cb
																																					_t558 = _t384;
																																					_push(_t558);
																																					_v116 = _t558;
																																					_t736 = E01356A5E();
																																					_t867 = _t866 + 8;
																																					_v128 = _t736;
																																					__eflags = _t736;
																																					if(__eflags == 0) {
																																						E01332056(__eflags);
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						asm("int3");
																																						_push(_t829);
																																						_push(0xffffffff);
																																						_push(0x136b34e);
																																						_push( *[fs:0x0]);
																																						_t868 = _t867 - 8;
																																						_push(_t799);
																																						_push(_t778);
																																						_t562 =  *0x1383020; // 0xc9209188
																																						_push(_t562 ^ _t867);
																																						 *[fs:0x0] =  &_v812;
																																						_t779 = _t736;
																																						_v816 = 0;
																																						_v804 = 0;
																																						_t800 = E01356078(_t699, _t779, _t799);
																																						_t780 = _t779 + 8;
																																						_v820 = _t800;
																																						_v816 = 1;
																																						__eflags = _t780 -  &_v820;
																																						if(_t780 !=  &_v820) {
																																							E0134C213( *_t780);
																																							_t868 = _t868 + 4;
																																							 *_t780 = _t800;
																																							_t800 = 0;
																																							__eflags = 0;
																																							_v68 = 0;
																																						}
																																						_v64 = 1;
																																						__eflags = 1;
																																						_v64 = 0;
																																						_v52 = 0xffffffff;
																																						_t569 = E0134C213(_t800);
																																						 *[fs:0x0] = _v60;
																																						return _t569;
																																					} else {
																																						_t571 = _v116;
																																						__eflags = _t571;
																																						if(_t571 != 0) {
																																							E01348FF0(_t736, _t778, _t571);
																																							_t736 = _v128;
																																							_t867 = _t867 + 0xc;
																																						}
																																						 *(_t799 + 8) = _t736;
																																						_push( &_v108);
																																						 *(_t799 + 0x10) = E0132FBD0("false", 0);
																																						_push( &_v108);
																																						 *(_t799 + 0x14) = E0132FBD0("true", 0);
																																						__eflags =  *((char*)(_t699 + 0xc));
																																						_v132 = 0;
																																						if( *((char*)(_t699 + 0xc)) == 0) {
																																							_t739 = _v120;
																																							 *((short*)(_t799 + 0xc)) =  *( *(_t739 + 0x30)) & 0x0000ffff;
																																							_t579 =  *( *(_t739 + 0x34)) & 0x0000ffff;
																																						} else {
																																							_v112 = 0x2e;
																																							_v116 = 0;
																																							asm("xorps xmm0, xmm0");
																																							asm("movlpd [ebp-0x50], xmm0");
																																							E013362D2(_t736,  &_v116,  &_v112, 1,  &_v124,  &_v108);
																																							 *((short*)(_t799 + 0xc)) = _v116 & 0x0000ffff;
																																							asm("xorps xmm0, xmm0");
																																							_v112 = 0x2c;
																																							_v116 = 0;
																																							asm("movlpd [ebp-0x50], xmm0");
																																							E013362D2(_t736,  &_v116,  &_v112, 1,  &_v124,  &_v108);
																																							_t579 = _v116 & 0x0000ffff;
																																						}
																																						 *(_t799 + 0xe) = _t579;
																																						_v48 = 0xffffffff;
																																						 *[fs:0x0] = _v56;
																																						_pop(_t782);
																																						_pop(_t802);
																																						__eflags = _v64 ^ _t829;
																																						return E01347708(_t579, _t699, _v64 ^ _t829, _t762, _t782, _t802);
																																					}
																																				} else {
																																					E01335D63(_t721,  &_v108, _t798);
																																					_t877 = _t857 + 8;
																																					_v36 = 8;
																																					_v48 = 1;
																																					 *_t776 = 0x136e0d8;
																																					_v36 = 9;
																																					 *_t776 = 0x136e0e8;
																																					 *(_t776 + 4) = 0;
																																					_v36 = 0xa;
																																					_t328 = _t776 + 8; // 0x8
																																					_t701 = _t328;
																																					 *_t776 = 0x136e620;
																																					 *_t701 = 0;
																																					_v36 = 0xc;
																																					_t803 = E01356078(_t701, _t776, _t798);
																																					_v52 = _t803;
																																					_v48 = 3;
																																					__eflags = _t701 -  &_v52;
																																					if(_t701 !=  &_v52) {
																																						E0134C213( *_t701);
																																						_t877 = _t877 + 4;
																																						 *_t701 = _t803;
																																						_t803 = 0;
																																						__eflags = 0;
																																						_v52 = 0;
																																					}
																																					_v48 = 3;
																																					_t696 = 1;
																																					_v48 = 3;
																																					_v36 = 0xb;
																																					E0134C213(_t803);
																																					_t857 = _t877 + 4;
																																					_v36 = 8;
																																					L145:
																																					_v36 = 0xd;
																																					 *_v24 = _t776;
																																					_v36 = 0xffffffff;
																																					__eflags = _t696 & 0x00000001;
																																					if((_t696 & 0x00000001) != 0) {
																																						_v48 = _t696 & 0xfffffffe;
																																						_v36 = 0x14;
																																						E01335DAE(_t721,  &_v108);
																																						_t859 = _t857 + 4;
																																						_v36 = 0x13;
																																						_t529 = _v64;
																																						__eflags = _t529;
																																						if(_t529 != 0) {
																																							E0134C213(_t529);
																																							_t859 = _t859 + 4;
																																						}
																																						_v64 = 0;
																																						_v36 = 0x12;
																																						_t530 = _v72;
																																						__eflags = _t530;
																																						if(_t530 != 0) {
																																							E0134C213(_t530);
																																							_t859 = _t859 + 4;
																																						}
																																						_v72 = 0;
																																						_v36 = 0x11;
																																						_t531 = _v80;
																																						__eflags = _t531;
																																						if(_t531 != 0) {
																																							E0134C213(_t531);
																																							_t859 = _t859 + 4;
																																						}
																																						_v80 = 0;
																																						_v36 = 0x10;
																																						_t532 = _v88;
																																						__eflags = _t532;
																																						if(_t532 != 0) {
																																							E0134C213(_t532);
																																							_t859 = _t859 + 4;
																																						}
																																						_v88 = 0;
																																						_v36 = 0xf;
																																						_t533 = _v96;
																																						__eflags = _t533;
																																						if(_t533 != 0) {
																																							E0134C213(_t533);
																																							_t859 = _t859 + 4;
																																						}
																																						_v96 = 0;
																																						_v36 = 0xe;
																																						_t534 = _v104;
																																						__eflags = _t534;
																																						if(_t534 != 0) {
																																							E0134C213(_t534);
																																						}
																																						_v104 = 0;
																																						_v36 = 0xffffffff;
																																						E01335EFD( &_v108);
																																					}
																																					goto L159;
																																				}
																																			}
																																		}
																																	}
																																} else {
																																	E01335D63( &_v100,  &_v100, _t774);
																																	_t853 = _t853 + 8;
																																	_v32 = 8;
																																	_t693 = 1;
																																	_v44 = 1;
																																	 *_t796 = 0x136e0d8;
																																	_v32 = 9;
																																	 *_t796 = 0x136e0e8;
																																	 *(_t796 + 4) = 0;
																																	_v32 = 0xa;
																																	 *_t796 = 0x136e670;
																																	_v32 = 8;
																																	L117:
																																	_v32 = 0xb;
																																	 *_v20 = _t796;
																																	_v32 = 0xffffffff;
																																	__eflags = _t693 & 0x00000001;
																																	if((_t693 & 0x00000001) != 0) {
																																		_v44 = _t693 & 0xfffffffe;
																																		_v32 = 0x12;
																																		E01335DAE(_t721,  &_v100);
																																		_t855 = _t853 + 4;
																																		_v32 = 0x11;
																																		_t502 = _v56;
																																		__eflags = _t502;
																																		if(_t502 != 0) {
																																			E0134C213(_t502);
																																			_t855 = _t855 + 4;
																																		}
																																		_v56 = 0;
																																		_v32 = 0x10;
																																		_t503 = _v64;
																																		__eflags = _t503;
																																		if(_t503 != 0) {
																																			E0134C213(_t503);
																																			_t855 = _t855 + 4;
																																		}
																																		_v64 = 0;
																																		_v32 = 0xf;
																																		_t504 = _v72;
																																		__eflags = _t504;
																																		if(_t504 != 0) {
																																			E0134C213(_t504);
																																			_t855 = _t855 + 4;
																																		}
																																		_v72 = 0;
																																		_v32 = 0xe;
																																		_t505 = _v80;
																																		__eflags = _t505;
																																		if(_t505 != 0) {
																																			E0134C213(_t505);
																																			_t855 = _t855 + 4;
																																		}
																																		_v80 = 0;
																																		_v32 = 0xd;
																																		_t506 = _v88;
																																		__eflags = _t506;
																																		if(_t506 != 0) {
																																			E0134C213(_t506);
																																			_t855 = _t855 + 4;
																																		}
																																		_v88 = 0;
																																		_v32 = 0xc;
																																		_t507 = _v96;
																																		__eflags = _t507;
																																		if(_t507 != 0) {
																																			E0134C213(_t507);
																																		}
																																		_v96 = 0;
																																		_v32 = 0xffffffff;
																																		E01335EFD( &_v100);
																																	}
																																	goto L131;
																																}
																															}
																														}
																													}
																												} else {
																													E01335D63( &_v160,  &_v160, _t772);
																													_v28 = 8;
																													_v100 = 1;
																													 *_t794 = 0x136e0d8;
																													_v28 = 9;
																													 *_t794 = 0x136e0e8;
																													 *(_t794 + 4) = 0;
																													_v28 = 0xa;
																													 *_t794 = 0x136e6a0;
																													E01356A36(_t761, _t794);
																													_t606 = E01336203(__eflags,  &_v240);
																													_v164 = _t794;
																													asm("movups xmm0, [eax]");
																													asm("movups [ebp-0x40], xmm0");
																													asm("movups xmm0, [eax+0x10]");
																													asm("movups [ebp-0x30], xmm0");
																													asm("movq xmm0, [eax+0x20]");
																													asm("movq [ebp-0x20], xmm0");
																													_v48 =  *(_t606 + 0x28);
																													 *(_t794 + 8) = 0;
																													 *(_t794 + 0x10) = 0;
																													 *(_t794 + 0x14) = 0;
																													_v28 = 0xb;
																													E01336203(__eflags,  &_v288);
																													_push(1);
																													_push(1);
																													_t610 = E01356A5E();
																													_t848 = _t848 + 0x18;
																													__eflags = _t610;
																													if(__eflags == 0) {
																														E01332056(__eflags);
																														goto L106;
																													} else {
																														 *_t610 = 0;
																														 *(_t794 + 8) = _t610;
																														_push( &_v88);
																														 *(_t794 + 0x10) = E0132FBD0("false", 0);
																														_push( &_v88);
																														 *(_t794 + 0x14) = E0132FBD0("true", 0);
																														_v164 = 0;
																														asm("xorps xmm0, xmm0");
																														_v92 = 0x2e;
																														_v104 = 0;
																														asm("movlpd [ebp-0x9c], xmm0");
																														E013362D2( &_v160,  &_v104,  &_v92, 1,  &_v180,  &_v88);
																														 *((short*)(_t794 + 0xc)) = _v104 & 0x0000ffff;
																														asm("xorps xmm0, xmm0");
																														_v96 = 0x2c;
																														_v108 = 0;
																														asm("movlpd [ebp-0xa4], xmm0");
																														E013362D2(_t721,  &_v108,  &_v96, 1,  &_v188,  &_v88);
																														_t848 = _t848 + 0x40;
																														 *((short*)(_t794 + 0xe)) = _v108 & 0x0000ffff;
																														_v28 = 8;
																														L90:
																														_v28 = 0xc;
																														 *_v168 = _t794;
																														_v28 = 0xffffffff;
																														_t471 = _v100;
																														__eflags = _t471 & 0x00000001;
																														if((_t471 & 0x00000001) != 0) {
																															_v100 = _t471 & 0xfffffffe;
																															_v28 = 0x13;
																															E01335DAE(_t721,  &_v160);
																															_t851 = _t848 + 4;
																															_v28 = 0x12;
																															_t475 = _v116;
																															__eflags = _t475;
																															if(_t475 != 0) {
																																E0134C213(_t475);
																																_t851 = _t851 + 4;
																															}
																															_v116 = 0;
																															_v28 = 0x11;
																															_t476 = _v124;
																															__eflags = _t476;
																															if(_t476 != 0) {
																																E0134C213(_t476);
																																_t851 = _t851 + 4;
																															}
																															_v124 = 0;
																															_v28 = 0x10;
																															_t477 = _v132;
																															__eflags = _t477;
																															if(_t477 != 0) {
																																E0134C213(_t477);
																																_t851 = _t851 + 4;
																															}
																															_v132 = 0;
																															_v28 = 0xf;
																															_t478 = _v140;
																															__eflags = _t478;
																															if(_t478 != 0) {
																																E0134C213(_t478);
																																_t851 = _t851 + 4;
																															}
																															_v140 = 0;
																															_v28 = 0xe;
																															_t479 = _v148;
																															__eflags = _t479;
																															if(_t479 != 0) {
																																E0134C213(_t479);
																																_t851 = _t851 + 4;
																															}
																															_v148 = 0;
																															_v28 = 0xd;
																															_t480 = _v156;
																															__eflags = _t480;
																															if(_t480 != 0) {
																																E0134C213(_t480);
																															}
																															_v156 = 0;
																															_v28 = 0xffffffff;
																															E01335EFD( &_v160);
																														}
																														goto L104;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									_t103 = _t651 + 0x23; // 0x23
																									_t768 = _t103 & 0xffffffe0;
																									 *(_t768 - 4) = _t651;
																									L68:
																									_t690[4] = _v140;
																									_t690[5] = _t791;
																									_t806 = _t820 + _t768;
																									__eflags = _v132 - 0x10;
																									_v140 = _v124 + _t820 + _t768;
																									_push(_t820);
																									if(_v132 < 0x10) {
																										_push(_t690);
																										_push(_t768);
																										E01348FF0();
																										E01348E90(_t768, _t806, _v120, _v124);
																										 *_v140 = 0;
																										goto L75;
																									} else {
																										_t808 =  *_t690;
																										_push(_t808);
																										_push(_t768);
																										E01348FF0();
																										E01348E90(_t768, _t820 + _t768, _v120, _v124);
																										_t844 = _t844 + 0x18;
																										 *_v140 = 0;
																										__eflags = _v132 + 1 - 0x1000;
																										if(_v132 + 1 < 0x1000) {
																											L72:
																											__eflags = _t808;
																											if(_t808 == 0) {
																												L75:
																												 *_t690 = _t768;
																												return _t690;
																											} else {
																												LocalFree(_t808);
																												 *_t690 = _t768;
																												return _t690;
																											}
																										} else {
																											_t720 =  *(_t808 - 4);
																											_t791 = _t808 - _t720;
																											_t122 = _t791 - 4; // 0x7ffffffb
																											__eflags = _t122 - 0x1f;
																											if(_t122 > 0x1f) {
																												goto L78;
																											} else {
																												_t808 = _t720;
																												goto L72;
																											}
																										}
																									}
																								}
																							}
																						}
																					} else {
																						_t791 = _v32;
																						_v4 = _t791;
																						_v16 = 2;
																						E01335C34(_t791);
																						 *((intOrPtr*)( *_t791 + 4))();
																						 *0x1385750 = _t791;
																						_v4 = 0;
																						_v16 = 0;
																						goto L52;
																					}
																				} else {
																					_t791 = _t688;
																					goto L52;
																				}
																			} else {
																				_t791 =  *(_v28 +  *((intOrPtr*)(_t656 + 8)));
																				goto L47;
																			}
																		}
																	}
																}
															} else {
																_t789 = _v28;
																_v0 = _t789;
																_v12 = 2;
																E01335C34(_t789);
																 *((intOrPtr*)( *_t789 + 4))();
																 *0x1385754 = _t789;
																_v0 = 0;
																_v12 = 0;
																goto L34;
															}
														} else {
															_t789 = _t686;
															goto L34;
														}
													} else {
														_t789 =  *(_v24 +  *((intOrPtr*)(_t666 + 8)));
														goto L29;
													}
												}
											}
										}
									} else {
										_t787 = _v24;
										_a4 = _t787;
										_v8 = 2;
										E01335C34(_t787);
										 *((intOrPtr*)( *_t787 + 4))();
										 *0x1385758 = _t787;
										_a4 = 0;
										_v8 = 0;
										goto L16;
									}
								} else {
									_t787 = _t684;
									goto L16;
								}
							} else {
								_t787 =  *(_v20 +  *((intOrPtr*)(_t676 + 8)));
								goto L11;
							}
						}
					}
				}
			}

0x0132eaf1
0x0132eaf3
0x0132eaf5
0x0132eb00
0x0132eb01
0x0132eb04
0x0132eb07
0x0132eb0e
0x0132eb12
0x0132eb1d
0x0132eb22
0x0132eb29
0x0132eb2f
0x0132eb35
0x0132eb3a
0x0132eb40
0x0132eb45
0x0132eb4f
0x0132eb51
0x0132eb56
0x0132eb57
0x0132eb5c
0x0132eb5c
0x0132eb61
0x0132eb68
0x0132eb6d
0x0132eb6d
0x0132eb73
0x0132eb76
0x0132eb7d
0x0132eb80
0x0132eb80
0x0132eb86
0x0132eb94
0x0132eb94
0x0132eb96
0x00000000
0x0132eb88
0x0132eb8b
0x0132eb90
0x0132ebfd
0x0132ebfd
0x0132ec07
0x0132ec11
0x0132ec1f
0x0132eb92
0x0132eb99
0x0132eb9d
0x0132ebb2
0x0132ebb4
0x00000000
0x00000000
0x00000000
0x00000000
0x0132eb9f
0x0132eb9f
0x0132eba7
0x0132ebb6
0x0132ebb8
0x0132ebbe
0x0132ebc1
0x0132ebc4
0x0132ebc5
0x0132ebca
0x0132ebcd
0x0132ebd0
0x0132ec20
0x0132ec25
0x0132ec26
0x0132ec27
0x0132ec28
0x0132ec29
0x0132ec2a
0x0132ec2b
0x0132ec2c
0x0132ec2d
0x0132ec2e
0x0132ec2f
0x0132ec30
0x0132ec31
0x0132ec33
0x0132ec35
0x0132ec40
0x0132ec41
0x0132ec44
0x0132ec45
0x0132ec46
0x0132ec47
0x0132ec4e
0x0132ec52
0x0132ec5d
0x0132ec62
0x0132ec69
0x0132ec6f
0x0132ec75
0x0132ec78
0x0132ec7a
0x0132ec80
0x0132ec85
0x0132ec89
0x0132ec8f
0x0132ec91
0x0132ec96
0x0132ec96
0x0132ec97
0x0132ec9c
0x0132ec9c
0x0132eca1
0x0132eca8
0x0132ecad
0x0132ecad
0x0132ecb6
0x0132ecbd
0x0132ecc0
0x0132ecc3
0x0132ecc6
0x0132ecd4
0x0132ecd4
0x0132ecd6
0x00000000
0x0132ecc8
0x0132eccb
0x0132ecce
0x0132ecd0
0x0132ed3d
0x0132ed3d
0x0132ed47
0x0132ed51
0x0132ed5f
0x0132ecd2
0x0132ecd9
0x0132ecd9
0x0132ecdd
0x0132ecf2
0x0132ecf2
0x0132ecf4
0x00000000
0x00000000
0x00000000
0x00000000
0x0132ecdf
0x0132ecdf
0x0132ece4
0x0132ece7
0x0132ecf6
0x0132ecf6
0x0132ecf8
0x0132ecfe
0x0132ed01
0x0132ed04
0x0132ed05
0x0132ed0a
0x0132ed0d
0x0132ed10
0x0132ed60
0x0132ed65
0x0132ed66
0x0132ed67
0x0132ed68
0x0132ed69
0x0132ed6a
0x0132ed6b
0x0132ed6c
0x0132ed6d
0x0132ed6e
0x0132ed6f
0x0132ed70
0x0132ed71
0x0132ed73
0x0132ed75
0x0132ed80
0x0132ed81
0x0132ed84
0x0132ed85
0x0132ed86
0x0132ed87
0x0132ed8e
0x0132ed92
0x0132ed9d
0x0132eda2
0x0132eda9
0x0132edaf
0x0132edb5
0x0132edb8
0x0132edba
0x0132edc0
0x0132edc5
0x0132edc9
0x0132edcf
0x0132edd1
0x0132edd6
0x0132edd6
0x0132edd7
0x0132eddc
0x0132eddc
0x0132ede1
0x0132ede8
0x0132eded
0x0132eded
0x0132edf6
0x0132edfd
0x0132ee00
0x0132ee03
0x0132ee06
0x0132ee14
0x0132ee14
0x0132ee16
0x00000000
0x0132ee08
0x0132ee0b
0x0132ee0e
0x0132ee10
0x0132ee7d
0x0132ee7d
0x0132ee87
0x0132ee91
0x0132ee9f
0x0132ee12
0x0132ee19
0x0132ee19
0x0132ee1d
0x0132ee32
0x0132ee32
0x0132ee34
0x00000000
0x00000000
0x00000000
0x00000000
0x0132ee1f
0x0132ee1f
0x0132ee24
0x0132ee27
0x0132ee36
0x0132ee36
0x0132ee38
0x0132ee3e
0x0132ee41
0x0132ee44
0x0132ee45
0x0132ee4a
0x0132ee4d
0x0132ee50
0x0132eea0
0x0132eea5
0x0132eea6
0x0132eea7
0x0132eea8
0x0132eea9
0x0132eeaa
0x0132eeab
0x0132eeac
0x0132eead
0x0132eeae
0x0132eeaf
0x0132eeb0
0x0132eeb1
0x0132eeb5
0x0132eeb6
0x0132eeb8
0x0132eebd
0x0132eec0
0x0132eec5
0x0132eec7
0x0132eff8
0x00000000
0x0132eecd
0x0132eecd
0x0132eece
0x0132eed3
0x0132eed7
0x0132eeda
0x0132eedb
0x0132eede
0x0132eee2
0x0132eee4
0x0132ef0e
0x0132ef10
0x0132ef12
0x0132ef14
0x0132ef1d
0x0132ef1f
0x0132ef21
0x0132ef24
0x0132ef24
0x0132ef27
0x0132ef2d
0x0132ef3c
0x0132ef3e
0x0132ef4d
0x0132ef4d
0x0132ef40
0x0132ef49
0x0132ef49
0x00000000
0x0132ef2f
0x0132ef2f
0x0132ef2f
0x0132ef32
0x0132ef34
0x0132effd
0x0132effd
0x00000000
0x0132ef3a
0x00000000
0x0132ef3a
0x0132ef34
0x0132ef16
0x0132ef16
0x00000000
0x0132ef16
0x0132eee6
0x0132eee6
0x0132eee8
0x0132eeed
0x0132eeed
0x0132eef0
0x0132eef3
0x0132eef9
0x0132eefb
0x0132f002
0x0132f002
0x0132f007
0x0132f008
0x0132f009
0x0132f00a
0x0132f00b
0x0132f00c
0x0132f00d
0x0132f00e
0x0132f00f
0x0132f010
0x0132f011
0x0132f019
0x0132f01c
0x0132f020
0x0132f024
0x0132f026
0x0132f028
0x0132f033
0x0132f034
0x0132f035
0x0132f03b
0x0132f040
0x0132f042
0x0132f045
0x0132f046
0x0132f047
0x0132f04b
0x0132f051
0x0132f056
0x0132f059
0x0132f05f
0x0132f062
0x0132f064
0x0132f37b
0x0132f383
0x0132f38b
0x0132f38c
0x0132f390
0x0132f39d
0x0132f06a
0x0132f06a
0x0132f06c
0x00000000
0x0132f072
0x0132f07c
0x0132f07e
0x0132f084
0x0132f08b
0x0132f08d
0x0132f282
0x0132f282
0x00000000
0x0132f093
0x0132f093
0x0132f096
0x0132f098
0x0132f0a6
0x0132f09a
0x0132f09a
0x0132f09d
0x0132f09f
0x0132f0a1
0x0132f0a1
0x0132f09f
0x0132f0ad
0x0132f0b3
0x0132f0b8
0x0132f0bc
0x0132f0c6
0x0132f0ca
0x0132f0ce
0x0132f0d5
0x0132f0d9
0x0132f0df
0x0132f0e6
0x0132f0ea
0x0132f0ee
0x0132f0f1
0x0132f0f5
0x0132f0f9
0x0132f0fc
0x0132f0ff
0x0132f103
0x0132f106
0x0132f109
0x0132f10d
0x0132f10f
0x0132f3a3
0x0132f3a8
0x0132f3ad
0x0132f3ae
0x0132f3af
0x0132f3b0
0x0132f3b1
0x0132f3b3
0x0132f3b5
0x0132f3c0
0x0132f3c1
0x0132f3c4
0x0132f3c5
0x0132f3c6
0x0132f3c7
0x0132f3ce
0x0132f3d2
0x0132f3d8
0x0132f3db
0x0132f3dd
0x0132f3e0
0x0132f3e2
0x0132f5b7
0x0132f5bf
0x0132f5cd
0x0132f3e8
0x0132f3e8
0x0132f3ea
0x00000000
0x0132f3f0
0x0132f3fa
0x0132f3fc
0x0132f3ff
0x0132f402
0x0132f404
0x0132f4cf
0x0132f4cf
0x00000000
0x0132f40a
0x0132f40d
0x0132f410
0x0132f412
0x0132f420
0x0132f414
0x0132f414
0x0132f417
0x0132f419
0x0132f41b
0x0132f41b
0x0132f419
0x0132f427
0x0132f42a
0x0132f42f
0x0132f433
0x0132f43a
0x0132f43e
0x0132f442
0x0132f449
0x0132f44d
0x0132f453
0x0132f45a
0x0132f45e
0x0132f462
0x0132f465
0x0132f469
0x0132f46d
0x0132f470
0x0132f473
0x0132f477
0x0132f47a
0x0132f47d
0x0132f481
0x0132f483
0x0132f5d3
0x0132f5d8
0x0132f5d9
0x0132f5da
0x0132f5db
0x0132f5dc
0x0132f5dd
0x0132f5de
0x0132f5df
0x0132f5e0
0x0132f5e1
0x0132f5e3
0x0132f5e5
0x0132f5f0
0x0132f5f1
0x0132f5f4
0x0132f5f5
0x0132f5f6
0x0132f5f7
0x0132f5fe
0x0132f602
0x0132f608
0x0132f60b
0x0132f60d
0x0132f610
0x0132f612
0x0132f837
0x0132f83f
0x0132f84d
0x0132f618
0x0132f618
0x0132f61a
0x00000000
0x0132f620
0x0132f62a
0x0132f62c
0x0132f62f
0x0132f632
0x0132f634
0x0132f74f
0x0132f74f
0x00000000
0x0132f63a
0x0132f63d
0x0132f640
0x0132f642
0x0132f650
0x0132f644
0x0132f644
0x0132f647
0x0132f649
0x0132f64b
0x0132f64b
0x0132f649
0x0132f657
0x0132f65a
0x0132f65f
0x0132f663
0x0132f66a
0x0132f66e
0x0132f672
0x0132f679
0x0132f67d
0x0132f683
0x0132f68a
0x0132f68e
0x0132f692
0x0132f695
0x0132f699
0x0132f69d
0x0132f6a0
0x0132f6a3
0x0132f6a7
0x0132f6aa
0x0132f6ad
0x0132f6b1
0x0132f6b3
0x0132f853
0x0132f858
0x0132f859
0x0132f85a
0x0132f85b
0x0132f85c
0x0132f85d
0x0132f85e
0x0132f85f
0x0132f860
0x0132f861
0x0132f869
0x0132f86c
0x0132f870
0x0132f874
0x0132f876
0x0132f878
0x0132f883
0x0132f884
0x0132f888
0x0132f88d
0x0132f88f
0x0132f892
0x0132f893
0x0132f894
0x0132f898
0x0132f89e
0x0132f8a5
0x0132f8ae
0x0132f8b1
0x0132f8b9
0x0132f8bc
0x0132f8bf
0x0132f8c3
0x0132f8c7
0x0132f8cb
0x0132f8d0
0x0132f8d8
0x0132f8db
0x0132f8e2
0x0132f8e9
0x0132f8f0
0x0132f8fe
0x0132f903
0x0132f906
0x0132f90a
0x0132f913
0x0132f90c
0x0132f90c
0x0132f90c
0x0132f916
0x0132f918
0x0132f918
0x0132f920
0x0132f920
0x0132f922
0x0132f923
0x0132f923
0x0132f927
0x0132f929
0x0132f92b
0x0132f92b
0x0132f92e
0x0132f92f
0x0132f937
0x0132f939
0x0132f93c
0x0132f93f
0x0132f941
0x0132fa3e
0x0132fa43
0x0132fa44
0x0132fa45
0x0132fa46
0x0132fa47
0x0132fa48
0x0132fa49
0x0132fa4a
0x0132fa4b
0x0132fa4c
0x0132fa4d
0x0132fa4e
0x0132fa4f
0x0132fa50
0x0132fa53
0x0132fa55
0x0132fa60
0x0132fa61
0x0132fa64
0x0132fa65
0x0132fa66
0x0132fa6d
0x0132fa71
0x0132fa77
0x0132fa79
0x0132fa80
0x0132fa8c
0x0132fa8e
0x0132fa94
0x0132fa97
0x0132fa9e
0x0132faa0
0x0132faa4
0x0132faa9
0x0132faac
0x0132faae
0x0132faae
0x0132fab0
0x0132fab0
0x0132fab8
0x0132fabb
0x0132fabe
0x0132fac1
0x0132fac9
0x0132fad4
0x0132fae1
0x0132f947
0x0132f947
0x0132f94a
0x0132f94c
0x0132f951
0x0132f956
0x0132f959
0x0132f959
0x0132f95f
0x0132f962
0x0132f972
0x0132f978
0x0132f988
0x0132f98b
0x0132f98f
0x0132f996
0x0132fa00
0x0132fa09
0x0132fa10
0x0132f998
0x0132f99b
0x0132f9a3
0x0132f9b0
0x0132f9b7
0x0132f9bd
0x0132f9c9
0x0132f9cd
0x0132f9d3
0x0132f9d7
0x0132f9e2
0x0132f9f2
0x0132f9f7
0x0132f9fb
0x0132fa13
0x0132fa17
0x0132fa21
0x0132fa29
0x0132fa2a
0x0132fa2e
0x0132fa3b
0x0132fa3b
0x0132f6b9
0x0132f6be
0x0132f6c3
0x0132f6c6
0x0132f6ca
0x0132f6d1
0x0132f6d7
0x0132f6de
0x0132f6e4
0x0132f6eb
0x0132f6f2
0x0132f6f2
0x0132f6f5
0x0132f6fb
0x0132f701
0x0132f70a
0x0132f70f
0x0132f712
0x0132f719
0x0132f71b
0x0132f71f
0x0132f724
0x0132f727
0x0132f729
0x0132f729
0x0132f72b
0x0132f72b
0x0132f733
0x0132f736
0x0132f739
0x0132f73c
0x0132f741
0x0132f746
0x0132f749
0x0132f751
0x0132f751
0x0132f75b
0x0132f75d
0x0132f764
0x0132f767
0x0132f770
0x0132f773
0x0132f77e
0x0132f783
0x0132f786
0x0132f78a
0x0132f78d
0x0132f78f
0x0132f792
0x0132f797
0x0132f797
0x0132f79a
0x0132f7a1
0x0132f7a5
0x0132f7a8
0x0132f7aa
0x0132f7ad
0x0132f7b2
0x0132f7b2
0x0132f7b5
0x0132f7bc
0x0132f7c0
0x0132f7c3
0x0132f7c5
0x0132f7c8
0x0132f7cd
0x0132f7cd
0x0132f7d0
0x0132f7d7
0x0132f7db
0x0132f7de
0x0132f7e0
0x0132f7e3
0x0132f7e8
0x0132f7e8
0x0132f7eb
0x0132f7f2
0x0132f7f6
0x0132f7f9
0x0132f7fb
0x0132f7fe
0x0132f803
0x0132f803
0x0132f806
0x0132f80d
0x0132f811
0x0132f814
0x0132f816
0x0132f819
0x0132f81e
0x0132f821
0x0132f828
0x0132f832
0x0132f832
0x00000000
0x0132f767
0x0132f6b3
0x0132f634
0x0132f61a
0x0132f489
0x0132f48e
0x0132f493
0x0132f496
0x0132f49a
0x0132f49f
0x0132f4a2
0x0132f4a8
0x0132f4af
0x0132f4b5
0x0132f4bc
0x0132f4c3
0x0132f4c9
0x0132f4d1
0x0132f4d1
0x0132f4db
0x0132f4dd
0x0132f4e4
0x0132f4e7
0x0132f4f0
0x0132f4f3
0x0132f4fe
0x0132f503
0x0132f506
0x0132f50a
0x0132f50d
0x0132f50f
0x0132f512
0x0132f517
0x0132f517
0x0132f51a
0x0132f521
0x0132f525
0x0132f528
0x0132f52a
0x0132f52d
0x0132f532
0x0132f532
0x0132f535
0x0132f53c
0x0132f540
0x0132f543
0x0132f545
0x0132f548
0x0132f54d
0x0132f54d
0x0132f550
0x0132f557
0x0132f55b
0x0132f55e
0x0132f560
0x0132f563
0x0132f568
0x0132f568
0x0132f56b
0x0132f572
0x0132f576
0x0132f579
0x0132f57b
0x0132f57e
0x0132f583
0x0132f583
0x0132f586
0x0132f58d
0x0132f591
0x0132f594
0x0132f596
0x0132f599
0x0132f59e
0x0132f5a1
0x0132f5a8
0x0132f5b2
0x0132f5b2
0x00000000
0x0132f4e7
0x0132f483
0x0132f404
0x0132f3ea
0x0132f115
0x0132f11d
0x0132f122
0x0132f12b
0x0132f12e
0x0132f134
0x0132f13b
0x0132f141
0x0132f148
0x0132f14f
0x0132f155
0x0132f161
0x0132f169
0x0132f16f
0x0132f172
0x0132f176
0x0132f17a
0x0132f17e
0x0132f183
0x0132f18b
0x0132f18e
0x0132f195
0x0132f19c
0x0132f1a3
0x0132f1ae
0x0132f1b6
0x0132f1b8
0x0132f1ba
0x0132f1bf
0x0132f1c2
0x0132f1c4
0x0132f39e
0x00000000
0x0132f1ca
0x0132f1ca
0x0132f1cd
0x0132f1d3
0x0132f1e3
0x0132f1e9
0x0132f1f9
0x0132f1ff
0x0132f209
0x0132f20c
0x0132f210
0x0132f21e
0x0132f231
0x0132f23d
0x0132f241
0x0132f247
0x0132f24b
0x0132f259
0x0132f26c
0x0132f275
0x0132f278
0x0132f27c
0x0132f284
0x0132f284
0x0132f291
0x0132f293
0x0132f29a
0x0132f29d
0x0132f29f
0x0132f2a8
0x0132f2ab
0x0132f2b9
0x0132f2be
0x0132f2c1
0x0132f2c5
0x0132f2c8
0x0132f2ca
0x0132f2cd
0x0132f2d2
0x0132f2d2
0x0132f2d5
0x0132f2dc
0x0132f2e0
0x0132f2e3
0x0132f2e5
0x0132f2e8
0x0132f2ed
0x0132f2ed
0x0132f2f0
0x0132f2f7
0x0132f2fb
0x0132f2fe
0x0132f300
0x0132f303
0x0132f308
0x0132f308
0x0132f30b
0x0132f312
0x0132f316
0x0132f319
0x0132f31b
0x0132f31e
0x0132f323
0x0132f323
0x0132f326
0x0132f32d
0x0132f331
0x0132f334
0x0132f336
0x0132f339
0x0132f33e
0x0132f33e
0x0132f341
0x0132f348
0x0132f34c
0x0132f352
0x0132f354
0x0132f357
0x0132f35c
0x0132f35f
0x0132f369
0x0132f376
0x0132f376
0x00000000
0x0132f29f
0x0132f1c4
0x0132f10f
0x0132f08d
0x0132f06c
0x0132ef01
0x0132ef01
0x0132ef04
0x0132ef07
0x0132ef4f
0x0132ef53
0x0132ef63
0x0132ef66
0x0132ef6b
0x0132ef70
0x0132ef74
0x0132ef75
0x0132efcd
0x0132efce
0x0132efcf
0x0132efdd
0x0132efe9
0x00000000
0x0132ef77
0x0132ef77
0x0132ef79
0x0132ef7a
0x0132ef7b
0x0132ef8c
0x0132ef95
0x0132ef98
0x0132efa0
0x0132efa5
0x0132efb6
0x0132efb6
0x0132efb8
0x0132efec
0x0132efec
0x0132eff5
0x0132efba
0x0132efbb
0x0132efc1
0x0132efca
0x0132efca
0x0132efa7
0x0132efa7
0x0132efaa
0x0132efac
0x0132efaf
0x0132efb2
0x00000000
0x0132efb4
0x0132efb4
0x00000000
0x0132efb4
0x0132efb2
0x0132efa5
0x0132ef75
0x0132eefb
0x0132eee4
0x0132ee52
0x0132ee52
0x0132ee55
0x0132ee58
0x0132ee5d
0x0132ee69
0x0132ee6c
0x0132ee72
0x0132ee79
0x00000000
0x0132ee79
0x0132ee3a
0x0132ee3a
0x00000000
0x0132ee3a
0x0132ee29
0x0132ee2f
0x00000000
0x0132ee2f
0x0132ee27
0x0132ee1d
0x0132ee10
0x0132ed12
0x0132ed12
0x0132ed15
0x0132ed18
0x0132ed1d
0x0132ed29
0x0132ed2c
0x0132ed32
0x0132ed39
0x00000000
0x0132ed39
0x0132ecfa
0x0132ecfa
0x00000000
0x0132ecfa
0x0132ece9
0x0132ecef
0x00000000
0x0132ecef
0x0132ece7
0x0132ecdd
0x0132ecd0
0x0132ebd2
0x0132ebd2
0x0132ebd5
0x0132ebd8
0x0132ebdd
0x0132ebe9
0x0132ebec
0x0132ebf2
0x0132ebf9
0x00000000
0x0132ebf9
0x0132ebba
0x0132ebba
0x00000000
0x0132ebba
0x0132eba9
0x0132ebaf
0x00000000
0x0132ebaf
0x0132eba7
0x0132eb9d
0x0132eb90

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0132EB1D
std::_Lockit::_Lockit.LIBCPMT ref: 0132EB40
std::_Lockit::~_Lockit.LIBCPMT ref: 0132EB68
std::_Facet_Register.LIBCPMT ref: 0132EBDD
std::_Lockit::~_Lockit.LIBCPMT ref: 0132EC07

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 810c5be2a1f2de92990094144159c40b99b54dc6126716620b3635e7f68cfc8b
Instruction ID: 9431354fe6aff5750ce95f0560c63fd7bd98035b199ae2b699a92119824178c0
Opcode Fuzzy Hash: 810c5be2a1f2de92990094144159c40b99b54dc6126716620b3635e7f68cfc8b
Instruction Fuzzy Hash: 8741D57180426ADFDF21EF58D441B9EBBB8FB44728F148269E815A7385D730AE04CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0132ED70 Relevance: 7.6, APIs: 5, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0132ED70(void* __ebx, void* _a4) {
				void* _v8;
				void** _v12;
				void** _v16;
				long _v20;
				signed int _v24;
				void* _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				void* _v48;
				signed int _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				short _v68;
				signed int _v72;
				short _v76;
				void* _v80;
				char _v84;
				void* _v88;
				signed int _v92;
				signed short _v96;
				signed short _v100;
				char _v104;
				void* _v108;
				char _v112;
				void* _v116;
				void* _v120;
				void* _v124;
				short _v128;
				void* _v132;
				char _v136;
				void* _v140;
				char _v144;
				void* _v148;
				char _v152;
				void* _v156;
				void** _v160;
				void* _v164;
				char _v172;
				char _v180;
				void* _v216;
				char _v232;
				char _v280;
				void* _v348;
				char _v368;
				signed int _v372;
				void* _v444;
				char _v464;
				intOrPtr _v468;
				intOrPtr _v556;
				void* _v564;
				char _v572;
				signed int _v580;
				intOrPtr _v584;
				intOrPtr _v636;
				void* _v648;
				char _v696;
				void* _v716;
				char _v724;
				signed int _v728;
				char _v732;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t367;
				signed int* _t373;
				signed int _t381;
				signed int _t382;
				signed int _t389;
				void* _t393;
				void* _t394;
				void* _t395;
				void* _t396;
				void* _t397;
				void* _t398;
				void* _t406;
				signed int _t411;
				void* _t414;
				void* _t420;
				void* _t421;
				void* _t422;
				void* _t423;
				void* _t424;
				void* _t425;
				void* _t433;
				signed int _t438;
				void* _t441;
				void* _t447;
				void* _t448;
				void* _t449;
				void* _t450;
				void* _t451;
				void* _t452;
				void* _t461;
				signed int _t466;
				signed int _t467;
				void* _t471;
				void* _t475;
				void* _t476;
				signed int _t480;
				void* _t487;
				void* _t489;
				signed int _t497;
				void* _t524;
				void* _t528;
				signed int _t546;
				unsigned int _t548;
				void* _t549;
				long _t568;
				void* _t569;
				void* _t574;
				signed int _t582;
				void** _t584;
				void* _t585;
				signed int _t587;
				signed int _t590;
				void* _t593;
				void** _t595;
				signed int _t600;
				void* _t618;
				void* _t619;
				void* _t620;
				intOrPtr _t623;
				intOrPtr _t634;
				signed int _t635;
				void* _t636;
				signed int _t638;
				intOrPtr _t640;
				void* _t641;
				void* _t642;
				void* _t644;
				void* _t646;
				intOrPtr _t647;
				void* _t648;
				void* _t649;
				intOrPtr* _t650;
				void* _t652;
				signed int _t657;
				void* _t659;
				void* _t660;
				void* _t662;
				void* _t664;
				void* _t665;
				char _t666;
				void* _t668;
				void* _t669;
				signed int _t671;
				void* _t674;
				signed int _t678;
				void* _t680;
				signed int _t682;
				signed int _t684;
				signed int _t686;
				signed int _t689;
				signed int _t695;
				void* _t696;
				void* _t698;
				signed int _t701;
				signed int _t702;
				void* _t705;
				signed int _t707;
				void* _t709;
				void* _t711;
				void* _t713;
				signed int _t717;
				void* _t720;
				signed int _t721;
				void* _t722;
				void* _t731;

				_t678 = _t695;
				_push(0xffffffff);
				_push(0x136a7fd);
				_push( *[fs:0x0]);
				_t696 = _t695 - 0x10;
				_push(__ebx);
				_t367 =  *0x1383020; // 0xc9209188
				_push(_t367 ^ _t678);
				 *[fs:0x0] =  &_v16;
				E01335EA5( &_v28, 0);
				_v8 = 0;
				_t638 =  *0x13867c8;
				_t582 =  *0x1385750; // 0x0
				_v24 = _t582;
				if(_t638 == 0) {
					_v8 = 0;
					E01335EFD( &_v20);
					_t638 =  *0x13867c8;
				}
				_t600 = _t638 * 4;
				_v20 = _t600;
				_t634 =  *((intOrPtr*)(_a4 + 4));
				if(_t638 >=  *((intOrPtr*)(_t634 + 0xc))) {
					_t657 = 0;
					__eflags = 0;
					_v20 = _t600;
					goto L8;
				} else {
					_t657 =  *(_t600 +  *((intOrPtr*)(_t634 + 8)));
					if(_t657 != 0) {
						L16:
						_v8 = 0xffffffff;
						E01335EFD( &_v28);
						 *[fs:0x0] = _v16;
						return _t657;
					} else {
						L8:
						if( *((char*)(_t634 + 0x14)) == 0) {
							L11:
							if(_t657 != 0) {
								goto L16;
							} else {
								goto L12;
							}
						} else {
							_t574 = E01335C60();
							if(_t638 >=  *((intOrPtr*)(_t574 + 0xc))) {
								L12:
								if(_t582 == 0) {
									_push(_a4);
									_t373 =  &_v24;
									_push(_t373);
									L43();
									_t698 = _t696 + 8;
									__eflags = _t373 - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t600);
										_t635 = _v44;
										_push(_t582);
										_t584 = _t600;
										_t604 = 0x7fffffff;
										_push(_t678);
										_t680 = _t584[4];
										__eflags = 0x7fffffff - _t680 - _t635;
										if(0x7fffffff - _t680 < _t635) {
											E01323680(_t584, 0x7fffffff, _t635, _t638, _t680);
											goto L41;
										} else {
											_push(_t657);
											_t546 = _t635 + _t680;
											_v52 = _t546;
											_t671 = _t546 | 0x0000000f;
											_push(_t638);
											_t638 = _t584[5];
											_v44 = _t638;
											__eflags = _t671 - 0x7fffffff;
											if(_t671 <= 0x7fffffff) {
												_t548 = _t638 >> 1;
												_t604 = 0x7fffffff - _t548;
												__eflags = _t638 - 0x7fffffff;
												if(_t638 <= 0x7fffffff) {
													_t549 = _t548 + _t638;
													__eflags = _t671 - _t549;
													_t657 =  <  ? _t549 : _t671;
													_t41 = _t657 + 1; // 0x80000000
													_t604 = _t41;
													__eflags = _t604 - 0x1000;
													if(_t604 < 0x1000) {
														__eflags = _t604;
														if(_t604 == 0) {
															_t638 = 0;
															__eflags = 0;
														} else {
															_t638 = LocalAlloc(0x40, _t604);
														}
														goto L32;
													} else {
														_t42 = _t604 + 0x23; // 0x80000023
														_t568 = _t42;
														__eflags = _t568 - _t604;
														if(__eflags <= 0) {
															L41:
															E01323AF0(__eflags);
															goto L42;
														} else {
															goto L22;
														}
													}
												} else {
													_t657 = 0x7fffffff;
													goto L21;
												}
											} else {
												_t657 = 0x7fffffff;
												L21:
												_t568 = 0xffffffff80000023;
												__eflags = 0x80000000;
												L22:
												_t569 = LocalAlloc(0x40, _t568);
												__eflags = _t569;
												if(_t569 == 0) {
													L42:
													E0134C5C2(_t584, _t604, _t635, _t638);
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t584);
													_t585 = _t698;
													_t701 = (_t698 - 0x00000008 & 0xfffffff8) + 4;
													_push(_t680);
													_v68 =  *((intOrPtr*)(_t585 + 4));
													_t682 = _t701;
													_push(0xffffffff);
													_push(0x136b100);
													_push( *[fs:0x0]);
													_push(_t585);
													_t702 = _t701 - 0xf8;
													_t381 =  *0x1383020; // 0xc9209188
													_t382 = _t381 ^ _t682;
													_v92 = _t382;
													_push(_t657);
													_push(_t638);
													_push(_t382);
													 *[fs:0x0] =  &_v84;
													_t605 =  *(_t585 + 8);
													_t640 =  *((intOrPtr*)(_t585 + 0xc));
													_v216 = _t605;
													_v148 = 0;
													__eflags = _t605;
													if(_t605 == 0) {
														L68:
														 *[fs:0x0] = _v28;
														_pop(_t641);
														_pop(_t659);
														__eflags = _v36 ^ _t682;
														return E01347708(4, _t585, _v36 ^ _t682, _t635, _t641, _t659);
													} else {
														__eflags =  *_t605;
														if( *_t605 != 0) {
															goto L68;
														} else {
															_t660 = LocalAlloc(0x40, 0x18);
															_v164 = _t660;
															_v20 = 0;
															__eflags = _t660;
															if(_t660 == 0) {
																_t660 = 0;
																__eflags = 0;
																goto L54;
															} else {
																_t406 =  *(_t640 + 4);
																__eflags = _t406;
																if(_t406 == 0) {
																	_t642 = 0x137b6c9;
																} else {
																	_t642 =  *(_t406 + 0x18);
																	__eflags = _t642;
																	if(_t642 == 0) {
																		_t642 = _t406 + 0x1c;
																	}
																}
																_t605 =  &_v152;
																E01335EA5( &_v152, 0);
																_v20 = 1;
																_v148 = 0;
																_v144 = 0;
																_v20 = 2;
																_v140 = 0;
																_v136 = 0;
																_v20 = 3;
																_v132 = 0;
																_v128 = 0;
																_v20 = 4;
																_v124 = 0;
																_v120 = 0;
																_v20 = 5;
																_v116 = 0;
																_v112 = 0;
																_v20 = 6;
																_v108 = 0;
																_v104 = 0;
																_v20 = 7;
																__eflags = _t642;
																if(_t642 == 0) {
																	L70:
																	E013320D0("bad locale name");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t682);
																	_t684 = _t702;
																	_push(0xffffffff);
																	_push(0x136b1dd);
																	_push( *[fs:0x0]);
																	_t707 = _t702 - 0x3c;
																	_push(_t585);
																	_push(_t660);
																	_push(_t642);
																	_t411 =  *0x1383020; // 0xc9209188
																	_push(_t411 ^ _t684);
																	 *[fs:0x0] =  &_v368;
																	_t414 = _v348;
																	_t587 = 0;
																	_v372 = 0;
																	__eflags = _t414;
																	if(_t414 == 0) {
																		L95:
																		 *[fs:0x0] = _v32;
																		return 4;
																	} else {
																		__eflags =  *_t414;
																		if( *_t414 != 0) {
																			goto L95;
																		} else {
																			_t662 = LocalAlloc(0x40, 8);
																			_v40 = _t662;
																			_v24 = 0;
																			__eflags = _t662;
																			if(_t662 == 0) {
																				_t662 = 0;
																				__eflags = 0;
																				goto L81;
																			} else {
																				_t433 =  *(_v8 + 4);
																				__eflags = _t433;
																				if(_t433 == 0) {
																					_t644 = 0x137b6c9;
																				} else {
																					_t644 =  *(_t433 + 0x18);
																					__eflags = _t644;
																					if(_t644 == 0) {
																						_t644 = _t433 + 0x1c;
																					}
																				}
																				_t605 =  &_v92;
																				E01335EA5( &_v92, 0);
																				_v24 = 1;
																				_v88 = 0;
																				_v84 = 0;
																				_v24 = 2;
																				_v80 = 0;
																				_v76 = 0;
																				_v24 = 3;
																				_v72 = 0;
																				_v68 = 0;
																				_v24 = 4;
																				_v64 = 0;
																				_v60 = 0;
																				_v24 = 5;
																				_v56 = 0;
																				_v52 = 0;
																				_v24 = 6;
																				_v48 = 0;
																				_v44 = 0;
																				_v24 = 7;
																				__eflags = _t644;
																				if(_t644 == 0) {
																					E013320D0("bad locale name");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					asm("int3");
																					_push(_t684);
																					_t686 = _t707;
																					_push(0xffffffff);
																					_push(0x136b2d1);
																					_push( *[fs:0x0]);
																					_t711 = _t707 - 0x40;
																					_push(_t587);
																					_push(_t662);
																					_push(_t644);
																					_t438 =  *0x1383020; // 0xc9209188
																					_push(_t438 ^ _t686);
																					 *[fs:0x0] =  &_v464;
																					_t441 = _v444;
																					_t590 = 0;
																					_v468 = 0;
																					__eflags = _t441;
																					if(_t441 == 0) {
																						L123:
																						 *[fs:0x0] = _v36;
																						return 5;
																					} else {
																						__eflags =  *_t441;
																						if( *_t441 != 0) {
																							goto L123;
																						} else {
																							_t646 = LocalAlloc(0x40, 0xc);
																							_v48 = _t646;
																							_v28 = 0;
																							__eflags = _t646;
																							if(_t646 == 0) {
																								_t646 = 0;
																								__eflags = 0;
																								goto L109;
																							} else {
																								_t461 = _v12[1];
																								__eflags = _t461;
																								if(_t461 == 0) {
																									_t664 = 0x137b6c9;
																								} else {
																									_t664 =  *(_t461 + 0x18);
																									__eflags = _t664;
																									if(_t664 == 0) {
																										_t664 = _t461 + 0x1c;
																									}
																								}
																								_t605 =  &_v100;
																								E01335EA5(_t605, 0);
																								_v28 = 1;
																								_v96 = 0;
																								_v92 = 0;
																								_v28 = 2;
																								_v88 = 0;
																								_v84 = 0;
																								_v28 = 3;
																								_v80 = 0;
																								_v76 = 0;
																								_v28 = 4;
																								_v72 = 0;
																								_v68 = 0;
																								_v28 = 5;
																								_v64 = 0;
																								_v60 = 0;
																								_v28 = 6;
																								_v56 = 0;
																								_v52 = 0;
																								_v28 = 7;
																								__eflags = _t664;
																								if(__eflags == 0) {
																									E013320D0("bad locale name");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									asm("int3");
																									_push(_t590);
																									_t593 = _t711;
																									_t717 = (_t711 - 0x00000008 & 0xfffffff8) + 4;
																									_push(_t686);
																									_v556 =  *((intOrPtr*)(_t593 + 4));
																									_t689 = _t717;
																									_push(0xffffffff);
																									_push(0x136b2fd);
																									_push( *[fs:0x0]);
																									_push(_t593);
																									_t466 =  *0x1383020; // 0xc9209188
																									_t467 = _t466 ^ _t689;
																									_v580 = _t467;
																									_push(_t664);
																									_push(_t646);
																									_push(_t467);
																									 *[fs:0x0] =  &_v572;
																									_t665 = _t605;
																									_t647 = E01356A36(_t635, _t665);
																									_v636 = _t647;
																									_t471 = E01336203(__eflags,  &_v696);
																									_v648 = _t665;
																									asm("movups xmm0, [eax]");
																									asm("movups [ebp-0x40], xmm0");
																									asm("movups xmm0, [eax+0x10]");
																									asm("movups [ebp-0x30], xmm0");
																									asm("movq xmm0, [eax+0x20]");
																									asm("movq [ebp-0x20], xmm0");
																									_v584 =  *((intOrPtr*)(_t471 + 0x28));
																									 *(_t665 + 8) = 0;
																									 *(_t665 + 0x10) = 0;
																									 *(_t665 + 0x14) = 0;
																									_v564 = 0;
																									E01336203(__eflags,  &_v696);
																									_t720 = _t717 - 0x78 + 8;
																									__eflags =  *((char*)(_t593 + 0xc));
																									if( *((char*)(_t593 + 0xc)) == 0) {
																										_t648 =  *(_t647 + 8);
																									} else {
																										_t648 = 0x137b6c9;
																									}
																									_t618 = _t648;
																									_t319 = _t618 + 1; // 0x137b6ca
																									_t636 = _t319;
																									do {
																										_t475 =  *_t618;
																										_t618 = _t618 + 1;
																										__eflags = _t475;
																									} while (_t475 != 0);
																									_t619 = _t618 - _t636;
																									_push(1);
																									_t320 = _t619 + 1; // 0x137b6cb
																									_t476 = _t320;
																									_push(_t476);
																									_v108 = _t476;
																									_t620 = E01356A5E();
																									_t721 = _t720 + 8;
																									_v120 = _t620;
																									__eflags = _t620;
																									if(__eflags == 0) {
																										E01332056(__eflags);
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										asm("int3");
																										_push(_t689);
																										_push(0xffffffff);
																										_push(0x136b34e);
																										_push( *[fs:0x0]);
																										_t722 = _t721 - 8;
																										_push(_t665);
																										_push(_t648);
																										_t480 =  *0x1383020; // 0xc9209188
																										_push(_t480 ^ _t721);
																										 *[fs:0x0] =  &_v724;
																										_t649 = _t620;
																										_v728 = 0;
																										_v716 = 0;
																										_t666 = E01356078(_t593, _t649, _t665);
																										_t650 = _t649 + 8;
																										_v732 = _t666;
																										_v728 = 1;
																										__eflags = _t650 -  &_v732;
																										if(_t650 !=  &_v732) {
																											E0134C213( *_t650);
																											_t722 = _t722 + 4;
																											 *_t650 = _t666;
																											_t666 = 0;
																											__eflags = 0;
																											_v60 = 0;
																										}
																										_v56 = 1;
																										__eflags = 1;
																										_v56 = 0;
																										_v44 = 0xffffffff;
																										_t487 = E0134C213(_t666);
																										 *[fs:0x0] = _v52;
																										return _t487;
																									} else {
																										_t489 = _v108;
																										__eflags = _t489;
																										if(_t489 != 0) {
																											E01348FF0(_t620, _t648, _t489);
																											_t620 = _v120;
																											_t721 = _t721 + 0xc;
																										}
																										 *(_t665 + 8) = _t620;
																										_push( &_v100);
																										 *(_t665 + 0x10) = E0132FBD0("false", 0);
																										_push( &_v100);
																										 *(_t665 + 0x14) = E0132FBD0("true", 0);
																										__eflags =  *((char*)(_t593 + 0xc));
																										_v124 = 0;
																										if( *((char*)(_t593 + 0xc)) == 0) {
																											_t623 = _v112;
																											 *((short*)(_t665 + 0xc)) =  *( *(_t623 + 0x30)) & 0x0000ffff;
																											_t497 =  *( *(_t623 + 0x34)) & 0x0000ffff;
																										} else {
																											_v104 = 0x2e;
																											_v108 = 0;
																											asm("xorps xmm0, xmm0");
																											asm("movlpd [ebp-0x50], xmm0");
																											E013362D2(_t620,  &_v108,  &_v104, 1,  &_v116,  &_v100);
																											 *((short*)(_t665 + 0xc)) = _v108 & 0x0000ffff;
																											asm("xorps xmm0, xmm0");
																											_v104 = 0x2c;
																											_v108 = 0;
																											asm("movlpd [ebp-0x50], xmm0");
																											E013362D2(_t620,  &_v108,  &_v104, 1,  &_v116,  &_v100);
																											_t497 = _v108 & 0x0000ffff;
																										}
																										 *(_t665 + 0xe) = _t497;
																										_v40 = 0xffffffff;
																										 *[fs:0x0] = _v48;
																										_pop(_t652);
																										_pop(_t668);
																										__eflags = _v56 ^ _t689;
																										return E01347708(_t497, _t593, _v56 ^ _t689, _t636, _t652, _t668);
																									}
																								} else {
																									E01335D63(_t605,  &_v100, _t664);
																									_t731 = _t711 + 8;
																									_v28 = 8;
																									_v40 = 1;
																									 *_t646 = 0x136e0d8;
																									_v28 = 9;
																									 *_t646 = 0x136e0e8;
																									 *(_t646 + 4) = 0;
																									_v28 = 0xa;
																									_t264 = _t646 + 8; // 0x8
																									_t595 = _t264;
																									 *_t646 = 0x136e620;
																									 *_t595 = 0;
																									_v28 = 0xc;
																									_t669 = E01356078(_t595, _t646, _t664);
																									_v44 = _t669;
																									_v40 = 3;
																									__eflags = _t595 -  &_v44;
																									if(_t595 !=  &_v44) {
																										E0134C213( *_t595);
																										_t731 = _t731 + 4;
																										 *_t595 = _t669;
																										_t669 = 0;
																										__eflags = 0;
																										_v44 = 0;
																									}
																									_v40 = 3;
																									_t590 = 1;
																									_v40 = 3;
																									_v28 = 0xb;
																									E0134C213(_t669);
																									_t711 = _t731 + 4;
																									_v28 = 8;
																									L109:
																									_v28 = 0xd;
																									 *_v16 = _t646;
																									_v28 = 0xffffffff;
																									__eflags = _t590 & 0x00000001;
																									if((_t590 & 0x00000001) != 0) {
																										_v40 = _t590 & 0xfffffffe;
																										_v28 = 0x14;
																										E01335DAE(_t605,  &_v100);
																										_t713 = _t711 + 4;
																										_v28 = 0x13;
																										_t447 = _v56;
																										__eflags = _t447;
																										if(_t447 != 0) {
																											E0134C213(_t447);
																											_t713 = _t713 + 4;
																										}
																										_v56 = 0;
																										_v28 = 0x12;
																										_t448 = _v64;
																										__eflags = _t448;
																										if(_t448 != 0) {
																											E0134C213(_t448);
																											_t713 = _t713 + 4;
																										}
																										_v64 = 0;
																										_v28 = 0x11;
																										_t449 = _v72;
																										__eflags = _t449;
																										if(_t449 != 0) {
																											E0134C213(_t449);
																											_t713 = _t713 + 4;
																										}
																										_v72 = 0;
																										_v28 = 0x10;
																										_t450 = _v80;
																										__eflags = _t450;
																										if(_t450 != 0) {
																											E0134C213(_t450);
																											_t713 = _t713 + 4;
																										}
																										_v80 = 0;
																										_v28 = 0xf;
																										_t451 = _v88;
																										__eflags = _t451;
																										if(_t451 != 0) {
																											E0134C213(_t451);
																											_t713 = _t713 + 4;
																										}
																										_v88 = 0;
																										_v28 = 0xe;
																										_t452 = _v96;
																										__eflags = _t452;
																										if(_t452 != 0) {
																											E0134C213(_t452);
																										}
																										_v96 = 0;
																										_v28 = 0xffffffff;
																										E01335EFD( &_v100);
																									}
																									goto L123;
																								}
																							}
																						}
																					}
																				} else {
																					E01335D63( &_v92,  &_v92, _t644);
																					_t707 = _t707 + 8;
																					_v24 = 8;
																					_t587 = 1;
																					_v36 = 1;
																					 *_t662 = 0x136e0d8;
																					_v24 = 9;
																					 *_t662 = 0x136e0e8;
																					 *(_t662 + 4) = 0;
																					_v24 = 0xa;
																					 *_t662 = 0x136e670;
																					_v24 = 8;
																					L81:
																					_v24 = 0xb;
																					 *_v12 = _t662;
																					_v24 = 0xffffffff;
																					__eflags = _t587 & 0x00000001;
																					if((_t587 & 0x00000001) != 0) {
																						_v36 = _t587 & 0xfffffffe;
																						_v24 = 0x12;
																						E01335DAE(_t605,  &_v92);
																						_t709 = _t707 + 4;
																						_v24 = 0x11;
																						_t420 = _v48;
																						__eflags = _t420;
																						if(_t420 != 0) {
																							E0134C213(_t420);
																							_t709 = _t709 + 4;
																						}
																						_v48 = 0;
																						_v24 = 0x10;
																						_t421 = _v56;
																						__eflags = _t421;
																						if(_t421 != 0) {
																							E0134C213(_t421);
																							_t709 = _t709 + 4;
																						}
																						_v56 = 0;
																						_v24 = 0xf;
																						_t422 = _v64;
																						__eflags = _t422;
																						if(_t422 != 0) {
																							E0134C213(_t422);
																							_t709 = _t709 + 4;
																						}
																						_v64 = 0;
																						_v24 = 0xe;
																						_t423 = _v72;
																						__eflags = _t423;
																						if(_t423 != 0) {
																							E0134C213(_t423);
																							_t709 = _t709 + 4;
																						}
																						_v72 = 0;
																						_v24 = 0xd;
																						_t424 = _v80;
																						__eflags = _t424;
																						if(_t424 != 0) {
																							E0134C213(_t424);
																							_t709 = _t709 + 4;
																						}
																						_v80 = 0;
																						_v24 = 0xc;
																						_t425 = _v88;
																						__eflags = _t425;
																						if(_t425 != 0) {
																							E0134C213(_t425);
																						}
																						_v88 = 0;
																						_v24 = 0xffffffff;
																						E01335EFD( &_v92);
																					}
																					goto L95;
																				}
																			}
																		}
																	}
																} else {
																	E01335D63( &_v152,  &_v152, _t642);
																	_v20 = 8;
																	_v92 = 1;
																	 *_t660 = 0x136e0d8;
																	_v20 = 9;
																	 *_t660 = 0x136e0e8;
																	 *(_t660 + 4) = 0;
																	_v20 = 0xa;
																	 *_t660 = 0x136e6a0;
																	E01356A36(_t635, _t660);
																	_t524 = E01336203(__eflags,  &_v232);
																	_v156 = _t660;
																	asm("movups xmm0, [eax]");
																	asm("movups [ebp-0x40], xmm0");
																	asm("movups xmm0, [eax+0x10]");
																	asm("movups [ebp-0x30], xmm0");
																	asm("movq xmm0, [eax+0x20]");
																	asm("movq [ebp-0x20], xmm0");
																	_v40 =  *(_t524 + 0x28);
																	 *(_t660 + 8) = 0;
																	 *(_t660 + 0x10) = 0;
																	 *(_t660 + 0x14) = 0;
																	_v20 = 0xb;
																	E01336203(__eflags,  &_v280);
																	_push(1);
																	_push(1);
																	_t528 = E01356A5E();
																	_t702 = _t702 + 0x18;
																	__eflags = _t528;
																	if(__eflags == 0) {
																		E01332056(__eflags);
																		goto L70;
																	} else {
																		 *_t528 = 0;
																		 *(_t660 + 8) = _t528;
																		_push( &_v80);
																		 *(_t660 + 0x10) = E0132FBD0("false", 0);
																		_push( &_v80);
																		 *(_t660 + 0x14) = E0132FBD0("true", 0);
																		_v156 = 0;
																		asm("xorps xmm0, xmm0");
																		_v84 = 0x2e;
																		_v96 = 0;
																		asm("movlpd [ebp-0x9c], xmm0");
																		E013362D2( &_v152,  &_v96,  &_v84, 1,  &_v172,  &_v80);
																		 *((short*)(_t660 + 0xc)) = _v96 & 0x0000ffff;
																		asm("xorps xmm0, xmm0");
																		_v88 = 0x2c;
																		_v100 = 0;
																		asm("movlpd [ebp-0xa4], xmm0");
																		E013362D2(_t605,  &_v100,  &_v88, 1,  &_v180,  &_v80);
																		_t702 = _t702 + 0x40;
																		 *((short*)(_t660 + 0xe)) = _v100 & 0x0000ffff;
																		_v20 = 8;
																		L54:
																		_v20 = 0xc;
																		 *_v160 = _t660;
																		_v20 = 0xffffffff;
																		_t389 = _v92;
																		__eflags = _t389 & 0x00000001;
																		if((_t389 & 0x00000001) != 0) {
																			_v92 = _t389 & 0xfffffffe;
																			_v20 = 0x13;
																			E01335DAE(_t605,  &_v152);
																			_t705 = _t702 + 4;
																			_v20 = 0x12;
																			_t393 = _v108;
																			__eflags = _t393;
																			if(_t393 != 0) {
																				E0134C213(_t393);
																				_t705 = _t705 + 4;
																			}
																			_v108 = 0;
																			_v20 = 0x11;
																			_t394 = _v116;
																			__eflags = _t394;
																			if(_t394 != 0) {
																				E0134C213(_t394);
																				_t705 = _t705 + 4;
																			}
																			_v116 = 0;
																			_v20 = 0x10;
																			_t395 = _v124;
																			__eflags = _t395;
																			if(_t395 != 0) {
																				E0134C213(_t395);
																				_t705 = _t705 + 4;
																			}
																			_v124 = 0;
																			_v20 = 0xf;
																			_t396 = _v132;
																			__eflags = _t396;
																			if(_t396 != 0) {
																				E0134C213(_t396);
																				_t705 = _t705 + 4;
																			}
																			_v132 = 0;
																			_v20 = 0xe;
																			_t397 = _v140;
																			__eflags = _t397;
																			if(_t397 != 0) {
																				E0134C213(_t397);
																				_t705 = _t705 + 4;
																			}
																			_v140 = 0;
																			_v20 = 0xd;
																			_t398 = _v148;
																			__eflags = _t398;
																			if(_t398 != 0) {
																				E0134C213(_t398);
																			}
																			_v148 = 0;
																			_v20 = 0xffffffff;
																			E01335EFD( &_v152);
																		}
																		goto L68;
																	}
																}
															}
														}
													}
												} else {
													_t39 = _t569 + 0x23; // 0x23
													_t638 = _t39 & 0xffffffe0;
													 *(_t638 - 4) = _t569;
													L32:
													_t584[4] = _v52;
													_t584[5] = _t657;
													_t672 = _t680 + _t638;
													__eflags = _v44 - 0x10;
													_v52 = _v36 + _t680 + _t638;
													_push(_t680);
													if(_v44 < 0x10) {
														_push(_t584);
														_push(_t638);
														E01348FF0();
														E01348E90(_t638, _t672, _v32, _v36);
														 *_v52 = 0;
														goto L39;
													} else {
														_t674 =  *_t584;
														_push(_t674);
														_push(_t638);
														E01348FF0();
														E01348E90(_t638, _t680 + _t638, _v32, _v36);
														_t698 = _t698 + 0x18;
														 *_v52 = 0;
														__eflags = _v44 + 1 - 0x1000;
														if(_v44 + 1 < 0x1000) {
															L36:
															__eflags = _t674;
															if(_t674 == 0) {
																L39:
																 *_t584 = _t638;
																return _t584;
															} else {
																LocalFree(_t674);
																 *_t584 = _t638;
																return _t584;
															}
														} else {
															_t604 =  *(_t674 - 4);
															_t657 = _t674 - _t604;
															_t58 = _t657 - 4; // 0x7ffffffb
															__eflags = _t58 - 0x1f;
															if(_t58 > 0x1f) {
																goto L42;
															} else {
																_t674 = _t604;
																goto L36;
															}
														}
													}
												}
											}
										}
									} else {
										_t657 = _v24;
										_a4 = _t657;
										_v8 = 2;
										E01335C34(_t657);
										 *((intOrPtr*)( *_t657 + 4))();
										 *0x1385750 = _t657;
										_a4 = 0;
										_v8 = 0;
										goto L16;
									}
								} else {
									_t657 = _t582;
									goto L16;
								}
							} else {
								_t657 =  *(_v20 +  *((intOrPtr*)(_t574 + 8)));
								goto L11;
							}
						}
					}
				}
			}

0x0132ed71
0x0132ed73
0x0132ed75
0x0132ed80
0x0132ed81
0x0132ed84
0x0132ed87
0x0132ed8e
0x0132ed92
0x0132ed9d
0x0132eda2
0x0132eda9
0x0132edaf
0x0132edb5
0x0132edba
0x0132ede1
0x0132ede8
0x0132eded
0x0132eded
0x0132edf6
0x0132edfd
0x0132ee00
0x0132ee06
0x0132ee14
0x0132ee14
0x0132ee16
0x00000000
0x0132ee08
0x0132ee0b
0x0132ee10
0x0132ee7d
0x0132ee7d
0x0132ee87
0x0132ee91
0x0132ee9f
0x0132ee12
0x0132ee19
0x0132ee1d
0x0132ee32
0x0132ee34
0x00000000
0x00000000
0x00000000
0x00000000
0x0132ee1f
0x0132ee1f
0x0132ee27
0x0132ee36
0x0132ee38
0x0132ee3e
0x0132ee41
0x0132ee44
0x0132ee45
0x0132ee4a
0x0132ee4d
0x0132ee50
0x0132eea0
0x0132eea5
0x0132eea6
0x0132eea7
0x0132eea8
0x0132eea9
0x0132eeaa
0x0132eeab
0x0132eeac
0x0132eead
0x0132eeae
0x0132eeaf
0x0132eeb0
0x0132eeb1
0x0132eeb5
0x0132eeb6
0x0132eeb8
0x0132eebd
0x0132eec0
0x0132eec5
0x0132eec7
0x0132eff8
0x00000000
0x0132eecd
0x0132eecd
0x0132eece
0x0132eed3
0x0132eed7
0x0132eeda
0x0132eedb
0x0132eede
0x0132eee2
0x0132eee4
0x0132ef0e
0x0132ef10
0x0132ef12
0x0132ef14
0x0132ef1d
0x0132ef1f
0x0132ef21
0x0132ef24
0x0132ef24
0x0132ef27
0x0132ef2d
0x0132ef3c
0x0132ef3e
0x0132ef4d
0x0132ef4d
0x0132ef40
0x0132ef49
0x0132ef49
0x00000000
0x0132ef2f
0x0132ef2f
0x0132ef2f
0x0132ef32
0x0132ef34
0x0132effd
0x0132effd
0x00000000
0x0132ef3a
0x00000000
0x0132ef3a
0x0132ef34
0x0132ef16
0x0132ef16
0x00000000
0x0132ef16
0x0132eee6
0x0132eee6
0x0132eee8
0x0132eeed
0x0132eeed
0x0132eef0
0x0132eef3
0x0132eef9
0x0132eefb
0x0132f002
0x0132f002
0x0132f007
0x0132f008
0x0132f009
0x0132f00a
0x0132f00b
0x0132f00c
0x0132f00d
0x0132f00e
0x0132f00f
0x0132f010
0x0132f011
0x0132f019
0x0132f01c
0x0132f020
0x0132f024
0x0132f026
0x0132f028
0x0132f033
0x0132f034
0x0132f035
0x0132f03b
0x0132f040
0x0132f042
0x0132f045
0x0132f046
0x0132f047
0x0132f04b
0x0132f051
0x0132f056
0x0132f059
0x0132f05f
0x0132f062
0x0132f064
0x0132f37b
0x0132f383
0x0132f38b
0x0132f38c
0x0132f390
0x0132f39d
0x0132f06a
0x0132f06a
0x0132f06c
0x00000000
0x0132f072
0x0132f07c
0x0132f07e
0x0132f084
0x0132f08b
0x0132f08d
0x0132f282
0x0132f282
0x00000000
0x0132f093
0x0132f093
0x0132f096
0x0132f098
0x0132f0a6
0x0132f09a
0x0132f09a
0x0132f09d
0x0132f09f
0x0132f0a1
0x0132f0a1
0x0132f09f
0x0132f0ad
0x0132f0b3
0x0132f0b8
0x0132f0bc
0x0132f0c6
0x0132f0ca
0x0132f0ce
0x0132f0d5
0x0132f0d9
0x0132f0df
0x0132f0e6
0x0132f0ea
0x0132f0ee
0x0132f0f1
0x0132f0f5
0x0132f0f9
0x0132f0fc
0x0132f0ff
0x0132f103
0x0132f106
0x0132f109
0x0132f10d
0x0132f10f
0x0132f3a3
0x0132f3a8
0x0132f3ad
0x0132f3ae
0x0132f3af
0x0132f3b0
0x0132f3b1
0x0132f3b3
0x0132f3b5
0x0132f3c0
0x0132f3c1
0x0132f3c4
0x0132f3c5
0x0132f3c6
0x0132f3c7
0x0132f3ce
0x0132f3d2
0x0132f3d8
0x0132f3db
0x0132f3dd
0x0132f3e0
0x0132f3e2
0x0132f5b7
0x0132f5bf
0x0132f5cd
0x0132f3e8
0x0132f3e8
0x0132f3ea
0x00000000
0x0132f3f0
0x0132f3fa
0x0132f3fc
0x0132f3ff
0x0132f402
0x0132f404
0x0132f4cf
0x0132f4cf
0x00000000
0x0132f40a
0x0132f40d
0x0132f410
0x0132f412
0x0132f420
0x0132f414
0x0132f414
0x0132f417
0x0132f419
0x0132f41b
0x0132f41b
0x0132f419
0x0132f427
0x0132f42a
0x0132f42f
0x0132f433
0x0132f43a
0x0132f43e
0x0132f442
0x0132f449
0x0132f44d
0x0132f453
0x0132f45a
0x0132f45e
0x0132f462
0x0132f465
0x0132f469
0x0132f46d
0x0132f470
0x0132f473
0x0132f477
0x0132f47a
0x0132f47d
0x0132f481
0x0132f483
0x0132f5d3
0x0132f5d8
0x0132f5d9
0x0132f5da
0x0132f5db
0x0132f5dc
0x0132f5dd
0x0132f5de
0x0132f5df
0x0132f5e0
0x0132f5e1
0x0132f5e3
0x0132f5e5
0x0132f5f0
0x0132f5f1
0x0132f5f4
0x0132f5f5
0x0132f5f6
0x0132f5f7
0x0132f5fe
0x0132f602
0x0132f608
0x0132f60b
0x0132f60d
0x0132f610
0x0132f612
0x0132f837
0x0132f83f
0x0132f84d
0x0132f618
0x0132f618
0x0132f61a
0x00000000
0x0132f620
0x0132f62a
0x0132f62c
0x0132f62f
0x0132f632
0x0132f634
0x0132f74f
0x0132f74f
0x00000000
0x0132f63a
0x0132f63d
0x0132f640
0x0132f642
0x0132f650
0x0132f644
0x0132f644
0x0132f647
0x0132f649
0x0132f64b
0x0132f64b
0x0132f649
0x0132f657
0x0132f65a
0x0132f65f
0x0132f663
0x0132f66a
0x0132f66e
0x0132f672
0x0132f679
0x0132f67d
0x0132f683
0x0132f68a
0x0132f68e
0x0132f692
0x0132f695
0x0132f699
0x0132f69d
0x0132f6a0
0x0132f6a3
0x0132f6a7
0x0132f6aa
0x0132f6ad
0x0132f6b1
0x0132f6b3
0x0132f853
0x0132f858
0x0132f859
0x0132f85a
0x0132f85b
0x0132f85c
0x0132f85d
0x0132f85e
0x0132f85f
0x0132f860
0x0132f861
0x0132f869
0x0132f86c
0x0132f870
0x0132f874
0x0132f876
0x0132f878
0x0132f883
0x0132f884
0x0132f888
0x0132f88d
0x0132f88f
0x0132f892
0x0132f893
0x0132f894
0x0132f898
0x0132f89e
0x0132f8a5
0x0132f8ae
0x0132f8b1
0x0132f8b9
0x0132f8bc
0x0132f8bf
0x0132f8c3
0x0132f8c7
0x0132f8cb
0x0132f8d0
0x0132f8d8
0x0132f8db
0x0132f8e2
0x0132f8e9
0x0132f8f0
0x0132f8fe
0x0132f903
0x0132f906
0x0132f90a
0x0132f913
0x0132f90c
0x0132f90c
0x0132f90c
0x0132f916
0x0132f918
0x0132f918
0x0132f920
0x0132f920
0x0132f922
0x0132f923
0x0132f923
0x0132f927
0x0132f929
0x0132f92b
0x0132f92b
0x0132f92e
0x0132f92f
0x0132f937
0x0132f939
0x0132f93c
0x0132f93f
0x0132f941
0x0132fa3e
0x0132fa43
0x0132fa44
0x0132fa45
0x0132fa46
0x0132fa47
0x0132fa48
0x0132fa49
0x0132fa4a
0x0132fa4b
0x0132fa4c
0x0132fa4d
0x0132fa4e
0x0132fa4f
0x0132fa50
0x0132fa53
0x0132fa55
0x0132fa60
0x0132fa61
0x0132fa64
0x0132fa65
0x0132fa66
0x0132fa6d
0x0132fa71
0x0132fa77
0x0132fa79
0x0132fa80
0x0132fa8c
0x0132fa8e
0x0132fa94
0x0132fa97
0x0132fa9e
0x0132faa0
0x0132faa4
0x0132faa9
0x0132faac
0x0132faae
0x0132faae
0x0132fab0
0x0132fab0
0x0132fab8
0x0132fabb
0x0132fabe
0x0132fac1
0x0132fac9
0x0132fad4
0x0132fae1
0x0132f947
0x0132f947
0x0132f94a
0x0132f94c
0x0132f951
0x0132f956
0x0132f959
0x0132f959
0x0132f95f
0x0132f962
0x0132f972
0x0132f978
0x0132f988
0x0132f98b
0x0132f98f
0x0132f996
0x0132fa00
0x0132fa09
0x0132fa10
0x0132f998
0x0132f99b
0x0132f9a3
0x0132f9b0
0x0132f9b7
0x0132f9bd
0x0132f9c9
0x0132f9cd
0x0132f9d3
0x0132f9d7
0x0132f9e2
0x0132f9f2
0x0132f9f7
0x0132f9fb
0x0132fa13
0x0132fa17
0x0132fa21
0x0132fa29
0x0132fa2a
0x0132fa2e
0x0132fa3b
0x0132fa3b
0x0132f6b9
0x0132f6be
0x0132f6c3
0x0132f6c6
0x0132f6ca
0x0132f6d1
0x0132f6d7
0x0132f6de
0x0132f6e4
0x0132f6eb
0x0132f6f2
0x0132f6f2
0x0132f6f5
0x0132f6fb
0x0132f701
0x0132f70a
0x0132f70f
0x0132f712
0x0132f719
0x0132f71b
0x0132f71f
0x0132f724
0x0132f727
0x0132f729
0x0132f729
0x0132f72b
0x0132f72b
0x0132f733
0x0132f736
0x0132f739
0x0132f73c
0x0132f741
0x0132f746
0x0132f749
0x0132f751
0x0132f751
0x0132f75b
0x0132f75d
0x0132f764
0x0132f767
0x0132f770
0x0132f773
0x0132f77e
0x0132f783
0x0132f786
0x0132f78a
0x0132f78d
0x0132f78f
0x0132f792
0x0132f797
0x0132f797
0x0132f79a
0x0132f7a1
0x0132f7a5
0x0132f7a8
0x0132f7aa
0x0132f7ad
0x0132f7b2
0x0132f7b2
0x0132f7b5
0x0132f7bc
0x0132f7c0
0x0132f7c3
0x0132f7c5
0x0132f7c8
0x0132f7cd
0x0132f7cd
0x0132f7d0
0x0132f7d7
0x0132f7db
0x0132f7de
0x0132f7e0
0x0132f7e3
0x0132f7e8
0x0132f7e8
0x0132f7eb
0x0132f7f2
0x0132f7f6
0x0132f7f9
0x0132f7fb
0x0132f7fe
0x0132f803
0x0132f803
0x0132f806
0x0132f80d
0x0132f811
0x0132f814
0x0132f816
0x0132f819
0x0132f81e
0x0132f821
0x0132f828
0x0132f832
0x0132f832
0x00000000
0x0132f767
0x0132f6b3
0x0132f634
0x0132f61a
0x0132f489
0x0132f48e
0x0132f493
0x0132f496
0x0132f49a
0x0132f49f
0x0132f4a2
0x0132f4a8
0x0132f4af
0x0132f4b5
0x0132f4bc
0x0132f4c3
0x0132f4c9
0x0132f4d1
0x0132f4d1
0x0132f4db
0x0132f4dd
0x0132f4e4
0x0132f4e7
0x0132f4f0
0x0132f4f3
0x0132f4fe
0x0132f503
0x0132f506
0x0132f50a
0x0132f50d
0x0132f50f
0x0132f512
0x0132f517
0x0132f517
0x0132f51a
0x0132f521
0x0132f525
0x0132f528
0x0132f52a
0x0132f52d
0x0132f532
0x0132f532
0x0132f535
0x0132f53c
0x0132f540
0x0132f543
0x0132f545
0x0132f548
0x0132f54d
0x0132f54d
0x0132f550
0x0132f557
0x0132f55b
0x0132f55e
0x0132f560
0x0132f563
0x0132f568
0x0132f568
0x0132f56b
0x0132f572
0x0132f576
0x0132f579
0x0132f57b
0x0132f57e
0x0132f583
0x0132f583
0x0132f586
0x0132f58d
0x0132f591
0x0132f594
0x0132f596
0x0132f599
0x0132f59e
0x0132f5a1
0x0132f5a8
0x0132f5b2
0x0132f5b2
0x00000000
0x0132f4e7
0x0132f483
0x0132f404
0x0132f3ea
0x0132f115
0x0132f11d
0x0132f122
0x0132f12b
0x0132f12e
0x0132f134
0x0132f13b
0x0132f141
0x0132f148
0x0132f14f
0x0132f155
0x0132f161
0x0132f169
0x0132f16f
0x0132f172
0x0132f176
0x0132f17a
0x0132f17e
0x0132f183
0x0132f18b
0x0132f18e
0x0132f195
0x0132f19c
0x0132f1a3
0x0132f1ae
0x0132f1b6
0x0132f1b8
0x0132f1ba
0x0132f1bf
0x0132f1c2
0x0132f1c4
0x0132f39e
0x00000000
0x0132f1ca
0x0132f1ca
0x0132f1cd
0x0132f1d3
0x0132f1e3
0x0132f1e9
0x0132f1f9
0x0132f1ff
0x0132f209
0x0132f20c
0x0132f210
0x0132f21e
0x0132f231
0x0132f23d
0x0132f241
0x0132f247
0x0132f24b
0x0132f259
0x0132f26c
0x0132f275
0x0132f278
0x0132f27c
0x0132f284
0x0132f284
0x0132f291
0x0132f293
0x0132f29a
0x0132f29d
0x0132f29f
0x0132f2a8
0x0132f2ab
0x0132f2b9
0x0132f2be
0x0132f2c1
0x0132f2c5
0x0132f2c8
0x0132f2ca
0x0132f2cd
0x0132f2d2
0x0132f2d2
0x0132f2d5
0x0132f2dc
0x0132f2e0
0x0132f2e3
0x0132f2e5
0x0132f2e8
0x0132f2ed
0x0132f2ed
0x0132f2f0
0x0132f2f7
0x0132f2fb
0x0132f2fe
0x0132f300
0x0132f303
0x0132f308
0x0132f308
0x0132f30b
0x0132f312
0x0132f316
0x0132f319
0x0132f31b
0x0132f31e
0x0132f323
0x0132f323
0x0132f326
0x0132f32d
0x0132f331
0x0132f334
0x0132f336
0x0132f339
0x0132f33e
0x0132f33e
0x0132f341
0x0132f348
0x0132f34c
0x0132f352
0x0132f354
0x0132f357
0x0132f35c
0x0132f35f
0x0132f369
0x0132f376
0x0132f376
0x00000000
0x0132f29f
0x0132f1c4
0x0132f10f
0x0132f08d
0x0132f06c
0x0132ef01
0x0132ef01
0x0132ef04
0x0132ef07
0x0132ef4f
0x0132ef53
0x0132ef63
0x0132ef66
0x0132ef6b
0x0132ef70
0x0132ef74
0x0132ef75
0x0132efcd
0x0132efce
0x0132efcf
0x0132efdd
0x0132efe9
0x00000000
0x0132ef77
0x0132ef77
0x0132ef79
0x0132ef7a
0x0132ef7b
0x0132ef8c
0x0132ef95
0x0132ef98
0x0132efa0
0x0132efa5
0x0132efb6
0x0132efb6
0x0132efb8
0x0132efec
0x0132efec
0x0132eff5
0x0132efba
0x0132efbb
0x0132efc1
0x0132efca
0x0132efca
0x0132efa7
0x0132efa7
0x0132efaa
0x0132efac
0x0132efaf
0x0132efb2
0x00000000
0x0132efb4
0x0132efb4
0x00000000
0x0132efb4
0x0132efb2
0x0132efa5
0x0132ef75
0x0132eefb
0x0132eee4
0x0132ee52
0x0132ee52
0x0132ee55
0x0132ee58
0x0132ee5d
0x0132ee69
0x0132ee6c
0x0132ee72
0x0132ee79
0x00000000
0x0132ee79
0x0132ee3a
0x0132ee3a
0x00000000
0x0132ee3a
0x0132ee29
0x0132ee2f
0x00000000
0x0132ee2f
0x0132ee27
0x0132ee1d
0x0132ee10

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0132ED9D
std::_Lockit::_Lockit.LIBCPMT ref: 0132EDC0
std::_Lockit::~_Lockit.LIBCPMT ref: 0132EDE8
std::_Facet_Register.LIBCPMT ref: 0132EE5D
std::_Lockit::~_Lockit.LIBCPMT ref: 0132EE87

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: da6f542cdf5ab06557ad0abc335ff0e9792ff587160eb7853bceec780627c46e
Instruction ID: 8e3ca4e63797889b1714ecf2dd7a4463047f262627df2dc93ce2b80da9589d50
Opcode Fuzzy Hash: da6f542cdf5ab06557ad0abc335ff0e9792ff587160eb7853bceec780627c46e
Instruction Fuzzy Hash: 9341E67180026ADFDB21EF5CC4417AEBBB8FB44728F148669D81567381D734AE44CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0132EC30 Relevance: 7.6, APIs: 5, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0132EC30(void* __ebx, void* _a4) {
				void* _v0;
				void* _v8;
				char _v12;
				void** _v16;
				void** _v20;
				long _v24;
				void* _v28;
				void* _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				void* _v48;
				void* _v52;
				char _v56;
				signed int _v60;
				char _v64;
				signed int _v68;
				short _v72;
				signed int _v76;
				short _v80;
				void* _v84;
				signed int _v88;
				void* _v92;
				signed int _v96;
				signed short _v100;
				signed short _v104;
				char _v108;
				void* _v112;
				char _v116;
				void* _v120;
				void* _v124;
				void* _v128;
				short _v132;
				void* _v136;
				char _v140;
				void* _v144;
				char _v148;
				void* _v152;
				char _v156;
				void* _v160;
				void** _v164;
				void* _v168;
				char _v176;
				char _v184;
				intOrPtr _v192;
				char _v236;
				void* _v260;
				char _v284;
				void* _v392;
				char _v412;
				void* _v416;
				void* _v488;
				char _v508;
				intOrPtr _v512;
				intOrPtr _v600;
				void* _v608;
				char _v616;
				signed int _v624;
				intOrPtr _v628;
				intOrPtr _v680;
				void* _v692;
				char _v740;
				void* _v760;
				char _v768;
				signed int _v772;
				char _v776;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t399;
				long* _t405;
				signed int _t408;
				void** _t414;
				signed int _t422;
				signed int _t423;
				signed int _t430;
				void* _t434;
				void* _t435;
				void* _t436;
				void* _t437;
				void* _t438;
				void* _t439;
				void* _t447;
				signed int _t452;
				void* _t455;
				void* _t461;
				void* _t462;
				void* _t463;
				void* _t464;
				void* _t465;
				void* _t466;
				void* _t474;
				signed int _t479;
				void* _t482;
				void* _t488;
				void* _t489;
				void* _t490;
				void* _t491;
				void* _t492;
				void* _t493;
				void* _t502;
				signed int _t507;
				signed int _t508;
				void* _t512;
				void* _t516;
				void* _t517;
				signed int _t521;
				void* _t528;
				void* _t530;
				signed int _t538;
				void* _t565;
				void* _t569;
				signed int _t587;
				unsigned int _t589;
				void* _t590;
				long _t609;
				void* _t610;
				void* _t615;
				void* _t620;
				void* _t621;
				void* _t625;
				void* _t630;
				signed int _t631;
				long _t633;
				void* _t635;
				void** _t637;
				void* _t638;
				signed int _t640;
				signed int _t643;
				void* _t646;
				void** _t648;
				signed int _t653;
				signed int _t658;
				void* _t676;
				void* _t677;
				void* _t678;
				intOrPtr _t681;
				intOrPtr _t695;
				intOrPtr _t697;
				signed int _t698;
				void* _t699;
				signed int _t701;
				signed int _t703;
				intOrPtr _t705;
				void* _t706;
				void* _t707;
				void* _t709;
				void* _t711;
				intOrPtr _t712;
				void* _t713;
				void* _t714;
				intOrPtr* _t715;
				void* _t717;
				long _t722;
				void* _t724;
				void* _t726;
				void* _t727;
				void* _t729;
				void* _t731;
				void* _t732;
				char _t733;
				void* _t735;
				void* _t736;
				signed int _t738;
				void* _t741;
				signed int _t746;
				signed int _t748;
				void* _t750;
				signed int _t752;
				signed int _t754;
				signed int _t756;
				signed int _t759;
				signed int _t765;
				void* _t766;
				signed int _t768;
				void* _t769;
				void* _t771;
				signed int _t774;
				signed int _t775;
				void* _t778;
				signed int _t780;
				void* _t782;
				void* _t784;
				void* _t786;
				signed int _t790;
				void* _t793;
				signed int _t794;
				void* _t795;
				void* _t804;

				_t746 = _t765;
				_push(0xffffffff);
				_push(0x136ac0d);
				_push( *[fs:0x0]);
				_t766 = _t765 - 0xc;
				_push(__ebx);
				_t399 =  *0x1383020; // 0xc9209188
				_push(_t399 ^ _t746);
				 *[fs:0x0] =  &_v16;
				E01335EA5( &_v28, 0);
				_v8 = 0;
				_t701 =  *0x13867c0;
				_t633 =  *0x1385754; // 0x0
				_v24 = _t633;
				if(_t701 == 0) {
					E01335EA5( &_v20, _t701);
					_v8 = 1;
					if( *0x13867c0 == _t701) {
						_t630 =  *0x138488c; // 0x0
						_t631 = _t630 + 1;
						 *0x138488c = _t631;
						 *0x13867c0 = _t631;
					}
					_v8 = 0;
					E01335EFD( &_v20);
					_t701 =  *0x13867c0;
				}
				_t653 = _t701 * 4;
				_v20 = _t653;
				_t695 =  *((intOrPtr*)(_a4 + 4));
				if(_t701 >=  *((intOrPtr*)(_t695 + 0xc))) {
					_t722 = 0;
					__eflags = 0;
					_v20 = _t653;
					goto L8;
				} else {
					_t722 =  *(_t653 +  *((intOrPtr*)(_t695 + 8)));
					if(_t722 != 0) {
						L16:
						_v8 = 0xffffffff;
						E01335EFD( &_v28);
						 *[fs:0x0] = _v16;
						return _t722;
					} else {
						L8:
						if( *((char*)(_t695 + 0x14)) == 0) {
							L11:
							if(_t722 != 0) {
								goto L16;
							} else {
								goto L12;
							}
						} else {
							_t625 = E01335C60();
							if(_t701 >=  *((intOrPtr*)(_t625 + 0xc))) {
								L12:
								if(_t633 == 0) {
									_push(_a4);
									_t405 =  &_v24;
									_push(_t405);
									L89();
									_t768 = _t766 + 8;
									__eflags = _t405 - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t746);
										_t748 = _t768;
										_push(0xffffffff);
										_push(0x136a7fd);
										_push( *[fs:0x0]);
										_t769 = _t768 - 0x10;
										_push(_t633);
										_push(_t722);
										_push(_t701);
										_t408 =  *0x1383020; // 0xc9209188
										_push(_t408 ^ _t748);
										 *[fs:0x0] =  &_v60;
										E01335EA5( &_v72, 0);
										_v52 = 0;
										_t703 =  *0x13867c8;
										_t635 =  *0x1385750; // 0x0
										_v68 = _t635;
										__eflags = _t703;
										if(_t703 == 0) {
											E01335EA5( &_v24, _t703);
											_v12 = 1;
											__eflags =  *0x13867c8 - _t703;
											if( *0x13867c8 == _t703) {
												_t620 =  *0x138488c; // 0x0
												_t621 = _t620 + 1;
												__eflags = _t621;
												 *0x138488c = _t621;
												 *0x13867c8 = _t621;
											}
											_v12 = 0;
											E01335EFD( &_v24);
											_t703 =  *0x13867c8;
										}
										_t658 = _t703 * 4;
										_v24 = _t658;
										_t697 =  *((intOrPtr*)(_v0 + 4));
										__eflags = _t703 -  *((intOrPtr*)(_t697 + 0xc));
										if(_t703 >=  *((intOrPtr*)(_t697 + 0xc))) {
											_t724 = 0;
											__eflags = 0;
											_v24 = _t658;
											goto L26;
										} else {
											_t724 =  *(_t658 +  *((intOrPtr*)(_t697 + 8)));
											__eflags = _t724;
											if(_t724 != 0) {
												L34:
												_v12 = 0xffffffff;
												E01335EFD( &_v32);
												 *[fs:0x0] = _v20;
												return _t724;
											} else {
												L26:
												__eflags =  *((char*)(_t697 + 0x14));
												if( *((char*)(_t697 + 0x14)) == 0) {
													L29:
													__eflags = _t724;
													if(_t724 != 0) {
														goto L34;
													} else {
														goto L30;
													}
												} else {
													_t615 = E01335C60();
													__eflags = _t703 -  *((intOrPtr*)(_t615 + 0xc));
													if(_t703 >=  *((intOrPtr*)(_t615 + 0xc))) {
														L30:
														__eflags = _t635;
														if(_t635 == 0) {
															_push(_v0);
															_t414 =  &_v28;
															_push(_t414);
															L61();
															_t771 = _t769 + 8;
															__eflags = _t414 - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																asm("int3");
																_push(_t658);
																_t698 = _v88;
																_push(_t635);
																_t637 = _t658;
																_t662 = 0x7fffffff;
																_push(_t748);
																_t750 = _t637[4];
																__eflags = 0x7fffffff - _t750 - _t698;
																if(0x7fffffff - _t750 < _t698) {
																	E01323680(_t637, 0x7fffffff, _t698, _t703, _t750);
																	goto L59;
																} else {
																	_push(_t724);
																	_t587 = _t698 + _t750;
																	_v96 = _t587;
																	_t738 = _t587 | 0x0000000f;
																	_push(_t703);
																	_t703 = _t637[5];
																	_v88 = _t703;
																	__eflags = _t738 - 0x7fffffff;
																	if(_t738 <= 0x7fffffff) {
																		_t589 = _t703 >> 1;
																		_t662 = 0x7fffffff - _t589;
																		__eflags = _t703 - 0x7fffffff;
																		if(_t703 <= 0x7fffffff) {
																			_t590 = _t589 + _t703;
																			__eflags = _t738 - _t590;
																			_t724 =  <  ? _t590 : _t738;
																			_t73 = _t724 + 1; // 0x80000000
																			_t662 = _t73;
																			__eflags = _t662 - 0x1000;
																			if(_t662 < 0x1000) {
																				__eflags = _t662;
																				if(_t662 == 0) {
																					_t703 = 0;
																					__eflags = 0;
																				} else {
																					_t703 = LocalAlloc(0x40, _t662);
																				}
																				goto L50;
																			} else {
																				_t74 = _t662 + 0x23; // 0x80000023
																				_t609 = _t74;
																				__eflags = _t609 - _t662;
																				if(__eflags <= 0) {
																					L59:
																					E01323AF0(__eflags);
																					goto L60;
																				} else {
																					goto L40;
																				}
																			}
																		} else {
																			_t724 = 0x7fffffff;
																			goto L39;
																		}
																	} else {
																		_t724 = 0x7fffffff;
																		L39:
																		_t609 = 0xffffffff80000023;
																		__eflags = 0x80000000;
																		L40:
																		_t610 = LocalAlloc(0x40, _t609);
																		__eflags = _t610;
																		if(_t610 == 0) {
																			L60:
																			E0134C5C2(_t637, _t662, _t698, _t703);
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			asm("int3");
																			_push(_t637);
																			_t638 = _t771;
																			_t774 = (_t771 - 0x00000008 & 0xfffffff8) + 4;
																			_push(_t750);
																			_v112 =  *((intOrPtr*)(_t638 + 4));
																			_t752 = _t774;
																			_push(0xffffffff);
																			_push(0x136b100);
																			_push( *[fs:0x0]);
																			_push(_t638);
																			_t775 = _t774 - 0xf8;
																			_t422 =  *0x1383020; // 0xc9209188
																			_t423 = _t422 ^ _t752;
																			_v136 = _t423;
																			_push(_t724);
																			_push(_t703);
																			_push(_t423);
																			 *[fs:0x0] =  &_v128;
																			_t663 =  *(_t638 + 8);
																			_t705 =  *((intOrPtr*)(_t638 + 0xc));
																			_v260 = _t663;
																			_v192 = 0;
																			__eflags = _t663;
																			if(_t663 == 0) {
																				L86:
																				 *[fs:0x0] = _v32;
																				_pop(_t706);
																				_pop(_t726);
																				__eflags = _v40 ^ _t752;
																				return E01347708(4, _t638, _v40 ^ _t752, _t698, _t706, _t726);
																			} else {
																				__eflags =  *_t663;
																				if( *_t663 != 0) {
																					goto L86;
																				} else {
																					_t727 = LocalAlloc(0x40, 0x18);
																					_v168 = _t727;
																					_v24 = 0;
																					__eflags = _t727;
																					if(_t727 == 0) {
																						_t727 = 0;
																						__eflags = 0;
																						goto L72;
																					} else {
																						_t447 =  *(_t705 + 4);
																						__eflags = _t447;
																						if(_t447 == 0) {
																							_t707 = 0x137b6c9;
																						} else {
																							_t707 =  *(_t447 + 0x18);
																							__eflags = _t707;
																							if(_t707 == 0) {
																								_t707 = _t447 + 0x1c;
																							}
																						}
																						_t663 =  &_v156;
																						E01335EA5( &_v156, 0);
																						_v24 = 1;
																						_v152 = 0;
																						_v148 = 0;
																						_v24 = 2;
																						_v144 = 0;
																						_v140 = 0;
																						_v24 = 3;
																						_v136 = 0;
																						_v132 = 0;
																						_v24 = 4;
																						_v128 = 0;
																						_v124 = 0;
																						_v24 = 5;
																						_v120 = 0;
																						_v116 = 0;
																						_v24 = 6;
																						_v112 = 0;
																						_v108 = 0;
																						_v24 = 7;
																						__eflags = _t707;
																						if(_t707 == 0) {
																							L88:
																							E013320D0("bad locale name");
																							asm("int3");
																							asm("int3");
																							asm("int3");
																							_push(_t752);
																							_t754 = _t775;
																							_push(0xffffffff);
																							_push(0x136b1dd);
																							_push( *[fs:0x0]);
																							_t780 = _t775 - 0x3c;
																							_push(_t638);
																							_push(_t727);
																							_push(_t707);
																							_t452 =  *0x1383020; // 0xc9209188
																							_push(_t452 ^ _t754);
																							 *[fs:0x0] =  &_v412;
																							_t455 = _v392;
																							_t640 = 0;
																							_v416 = 0;
																							__eflags = _t455;
																							if(_t455 == 0) {
																								L113:
																								 *[fs:0x0] = _v36;
																								return 4;
																							} else {
																								__eflags =  *_t455;
																								if( *_t455 != 0) {
																									goto L113;
																								} else {
																									_t729 = LocalAlloc(0x40, 8);
																									_v44 = _t729;
																									_v28 = 0;
																									__eflags = _t729;
																									if(_t729 == 0) {
																										_t729 = 0;
																										__eflags = 0;
																										goto L99;
																									} else {
																										_t474 =  *(_v12 + 4);
																										__eflags = _t474;
																										if(_t474 == 0) {
																											_t709 = 0x137b6c9;
																										} else {
																											_t709 =  *(_t474 + 0x18);
																											__eflags = _t709;
																											if(_t709 == 0) {
																												_t709 = _t474 + 0x1c;
																											}
																										}
																										_t663 =  &_v96;
																										E01335EA5( &_v96, 0);
																										_v28 = 1;
																										_v92 = 0;
																										_v88 = 0;
																										_v28 = 2;
																										_v84 = 0;
																										_v80 = 0;
																										_v28 = 3;
																										_v76 = 0;
																										_v72 = 0;
																										_v28 = 4;
																										_v68 = 0;
																										_v64 = 0;
																										_v28 = 5;
																										_v60 = 0;
																										_v56 = 0;
																										_v28 = 6;
																										_v52 = 0;
																										_v48 = 0;
																										_v28 = 7;
																										__eflags = _t709;
																										if(_t709 == 0) {
																											E013320D0("bad locale name");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											asm("int3");
																											_push(_t754);
																											_t756 = _t780;
																											_push(0xffffffff);
																											_push(0x136b2d1);
																											_push( *[fs:0x0]);
																											_t784 = _t780 - 0x40;
																											_push(_t640);
																											_push(_t729);
																											_push(_t709);
																											_t479 =  *0x1383020; // 0xc9209188
																											_push(_t479 ^ _t756);
																											 *[fs:0x0] =  &_v508;
																											_t482 = _v488;
																											_t643 = 0;
																											_v512 = 0;
																											__eflags = _t482;
																											if(_t482 == 0) {
																												L141:
																												 *[fs:0x0] = _v40;
																												return 5;
																											} else {
																												__eflags =  *_t482;
																												if( *_t482 != 0) {
																													goto L141;
																												} else {
																													_t711 = LocalAlloc(0x40, 0xc);
																													_v52 = _t711;
																													_v32 = 0;
																													__eflags = _t711;
																													if(_t711 == 0) {
																														_t711 = 0;
																														__eflags = 0;
																														goto L127;
																													} else {
																														_t502 = _v16[1];
																														__eflags = _t502;
																														if(_t502 == 0) {
																															_t731 = 0x137b6c9;
																														} else {
																															_t731 =  *(_t502 + 0x18);
																															__eflags = _t731;
																															if(_t731 == 0) {
																																_t731 = _t502 + 0x1c;
																															}
																														}
																														_t663 =  &_v104;
																														E01335EA5(_t663, 0);
																														_v32 = 1;
																														_v100 = 0;
																														_v96 = 0;
																														_v32 = 2;
																														_v92 = 0;
																														_v88 = 0;
																														_v32 = 3;
																														_v84 = 0;
																														_v80 = 0;
																														_v32 = 4;
																														_v76 = 0;
																														_v72 = 0;
																														_v32 = 5;
																														_v68 = 0;
																														_v64 = 0;
																														_v32 = 6;
																														_v60 = 0;
																														_v56 = 0;
																														_v32 = 7;
																														__eflags = _t731;
																														if(__eflags == 0) {
																															E013320D0("bad locale name");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															asm("int3");
																															_push(_t643);
																															_t646 = _t784;
																															_t790 = (_t784 - 0x00000008 & 0xfffffff8) + 4;
																															_push(_t756);
																															_v600 =  *((intOrPtr*)(_t646 + 4));
																															_t759 = _t790;
																															_push(0xffffffff);
																															_push(0x136b2fd);
																															_push( *[fs:0x0]);
																															_push(_t646);
																															_t507 =  *0x1383020; // 0xc9209188
																															_t508 = _t507 ^ _t759;
																															_v624 = _t508;
																															_push(_t731);
																															_push(_t711);
																															_push(_t508);
																															 *[fs:0x0] =  &_v616;
																															_t732 = _t663;
																															_t712 = E01356A36(_t698, _t732);
																															_v680 = _t712;
																															_t512 = E01336203(__eflags,  &_v740);
																															_v692 = _t732;
																															asm("movups xmm0, [eax]");
																															asm("movups [ebp-0x40], xmm0");
																															asm("movups xmm0, [eax+0x10]");
																															asm("movups [ebp-0x30], xmm0");
																															asm("movq xmm0, [eax+0x20]");
																															asm("movq [ebp-0x20], xmm0");
																															_v628 =  *((intOrPtr*)(_t512 + 0x28));
																															 *(_t732 + 8) = 0;
																															 *(_t732 + 0x10) = 0;
																															 *(_t732 + 0x14) = 0;
																															_v608 = 0;
																															E01336203(__eflags,  &_v740);
																															_t793 = _t790 - 0x78 + 8;
																															__eflags =  *((char*)(_t646 + 0xc));
																															if( *((char*)(_t646 + 0xc)) == 0) {
																																_t713 =  *(_t712 + 8);
																															} else {
																																_t713 = 0x137b6c9;
																															}
																															_t676 = _t713;
																															_t351 = _t676 + 1; // 0x137b6ca
																															_t699 = _t351;
																															do {
																																_t516 =  *_t676;
																																_t676 = _t676 + 1;
																																__eflags = _t516;
																															} while (_t516 != 0);
																															_t677 = _t676 - _t699;
																															_push(1);
																															_t352 = _t677 + 1; // 0x137b6cb
																															_t517 = _t352;
																															_push(_t517);
																															_v112 = _t517;
																															_t678 = E01356A5E();
																															_t794 = _t793 + 8;
																															_v124 = _t678;
																															__eflags = _t678;
																															if(__eflags == 0) {
																																E01332056(__eflags);
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																asm("int3");
																																_push(_t759);
																																_push(0xffffffff);
																																_push(0x136b34e);
																																_push( *[fs:0x0]);
																																_t795 = _t794 - 8;
																																_push(_t732);
																																_push(_t713);
																																_t521 =  *0x1383020; // 0xc9209188
																																_push(_t521 ^ _t794);
																																 *[fs:0x0] =  &_v768;
																																_t714 = _t678;
																																_v772 = 0;
																																_v760 = 0;
																																_t733 = E01356078(_t646, _t714, _t732);
																																_t715 = _t714 + 8;
																																_v776 = _t733;
																																_v772 = 1;
																																__eflags = _t715 -  &_v776;
																																if(_t715 !=  &_v776) {
																																	E0134C213( *_t715);
																																	_t795 = _t795 + 4;
																																	 *_t715 = _t733;
																																	_t733 = 0;
																																	__eflags = 0;
																																	_v64 = 0;
																																}
																																_v60 = 1;
																																__eflags = 1;
																																_v60 = 0;
																																_v48 = 0xffffffff;
																																_t528 = E0134C213(_t733);
																																 *[fs:0x0] = _v56;
																																return _t528;
																															} else {
																																_t530 = _v112;
																																__eflags = _t530;
																																if(_t530 != 0) {
																																	E01348FF0(_t678, _t713, _t530);
																																	_t678 = _v124;
																																	_t794 = _t794 + 0xc;
																																}
																																 *(_t732 + 8) = _t678;
																																_push( &_v104);
																																 *(_t732 + 0x10) = E0132FBD0("false", 0);
																																_push( &_v104);
																																 *(_t732 + 0x14) = E0132FBD0("true", 0);
																																__eflags =  *((char*)(_t646 + 0xc));
																																_v128 = 0;
																																if( *((char*)(_t646 + 0xc)) == 0) {
																																	_t681 = _v116;
																																	 *((short*)(_t732 + 0xc)) =  *( *(_t681 + 0x30)) & 0x0000ffff;
																																	_t538 =  *( *(_t681 + 0x34)) & 0x0000ffff;
																																} else {
																																	_v108 = 0x2e;
																																	_v112 = 0;
																																	asm("xorps xmm0, xmm0");
																																	asm("movlpd [ebp-0x50], xmm0");
																																	E013362D2(_t678,  &_v112,  &_v108, 1,  &_v120,  &_v104);
																																	 *((short*)(_t732 + 0xc)) = _v112 & 0x0000ffff;
																																	asm("xorps xmm0, xmm0");
																																	_v108 = 0x2c;
																																	_v112 = 0;
																																	asm("movlpd [ebp-0x50], xmm0");
																																	E013362D2(_t678,  &_v112,  &_v108, 1,  &_v120,  &_v104);
																																	_t538 = _v112 & 0x0000ffff;
																																}
																																 *(_t732 + 0xe) = _t538;
																																_v44 = 0xffffffff;
																																 *[fs:0x0] = _v52;
																																_pop(_t717);
																																_pop(_t735);
																																__eflags = _v60 ^ _t759;
																																return E01347708(_t538, _t646, _v60 ^ _t759, _t699, _t717, _t735);
																															}
																														} else {
																															E01335D63(_t663,  &_v104, _t731);
																															_t804 = _t784 + 8;
																															_v32 = 8;
																															_v44 = 1;
																															 *_t711 = 0x136e0d8;
																															_v32 = 9;
																															 *_t711 = 0x136e0e8;
																															 *(_t711 + 4) = 0;
																															_v32 = 0xa;
																															_t296 = _t711 + 8; // 0x8
																															_t648 = _t296;
																															 *_t711 = 0x136e620;
																															 *_t648 = 0;
																															_v32 = 0xc;
																															_t736 = E01356078(_t648, _t711, _t731);
																															_v48 = _t736;
																															_v44 = 3;
																															__eflags = _t648 -  &_v48;
																															if(_t648 !=  &_v48) {
																																E0134C213( *_t648);
																																_t804 = _t804 + 4;
																																 *_t648 = _t736;
																																_t736 = 0;
																																__eflags = 0;
																																_v48 = 0;
																															}
																															_v44 = 3;
																															_t643 = 1;
																															_v44 = 3;
																															_v32 = 0xb;
																															E0134C213(_t736);
																															_t784 = _t804 + 4;
																															_v32 = 8;
																															L127:
																															_v32 = 0xd;
																															 *_v20 = _t711;
																															_v32 = 0xffffffff;
																															__eflags = _t643 & 0x00000001;
																															if((_t643 & 0x00000001) != 0) {
																																_v44 = _t643 & 0xfffffffe;
																																_v32 = 0x14;
																																E01335DAE(_t663,  &_v104);
																																_t786 = _t784 + 4;
																																_v32 = 0x13;
																																_t488 = _v60;
																																__eflags = _t488;
																																if(_t488 != 0) {
																																	E0134C213(_t488);
																																	_t786 = _t786 + 4;
																																}
																																_v60 = 0;
																																_v32 = 0x12;
																																_t489 = _v68;
																																__eflags = _t489;
																																if(_t489 != 0) {
																																	E0134C213(_t489);
																																	_t786 = _t786 + 4;
																																}
																																_v68 = 0;
																																_v32 = 0x11;
																																_t490 = _v76;
																																__eflags = _t490;
																																if(_t490 != 0) {
																																	E0134C213(_t490);
																																	_t786 = _t786 + 4;
																																}
																																_v76 = 0;
																																_v32 = 0x10;
																																_t491 = _v84;
																																__eflags = _t491;
																																if(_t491 != 0) {
																																	E0134C213(_t491);
																																	_t786 = _t786 + 4;
																																}
																																_v84 = 0;
																																_v32 = 0xf;
																																_t492 = _v92;
																																__eflags = _t492;
																																if(_t492 != 0) {
																																	E0134C213(_t492);
																																	_t786 = _t786 + 4;
																																}
																																_v92 = 0;
																																_v32 = 0xe;
																																_t493 = _v100;
																																__eflags = _t493;
																																if(_t493 != 0) {
																																	E0134C213(_t493);
																																}
																																_v100 = 0;
																																_v32 = 0xffffffff;
																																E01335EFD( &_v104);
																															}
																															goto L141;
																														}
																													}
																												}
																											}
																										} else {
																											E01335D63( &_v96,  &_v96, _t709);
																											_t780 = _t780 + 8;
																											_v28 = 8;
																											_t640 = 1;
																											_v40 = 1;
																											 *_t729 = 0x136e0d8;
																											_v28 = 9;
																											 *_t729 = 0x136e0e8;
																											 *(_t729 + 4) = 0;
																											_v28 = 0xa;
																											 *_t729 = 0x136e670;
																											_v28 = 8;
																											L99:
																											_v28 = 0xb;
																											 *_v16 = _t729;
																											_v28 = 0xffffffff;
																											__eflags = _t640 & 0x00000001;
																											if((_t640 & 0x00000001) != 0) {
																												_v40 = _t640 & 0xfffffffe;
																												_v28 = 0x12;
																												E01335DAE(_t663,  &_v96);
																												_t782 = _t780 + 4;
																												_v28 = 0x11;
																												_t461 = _v52;
																												__eflags = _t461;
																												if(_t461 != 0) {
																													E0134C213(_t461);
																													_t782 = _t782 + 4;
																												}
																												_v52 = 0;
																												_v28 = 0x10;
																												_t462 = _v60;
																												__eflags = _t462;
																												if(_t462 != 0) {
																													E0134C213(_t462);
																													_t782 = _t782 + 4;
																												}
																												_v60 = 0;
																												_v28 = 0xf;
																												_t463 = _v68;
																												__eflags = _t463;
																												if(_t463 != 0) {
																													E0134C213(_t463);
																													_t782 = _t782 + 4;
																												}
																												_v68 = 0;
																												_v28 = 0xe;
																												_t464 = _v76;
																												__eflags = _t464;
																												if(_t464 != 0) {
																													E0134C213(_t464);
																													_t782 = _t782 + 4;
																												}
																												_v76 = 0;
																												_v28 = 0xd;
																												_t465 = _v84;
																												__eflags = _t465;
																												if(_t465 != 0) {
																													E0134C213(_t465);
																													_t782 = _t782 + 4;
																												}
																												_v84 = 0;
																												_v28 = 0xc;
																												_t466 = _v92;
																												__eflags = _t466;
																												if(_t466 != 0) {
																													E0134C213(_t466);
																												}
																												_v92 = 0;
																												_v28 = 0xffffffff;
																												E01335EFD( &_v96);
																											}
																											goto L113;
																										}
																									}
																								}
																							}
																						} else {
																							E01335D63( &_v156,  &_v156, _t707);
																							_v24 = 8;
																							_v96 = 1;
																							 *_t727 = 0x136e0d8;
																							_v24 = 9;
																							 *_t727 = 0x136e0e8;
																							 *(_t727 + 4) = 0;
																							_v24 = 0xa;
																							 *_t727 = 0x136e6a0;
																							E01356A36(_t698, _t727);
																							_t565 = E01336203(__eflags,  &_v236);
																							_v160 = _t727;
																							asm("movups xmm0, [eax]");
																							asm("movups [ebp-0x40], xmm0");
																							asm("movups xmm0, [eax+0x10]");
																							asm("movups [ebp-0x30], xmm0");
																							asm("movq xmm0, [eax+0x20]");
																							asm("movq [ebp-0x20], xmm0");
																							_v44 =  *(_t565 + 0x28);
																							 *(_t727 + 8) = 0;
																							 *(_t727 + 0x10) = 0;
																							 *(_t727 + 0x14) = 0;
																							_v24 = 0xb;
																							E01336203(__eflags,  &_v284);
																							_push(1);
																							_push(1);
																							_t569 = E01356A5E();
																							_t775 = _t775 + 0x18;
																							__eflags = _t569;
																							if(__eflags == 0) {
																								E01332056(__eflags);
																								goto L88;
																							} else {
																								 *_t569 = 0;
																								 *(_t727 + 8) = _t569;
																								_push( &_v84);
																								 *(_t727 + 0x10) = E0132FBD0("false", 0);
																								_push( &_v84);
																								 *(_t727 + 0x14) = E0132FBD0("true", 0);
																								_v160 = 0;
																								asm("xorps xmm0, xmm0");
																								_v88 = 0x2e;
																								_v100 = 0;
																								asm("movlpd [ebp-0x9c], xmm0");
																								E013362D2( &_v156,  &_v100,  &_v88, 1,  &_v176,  &_v84);
																								 *((short*)(_t727 + 0xc)) = _v100 & 0x0000ffff;
																								asm("xorps xmm0, xmm0");
																								_v92 = 0x2c;
																								_v104 = 0;
																								asm("movlpd [ebp-0xa4], xmm0");
																								E013362D2(_t663,  &_v104,  &_v92, 1,  &_v184,  &_v84);
																								_t775 = _t775 + 0x40;
																								 *((short*)(_t727 + 0xe)) = _v104 & 0x0000ffff;
																								_v24 = 8;
																								L72:
																								_v24 = 0xc;
																								 *_v164 = _t727;
																								_v24 = 0xffffffff;
																								_t430 = _v96;
																								__eflags = _t430 & 0x00000001;
																								if((_t430 & 0x00000001) != 0) {
																									_v96 = _t430 & 0xfffffffe;
																									_v24 = 0x13;
																									E01335DAE(_t663,  &_v156);
																									_t778 = _t775 + 4;
																									_v24 = 0x12;
																									_t434 = _v112;
																									__eflags = _t434;
																									if(_t434 != 0) {
																										E0134C213(_t434);
																										_t778 = _t778 + 4;
																									}
																									_v112 = 0;
																									_v24 = 0x11;
																									_t435 = _v120;
																									__eflags = _t435;
																									if(_t435 != 0) {
																										E0134C213(_t435);
																										_t778 = _t778 + 4;
																									}
																									_v120 = 0;
																									_v24 = 0x10;
																									_t436 = _v128;
																									__eflags = _t436;
																									if(_t436 != 0) {
																										E0134C213(_t436);
																										_t778 = _t778 + 4;
																									}
																									_v128 = 0;
																									_v24 = 0xf;
																									_t437 = _v136;
																									__eflags = _t437;
																									if(_t437 != 0) {
																										E0134C213(_t437);
																										_t778 = _t778 + 4;
																									}
																									_v136 = 0;
																									_v24 = 0xe;
																									_t438 = _v144;
																									__eflags = _t438;
																									if(_t438 != 0) {
																										E0134C213(_t438);
																										_t778 = _t778 + 4;
																									}
																									_v144 = 0;
																									_v24 = 0xd;
																									_t439 = _v152;
																									__eflags = _t439;
																									if(_t439 != 0) {
																										E0134C213(_t439);
																									}
																									_v152 = 0;
																									_v24 = 0xffffffff;
																									E01335EFD( &_v156);
																								}
																								goto L86;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t71 = _t610 + 0x23; // 0x23
																			_t703 = _t71 & 0xffffffe0;
																			 *(_t703 - 4) = _t610;
																			L50:
																			_t637[4] = _v96;
																			_t637[5] = _t724;
																			_t739 = _t750 + _t703;
																			__eflags = _v88 - 0x10;
																			_v96 = _v80 + _t750 + _t703;
																			_push(_t750);
																			if(_v88 < 0x10) {
																				_push(_t637);
																				_push(_t703);
																				E01348FF0();
																				E01348E90(_t703, _t739, _v76, _v80);
																				 *_v96 = 0;
																				goto L57;
																			} else {
																				_t741 =  *_t637;
																				_push(_t741);
																				_push(_t703);
																				E01348FF0();
																				E01348E90(_t703, _t750 + _t703, _v76, _v80);
																				_t771 = _t771 + 0x18;
																				 *_v96 = 0;
																				__eflags = _v88 + 1 - 0x1000;
																				if(_v88 + 1 < 0x1000) {
																					L54:
																					__eflags = _t741;
																					if(_t741 == 0) {
																						L57:
																						 *_t637 = _t703;
																						return _t637;
																					} else {
																						LocalFree(_t741);
																						 *_t637 = _t703;
																						return _t637;
																					}
																				} else {
																					_t662 =  *(_t741 - 4);
																					_t724 = _t741 - _t662;
																					_t90 = _t724 - 4; // 0x7ffffffb
																					__eflags = _t90 - 0x1f;
																					if(_t90 > 0x1f) {
																						goto L60;
																					} else {
																						_t741 = _t662;
																						goto L54;
																					}
																				}
																			}
																		}
																	}
																}
															} else {
																_t724 = _v28;
																_v0 = _t724;
																_v12 = 2;
																E01335C34(_t724);
																 *((intOrPtr*)( *_t724 + 4))();
																 *0x1385750 = _t724;
																_v0 = 0;
																_v12 = 0;
																goto L34;
															}
														} else {
															_t724 = _t635;
															goto L34;
														}
													} else {
														_t724 =  *(_v24 +  *((intOrPtr*)(_t615 + 8)));
														goto L29;
													}
												}
											}
										}
									} else {
										_t722 = _v24;
										_a4 = _t722;
										_v8 = 2;
										E01335C34(_t722);
										 *((intOrPtr*)( *_t722 + 4))();
										 *0x1385754 = _t722;
										_a4 = 0;
										_v8 = 0;
										goto L16;
									}
								} else {
									_t722 = _t633;
									goto L16;
								}
							} else {
								_t722 =  *(_v20 +  *((intOrPtr*)(_t625 + 8)));
								goto L11;
							}
						}
					}
				}
			}

0x0132ec31
0x0132ec33
0x0132ec35
0x0132ec40
0x0132ec41
0x0132ec44
0x0132ec47
0x0132ec4e
0x0132ec52
0x0132ec5d
0x0132ec62
0x0132ec69
0x0132ec6f
0x0132ec75
0x0132ec7a
0x0132ec80
0x0132ec85
0x0132ec8f
0x0132ec91
0x0132ec96
0x0132ec97
0x0132ec9c
0x0132ec9c
0x0132eca1
0x0132eca8
0x0132ecad
0x0132ecad
0x0132ecb6
0x0132ecbd
0x0132ecc0
0x0132ecc6
0x0132ecd4
0x0132ecd4
0x0132ecd6
0x00000000
0x0132ecc8
0x0132eccb
0x0132ecd0
0x0132ed3d
0x0132ed3d
0x0132ed47
0x0132ed51
0x0132ed5f
0x0132ecd2
0x0132ecd9
0x0132ecdd
0x0132ecf2
0x0132ecf4
0x00000000
0x00000000
0x00000000
0x00000000
0x0132ecdf
0x0132ecdf
0x0132ece7
0x0132ecf6
0x0132ecf8
0x0132ecfe
0x0132ed01
0x0132ed04
0x0132ed05
0x0132ed0a
0x0132ed0d
0x0132ed10
0x0132ed60
0x0132ed65
0x0132ed66
0x0132ed67
0x0132ed68
0x0132ed69
0x0132ed6a
0x0132ed6b
0x0132ed6c
0x0132ed6d
0x0132ed6e
0x0132ed6f
0x0132ed70
0x0132ed71
0x0132ed73
0x0132ed75
0x0132ed80
0x0132ed81
0x0132ed84
0x0132ed85
0x0132ed86
0x0132ed87
0x0132ed8e
0x0132ed92
0x0132ed9d
0x0132eda2
0x0132eda9
0x0132edaf
0x0132edb5
0x0132edb8
0x0132edba
0x0132edc0
0x0132edc5
0x0132edc9
0x0132edcf
0x0132edd1
0x0132edd6
0x0132edd6
0x0132edd7
0x0132eddc
0x0132eddc
0x0132ede1
0x0132ede8
0x0132eded
0x0132eded
0x0132edf6
0x0132edfd
0x0132ee00
0x0132ee03
0x0132ee06
0x0132ee14
0x0132ee14
0x0132ee16
0x00000000
0x0132ee08
0x0132ee0b
0x0132ee0e
0x0132ee10
0x0132ee7d
0x0132ee7d
0x0132ee87
0x0132ee91
0x0132ee9f
0x0132ee12
0x0132ee19
0x0132ee19
0x0132ee1d
0x0132ee32
0x0132ee32
0x0132ee34
0x00000000
0x00000000
0x00000000
0x00000000
0x0132ee1f
0x0132ee1f
0x0132ee24
0x0132ee27
0x0132ee36
0x0132ee36
0x0132ee38
0x0132ee3e
0x0132ee41
0x0132ee44
0x0132ee45
0x0132ee4a
0x0132ee4d
0x0132ee50
0x0132eea0
0x0132eea5
0x0132eea6
0x0132eea7
0x0132eea8
0x0132eea9
0x0132eeaa
0x0132eeab
0x0132eeac
0x0132eead
0x0132eeae
0x0132eeaf
0x0132eeb0
0x0132eeb1
0x0132eeb5
0x0132eeb6
0x0132eeb8
0x0132eebd
0x0132eec0
0x0132eec5
0x0132eec7
0x0132eff8
0x00000000
0x0132eecd
0x0132eecd
0x0132eece
0x0132eed3
0x0132eed7
0x0132eeda
0x0132eedb
0x0132eede
0x0132eee2
0x0132eee4
0x0132ef0e
0x0132ef10
0x0132ef12
0x0132ef14
0x0132ef1d
0x0132ef1f
0x0132ef21
0x0132ef24
0x0132ef24
0x0132ef27
0x0132ef2d
0x0132ef3c
0x0132ef3e
0x0132ef4d
0x0132ef4d
0x0132ef40
0x0132ef49
0x0132ef49
0x00000000
0x0132ef2f
0x0132ef2f
0x0132ef2f
0x0132ef32
0x0132ef34
0x0132effd
0x0132effd
0x00000000
0x0132ef3a
0x00000000
0x0132ef3a
0x0132ef34
0x0132ef16
0x0132ef16
0x00000000
0x0132ef16
0x0132eee6
0x0132eee6
0x0132eee8
0x0132eeed
0x0132eeed
0x0132eef0
0x0132eef3
0x0132eef9
0x0132eefb
0x0132f002
0x0132f002
0x0132f007
0x0132f008
0x0132f009
0x0132f00a
0x0132f00b
0x0132f00c
0x0132f00d
0x0132f00e
0x0132f00f
0x0132f010
0x0132f011
0x0132f019
0x0132f01c
0x0132f020
0x0132f024
0x0132f026
0x0132f028
0x0132f033
0x0132f034
0x0132f035
0x0132f03b
0x0132f040
0x0132f042
0x0132f045
0x0132f046
0x0132f047
0x0132f04b
0x0132f051
0x0132f056
0x0132f059
0x0132f05f
0x0132f062
0x0132f064
0x0132f37b
0x0132f383
0x0132f38b
0x0132f38c
0x0132f390
0x0132f39d
0x0132f06a
0x0132f06a
0x0132f06c
0x00000000
0x0132f072
0x0132f07c
0x0132f07e
0x0132f084
0x0132f08b
0x0132f08d
0x0132f282
0x0132f282
0x00000000
0x0132f093
0x0132f093
0x0132f096
0x0132f098
0x0132f0a6
0x0132f09a
0x0132f09a
0x0132f09d
0x0132f09f
0x0132f0a1
0x0132f0a1
0x0132f09f
0x0132f0ad
0x0132f0b3
0x0132f0b8
0x0132f0bc
0x0132f0c6
0x0132f0ca
0x0132f0ce
0x0132f0d5
0x0132f0d9
0x0132f0df
0x0132f0e6
0x0132f0ea
0x0132f0ee
0x0132f0f1
0x0132f0f5
0x0132f0f9
0x0132f0fc
0x0132f0ff
0x0132f103
0x0132f106
0x0132f109
0x0132f10d
0x0132f10f
0x0132f3a3
0x0132f3a8
0x0132f3ad
0x0132f3ae
0x0132f3af
0x0132f3b0
0x0132f3b1
0x0132f3b3
0x0132f3b5
0x0132f3c0
0x0132f3c1
0x0132f3c4
0x0132f3c5
0x0132f3c6
0x0132f3c7
0x0132f3ce
0x0132f3d2
0x0132f3d8
0x0132f3db
0x0132f3dd
0x0132f3e0
0x0132f3e2
0x0132f5b7
0x0132f5bf
0x0132f5cd
0x0132f3e8
0x0132f3e8
0x0132f3ea
0x00000000
0x0132f3f0
0x0132f3fa
0x0132f3fc
0x0132f3ff
0x0132f402
0x0132f404
0x0132f4cf
0x0132f4cf
0x00000000
0x0132f40a
0x0132f40d
0x0132f410
0x0132f412
0x0132f420
0x0132f414
0x0132f414
0x0132f417
0x0132f419
0x0132f41b
0x0132f41b
0x0132f419
0x0132f427
0x0132f42a
0x0132f42f
0x0132f433
0x0132f43a
0x0132f43e
0x0132f442
0x0132f449
0x0132f44d
0x0132f453
0x0132f45a
0x0132f45e
0x0132f462
0x0132f465
0x0132f469
0x0132f46d
0x0132f470
0x0132f473
0x0132f477
0x0132f47a
0x0132f47d
0x0132f481
0x0132f483
0x0132f5d3
0x0132f5d8
0x0132f5d9
0x0132f5da
0x0132f5db
0x0132f5dc
0x0132f5dd
0x0132f5de
0x0132f5df
0x0132f5e0
0x0132f5e1
0x0132f5e3
0x0132f5e5
0x0132f5f0
0x0132f5f1
0x0132f5f4
0x0132f5f5
0x0132f5f6
0x0132f5f7
0x0132f5fe
0x0132f602
0x0132f608
0x0132f60b
0x0132f60d
0x0132f610
0x0132f612
0x0132f837
0x0132f83f
0x0132f84d
0x0132f618
0x0132f618
0x0132f61a
0x00000000
0x0132f620
0x0132f62a
0x0132f62c
0x0132f62f
0x0132f632
0x0132f634
0x0132f74f
0x0132f74f
0x00000000
0x0132f63a
0x0132f63d
0x0132f640
0x0132f642
0x0132f650
0x0132f644
0x0132f644
0x0132f647
0x0132f649
0x0132f64b
0x0132f64b
0x0132f649
0x0132f657
0x0132f65a
0x0132f65f
0x0132f663
0x0132f66a
0x0132f66e
0x0132f672
0x0132f679
0x0132f67d
0x0132f683
0x0132f68a
0x0132f68e
0x0132f692
0x0132f695
0x0132f699
0x0132f69d
0x0132f6a0
0x0132f6a3
0x0132f6a7
0x0132f6aa
0x0132f6ad
0x0132f6b1
0x0132f6b3
0x0132f853
0x0132f858
0x0132f859
0x0132f85a
0x0132f85b
0x0132f85c
0x0132f85d
0x0132f85e
0x0132f85f
0x0132f860
0x0132f861
0x0132f869
0x0132f86c
0x0132f870
0x0132f874
0x0132f876
0x0132f878
0x0132f883
0x0132f884
0x0132f888
0x0132f88d
0x0132f88f
0x0132f892
0x0132f893
0x0132f894
0x0132f898
0x0132f89e
0x0132f8a5
0x0132f8ae
0x0132f8b1
0x0132f8b9
0x0132f8bc
0x0132f8bf
0x0132f8c3
0x0132f8c7
0x0132f8cb
0x0132f8d0
0x0132f8d8
0x0132f8db
0x0132f8e2
0x0132f8e9
0x0132f8f0
0x0132f8fe
0x0132f903
0x0132f906
0x0132f90a
0x0132f913
0x0132f90c
0x0132f90c
0x0132f90c
0x0132f916
0x0132f918
0x0132f918
0x0132f920
0x0132f920
0x0132f922
0x0132f923
0x0132f923
0x0132f927
0x0132f929
0x0132f92b
0x0132f92b
0x0132f92e
0x0132f92f
0x0132f937
0x0132f939
0x0132f93c
0x0132f93f
0x0132f941
0x0132fa3e
0x0132fa43
0x0132fa44
0x0132fa45
0x0132fa46
0x0132fa47
0x0132fa48
0x0132fa49
0x0132fa4a
0x0132fa4b
0x0132fa4c
0x0132fa4d
0x0132fa4e
0x0132fa4f
0x0132fa50
0x0132fa53
0x0132fa55
0x0132fa60
0x0132fa61
0x0132fa64
0x0132fa65
0x0132fa66
0x0132fa6d
0x0132fa71
0x0132fa77
0x0132fa79
0x0132fa80
0x0132fa8c
0x0132fa8e
0x0132fa94
0x0132fa97
0x0132fa9e
0x0132faa0
0x0132faa4
0x0132faa9
0x0132faac
0x0132faae
0x0132faae
0x0132fab0
0x0132fab0
0x0132fab8
0x0132fabb
0x0132fabe
0x0132fac1
0x0132fac9
0x0132fad4
0x0132fae1
0x0132f947
0x0132f947
0x0132f94a
0x0132f94c
0x0132f951
0x0132f956
0x0132f959
0x0132f959
0x0132f95f
0x0132f962
0x0132f972
0x0132f978
0x0132f988
0x0132f98b
0x0132f98f
0x0132f996
0x0132fa00
0x0132fa09
0x0132fa10
0x0132f998
0x0132f99b
0x0132f9a3
0x0132f9b0
0x0132f9b7
0x0132f9bd
0x0132f9c9
0x0132f9cd
0x0132f9d3
0x0132f9d7
0x0132f9e2
0x0132f9f2
0x0132f9f7
0x0132f9fb
0x0132fa13
0x0132fa17
0x0132fa21
0x0132fa29
0x0132fa2a
0x0132fa2e
0x0132fa3b
0x0132fa3b
0x0132f6b9
0x0132f6be
0x0132f6c3
0x0132f6c6
0x0132f6ca
0x0132f6d1
0x0132f6d7
0x0132f6de
0x0132f6e4
0x0132f6eb
0x0132f6f2
0x0132f6f2
0x0132f6f5
0x0132f6fb
0x0132f701
0x0132f70a
0x0132f70f
0x0132f712
0x0132f719
0x0132f71b
0x0132f71f
0x0132f724
0x0132f727
0x0132f729
0x0132f729
0x0132f72b
0x0132f72b
0x0132f733
0x0132f736
0x0132f739
0x0132f73c
0x0132f741
0x0132f746
0x0132f749
0x0132f751
0x0132f751
0x0132f75b
0x0132f75d
0x0132f764
0x0132f767
0x0132f770
0x0132f773
0x0132f77e
0x0132f783
0x0132f786
0x0132f78a
0x0132f78d
0x0132f78f
0x0132f792
0x0132f797
0x0132f797
0x0132f79a
0x0132f7a1
0x0132f7a5
0x0132f7a8
0x0132f7aa
0x0132f7ad
0x0132f7b2
0x0132f7b2
0x0132f7b5
0x0132f7bc
0x0132f7c0
0x0132f7c3
0x0132f7c5
0x0132f7c8
0x0132f7cd
0x0132f7cd
0x0132f7d0
0x0132f7d7
0x0132f7db
0x0132f7de
0x0132f7e0
0x0132f7e3
0x0132f7e8
0x0132f7e8
0x0132f7eb
0x0132f7f2
0x0132f7f6
0x0132f7f9
0x0132f7fb
0x0132f7fe
0x0132f803
0x0132f803
0x0132f806
0x0132f80d
0x0132f811
0x0132f814
0x0132f816
0x0132f819
0x0132f81e
0x0132f821
0x0132f828
0x0132f832
0x0132f832
0x00000000
0x0132f767
0x0132f6b3
0x0132f634
0x0132f61a
0x0132f489
0x0132f48e
0x0132f493
0x0132f496
0x0132f49a
0x0132f49f
0x0132f4a2
0x0132f4a8
0x0132f4af
0x0132f4b5
0x0132f4bc
0x0132f4c3
0x0132f4c9
0x0132f4d1
0x0132f4d1
0x0132f4db
0x0132f4dd
0x0132f4e4
0x0132f4e7
0x0132f4f0
0x0132f4f3
0x0132f4fe
0x0132f503
0x0132f506
0x0132f50a
0x0132f50d
0x0132f50f
0x0132f512
0x0132f517
0x0132f517
0x0132f51a
0x0132f521
0x0132f525
0x0132f528
0x0132f52a
0x0132f52d
0x0132f532
0x0132f532
0x0132f535
0x0132f53c
0x0132f540
0x0132f543
0x0132f545
0x0132f548
0x0132f54d
0x0132f54d
0x0132f550
0x0132f557
0x0132f55b
0x0132f55e
0x0132f560
0x0132f563
0x0132f568
0x0132f568
0x0132f56b
0x0132f572
0x0132f576
0x0132f579
0x0132f57b
0x0132f57e
0x0132f583
0x0132f583
0x0132f586
0x0132f58d
0x0132f591
0x0132f594
0x0132f596
0x0132f599
0x0132f59e
0x0132f5a1
0x0132f5a8
0x0132f5b2
0x0132f5b2
0x00000000
0x0132f4e7
0x0132f483
0x0132f404
0x0132f3ea
0x0132f115
0x0132f11d
0x0132f122
0x0132f12b
0x0132f12e
0x0132f134
0x0132f13b
0x0132f141
0x0132f148
0x0132f14f
0x0132f155
0x0132f161
0x0132f169
0x0132f16f
0x0132f172
0x0132f176
0x0132f17a
0x0132f17e
0x0132f183
0x0132f18b
0x0132f18e
0x0132f195
0x0132f19c
0x0132f1a3
0x0132f1ae
0x0132f1b6
0x0132f1b8
0x0132f1ba
0x0132f1bf
0x0132f1c2
0x0132f1c4
0x0132f39e
0x00000000
0x0132f1ca
0x0132f1ca
0x0132f1cd
0x0132f1d3
0x0132f1e3
0x0132f1e9
0x0132f1f9
0x0132f1ff
0x0132f209
0x0132f20c
0x0132f210
0x0132f21e
0x0132f231
0x0132f23d
0x0132f241
0x0132f247
0x0132f24b
0x0132f259
0x0132f26c
0x0132f275
0x0132f278
0x0132f27c
0x0132f284
0x0132f284
0x0132f291
0x0132f293
0x0132f29a
0x0132f29d
0x0132f29f
0x0132f2a8
0x0132f2ab
0x0132f2b9
0x0132f2be
0x0132f2c1
0x0132f2c5
0x0132f2c8
0x0132f2ca
0x0132f2cd
0x0132f2d2
0x0132f2d2
0x0132f2d5
0x0132f2dc
0x0132f2e0
0x0132f2e3
0x0132f2e5
0x0132f2e8
0x0132f2ed
0x0132f2ed
0x0132f2f0
0x0132f2f7
0x0132f2fb
0x0132f2fe
0x0132f300
0x0132f303
0x0132f308
0x0132f308
0x0132f30b
0x0132f312
0x0132f316
0x0132f319
0x0132f31b
0x0132f31e
0x0132f323
0x0132f323
0x0132f326
0x0132f32d
0x0132f331
0x0132f334
0x0132f336
0x0132f339
0x0132f33e
0x0132f33e
0x0132f341
0x0132f348
0x0132f34c
0x0132f352
0x0132f354
0x0132f357
0x0132f35c
0x0132f35f
0x0132f369
0x0132f376
0x0132f376
0x00000000
0x0132f29f
0x0132f1c4
0x0132f10f
0x0132f08d
0x0132f06c
0x0132ef01
0x0132ef01
0x0132ef04
0x0132ef07
0x0132ef4f
0x0132ef53
0x0132ef63
0x0132ef66
0x0132ef6b
0x0132ef70
0x0132ef74
0x0132ef75
0x0132efcd
0x0132efce
0x0132efcf
0x0132efdd
0x0132efe9
0x00000000
0x0132ef77
0x0132ef77
0x0132ef79
0x0132ef7a
0x0132ef7b
0x0132ef8c
0x0132ef95
0x0132ef98
0x0132efa0
0x0132efa5
0x0132efb6
0x0132efb6
0x0132efb8
0x0132efec
0x0132efec
0x0132eff5
0x0132efba
0x0132efbb
0x0132efc1
0x0132efca
0x0132efca
0x0132efa7
0x0132efa7
0x0132efaa
0x0132efac
0x0132efaf
0x0132efb2
0x00000000
0x0132efb4
0x0132efb4
0x00000000
0x0132efb4
0x0132efb2
0x0132efa5
0x0132ef75
0x0132eefb
0x0132eee4
0x0132ee52
0x0132ee52
0x0132ee55
0x0132ee58
0x0132ee5d
0x0132ee69
0x0132ee6c
0x0132ee72
0x0132ee79
0x00000000
0x0132ee79
0x0132ee3a
0x0132ee3a
0x00000000
0x0132ee3a
0x0132ee29
0x0132ee2f
0x00000000
0x0132ee2f
0x0132ee27
0x0132ee1d
0x0132ee10
0x0132ed12
0x0132ed12
0x0132ed15
0x0132ed18
0x0132ed1d
0x0132ed29
0x0132ed2c
0x0132ed32
0x0132ed39
0x00000000
0x0132ed39
0x0132ecfa
0x0132ecfa
0x00000000
0x0132ecfa
0x0132ece9
0x0132ecef
0x00000000
0x0132ecef
0x0132ece7
0x0132ecdd
0x0132ecd0

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0132EC5D
std::_Lockit::_Lockit.LIBCPMT ref: 0132EC80
std::_Lockit::~_Lockit.LIBCPMT ref: 0132ECA8
std::_Facet_Register.LIBCPMT ref: 0132ED1D
std::_Lockit::~_Lockit.LIBCPMT ref: 0132ED47

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: f4e69999b684a89b6c37d251546f468d3d99580b14e0b5012a0193e0d8753b69
Instruction ID: d634f57e00fdb0d16ccfcec63b5c9c51e77e624ae009c9997b2117695bbb9f4f
Opcode Fuzzy Hash: f4e69999b684a89b6c37d251546f468d3d99580b14e0b5012a0193e0d8753b69
Instruction Fuzzy Hash: F441C471800269DFCF21EF9CD44179EBBB8FB44728F148269E815A7385D731AA04CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 01327C30 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01327C30(void* __ecx, signed int* __edx) {
				signed int _t8;
				signed int _t10;
				signed int _t12;
				signed int _t14;
				signed int _t17;
				long _t20;
				signed short* _t23;
				void* _t25;
				void* _t27;
				void* _t30;
				void* _t31;
				void* _t34;
				signed int* _t37;

				_t37 = __edx;
				_t20 = GetLastError();
				_t23 =  ==  ? L"false" : L"true";
				while( *_t37 != 0) {
					_t37 =  &(_t37[0]);
				}
				_t8 = 0x43;
				_t34 = L"Call to ShellExecuteEx() returned:" - _t37;
				do {
					 *_t37 = _t8;
					_t37 =  &(_t37[0]);
					_t8 =  *(_t34 + _t37) & 0x0000ffff;
				} while (_t8 != 0);
				 *_t37 = 0;
				_t10 =  *_t23 & 0x0000ffff;
				if(_t10 != 0) {
					_t31 = _t23 - _t37;
					do {
						 *_t37 = _t10;
						_t37 =  &(_t37[0]);
						_t10 =  *(_t31 + _t37) & 0x0000ffff;
					} while (_t10 != 0);
				}
				 *_t37 = 0;
				_t25 = L"\r\n" - _t37;
				_t12 = 0xd;
				do {
					 *_t37 = _t12;
					_t37 =  &(_t37[0]);
					_t12 =  *(_t25 + _t37) & 0x0000ffff;
				} while (_t12 != 0);
				 *_t37 = 0;
				_t27 = L"Last error=" - _t37;
				_t14 = 0x4c;
				do {
					 *_t37 = _t14;
					_t37 =  &(_t37[0]);
					_t14 =  *(_t27 + _t37) & 0x0000ffff;
				} while (_t14 != 0);
				 *_t37 = 0;
				E01328570(_t20, _t37);
				while( *_t37 != 0) {
					_t37 =  &(_t37[0]);
				}
				_t17 = 0xd;
				_t30 = L"\r\n" - _t37;
				do {
					 *_t37 = _t17;
					_t37 =  &(_t37[0]);
					_t17 =  *(_t30 + _t37) & 0x0000ffff;
				} while (_t17 != 0);
				 *_t37 = 0;
				return _t37;
			}

0x01327c33
0x01327c3f
0x01327c4b
0x01327c52
0x01327c54
0x01327c57
0x01327c62
0x01327c67
0x01327c70
0x01327c70
0x01327c73
0x01327c76
0x01327c7a
0x01327c81
0x01327c84
0x01327c8a
0x01327c8c
0x01327c90
0x01327c90
0x01327c93
0x01327c96
0x01327c9a
0x01327c90
0x01327ca6
0x01327ca9
0x01327cab
0x01327cb0
0x01327cb0
0x01327cb3
0x01327cb6
0x01327cba
0x01327cc6
0x01327cc9
0x01327ccb
0x01327cd0
0x01327cd0
0x01327cd3
0x01327cd6
0x01327cda
0x01327ce5
0x01327ce8
0x01327cf1
0x01327cf3
0x01327cf6
0x01327d01
0x01327d06
0x01327d10
0x01327d10
0x01327d13
0x01327d16
0x01327d1a
0x01327d21
0x01327d29

APIs

GetLastError.KERNEL32(00000010,00000010,?,01327912,?,?), ref: 01327C37

Strings

false, xrefs: 01327C46
Last error=, xrefs: 01327CC1
true, xrefs: 01327C41
Call to ShellExecuteEx() returned:, xrefs: 01327C5D

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: 2a6dc648149eda745ff7bb7490355b108133eec62be2995086c7ebf7aa2d0e05
Instruction ID: 090de2b485590fb7dbe1fa910f0109e562dfabde917d2d1881bb7242a6580fc5
Opcode Fuzzy Hash: 2a6dc648149eda745ff7bb7490355b108133eec62be2995086c7ebf7aa2d0e05
Instruction Fuzzy Hash: FA215969A2027286CF702F3C8404335B2F0FF64659F65186FE8C8E7395E67988C28390

Uniqueness

Uniqueness Score: -1.00%

Function 01336FF9 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E01336FF9(void* __ecx, intOrPtr _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t17;
				intOrPtr _t19;
				char* _t21;
				short _t28;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t32 = _a8;
				_t31 = __ecx;
				_t29 = __ecx + 0x2c;
				if( *((char*)(__ecx + 0x28)) == 0) {
					_t5 = _t32 + 0x10; // 0x1c4689c0
					_t17 =  *_t5;
				} else {
					_t4 = _t32 + 0xc; // 0xbe0f2947
					_t17 =  *_t4;
				}
				 *((intOrPtr*)(_t31 + 0x10)) = E0133725B(_t29, _t31, _t32, _t17, 0, _t29);
				_t19 = 0x137b6c9;
				if( *((char*)(_t32 + 0x2e)) <= 4) {
					_t8 = _t32 + 0x20; // 0x47be0f00
					_t19 =  *_t8;
				}
				 *((intOrPtr*)(_t31 + 0x14)) = E0133725B(_t29, _t31, _t32, _t19, 0, _t29);
				_t21 = "-";
				if( *((char*)(_t32 + 0x2f)) <= 4) {
					_t11 = _t32 + 0x24; // 0x205e8d2e
					_t21 =  *_t11;
				}
				 *((intOrPtr*)(_t31 + 0x18)) = E0133725B(_t29, _t31, _t32, _t21, 0, _t29);
				_t13 = _t32 + 0x14; // 0x578c085
				 *((short*)(_t31 + 0xc)) = E0133722A( *( *_t13) & 0x000000ff, 0, _t29);
				_t15 = _t32 + 0x18; // 0x7c7ff883
				_t28 = E0133722A( *( *_t15) & 0x000000ff, 0, _t29);
				 *((short*)(_t31 + 0xe)) = _t28;
				return _t28;
			}

0x01336ffe
0x01337002
0x01337008
0x0133700b
0x01337012
0x01337012
0x0133700d
0x0133700d
0x0133700d
0x0133700d
0x0133701e
0x01337028
0x0133702d
0x0133702f
0x0133702f
0x0133702f
0x0133703b
0x01337045
0x0133704a
0x0133704c
0x0133704c
0x0133704c
0x01337058
0x0133705b
0x0133706a
0x0133706e
0x01337078
0x01337080
0x01337088

APIs

_Maklocstr.LIBCPMT ref: 01337019
_Maklocstr.LIBCPMT ref: 01337036
_Maklocstr.LIBCPMT ref: 01337053
_Maklocchr.LIBCPMT ref: 01337065
_Maklocchr.LIBCPMT ref: 01337078

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 68322c7a6ab28863ca763488fdad1ae354737137796955564625c7898c58c1b9
Instruction ID: 5e0a04f3cf379eb4c6e6c72189ad4d2b35126344fa2998f2238df1e773eed697
Opcode Fuzzy Hash: 68322c7a6ab28863ca763488fdad1ae354737137796955564625c7898c58c1b9
Instruction Fuzzy Hash: 291191F5500745BBE720DBA99880F12F7ECFF88258F044519F245CBA40D265FC548BA9

Uniqueness

Uniqueness Score: -1.00%

Function 01332823 Relevance: 7.6, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01332823(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t20;
				void* _t25;
				void* _t26;
				intOrPtr* _t40;
				intOrPtr _t41;
				intOrPtr* _t48;
				void* _t52;

				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t52 - 0x14, 0);
				_t48 =  *0x1384884; // 0x0
				 *(_t52 - 4) =  *(_t52 - 4) & 0x00000000;
				 *((intOrPtr*)(_t52 - 0x10)) = _t48;
				_t20 = E0132BD50( *((intOrPtr*)(_t52 + 8)), E0132BCE0());
				_t46 = _t20;
				if(_t20 != 0) {
					L5:
					E01335EFD(_t52 - 0x14);
					return E013481F0(_t46);
				} else {
					if(_t48 == 0) {
						_push( *((intOrPtr*)(_t52 + 8)));
						_push(_t52 - 0x10);
						_t25 = E01332E83(__ebx, _t46, _t48, __eflags);
						_pop(_t40);
						__eflags = _t25 - 0xffffffff;
						if(__eflags == 0) {
							_t26 = E0132C550(__eflags);
							asm("int3");
							_t41 =  *_t40;
							__eflags = _t41;
							if(_t41 != 0) {
								_push(_t48);
								_t49 = _t41;
								E0134C213( *((intOrPtr*)(_t41 + 8)));
								E0134C213( *((intOrPtr*)(_t41 + 0x10)));
								return E0134C213( *((intOrPtr*)(_t49 + 0x14)));
							} else {
								return _t26;
							}
						} else {
							_t46 =  *((intOrPtr*)(_t52 - 0x10));
							 *((intOrPtr*)(_t52 - 0x10)) = _t46;
							 *(_t52 - 4) = 1;
							E01335C34(_t46);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t46 + 4))))();
							 *0x1384884 = _t46;
							goto L5;
						}
					} else {
						_t46 = _t48;
						goto L5;
					}
				}
			}

0x01332823
0x0133282a
0x01332834
0x01332839
0x01332844
0x01332848
0x01332854
0x01332859
0x0133285d
0x013328a2
0x013328a5
0x013328b1
0x0133285f
0x01332861
0x01332867
0x0133286d
0x0133286e
0x01332874
0x01332875
0x01332878
0x013328b2
0x013328b7
0x013328b8
0x013328ba
0x013328bc
0x013348d0
0x013348d1
0x013348d6
0x013348de
0x013348ef
0x013328c2
0x013328c2
0x013328c2
0x0133287a
0x0133287a
0x0133287d
0x01332881
0x01332885
0x01332892
0x0133289a
0x0133289c
0x00000000
0x0133289c
0x01332863
0x01332863
0x00000000
0x01332863
0x01332861

APIs

__EH_prolog3.LIBCMT ref: 0133282A
std::_Lockit::_Lockit.LIBCPMT ref: 01332834

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

numpunct.LIBCPMT ref: 0133286E
std::_Facet_Register.LIBCPMT ref: 01332885
std::_Lockit::~_Lockit.LIBCPMT ref: 013328A5

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: a1abca2ab29fd75f83fe0824b0266f003cdcae92b866bcf9d7aa32bf6cff16da
Instruction ID: 7fe03df01e870c86a98fbabaacab6bdda0c926c9c071f48943ca2e74a3078e36
Opcode Fuzzy Hash: a1abca2ab29fd75f83fe0824b0266f003cdcae92b866bcf9d7aa32bf6cff16da
Instruction Fuzzy Hash: 9711E13590022A8BCF15EBACC4546AEBBB5AFE0718F254109E510AB384DF349E00CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 01338030 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E01338030(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				intOrPtr* _v12;
				void* _v16;
				char _v20;
				intOrPtr* _t60;
				void* _t98;
				intOrPtr* _t101;
				void* _t144;
				intOrPtr _t145;
				intOrPtr* _t162;
				intOrPtr* _t163;
				intOrPtr* _t164;
				void* _t165;
				void* _t168;
				intOrPtr* _t169;
				intOrPtr* _t170;
				void* _t171;
				void* _t172;

				_t159 = __edx;
				_t120 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t168 =  *0x1384a3c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t168;
				_t60 = E0132BD50(_a8, E0132BCE0());
				_t161 = _t60;
				if(_t60 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t161);
				} else {
					if(_t168 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E013393F1(__ebx, __edx, _t161, _t168, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t161, _t168);
							E01335EA5( &_v20, 0);
							_t169 =  *0x1384a58; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t169;
							_t162 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t162;
							if(_t162 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t162);
							} else {
								__eflags = _t169;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0133946C(_t120, _t162, _t169, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t120, _t162, _t169);
										E01335EA5( &_v20, 0);
										_t170 =  *0x1384a28; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t170;
										_t163 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t163;
										if(_t163 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t163);
										} else {
											__eflags = _t170;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E013394D8(_t120, _t163, _t170, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t120, _t163, _t170);
													E01335EA5( &_v20, 0);
													_t171 =  *0x1384a5c; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t171;
													_t164 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t164;
													if(_t164 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t164);
													} else {
														__eflags = _t171;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															_t98 = E01339544(_t120, _t164, _t171, __eflags);
															_pop(_t144);
															__eflags = _t98 - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(_t171);
																_push(_t164);
																_t172 = _t144;
																_t165 = _t172;
																asm("stosd");
																asm("stosd");
																asm("stosd");
																asm("stosd");
																_t101 = _v12;
																 *(_t172 + 0x10) =  *(_t172 + 0x10) & 0x00000000;
																 *(_t172 + 0x14) =  *(_t172 + 0x14) & 0x00000000;
																__eflags =  *((intOrPtr*)(_t101 + 0x14)) - 8;
																_t145 =  *((intOrPtr*)(_t101 + 0x10));
																if( *((intOrPtr*)(_t101 + 0x14)) >= 8) {
																	_t101 =  *_t101;
																}
																_push(_t145);
																E0133657C(_t120, _t172, _t159, _t165, _t101);
																return _t172;
															} else {
																_t164 = _v16;
																_v16 = _t164;
																_v4 = 1;
																E01335C34(_t164);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t164 + 4))))();
																 *0x1384a5c = _t164;
																goto L26;
															}
														} else {
															_t164 = _t171;
															goto L26;
														}
													}
												} else {
													_t163 = _v16;
													_v16 = _t163;
													_v4 = 1;
													E01335C34(_t163);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t163 + 4))))();
													 *0x1384a28 = _t163;
													goto L19;
												}
											} else {
												_t163 = _t170;
												goto L19;
											}
										}
									} else {
										_t162 = _v16;
										_v16 = _t162;
										_v4 = 1;
										E01335C34(_t162);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t162 + 4))))();
										 *0x1384a58 = _t162;
										goto L12;
									}
								} else {
									_t162 = _t169;
									goto L12;
								}
							}
						} else {
							_t161 = _v16;
							_v16 = _t161;
							_v4 = 1;
							E01335C34(_t161);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t161 + 4))))();
							 *0x1384a3c = _t161;
							goto L5;
						}
					} else {
						_t161 = _t168;
						goto L5;
					}
				}
			}

0x01338030
0x01338030
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338061
0x01338066
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e

APIs

__EH_prolog3.LIBCMT ref: 01338037
std::_Lockit::_Lockit.LIBCPMT ref: 01338041

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

numpunct.LIBCPMT ref: 0133807B
std::_Facet_Register.LIBCPMT ref: 01338092
std::_Lockit::~_Lockit.LIBCPMT ref: 013380B2

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 73f9255c7b8687587256b1f940548fb7b1330ed0cbdb28a36078ff6baf89843a
Instruction ID: fac0624e8fa1e09309e34d51fa0bd673a0beb5e5eead90670f6a419bff49491c
Opcode Fuzzy Hash: 73f9255c7b8687587256b1f940548fb7b1330ed0cbdb28a36078ff6baf89843a
Instruction Fuzzy Hash: 3D01D63690021ADBCF11FBACC8447AEF7B5AFD0318F154149E9106B281DF749A058B95

Uniqueness

Uniqueness Score: -1.00%

Function 013375B6 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E013375B6(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v84;
				intOrPtr* _t276;
				void* _t512;
				intOrPtr* _t515;
				void* _t738;
				intOrPtr _t739;
				intOrPtr* _t810;
				intOrPtr* _t811;
				intOrPtr* _t812;
				intOrPtr* _t813;
				intOrPtr* _t814;
				intOrPtr* _t815;
				intOrPtr* _t816;
				intOrPtr* _t817;
				intOrPtr* _t818;
				intOrPtr* _t819;
				intOrPtr* _t820;
				intOrPtr* _t821;
				intOrPtr* _t822;
				intOrPtr* _t823;
				intOrPtr* _t824;
				intOrPtr* _t825;
				intOrPtr* _t826;
				intOrPtr* _t827;
				intOrPtr* _t828;
				intOrPtr* _t829;
				intOrPtr* _t830;
				void* _t831;
				void* _t834;
				intOrPtr* _t835;
				intOrPtr* _t836;
				intOrPtr* _t837;
				intOrPtr* _t838;
				intOrPtr* _t839;
				intOrPtr* _t840;
				intOrPtr* _t841;
				intOrPtr* _t842;
				intOrPtr* _t843;
				intOrPtr* _t844;
				intOrPtr* _t845;
				intOrPtr* _t846;
				intOrPtr* _t847;
				intOrPtr* _t848;
				intOrPtr* _t849;
				intOrPtr* _t850;
				intOrPtr* _t851;
				intOrPtr* _t852;
				intOrPtr* _t853;
				intOrPtr* _t854;
				void* _t855;
				void* _t856;

				_t807 = __edx;
				_t606 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t834 =  *0x1384a60; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t834;
				_t276 = E0132BD50(_a8, E0132BCE0());
				_t809 = _t276;
				if(_t276 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t809);
				} else {
					if(_t834 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338BB7(__ebx, _t809, _t834, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t809, _t834);
							E01335EA5( &_v20, 0);
							_t835 =  *0x1384a2c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t835;
							_t810 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t810;
							if(_t810 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t810);
							} else {
								__eflags = _t835;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338C1D(_t606, _t810, _t835, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t606, _t810, _t835);
										E01335EA5( &_v20, 0);
										_t836 =  *0x1384a40; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t836;
										_t811 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t811;
										if(_t811 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t811);
										} else {
											__eflags = _t836;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01338C83(_t606, __edx, _t811, _t836, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t606, _t811, _t836);
													E01335EA5( &_v20, 0);
													_t837 =  *0x1384a10; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t837;
													_t812 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t812;
													if(_t812 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t812);
													} else {
														__eflags = _t837;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01338D25(_t606, __edx, _t812, _t837, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t606, _t812, _t837);
																E01335EA5( &_v20, 0);
																_t838 =  *0x1384a30; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t838;
																_t813 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t813;
																if(_t813 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t813);
																} else {
																	__eflags = _t838;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01338DC7(_t606, _t813, _t838, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t606, _t813, _t838);
																			E01335EA5( &_v20, 0);
																			_t839 =  *0x1384a44; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t839;
																			_t814 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t814;
																			if(_t814 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t814);
																			} else {
																				__eflags = _t839;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E01338E37(_t606, _t814, _t839, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t606, _t814, _t839);
																						E01335EA5( &_v20, 0);
																						_t840 =  *0x1384a14; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t840;
																						_t815 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t815;
																						if(_t815 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t815);
																						} else {
																							__eflags = _t840;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E01338E9F(_t606, _t815, _t840, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t606, _t815, _t840);
																									E01335EA5( &_v20, 0);
																									_t841 =  *0x1384a48; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t841;
																									_t816 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t816;
																									if(_t816 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t816);
																									} else {
																										__eflags = _t841;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E01338F07(_t606, _t816, _t841, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t606, _t816, _t841);
																												E01335EA5( &_v20, 0);
																												_t842 =  *0x1384a18; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t842;
																												_t817 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t817;
																												if(_t817 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t817);
																												} else {
																													__eflags = _t842;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E01338F6F(_t606, _t817, _t842, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t606, _t817, _t842);
																															E01335EA5( &_v20, 0);
																															_t843 =  *0x1384a4c; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t843;
																															_t818 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t818;
																															if(_t818 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t818);
																															} else {
																																__eflags = _t843;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E01338FD7(_t606, _t818, _t843, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t606, _t818, _t843);
																																		E01335EA5( &_v20, 0);
																																		_t844 =  *0x1384a1c; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t844;
																																		_t819 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t819;
																																		if(_t819 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t819);
																																		} else {
																																			__eflags = _t844;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0133903F(_t606, _t819, _t844, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t606, _t819, _t844);
																																					E01335EA5( &_v20, 0);
																																					_t845 =  *0x1384a54; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t845;
																																					_t820 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t820;
																																					if(_t820 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t820);
																																					} else {
																																						__eflags = _t845;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E013390A7(_t606, _t820, _t845, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t606, _t820, _t845);
																																								E01335EA5( &_v20, 0);
																																								_t846 =  *0x1384a50; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t846;
																																								_t821 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t821;
																																								if(_t821 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t821);
																																								} else {
																																									__eflags = _t846;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0133912B(_t606, _t821, _t846, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t606, _t821, _t846);
																																											E01335EA5( &_v20, 0);
																																											_t847 =  *0x1384a24; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t847;
																																											_t822 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t822;
																																											if(_t822 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t822);
																																											} else {
																																												__eflags = _t847;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E013391B0(_t606, _t822, _t847, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E01348213(0x136b979, _t606, _t822, _t847);
																																														E01335EA5( &_v20, 0);
																																														_t848 =  *0x1384a20; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t848;
																																														_t823 = E0132BD50(_a8, E0132BCE0());
																																														__eflags = _t823;
																																														if(_t823 != 0) {
																																															L103:
																																															E01335EFD( &_v20);
																																															return E013481F0(_t823);
																																														} else {
																																															__eflags = _t848;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E01339234(_t606, _t823, _t848, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0132C550(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E01348213(0x136b979, _t606, _t823, _t848);
																																																	E01335EA5( &_v20, 0);
																																																	_t849 =  *0x1384a34; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t849;
																																																	_t824 = E0132BD50(_a8, E0132BCE0());
																																																	__eflags = _t824;
																																																	if(_t824 != 0) {
																																																		L110:
																																																		E01335EFD( &_v20);
																																																		return E013481F0(_t824);
																																																	} else {
																																																		__eflags = _t849;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E013392B9(_t606, _t824, _t849, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0132C550(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E01348213(0x136b979, _t606, _t824, _t849);
																																																				E01335EA5( &_v20, 0);
																																																				_t850 =  *0x1384a0c; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t850;
																																																				_t825 = E0132BD50(_a8, E0132BCE0());
																																																				__eflags = _t825;
																																																				if(_t825 != 0) {
																																																					L117:
																																																					E01335EFD( &_v20);
																																																					return E013481F0(_t825);
																																																				} else {
																																																					__eflags = _t850;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E01339321(_t606, _t825, _t850, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0132C550(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E01348213(0x136b979, _t606, _t825, _t850);
																																																							E01335EA5( &_v20, 0);
																																																							_t851 =  *0x1384a38; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t851;
																																																							_t826 = E0132BD50(_a8, E0132BCE0());
																																																							__eflags = _t826;
																																																							if(_t826 != 0) {
																																																								L124:
																																																								E01335EFD( &_v20);
																																																								return E013481F0(_t826);
																																																							} else {
																																																								__eflags = _t851;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E01339389(_t606, _t826, _t851, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0132C550(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E01348213(0x136b979, _t606, _t826, _t851);
																																																										E01335EA5( &_v20, 0);
																																																										_t852 =  *0x1384a3c; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t852;
																																																										_t827 = E0132BD50(_a8, E0132BCE0());
																																																										__eflags = _t827;
																																																										if(_t827 != 0) {
																																																											L131:
																																																											E01335EFD( &_v20);
																																																											return E013481F0(_t827);
																																																										} else {
																																																											__eflags = _t852;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E013393F1(_t606, __edx, _t827, _t852, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0132C550(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E01348213(0x136b979, _t606, _t827, _t852);
																																																													E01335EA5( &_v20, 0);
																																																													_t853 =  *0x1384a58; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t853;
																																																													_t828 = E0132BD50(_a8, E0132BCE0());
																																																													__eflags = _t828;
																																																													if(_t828 != 0) {
																																																														L138:
																																																														E01335EFD( &_v20);
																																																														return E013481F0(_t828);
																																																													} else {
																																																														__eflags = _t853;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E0133946C(_t606, _t828, _t853, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0132C550(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																E01348213(0x136b979, _t606, _t828, _t853);
																																																																E01335EA5( &_v20, 0);
																																																																_t854 =  *0x1384a28; // 0x0
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t854;
																																																																_t829 = E0132BD50(_a8, E0132BCE0());
																																																																__eflags = _t829;
																																																																if(_t829 != 0) {
																																																																	L145:
																																																																	E01335EFD( &_v20);
																																																																	return E013481F0(_t829);
																																																																} else {
																																																																	__eflags = _t854;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		__eflags = E013394D8(_t606, _t829, _t854, __eflags) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0132C550(__eflags);
																																																																			asm("int3");
																																																																			_push(8);
																																																																			E01348213(0x136b979, _t606, _t829, _t854);
																																																																			E01335EA5( &_v20, 0);
																																																																			_t855 =  *0x1384a5c; // 0x0
																																																																			_v4 = _v4 & 0x00000000;
																																																																			_v16 = _t855;
																																																																			_t830 = E0132BD50(_a8, E0132BCE0());
																																																																			__eflags = _t830;
																																																																			if(_t830 != 0) {
																																																																				L152:
																																																																				E01335EFD( &_v20);
																																																																				return E013481F0(_t830);
																																																																			} else {
																																																																				__eflags = _t855;
																																																																				if(__eflags == 0) {
																																																																					_push(_a8);
																																																																					_push( &_v16);
																																																																					_t512 = E01339544(_t606, _t830, _t855, __eflags);
																																																																					_pop(_t738);
																																																																					__eflags = _t512 - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						E0132C550(__eflags);
																																																																						asm("int3");
																																																																						_push(_t855);
																																																																						_push(_t830);
																																																																						_t856 = _t738;
																																																																						_t831 = _t856;
																																																																						asm("stosd");
																																																																						asm("stosd");
																																																																						asm("stosd");
																																																																						asm("stosd");
																																																																						_t515 = _v84;
																																																																						 *(_t856 + 0x10) =  *(_t856 + 0x10) & 0x00000000;
																																																																						 *(_t856 + 0x14) =  *(_t856 + 0x14) & 0x00000000;
																																																																						__eflags =  *((intOrPtr*)(_t515 + 0x14)) - 8;
																																																																						_t739 =  *((intOrPtr*)(_t515 + 0x10));
																																																																						if( *((intOrPtr*)(_t515 + 0x14)) >= 8) {
																																																																							_t515 =  *_t515;
																																																																						}
																																																																						_push(_t739);
																																																																						E0133657C(_t606, _t856, _t807, _t831, _t515);
																																																																						return _t856;
																																																																					} else {
																																																																						_t830 = _v16;
																																																																						_v16 = _t830;
																																																																						_v4 = 1;
																																																																						E01335C34(_t830);
																																																																						 *0x136d26c();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t830 + 4))))();
																																																																						 *0x1384a5c = _t830;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t830 = _t855;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t829 = _v16;
																																																																			_v16 = _t829;
																																																																			_v4 = 1;
																																																																			E01335C34(_t829);
																																																																			 *0x136d26c();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t829 + 4))))();
																																																																			 *0x1384a28 = _t829;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t829 = _t854;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t828 = _v16;
																																																																_v16 = _t828;
																																																																_v4 = 1;
																																																																E01335C34(_t828);
																																																																 *0x136d26c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t828 + 4))))();
																																																																 *0x1384a58 = _t828;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t828 = _t853;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t827 = _v16;
																																																													_v16 = _t827;
																																																													_v4 = 1;
																																																													E01335C34(_t827);
																																																													 *0x136d26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t827 + 4))))();
																																																													 *0x1384a3c = _t827;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t827 = _t852;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t826 = _v16;
																																																										_v16 = _t826;
																																																										_v4 = 1;
																																																										E01335C34(_t826);
																																																										 *0x136d26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t826 + 4))))();
																																																										 *0x1384a38 = _t826;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t826 = _t851;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t825 = _v16;
																																																							_v16 = _t825;
																																																							_v4 = 1;
																																																							E01335C34(_t825);
																																																							 *0x136d26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t825 + 4))))();
																																																							 *0x1384a0c = _t825;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t825 = _t850;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t824 = _v16;
																																																				_v16 = _t824;
																																																				_v4 = 1;
																																																				E01335C34(_t824);
																																																				 *0x136d26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t824 + 4))))();
																																																				 *0x1384a34 = _t824;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t824 = _t849;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t823 = _v16;
																																																	_v16 = _t823;
																																																	_v4 = 1;
																																																	E01335C34(_t823);
																																																	 *0x136d26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t823 + 4))))();
																																																	 *0x1384a20 = _t823;
																																																	goto L103;
																																																}
																																															} else {
																																																_t823 = _t848;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t822 = _v16;
																																														_v16 = _t822;
																																														_v4 = 1;
																																														E01335C34(_t822);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t822 + 4))))();
																																														 *0x1384a24 = _t822;
																																														goto L96;
																																													}
																																												} else {
																																													_t822 = _t847;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t821 = _v16;
																																											_v16 = _t821;
																																											_v4 = 1;
																																											E01335C34(_t821);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t821 + 4))))();
																																											 *0x1384a50 = _t821;
																																											goto L89;
																																										}
																																									} else {
																																										_t821 = _t846;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t820 = _v16;
																																								_v16 = _t820;
																																								_v4 = 1;
																																								E01335C34(_t820);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t820 + 4))))();
																																								 *0x1384a54 = _t820;
																																								goto L82;
																																							}
																																						} else {
																																							_t820 = _t845;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t819 = _v16;
																																					_v16 = _t819;
																																					_v4 = 1;
																																					E01335C34(_t819);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t819 + 4))))();
																																					 *0x1384a1c = _t819;
																																					goto L75;
																																				}
																																			} else {
																																				_t819 = _t844;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t818 = _v16;
																																		_v16 = _t818;
																																		_v4 = 1;
																																		E01335C34(_t818);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t818 + 4))))();
																																		 *0x1384a4c = _t818;
																																		goto L68;
																																	}
																																} else {
																																	_t818 = _t843;
																																	goto L68;
																																}
																															}
																														} else {
																															_t817 = _v16;
																															_v16 = _t817;
																															_v4 = 1;
																															E01335C34(_t817);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t817 + 4))))();
																															 *0x1384a18 = _t817;
																															goto L61;
																														}
																													} else {
																														_t817 = _t842;
																														goto L61;
																													}
																												}
																											} else {
																												_t816 = _v16;
																												_v16 = _t816;
																												_v4 = 1;
																												E01335C34(_t816);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t816 + 4))))();
																												 *0x1384a48 = _t816;
																												goto L54;
																											}
																										} else {
																											_t816 = _t841;
																											goto L54;
																										}
																									}
																								} else {
																									_t815 = _v16;
																									_v16 = _t815;
																									_v4 = 1;
																									E01335C34(_t815);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t815 + 4))))();
																									 *0x1384a14 = _t815;
																									goto L47;
																								}
																							} else {
																								_t815 = _t840;
																								goto L47;
																							}
																						}
																					} else {
																						_t814 = _v16;
																						_v16 = _t814;
																						_v4 = 1;
																						E01335C34(_t814);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t814 + 4))))();
																						 *0x1384a44 = _t814;
																						goto L40;
																					}
																				} else {
																					_t814 = _t839;
																					goto L40;
																				}
																			}
																		} else {
																			_t813 = _v16;
																			_v16 = _t813;
																			_v4 = 1;
																			E01335C34(_t813);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t813 + 4))))();
																			 *0x1384a30 = _t813;
																			goto L33;
																		}
																	} else {
																		_t813 = _t838;
																		goto L33;
																	}
																}
															} else {
																_t812 = _v16;
																_v16 = _t812;
																_v4 = 1;
																E01335C34(_t812);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t812 + 4))))();
																 *0x1384a10 = _t812;
																goto L26;
															}
														} else {
															_t812 = _t837;
															goto L26;
														}
													}
												} else {
													_t811 = _v16;
													_v16 = _t811;
													_v4 = 1;
													E01335C34(_t811);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t811 + 4))))();
													 *0x1384a40 = _t811;
													goto L19;
												}
											} else {
												_t811 = _t836;
												goto L19;
											}
										}
									} else {
										_t810 = _v16;
										_v16 = _t810;
										_v4 = 1;
										E01335C34(_t810);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t810 + 4))))();
										 *0x1384a2c = _t810;
										goto L12;
									}
								} else {
									_t810 = _t835;
									goto L12;
								}
							}
						} else {
							_t809 = _v16;
							_v16 = _t809;
							_v4 = 1;
							E01335C34(_t809);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t809 + 4))))();
							 *0x1384a60 = _t809;
							goto L5;
						}
					} else {
						_t809 = _t834;
						goto L5;
					}
				}
			}

0x013375b6
0x013375b6
0x013375b6
0x013375bd
0x013375c7
0x013375cc
0x013375d7
0x013375db
0x013375e7
0x013375ec
0x013375f0
0x01337635
0x01337638
0x01337644
0x013375f2
0x013375f4
0x013375fa
0x01337600
0x01337608
0x0133760b
0x01337645
0x0133764a
0x0133764b
0x01337652
0x0133765c
0x01337661
0x0133766c
0x01337670
0x01337681
0x01337683
0x01337685
0x013376ca
0x013376cd
0x013376d9
0x01337687
0x01337687
0x01337689
0x0133768f
0x01337695
0x0133769d
0x013376a0
0x013376da
0x013376df
0x013376e0
0x013376e7
0x013376f1
0x013376f6
0x01337701
0x01337705
0x01337716
0x01337718
0x0133771a
0x0133775f
0x01337762
0x0133776e
0x0133771c
0x0133771c
0x0133771e
0x01337724
0x0133772a
0x01337732
0x01337735
0x0133776f
0x01337774
0x01337775
0x0133777c
0x01337786
0x0133778b
0x01337796
0x0133779a
0x013377ab
0x013377ad
0x013377af
0x013377f4
0x013377f7
0x01337803
0x013377b1
0x013377b1
0x013377b3
0x013377b9
0x013377bf
0x013377c7
0x013377ca
0x01337804
0x01337809
0x0133780a
0x01337811
0x0133781b
0x01337820
0x0133782b
0x0133782f
0x01337840
0x01337842
0x01337844
0x01337889
0x0133788c
0x01337898
0x01337846
0x01337846
0x01337848
0x0133784e
0x01337854
0x0133785c
0x0133785f
0x01337899
0x0133789e
0x0133789f
0x013378a6
0x013378b0
0x013378b5
0x013378c0
0x013378c4
0x013378d5
0x013378d7
0x013378d9
0x0133791e
0x01337921
0x0133792d
0x013378db
0x013378db
0x013378dd
0x013378e3
0x013378e9
0x013378f1
0x013378f4
0x0133792e
0x01337933
0x01337934
0x0133793b
0x01337945
0x0133794a
0x01337955
0x01337959
0x0133796a
0x0133796c
0x0133796e
0x013379b3
0x013379b6
0x013379c2
0x01337970
0x01337970
0x01337972
0x01337978
0x0133797e
0x01337986
0x01337989
0x013379c3
0x013379c8
0x013379c9
0x013379d0
0x013379da
0x013379df
0x013379ea
0x013379ee
0x013379ff
0x01337a01
0x01337a03
0x01337a48
0x01337a4b
0x01337a57
0x01337a05
0x01337a05
0x01337a07
0x01337a0d
0x01337a13
0x01337a1b
0x01337a1e
0x01337a58
0x01337a5d
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a94
0x01337a96
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c
0x01337a20
0x01337a20
0x01337a23
0x01337a27
0x01337a2b
0x01337a38
0x01337a40
0x01337a42
0x00000000
0x01337a42
0x01337a09
0x01337a09
0x00000000
0x01337a09
0x01337a07
0x0133798b
0x0133798b
0x0133798e
0x01337992
0x01337996
0x013379a3
0x013379ab
0x013379ad
0x00000000
0x013379ad
0x01337974
0x01337974
0x00000000
0x01337974
0x01337972
0x013378f6
0x013378f6
0x013378f9
0x013378fd
0x01337901
0x0133790e
0x01337916
0x01337918
0x00000000
0x01337918
0x013378df
0x013378df
0x00000000
0x013378df
0x013378dd
0x01337861
0x01337861
0x01337864
0x01337868
0x0133786c
0x01337879
0x01337881
0x01337883
0x00000000
0x01337883
0x0133784a
0x0133784a
0x00000000
0x0133784a
0x01337848
0x013377cc
0x013377cc
0x013377cf
0x013377d3
0x013377d7
0x013377e4
0x013377ec
0x013377ee
0x00000000
0x013377ee
0x013377b5
0x013377b5
0x00000000
0x013377b5
0x013377b3
0x01337737
0x01337737
0x0133773a
0x0133773e
0x01337742
0x0133774f
0x01337757
0x01337759
0x00000000
0x01337759
0x01337720
0x01337720
0x00000000
0x01337720
0x0133771e
0x013376a2
0x013376a2
0x013376a5
0x013376a9
0x013376ad
0x013376ba
0x013376c2
0x013376c4
0x00000000
0x013376c4
0x0133768b
0x0133768b
0x00000000
0x0133768b
0x01337689
0x0133760d
0x0133760d
0x01337610
0x01337614
0x01337618
0x01337625
0x0133762d
0x0133762f
0x00000000
0x0133762f
0x013375f6
0x013375f6
0x00000000
0x013375f6
0x013375f4

APIs

__EH_prolog3.LIBCMT ref: 013375BD
std::_Lockit::_Lockit.LIBCPMT ref: 013375C7

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

codecvt.LIBCPMT ref: 01337601
std::_Facet_Register.LIBCPMT ref: 01337618
std::_Lockit::~_Lockit.LIBCPMT ref: 01337638

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: d7535f9183667f015d721fddb5d08b8e3412e4ba23e6eb2103d25bcac730b214
Instruction ID: 75cc6cbfad5746b020ba46f597e97a1194e83f927e8c3f2df673e5d14c4684ec
Opcode Fuzzy Hash: d7535f9183667f015d721fddb5d08b8e3412e4ba23e6eb2103d25bcac730b214
Instruction Fuzzy Hash: F401CC7590022B9BDF05FBACC4547AEBBA5AFE0328F244109D811AB291DF34DA01CB99

Uniqueness

Uniqueness Score: -1.00%

Function 01337775 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E01337775(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v72;
				intOrPtr* _t240;
				void* _t443;
				intOrPtr* _t446;
				void* _t639;
				intOrPtr _t640;
				intOrPtr* _t702;
				intOrPtr* _t703;
				intOrPtr* _t704;
				intOrPtr* _t705;
				intOrPtr* _t706;
				intOrPtr* _t707;
				intOrPtr* _t708;
				intOrPtr* _t709;
				intOrPtr* _t710;
				intOrPtr* _t711;
				intOrPtr* _t712;
				intOrPtr* _t713;
				intOrPtr* _t714;
				intOrPtr* _t715;
				intOrPtr* _t716;
				intOrPtr* _t717;
				intOrPtr* _t718;
				intOrPtr* _t719;
				void* _t720;
				void* _t723;
				intOrPtr* _t724;
				intOrPtr* _t725;
				intOrPtr* _t726;
				intOrPtr* _t727;
				intOrPtr* _t728;
				intOrPtr* _t729;
				intOrPtr* _t730;
				intOrPtr* _t731;
				intOrPtr* _t732;
				intOrPtr* _t733;
				intOrPtr* _t734;
				intOrPtr* _t735;
				intOrPtr* _t736;
				intOrPtr* _t737;
				intOrPtr* _t738;
				intOrPtr* _t739;
				intOrPtr* _t740;
				void* _t741;
				void* _t742;

				_t699 = __edx;
				_t525 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t723 =  *0x1384a10; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t723;
				_t240 = E0132BD50(_a8, E0132BCE0());
				_t701 = _t240;
				if(_t240 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t701);
				} else {
					if(_t723 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338D25(__ebx, __edx, _t701, _t723, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t701, _t723);
							E01335EA5( &_v20, 0);
							_t724 =  *0x1384a30; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t724;
							_t702 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t702;
							if(_t702 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t702);
							} else {
								__eflags = _t724;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338DC7(_t525, _t702, _t724, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t525, _t702, _t724);
										E01335EA5( &_v20, 0);
										_t725 =  *0x1384a44; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t725;
										_t703 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t703;
										if(_t703 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t703);
										} else {
											__eflags = _t725;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01338E37(_t525, _t703, _t725, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t525, _t703, _t725);
													E01335EA5( &_v20, 0);
													_t726 =  *0x1384a14; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t726;
													_t704 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t704;
													if(_t704 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t704);
													} else {
														__eflags = _t726;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01338E9F(_t525, _t704, _t726, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t525, _t704, _t726);
																E01335EA5( &_v20, 0);
																_t727 =  *0x1384a48; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t727;
																_t705 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t705;
																if(_t705 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t705);
																} else {
																	__eflags = _t727;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01338F07(_t525, _t705, _t727, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t525, _t705, _t727);
																			E01335EA5( &_v20, 0);
																			_t728 =  *0x1384a18; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t728;
																			_t706 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t706;
																			if(_t706 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t706);
																			} else {
																				__eflags = _t728;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E01338F6F(_t525, _t706, _t728, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t525, _t706, _t728);
																						E01335EA5( &_v20, 0);
																						_t729 =  *0x1384a4c; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t729;
																						_t707 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t707;
																						if(_t707 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t707);
																						} else {
																							__eflags = _t729;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E01338FD7(_t525, _t707, _t729, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t525, _t707, _t729);
																									E01335EA5( &_v20, 0);
																									_t730 =  *0x1384a1c; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t730;
																									_t708 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t708;
																									if(_t708 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t708);
																									} else {
																										__eflags = _t730;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0133903F(_t525, _t708, _t730, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t525, _t708, _t730);
																												E01335EA5( &_v20, 0);
																												_t731 =  *0x1384a54; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t731;
																												_t709 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t709;
																												if(_t709 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t709);
																												} else {
																													__eflags = _t731;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E013390A7(_t525, _t709, _t731, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t525, _t709, _t731);
																															E01335EA5( &_v20, 0);
																															_t732 =  *0x1384a50; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t732;
																															_t710 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t710;
																															if(_t710 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t710);
																															} else {
																																__eflags = _t732;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0133912B(_t525, _t710, _t732, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t525, _t710, _t732);
																																		E01335EA5( &_v20, 0);
																																		_t733 =  *0x1384a24; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t733;
																																		_t711 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t711;
																																		if(_t711 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t711);
																																		} else {
																																			__eflags = _t733;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E013391B0(_t525, _t711, _t733, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t525, _t711, _t733);
																																					E01335EA5( &_v20, 0);
																																					_t734 =  *0x1384a20; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t734;
																																					_t712 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t712;
																																					if(_t712 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t712);
																																					} else {
																																						__eflags = _t734;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E01339234(_t525, _t712, _t734, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t525, _t712, _t734);
																																								E01335EA5( &_v20, 0);
																																								_t735 =  *0x1384a34; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t735;
																																								_t713 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t713;
																																								if(_t713 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t713);
																																								} else {
																																									__eflags = _t735;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E013392B9(_t525, _t713, _t735, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t525, _t713, _t735);
																																											E01335EA5( &_v20, 0);
																																											_t736 =  *0x1384a0c; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t736;
																																											_t714 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t714;
																																											if(_t714 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t714);
																																											} else {
																																												__eflags = _t736;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E01339321(_t525, _t714, _t736, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E01348213(0x136b979, _t525, _t714, _t736);
																																														E01335EA5( &_v20, 0);
																																														_t737 =  *0x1384a38; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t737;
																																														_t715 = E0132BD50(_a8, E0132BCE0());
																																														__eflags = _t715;
																																														if(_t715 != 0) {
																																															L103:
																																															E01335EFD( &_v20);
																																															return E013481F0(_t715);
																																														} else {
																																															__eflags = _t737;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E01339389(_t525, _t715, _t737, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0132C550(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E01348213(0x136b979, _t525, _t715, _t737);
																																																	E01335EA5( &_v20, 0);
																																																	_t738 =  *0x1384a3c; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t738;
																																																	_t716 = E0132BD50(_a8, E0132BCE0());
																																																	__eflags = _t716;
																																																	if(_t716 != 0) {
																																																		L110:
																																																		E01335EFD( &_v20);
																																																		return E013481F0(_t716);
																																																	} else {
																																																		__eflags = _t738;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E013393F1(_t525, __edx, _t716, _t738, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0132C550(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E01348213(0x136b979, _t525, _t716, _t738);
																																																				E01335EA5( &_v20, 0);
																																																				_t739 =  *0x1384a58; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t739;
																																																				_t717 = E0132BD50(_a8, E0132BCE0());
																																																				__eflags = _t717;
																																																				if(_t717 != 0) {
																																																					L117:
																																																					E01335EFD( &_v20);
																																																					return E013481F0(_t717);
																																																				} else {
																																																					__eflags = _t739;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E0133946C(_t525, _t717, _t739, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0132C550(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E01348213(0x136b979, _t525, _t717, _t739);
																																																							E01335EA5( &_v20, 0);
																																																							_t740 =  *0x1384a28; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t740;
																																																							_t718 = E0132BD50(_a8, E0132BCE0());
																																																							__eflags = _t718;
																																																							if(_t718 != 0) {
																																																								L124:
																																																								E01335EFD( &_v20);
																																																								return E013481F0(_t718);
																																																							} else {
																																																								__eflags = _t740;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E013394D8(_t525, _t718, _t740, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0132C550(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E01348213(0x136b979, _t525, _t718, _t740);
																																																										E01335EA5( &_v20, 0);
																																																										_t741 =  *0x1384a5c; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t741;
																																																										_t719 = E0132BD50(_a8, E0132BCE0());
																																																										__eflags = _t719;
																																																										if(_t719 != 0) {
																																																											L131:
																																																											E01335EFD( &_v20);
																																																											return E013481F0(_t719);
																																																										} else {
																																																											__eflags = _t741;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												_t443 = E01339544(_t525, _t719, _t741, __eflags);
																																																												_pop(_t639);
																																																												__eflags = _t443 - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0132C550(__eflags);
																																																													asm("int3");
																																																													_push(_t741);
																																																													_push(_t719);
																																																													_t742 = _t639;
																																																													_t720 = _t742;
																																																													asm("stosd");
																																																													asm("stosd");
																																																													asm("stosd");
																																																													asm("stosd");
																																																													_t446 = _v72;
																																																													 *(_t742 + 0x10) =  *(_t742 + 0x10) & 0x00000000;
																																																													 *(_t742 + 0x14) =  *(_t742 + 0x14) & 0x00000000;
																																																													__eflags =  *((intOrPtr*)(_t446 + 0x14)) - 8;
																																																													_t640 =  *((intOrPtr*)(_t446 + 0x10));
																																																													if( *((intOrPtr*)(_t446 + 0x14)) >= 8) {
																																																														_t446 =  *_t446;
																																																													}
																																																													_push(_t640);
																																																													E0133657C(_t525, _t742, _t699, _t720, _t446);
																																																													return _t742;
																																																												} else {
																																																													_t719 = _v16;
																																																													_v16 = _t719;
																																																													_v4 = 1;
																																																													E01335C34(_t719);
																																																													 *0x136d26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t719 + 4))))();
																																																													 *0x1384a5c = _t719;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t719 = _t741;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t718 = _v16;
																																																										_v16 = _t718;
																																																										_v4 = 1;
																																																										E01335C34(_t718);
																																																										 *0x136d26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t718 + 4))))();
																																																										 *0x1384a28 = _t718;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t718 = _t740;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t717 = _v16;
																																																							_v16 = _t717;
																																																							_v4 = 1;
																																																							E01335C34(_t717);
																																																							 *0x136d26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t717 + 4))))();
																																																							 *0x1384a58 = _t717;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t717 = _t739;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t716 = _v16;
																																																				_v16 = _t716;
																																																				_v4 = 1;
																																																				E01335C34(_t716);
																																																				 *0x136d26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t716 + 4))))();
																																																				 *0x1384a3c = _t716;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t716 = _t738;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t715 = _v16;
																																																	_v16 = _t715;
																																																	_v4 = 1;
																																																	E01335C34(_t715);
																																																	 *0x136d26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t715 + 4))))();
																																																	 *0x1384a38 = _t715;
																																																	goto L103;
																																																}
																																															} else {
																																																_t715 = _t737;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t714 = _v16;
																																														_v16 = _t714;
																																														_v4 = 1;
																																														E01335C34(_t714);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t714 + 4))))();
																																														 *0x1384a0c = _t714;
																																														goto L96;
																																													}
																																												} else {
																																													_t714 = _t736;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t713 = _v16;
																																											_v16 = _t713;
																																											_v4 = 1;
																																											E01335C34(_t713);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t713 + 4))))();
																																											 *0x1384a34 = _t713;
																																											goto L89;
																																										}
																																									} else {
																																										_t713 = _t735;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t712 = _v16;
																																								_v16 = _t712;
																																								_v4 = 1;
																																								E01335C34(_t712);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t712 + 4))))();
																																								 *0x1384a20 = _t712;
																																								goto L82;
																																							}
																																						} else {
																																							_t712 = _t734;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t711 = _v16;
																																					_v16 = _t711;
																																					_v4 = 1;
																																					E01335C34(_t711);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t711 + 4))))();
																																					 *0x1384a24 = _t711;
																																					goto L75;
																																				}
																																			} else {
																																				_t711 = _t733;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t710 = _v16;
																																		_v16 = _t710;
																																		_v4 = 1;
																																		E01335C34(_t710);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t710 + 4))))();
																																		 *0x1384a50 = _t710;
																																		goto L68;
																																	}
																																} else {
																																	_t710 = _t732;
																																	goto L68;
																																}
																															}
																														} else {
																															_t709 = _v16;
																															_v16 = _t709;
																															_v4 = 1;
																															E01335C34(_t709);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t709 + 4))))();
																															 *0x1384a54 = _t709;
																															goto L61;
																														}
																													} else {
																														_t709 = _t731;
																														goto L61;
																													}
																												}
																											} else {
																												_t708 = _v16;
																												_v16 = _t708;
																												_v4 = 1;
																												E01335C34(_t708);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t708 + 4))))();
																												 *0x1384a1c = _t708;
																												goto L54;
																											}
																										} else {
																											_t708 = _t730;
																											goto L54;
																										}
																									}
																								} else {
																									_t707 = _v16;
																									_v16 = _t707;
																									_v4 = 1;
																									E01335C34(_t707);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t707 + 4))))();
																									 *0x1384a4c = _t707;
																									goto L47;
																								}
																							} else {
																								_t707 = _t729;
																								goto L47;
																							}
																						}
																					} else {
																						_t706 = _v16;
																						_v16 = _t706;
																						_v4 = 1;
																						E01335C34(_t706);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t706 + 4))))();
																						 *0x1384a18 = _t706;
																						goto L40;
																					}
																				} else {
																					_t706 = _t728;
																					goto L40;
																				}
																			}
																		} else {
																			_t705 = _v16;
																			_v16 = _t705;
																			_v4 = 1;
																			E01335C34(_t705);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t705 + 4))))();
																			 *0x1384a48 = _t705;
																			goto L33;
																		}
																	} else {
																		_t705 = _t727;
																		goto L33;
																	}
																}
															} else {
																_t704 = _v16;
																_v16 = _t704;
																_v4 = 1;
																E01335C34(_t704);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t704 + 4))))();
																 *0x1384a14 = _t704;
																goto L26;
															}
														} else {
															_t704 = _t726;
															goto L26;
														}
													}
												} else {
													_t703 = _v16;
													_v16 = _t703;
													_v4 = 1;
													E01335C34(_t703);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t703 + 4))))();
													 *0x1384a44 = _t703;
													goto L19;
												}
											} else {
												_t703 = _t725;
												goto L19;
											}
										}
									} else {
										_t702 = _v16;
										_v16 = _t702;
										_v4 = 1;
										E01335C34(_t702);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t702 + 4))))();
										 *0x1384a30 = _t702;
										goto L12;
									}
								} else {
									_t702 = _t724;
									goto L12;
								}
							}
						} else {
							_t701 = _v16;
							_v16 = _t701;
							_v4 = 1;
							E01335C34(_t701);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t701 + 4))))();
							 *0x1384a10 = _t701;
							goto L5;
						}
					} else {
						_t701 = _t723;
						goto L5;
					}
				}
			}

0x01337775
0x01337775
0x01337775
0x0133777c
0x01337786
0x0133778b
0x01337796
0x0133779a
0x013377a6
0x013377ab
0x013377af
0x013377f4
0x013377f7
0x01337803
0x013377b1
0x013377b3
0x013377b9
0x013377bf
0x013377c7
0x013377ca
0x01337804
0x01337809
0x0133780a
0x01337811
0x0133781b
0x01337820
0x0133782b
0x0133782f
0x01337840
0x01337842
0x01337844
0x01337889
0x0133788c
0x01337898
0x01337846
0x01337846
0x01337848
0x0133784e
0x01337854
0x0133785c
0x0133785f
0x01337899
0x0133789e
0x0133789f
0x013378a6
0x013378b0
0x013378b5
0x013378c0
0x013378c4
0x013378d5
0x013378d7
0x013378d9
0x0133791e
0x01337921
0x0133792d
0x013378db
0x013378db
0x013378dd
0x013378e3
0x013378e9
0x013378f1
0x013378f4
0x0133792e
0x01337933
0x01337934
0x0133793b
0x01337945
0x0133794a
0x01337955
0x01337959
0x0133796a
0x0133796c
0x0133796e
0x013379b3
0x013379b6
0x013379c2
0x01337970
0x01337970
0x01337972
0x01337978
0x0133797e
0x01337986
0x01337989
0x013379c3
0x013379c8
0x013379c9
0x013379d0
0x013379da
0x013379df
0x013379ea
0x013379ee
0x013379ff
0x01337a01
0x01337a03
0x01337a48
0x01337a4b
0x01337a57
0x01337a05
0x01337a05
0x01337a07
0x01337a0d
0x01337a13
0x01337a1b
0x01337a1e
0x01337a58
0x01337a5d
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a94
0x01337a96
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c
0x01337a20
0x01337a20
0x01337a23
0x01337a27
0x01337a2b
0x01337a38
0x01337a40
0x01337a42
0x00000000
0x01337a42
0x01337a09
0x01337a09
0x00000000
0x01337a09
0x01337a07
0x0133798b
0x0133798b
0x0133798e
0x01337992
0x01337996
0x013379a3
0x013379ab
0x013379ad
0x00000000
0x013379ad
0x01337974
0x01337974
0x00000000
0x01337974
0x01337972
0x013378f6
0x013378f6
0x013378f9
0x013378fd
0x01337901
0x0133790e
0x01337916
0x01337918
0x00000000
0x01337918
0x013378df
0x013378df
0x00000000
0x013378df
0x013378dd
0x01337861
0x01337861
0x01337864
0x01337868
0x0133786c
0x01337879
0x01337881
0x01337883
0x00000000
0x01337883
0x0133784a
0x0133784a
0x00000000
0x0133784a
0x01337848
0x013377cc
0x013377cc
0x013377cf
0x013377d3
0x013377d7
0x013377e4
0x013377ec
0x013377ee
0x00000000
0x013377ee
0x013377b5
0x013377b5
0x00000000
0x013377b5
0x013377b3

APIs

__EH_prolog3.LIBCMT ref: 0133777C
std::_Lockit::_Lockit.LIBCPMT ref: 01337786

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

collate.LIBCPMT ref: 013377C0
std::_Facet_Register.LIBCPMT ref: 013377D7
std::_Lockit::~_Lockit.LIBCPMT ref: 013377F7

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: e7353cb71b0cddc3f879401c4bb87ba4a77ded95bcebde91094c0c17cbfc58b5
Instruction ID: 8b3aeffa847cc149f79760cf4366495794661855901616b718a22241e264d845
Opcode Fuzzy Hash: e7353cb71b0cddc3f879401c4bb87ba4a77ded95bcebde91094c0c17cbfc58b5
Instruction Fuzzy Hash: 5901C07590022BDBCF11FBACD4446BEBBB5BFD0328F244549D521AB281DF349A01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01332664 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01332664(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t56;
				void* _t94;
				void* _t95;
				intOrPtr* _t139;
				intOrPtr* _t140;
				intOrPtr* _t155;
				intOrPtr* _t156;
				intOrPtr* _t157;
				intOrPtr* _t159;
				intOrPtr* _t160;
				intOrPtr* _t161;
				intOrPtr* _t162;
				void* _t169;

				_t115 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t169 - 0x14, 0);
				_t159 =  *0x1384888; // 0x0
				 *(_t169 - 4) =  *(_t169 - 4) & 0x00000000;
				 *((intOrPtr*)(_t169 - 0x10)) = _t159;
				_t56 = E0132BD50( *((intOrPtr*)(_t169 + 8)), E0132BCE0());
				_t154 = _t56;
				if(_t56 != 0) {
					L5:
					E01335EFD(_t169 - 0x14);
					return E013481F0(_t154);
				} else {
					if(_t159 == 0) {
						_push( *((intOrPtr*)(_t169 + 8)));
						_push(_t169 - 0x10);
						__eflags = E01332D4B(__ebx, _t154, _t159, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t154, _t159);
							E01335EA5(_t169 - 0x14, 0);
							_t160 =  *0x138487c; // 0x0
							 *(_t169 - 4) =  *(_t169 - 4) & 0x00000000;
							 *((intOrPtr*)(_t169 - 0x10)) = _t160;
							_t155 = E0132BD50( *((intOrPtr*)(_t169 + 8)), E0132BCE0());
							__eflags = _t155;
							if(_t155 != 0) {
								L12:
								E01335EFD(_t169 - 0x14);
								return E013481F0(_t155);
							} else {
								__eflags = _t160;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t169 + 8)));
									_push(_t169 - 0x10);
									__eflags = E01332DB3(_t115, _t155, _t160, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t115, _t155, _t160);
										E01335EA5(_t169 - 0x14, 0);
										_t161 =  *0x1384880; // 0x0
										 *(_t169 - 4) =  *(_t169 - 4) & 0x00000000;
										 *((intOrPtr*)(_t169 - 0x10)) = _t161;
										_t156 = E0132BD50( *((intOrPtr*)(_t169 + 8)), E0132BCE0());
										__eflags = _t156;
										if(_t156 != 0) {
											L19:
											E01335EFD(_t169 - 0x14);
											return E013481F0(_t156);
										} else {
											__eflags = _t161;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t169 + 8)));
												_push(_t169 - 0x10);
												__eflags = E01332E1B(_t115, _t156, _t161, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t115, _t156, _t161);
													E01335EA5(_t169 - 0x14, 0);
													_t162 =  *0x1384884; // 0x0
													 *(_t169 - 4) =  *(_t169 - 4) & 0x00000000;
													 *((intOrPtr*)(_t169 - 0x10)) = _t162;
													_t157 = E0132BD50( *((intOrPtr*)(_t169 + 8)), E0132BCE0());
													__eflags = _t157;
													if(_t157 != 0) {
														L26:
														E01335EFD(_t169 - 0x14);
														return E013481F0(_t157);
													} else {
														__eflags = _t162;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t169 + 8)));
															_push(_t169 - 0x10);
															_t94 = E01332E83(_t115, _t157, _t162, __eflags);
															_pop(_t139);
															__eflags = _t94 - 0xffffffff;
															if(__eflags == 0) {
																_t95 = E0132C550(__eflags);
																asm("int3");
																_t140 =  *_t139;
																__eflags = _t140;
																if(_t140 != 0) {
																	_push(_t162);
																	_t163 = _t140;
																	E0134C213( *((intOrPtr*)(_t140 + 8)));
																	E0134C213( *((intOrPtr*)(_t140 + 0x10)));
																	return E0134C213( *((intOrPtr*)(_t163 + 0x14)));
																} else {
																	return _t95;
																}
															} else {
																_t157 =  *((intOrPtr*)(_t169 - 0x10));
																 *((intOrPtr*)(_t169 - 0x10)) = _t157;
																 *(_t169 - 4) = 1;
																E01335C34(_t157);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t157 + 4))))();
																 *0x1384884 = _t157;
																goto L26;
															}
														} else {
															_t157 = _t162;
															goto L26;
														}
													}
												} else {
													_t156 =  *((intOrPtr*)(_t169 - 0x10));
													 *((intOrPtr*)(_t169 - 0x10)) = _t156;
													 *(_t169 - 4) = 1;
													E01335C34(_t156);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t156 + 4))))();
													 *0x1384880 = _t156;
													goto L19;
												}
											} else {
												_t156 = _t161;
												goto L19;
											}
										}
									} else {
										_t155 =  *((intOrPtr*)(_t169 - 0x10));
										 *((intOrPtr*)(_t169 - 0x10)) = _t155;
										 *(_t169 - 4) = 1;
										E01335C34(_t155);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t155 + 4))))();
										 *0x138487c = _t155;
										goto L12;
									}
								} else {
									_t155 = _t160;
									goto L12;
								}
							}
						} else {
							_t154 =  *((intOrPtr*)(_t169 - 0x10));
							 *((intOrPtr*)(_t169 - 0x10)) = _t154;
							 *(_t169 - 4) = 1;
							E01335C34(_t154);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t154 + 4))))();
							 *0x1384888 = _t154;
							goto L5;
						}
					} else {
						_t154 = _t159;
						goto L5;
					}
				}
			}

0x01332664
0x01332664
0x0133266b
0x01332675
0x0133267a
0x01332685
0x01332689
0x01332695
0x0133269a
0x0133269e
0x013326e3
0x013326e6
0x013326f2
0x013326a0
0x013326a2
0x013326a8
0x013326ae
0x013326b6
0x013326b9
0x013326f3
0x013326f8
0x013326f9
0x01332700
0x0133270a
0x0133270f
0x0133271a
0x0133271e
0x0133272f
0x01332731
0x01332733
0x01332778
0x0133277b
0x01332787
0x01332735
0x01332735
0x01332737
0x0133273d
0x01332743
0x0133274b
0x0133274e
0x01332788
0x0133278d
0x0133278e
0x01332795
0x0133279f
0x013327a4
0x013327af
0x013327b3
0x013327c4
0x013327c6
0x013327c8
0x0133280d
0x01332810
0x0133281c
0x013327ca
0x013327ca
0x013327cc
0x013327d2
0x013327d8
0x013327e0
0x013327e3
0x0133281d
0x01332822
0x01332823
0x0133282a
0x01332834
0x01332839
0x01332844
0x01332848
0x01332859
0x0133285b
0x0133285d
0x013328a2
0x013328a5
0x013328b1
0x0133285f
0x0133285f
0x01332861
0x01332867
0x0133286d
0x0133286e
0x01332874
0x01332875
0x01332878
0x013328b2
0x013328b7
0x013328b8
0x013328ba
0x013328bc
0x013348d0
0x013348d1
0x013348d6
0x013348de
0x013348ef
0x013328c2
0x013328c2
0x013328c2
0x0133287a
0x0133287a
0x0133287d
0x01332881
0x01332885
0x01332892
0x0133289a
0x0133289c
0x00000000
0x0133289c
0x01332863
0x01332863
0x00000000
0x01332863
0x01332861
0x013327e5
0x013327e5
0x013327e8
0x013327ec
0x013327f0
0x013327fd
0x01332805
0x01332807
0x00000000
0x01332807
0x013327ce
0x013327ce
0x00000000
0x013327ce
0x013327cc
0x01332750
0x01332750
0x01332753
0x01332757
0x0133275b
0x01332768
0x01332770
0x01332772
0x00000000
0x01332772
0x01332739
0x01332739
0x00000000
0x01332739
0x01332737
0x013326bb
0x013326bb
0x013326be
0x013326c2
0x013326c6
0x013326d3
0x013326db
0x013326dd
0x00000000
0x013326dd
0x013326a4
0x013326a4
0x00000000
0x013326a4
0x013326a2

APIs

__EH_prolog3.LIBCMT ref: 0133266B
std::_Lockit::_Lockit.LIBCPMT ref: 01332675

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

codecvt.LIBCPMT ref: 013326AF
std::_Facet_Register.LIBCPMT ref: 013326C6
std::_Lockit::~_Lockit.LIBCPMT ref: 013326E6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 6bd7b37011dc413e30b4dbf49878a25a6034bf766b5fb51f08ef775c4c550f34
Instruction ID: 779df5bcc04dbb3b2095433bb4e10fc8a26a8324831767f7782837ffbd704a4b
Opcode Fuzzy Hash: 6bd7b37011dc413e30b4dbf49878a25a6034bf766b5fb51f08ef775c4c550f34
Instruction Fuzzy Hash: 1601D23590022A9BCF05FBACC8447BEBBB9AFD0328F254109D410AB290DF749A01DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0133764B Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0133764B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v80;
				intOrPtr* _t264;
				void* _t489;
				intOrPtr* _t492;
				void* _t705;
				intOrPtr _t706;
				intOrPtr* _t774;
				intOrPtr* _t775;
				intOrPtr* _t776;
				intOrPtr* _t777;
				intOrPtr* _t778;
				intOrPtr* _t779;
				intOrPtr* _t780;
				intOrPtr* _t781;
				intOrPtr* _t782;
				intOrPtr* _t783;
				intOrPtr* _t784;
				intOrPtr* _t785;
				intOrPtr* _t786;
				intOrPtr* _t787;
				intOrPtr* _t788;
				intOrPtr* _t789;
				intOrPtr* _t790;
				intOrPtr* _t791;
				intOrPtr* _t792;
				intOrPtr* _t793;
				void* _t794;
				void* _t797;
				intOrPtr* _t798;
				intOrPtr* _t799;
				intOrPtr* _t800;
				intOrPtr* _t801;
				intOrPtr* _t802;
				intOrPtr* _t803;
				intOrPtr* _t804;
				intOrPtr* _t805;
				intOrPtr* _t806;
				intOrPtr* _t807;
				intOrPtr* _t808;
				intOrPtr* _t809;
				intOrPtr* _t810;
				intOrPtr* _t811;
				intOrPtr* _t812;
				intOrPtr* _t813;
				intOrPtr* _t814;
				intOrPtr* _t815;
				intOrPtr* _t816;
				void* _t817;
				void* _t818;

				_t771 = __edx;
				_t579 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t797 =  *0x1384a2c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t797;
				_t264 = E0132BD50(_a8, E0132BCE0());
				_t773 = _t264;
				if(_t264 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t773);
				} else {
					if(_t797 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338C1D(__ebx, _t773, _t797, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t773, _t797);
							E01335EA5( &_v20, 0);
							_t798 =  *0x1384a40; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t798;
							_t774 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t774;
							if(_t774 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t774);
							} else {
								__eflags = _t798;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338C83(_t579, __edx, _t774, _t798, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t579, _t774, _t798);
										E01335EA5( &_v20, 0);
										_t799 =  *0x1384a10; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t799;
										_t775 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t775;
										if(_t775 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t775);
										} else {
											__eflags = _t799;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01338D25(_t579, __edx, _t775, _t799, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t579, _t775, _t799);
													E01335EA5( &_v20, 0);
													_t800 =  *0x1384a30; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t800;
													_t776 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t776;
													if(_t776 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t776);
													} else {
														__eflags = _t800;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01338DC7(_t579, _t776, _t800, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t579, _t776, _t800);
																E01335EA5( &_v20, 0);
																_t801 =  *0x1384a44; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t801;
																_t777 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t777;
																if(_t777 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t777);
																} else {
																	__eflags = _t801;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01338E37(_t579, _t777, _t801, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t579, _t777, _t801);
																			E01335EA5( &_v20, 0);
																			_t802 =  *0x1384a14; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t802;
																			_t778 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t778;
																			if(_t778 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t778);
																			} else {
																				__eflags = _t802;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E01338E9F(_t579, _t778, _t802, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t579, _t778, _t802);
																						E01335EA5( &_v20, 0);
																						_t803 =  *0x1384a48; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t803;
																						_t779 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t779;
																						if(_t779 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t779);
																						} else {
																							__eflags = _t803;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E01338F07(_t579, _t779, _t803, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t579, _t779, _t803);
																									E01335EA5( &_v20, 0);
																									_t804 =  *0x1384a18; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t804;
																									_t780 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t780;
																									if(_t780 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t780);
																									} else {
																										__eflags = _t804;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E01338F6F(_t579, _t780, _t804, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t579, _t780, _t804);
																												E01335EA5( &_v20, 0);
																												_t805 =  *0x1384a4c; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t805;
																												_t781 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t781;
																												if(_t781 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t781);
																												} else {
																													__eflags = _t805;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E01338FD7(_t579, _t781, _t805, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t579, _t781, _t805);
																															E01335EA5( &_v20, 0);
																															_t806 =  *0x1384a1c; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t806;
																															_t782 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t782;
																															if(_t782 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t782);
																															} else {
																																__eflags = _t806;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0133903F(_t579, _t782, _t806, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t579, _t782, _t806);
																																		E01335EA5( &_v20, 0);
																																		_t807 =  *0x1384a54; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t807;
																																		_t783 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t783;
																																		if(_t783 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t783);
																																		} else {
																																			__eflags = _t807;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E013390A7(_t579, _t783, _t807, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t579, _t783, _t807);
																																					E01335EA5( &_v20, 0);
																																					_t808 =  *0x1384a50; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t808;
																																					_t784 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t784;
																																					if(_t784 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t784);
																																					} else {
																																						__eflags = _t808;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0133912B(_t579, _t784, _t808, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t579, _t784, _t808);
																																								E01335EA5( &_v20, 0);
																																								_t809 =  *0x1384a24; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t809;
																																								_t785 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t785;
																																								if(_t785 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t785);
																																								} else {
																																									__eflags = _t809;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E013391B0(_t579, _t785, _t809, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t579, _t785, _t809);
																																											E01335EA5( &_v20, 0);
																																											_t810 =  *0x1384a20; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t810;
																																											_t786 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t786;
																																											if(_t786 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t786);
																																											} else {
																																												__eflags = _t810;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E01339234(_t579, _t786, _t810, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E01348213(0x136b979, _t579, _t786, _t810);
																																														E01335EA5( &_v20, 0);
																																														_t811 =  *0x1384a34; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t811;
																																														_t787 = E0132BD50(_a8, E0132BCE0());
																																														__eflags = _t787;
																																														if(_t787 != 0) {
																																															L103:
																																															E01335EFD( &_v20);
																																															return E013481F0(_t787);
																																														} else {
																																															__eflags = _t811;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E013392B9(_t579, _t787, _t811, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0132C550(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E01348213(0x136b979, _t579, _t787, _t811);
																																																	E01335EA5( &_v20, 0);
																																																	_t812 =  *0x1384a0c; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t812;
																																																	_t788 = E0132BD50(_a8, E0132BCE0());
																																																	__eflags = _t788;
																																																	if(_t788 != 0) {
																																																		L110:
																																																		E01335EFD( &_v20);
																																																		return E013481F0(_t788);
																																																	} else {
																																																		__eflags = _t812;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E01339321(_t579, _t788, _t812, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0132C550(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E01348213(0x136b979, _t579, _t788, _t812);
																																																				E01335EA5( &_v20, 0);
																																																				_t813 =  *0x1384a38; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t813;
																																																				_t789 = E0132BD50(_a8, E0132BCE0());
																																																				__eflags = _t789;
																																																				if(_t789 != 0) {
																																																					L117:
																																																					E01335EFD( &_v20);
																																																					return E013481F0(_t789);
																																																				} else {
																																																					__eflags = _t813;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E01339389(_t579, _t789, _t813, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0132C550(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E01348213(0x136b979, _t579, _t789, _t813);
																																																							E01335EA5( &_v20, 0);
																																																							_t814 =  *0x1384a3c; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t814;
																																																							_t790 = E0132BD50(_a8, E0132BCE0());
																																																							__eflags = _t790;
																																																							if(_t790 != 0) {
																																																								L124:
																																																								E01335EFD( &_v20);
																																																								return E013481F0(_t790);
																																																							} else {
																																																								__eflags = _t814;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E013393F1(_t579, __edx, _t790, _t814, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0132C550(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E01348213(0x136b979, _t579, _t790, _t814);
																																																										E01335EA5( &_v20, 0);
																																																										_t815 =  *0x1384a58; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t815;
																																																										_t791 = E0132BD50(_a8, E0132BCE0());
																																																										__eflags = _t791;
																																																										if(_t791 != 0) {
																																																											L131:
																																																											E01335EFD( &_v20);
																																																											return E013481F0(_t791);
																																																										} else {
																																																											__eflags = _t815;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E0133946C(_t579, _t791, _t815, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0132C550(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E01348213(0x136b979, _t579, _t791, _t815);
																																																													E01335EA5( &_v20, 0);
																																																													_t816 =  *0x1384a28; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t816;
																																																													_t792 = E0132BD50(_a8, E0132BCE0());
																																																													__eflags = _t792;
																																																													if(_t792 != 0) {
																																																														L138:
																																																														E01335EFD( &_v20);
																																																														return E013481F0(_t792);
																																																													} else {
																																																														__eflags = _t816;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															__eflags = E013394D8(_t579, _t792, _t816, __eflags) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0132C550(__eflags);
																																																																asm("int3");
																																																																_push(8);
																																																																E01348213(0x136b979, _t579, _t792, _t816);
																																																																E01335EA5( &_v20, 0);
																																																																_t817 =  *0x1384a5c; // 0x0
																																																																_v4 = _v4 & 0x00000000;
																																																																_v16 = _t817;
																																																																_t793 = E0132BD50(_a8, E0132BCE0());
																																																																__eflags = _t793;
																																																																if(_t793 != 0) {
																																																																	L145:
																																																																	E01335EFD( &_v20);
																																																																	return E013481F0(_t793);
																																																																} else {
																																																																	__eflags = _t817;
																																																																	if(__eflags == 0) {
																																																																		_push(_a8);
																																																																		_push( &_v16);
																																																																		_t489 = E01339544(_t579, _t793, _t817, __eflags);
																																																																		_pop(_t705);
																																																																		__eflags = _t489 - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E0132C550(__eflags);
																																																																			asm("int3");
																																																																			_push(_t817);
																																																																			_push(_t793);
																																																																			_t818 = _t705;
																																																																			_t794 = _t818;
																																																																			asm("stosd");
																																																																			asm("stosd");
																																																																			asm("stosd");
																																																																			asm("stosd");
																																																																			_t492 = _v80;
																																																																			 *(_t818 + 0x10) =  *(_t818 + 0x10) & 0x00000000;
																																																																			 *(_t818 + 0x14) =  *(_t818 + 0x14) & 0x00000000;
																																																																			__eflags =  *((intOrPtr*)(_t492 + 0x14)) - 8;
																																																																			_t706 =  *((intOrPtr*)(_t492 + 0x10));
																																																																			if( *((intOrPtr*)(_t492 + 0x14)) >= 8) {
																																																																				_t492 =  *_t492;
																																																																			}
																																																																			_push(_t706);
																																																																			E0133657C(_t579, _t818, _t771, _t794, _t492);
																																																																			return _t818;
																																																																		} else {
																																																																			_t793 = _v16;
																																																																			_v16 = _t793;
																																																																			_v4 = 1;
																																																																			E01335C34(_t793);
																																																																			 *0x136d26c();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t793 + 4))))();
																																																																			 *0x1384a5c = _t793;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t793 = _t817;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t792 = _v16;
																																																																_v16 = _t792;
																																																																_v4 = 1;
																																																																E01335C34(_t792);
																																																																 *0x136d26c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t792 + 4))))();
																																																																 *0x1384a28 = _t792;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t792 = _t816;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t791 = _v16;
																																																													_v16 = _t791;
																																																													_v4 = 1;
																																																													E01335C34(_t791);
																																																													 *0x136d26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t791 + 4))))();
																																																													 *0x1384a58 = _t791;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t791 = _t815;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t790 = _v16;
																																																										_v16 = _t790;
																																																										_v4 = 1;
																																																										E01335C34(_t790);
																																																										 *0x136d26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t790 + 4))))();
																																																										 *0x1384a3c = _t790;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t790 = _t814;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t789 = _v16;
																																																							_v16 = _t789;
																																																							_v4 = 1;
																																																							E01335C34(_t789);
																																																							 *0x136d26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t789 + 4))))();
																																																							 *0x1384a38 = _t789;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t789 = _t813;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t788 = _v16;
																																																				_v16 = _t788;
																																																				_v4 = 1;
																																																				E01335C34(_t788);
																																																				 *0x136d26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t788 + 4))))();
																																																				 *0x1384a0c = _t788;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t788 = _t812;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t787 = _v16;
																																																	_v16 = _t787;
																																																	_v4 = 1;
																																																	E01335C34(_t787);
																																																	 *0x136d26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t787 + 4))))();
																																																	 *0x1384a34 = _t787;
																																																	goto L103;
																																																}
																																															} else {
																																																_t787 = _t811;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t786 = _v16;
																																														_v16 = _t786;
																																														_v4 = 1;
																																														E01335C34(_t786);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t786 + 4))))();
																																														 *0x1384a20 = _t786;
																																														goto L96;
																																													}
																																												} else {
																																													_t786 = _t810;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t785 = _v16;
																																											_v16 = _t785;
																																											_v4 = 1;
																																											E01335C34(_t785);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t785 + 4))))();
																																											 *0x1384a24 = _t785;
																																											goto L89;
																																										}
																																									} else {
																																										_t785 = _t809;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t784 = _v16;
																																								_v16 = _t784;
																																								_v4 = 1;
																																								E01335C34(_t784);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t784 + 4))))();
																																								 *0x1384a50 = _t784;
																																								goto L82;
																																							}
																																						} else {
																																							_t784 = _t808;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t783 = _v16;
																																					_v16 = _t783;
																																					_v4 = 1;
																																					E01335C34(_t783);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t783 + 4))))();
																																					 *0x1384a54 = _t783;
																																					goto L75;
																																				}
																																			} else {
																																				_t783 = _t807;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t782 = _v16;
																																		_v16 = _t782;
																																		_v4 = 1;
																																		E01335C34(_t782);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t782 + 4))))();
																																		 *0x1384a1c = _t782;
																																		goto L68;
																																	}
																																} else {
																																	_t782 = _t806;
																																	goto L68;
																																}
																															}
																														} else {
																															_t781 = _v16;
																															_v16 = _t781;
																															_v4 = 1;
																															E01335C34(_t781);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t781 + 4))))();
																															 *0x1384a4c = _t781;
																															goto L61;
																														}
																													} else {
																														_t781 = _t805;
																														goto L61;
																													}
																												}
																											} else {
																												_t780 = _v16;
																												_v16 = _t780;
																												_v4 = 1;
																												E01335C34(_t780);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t780 + 4))))();
																												 *0x1384a18 = _t780;
																												goto L54;
																											}
																										} else {
																											_t780 = _t804;
																											goto L54;
																										}
																									}
																								} else {
																									_t779 = _v16;
																									_v16 = _t779;
																									_v4 = 1;
																									E01335C34(_t779);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t779 + 4))))();
																									 *0x1384a48 = _t779;
																									goto L47;
																								}
																							} else {
																								_t779 = _t803;
																								goto L47;
																							}
																						}
																					} else {
																						_t778 = _v16;
																						_v16 = _t778;
																						_v4 = 1;
																						E01335C34(_t778);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t778 + 4))))();
																						 *0x1384a14 = _t778;
																						goto L40;
																					}
																				} else {
																					_t778 = _t802;
																					goto L40;
																				}
																			}
																		} else {
																			_t777 = _v16;
																			_v16 = _t777;
																			_v4 = 1;
																			E01335C34(_t777);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t777 + 4))))();
																			 *0x1384a44 = _t777;
																			goto L33;
																		}
																	} else {
																		_t777 = _t801;
																		goto L33;
																	}
																}
															} else {
																_t776 = _v16;
																_v16 = _t776;
																_v4 = 1;
																E01335C34(_t776);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t776 + 4))))();
																 *0x1384a30 = _t776;
																goto L26;
															}
														} else {
															_t776 = _t800;
															goto L26;
														}
													}
												} else {
													_t775 = _v16;
													_v16 = _t775;
													_v4 = 1;
													E01335C34(_t775);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t775 + 4))))();
													 *0x1384a10 = _t775;
													goto L19;
												}
											} else {
												_t775 = _t799;
												goto L19;
											}
										}
									} else {
										_t774 = _v16;
										_v16 = _t774;
										_v4 = 1;
										E01335C34(_t774);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t774 + 4))))();
										 *0x1384a40 = _t774;
										goto L12;
									}
								} else {
									_t774 = _t798;
									goto L12;
								}
							}
						} else {
							_t773 = _v16;
							_v16 = _t773;
							_v4 = 1;
							E01335C34(_t773);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t773 + 4))))();
							 *0x1384a2c = _t773;
							goto L5;
						}
					} else {
						_t773 = _t797;
						goto L5;
					}
				}
			}

0x0133764b
0x0133764b
0x0133764b
0x01337652
0x0133765c
0x01337661
0x0133766c
0x01337670
0x0133767c
0x01337681
0x01337685
0x013376ca
0x013376cd
0x013376d9
0x01337687
0x01337689
0x0133768f
0x01337695
0x0133769d
0x013376a0
0x013376da
0x013376df
0x013376e0
0x013376e7
0x013376f1
0x013376f6
0x01337701
0x01337705
0x01337716
0x01337718
0x0133771a
0x0133775f
0x01337762
0x0133776e
0x0133771c
0x0133771c
0x0133771e
0x01337724
0x0133772a
0x01337732
0x01337735
0x0133776f
0x01337774
0x01337775
0x0133777c
0x01337786
0x0133778b
0x01337796
0x0133779a
0x013377ab
0x013377ad
0x013377af
0x013377f4
0x013377f7
0x01337803
0x013377b1
0x013377b1
0x013377b3
0x013377b9
0x013377bf
0x013377c7
0x013377ca
0x01337804
0x01337809
0x0133780a
0x01337811
0x0133781b
0x01337820
0x0133782b
0x0133782f
0x01337840
0x01337842
0x01337844
0x01337889
0x0133788c
0x01337898
0x01337846
0x01337846
0x01337848
0x0133784e
0x01337854
0x0133785c
0x0133785f
0x01337899
0x0133789e
0x0133789f
0x013378a6
0x013378b0
0x013378b5
0x013378c0
0x013378c4
0x013378d5
0x013378d7
0x013378d9
0x0133791e
0x01337921
0x0133792d
0x013378db
0x013378db
0x013378dd
0x013378e3
0x013378e9
0x013378f1
0x013378f4
0x0133792e
0x01337933
0x01337934
0x0133793b
0x01337945
0x0133794a
0x01337955
0x01337959
0x0133796a
0x0133796c
0x0133796e
0x013379b3
0x013379b6
0x013379c2
0x01337970
0x01337970
0x01337972
0x01337978
0x0133797e
0x01337986
0x01337989
0x013379c3
0x013379c8
0x013379c9
0x013379d0
0x013379da
0x013379df
0x013379ea
0x013379ee
0x013379ff
0x01337a01
0x01337a03
0x01337a48
0x01337a4b
0x01337a57
0x01337a05
0x01337a05
0x01337a07
0x01337a0d
0x01337a13
0x01337a1b
0x01337a1e
0x01337a58
0x01337a5d
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a94
0x01337a96
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c
0x01337a20
0x01337a20
0x01337a23
0x01337a27
0x01337a2b
0x01337a38
0x01337a40
0x01337a42
0x00000000
0x01337a42
0x01337a09
0x01337a09
0x00000000
0x01337a09
0x01337a07
0x0133798b
0x0133798b
0x0133798e
0x01337992
0x01337996
0x013379a3
0x013379ab
0x013379ad
0x00000000
0x013379ad
0x01337974
0x01337974
0x00000000
0x01337974
0x01337972
0x013378f6
0x013378f6
0x013378f9
0x013378fd
0x01337901
0x0133790e
0x01337916
0x01337918
0x00000000
0x01337918
0x013378df
0x013378df
0x00000000
0x013378df
0x013378dd
0x01337861
0x01337861
0x01337864
0x01337868
0x0133786c
0x01337879
0x01337881
0x01337883
0x00000000
0x01337883
0x0133784a
0x0133784a
0x00000000
0x0133784a
0x01337848
0x013377cc
0x013377cc
0x013377cf
0x013377d3
0x013377d7
0x013377e4
0x013377ec
0x013377ee
0x00000000
0x013377ee
0x013377b5
0x013377b5
0x00000000
0x013377b5
0x013377b3
0x01337737
0x01337737
0x0133773a
0x0133773e
0x01337742
0x0133774f
0x01337757
0x01337759
0x00000000
0x01337759
0x01337720
0x01337720
0x00000000
0x01337720
0x0133771e
0x013376a2
0x013376a2
0x013376a5
0x013376a9
0x013376ad
0x013376ba
0x013376c2
0x013376c4
0x00000000
0x013376c4
0x0133768b
0x0133768b
0x00000000
0x0133768b
0x01337689

APIs

__EH_prolog3.LIBCMT ref: 01337652
std::_Lockit::_Lockit.LIBCPMT ref: 0133765C

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

codecvt.LIBCPMT ref: 01337696
std::_Facet_Register.LIBCPMT ref: 013376AD
std::_Lockit::~_Lockit.LIBCPMT ref: 013376CD

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: 8359734a9fd00236e16d49b21b1e7258abb7edf4b934d02e1c08f10c6e02306e
Instruction ID: c53505495d512d6c39cadf6b83c8d7ecc3ae2d3545c6482bb6b523fc16c8b52b
Opcode Fuzzy Hash: 8359734a9fd00236e16d49b21b1e7258abb7edf4b934d02e1c08f10c6e02306e
Instruction Fuzzy Hash: F301D27590022B9BCF01FBACC8547AEBBB5AFE4328F254109D510AB290DF34DA019BD8

Uniqueness

Uniqueness Score: -1.00%

Function 013376E0 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E013376E0(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v76;
				intOrPtr* _t252;
				void* _t466;
				intOrPtr* _t469;
				void* _t672;
				intOrPtr _t673;
				intOrPtr* _t738;
				intOrPtr* _t739;
				intOrPtr* _t740;
				intOrPtr* _t741;
				intOrPtr* _t742;
				intOrPtr* _t743;
				intOrPtr* _t744;
				intOrPtr* _t745;
				intOrPtr* _t746;
				intOrPtr* _t747;
				intOrPtr* _t748;
				intOrPtr* _t749;
				intOrPtr* _t750;
				intOrPtr* _t751;
				intOrPtr* _t752;
				intOrPtr* _t753;
				intOrPtr* _t754;
				intOrPtr* _t755;
				intOrPtr* _t756;
				void* _t757;
				void* _t760;
				intOrPtr* _t761;
				intOrPtr* _t762;
				intOrPtr* _t763;
				intOrPtr* _t764;
				intOrPtr* _t765;
				intOrPtr* _t766;
				intOrPtr* _t767;
				intOrPtr* _t768;
				intOrPtr* _t769;
				intOrPtr* _t770;
				intOrPtr* _t771;
				intOrPtr* _t772;
				intOrPtr* _t773;
				intOrPtr* _t774;
				intOrPtr* _t775;
				intOrPtr* _t776;
				intOrPtr* _t777;
				intOrPtr* _t778;
				void* _t779;
				void* _t780;

				_t735 = __edx;
				_t552 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t760 =  *0x1384a40; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t760;
				_t252 = E0132BD50(_a8, E0132BCE0());
				_t737 = _t252;
				if(_t252 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t737);
				} else {
					if(_t760 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338C83(__ebx, __edx, _t737, _t760, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t737, _t760);
							E01335EA5( &_v20, 0);
							_t761 =  *0x1384a10; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t761;
							_t738 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t738;
							if(_t738 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t738);
							} else {
								__eflags = _t761;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338D25(_t552, __edx, _t738, _t761, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t552, _t738, _t761);
										E01335EA5( &_v20, 0);
										_t762 =  *0x1384a30; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t762;
										_t739 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t739;
										if(_t739 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t739);
										} else {
											__eflags = _t762;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01338DC7(_t552, _t739, _t762, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t552, _t739, _t762);
													E01335EA5( &_v20, 0);
													_t763 =  *0x1384a44; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t763;
													_t740 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t740;
													if(_t740 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t740);
													} else {
														__eflags = _t763;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01338E37(_t552, _t740, _t763, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t552, _t740, _t763);
																E01335EA5( &_v20, 0);
																_t764 =  *0x1384a14; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t764;
																_t741 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t741;
																if(_t741 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t741);
																} else {
																	__eflags = _t764;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01338E9F(_t552, _t741, _t764, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t552, _t741, _t764);
																			E01335EA5( &_v20, 0);
																			_t765 =  *0x1384a48; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t765;
																			_t742 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t742;
																			if(_t742 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t742);
																			} else {
																				__eflags = _t765;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E01338F07(_t552, _t742, _t765, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t552, _t742, _t765);
																						E01335EA5( &_v20, 0);
																						_t766 =  *0x1384a18; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t766;
																						_t743 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t743;
																						if(_t743 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t743);
																						} else {
																							__eflags = _t766;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E01338F6F(_t552, _t743, _t766, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t552, _t743, _t766);
																									E01335EA5( &_v20, 0);
																									_t767 =  *0x1384a4c; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t767;
																									_t744 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t744;
																									if(_t744 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t744);
																									} else {
																										__eflags = _t767;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E01338FD7(_t552, _t744, _t767, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t552, _t744, _t767);
																												E01335EA5( &_v20, 0);
																												_t768 =  *0x1384a1c; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t768;
																												_t745 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t745;
																												if(_t745 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t745);
																												} else {
																													__eflags = _t768;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0133903F(_t552, _t745, _t768, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t552, _t745, _t768);
																															E01335EA5( &_v20, 0);
																															_t769 =  *0x1384a54; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t769;
																															_t746 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t746;
																															if(_t746 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t746);
																															} else {
																																__eflags = _t769;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E013390A7(_t552, _t746, _t769, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t552, _t746, _t769);
																																		E01335EA5( &_v20, 0);
																																		_t770 =  *0x1384a50; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t770;
																																		_t747 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t747;
																																		if(_t747 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t747);
																																		} else {
																																			__eflags = _t770;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0133912B(_t552, _t747, _t770, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t552, _t747, _t770);
																																					E01335EA5( &_v20, 0);
																																					_t771 =  *0x1384a24; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t771;
																																					_t748 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t748;
																																					if(_t748 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t748);
																																					} else {
																																						__eflags = _t771;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E013391B0(_t552, _t748, _t771, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t552, _t748, _t771);
																																								E01335EA5( &_v20, 0);
																																								_t772 =  *0x1384a20; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t772;
																																								_t749 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t749;
																																								if(_t749 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t749);
																																								} else {
																																									__eflags = _t772;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E01339234(_t552, _t749, _t772, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t552, _t749, _t772);
																																											E01335EA5( &_v20, 0);
																																											_t773 =  *0x1384a34; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t773;
																																											_t750 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t750;
																																											if(_t750 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t750);
																																											} else {
																																												__eflags = _t773;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E013392B9(_t552, _t750, _t773, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E01348213(0x136b979, _t552, _t750, _t773);
																																														E01335EA5( &_v20, 0);
																																														_t774 =  *0x1384a0c; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t774;
																																														_t751 = E0132BD50(_a8, E0132BCE0());
																																														__eflags = _t751;
																																														if(_t751 != 0) {
																																															L103:
																																															E01335EFD( &_v20);
																																															return E013481F0(_t751);
																																														} else {
																																															__eflags = _t774;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E01339321(_t552, _t751, _t774, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0132C550(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E01348213(0x136b979, _t552, _t751, _t774);
																																																	E01335EA5( &_v20, 0);
																																																	_t775 =  *0x1384a38; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t775;
																																																	_t752 = E0132BD50(_a8, E0132BCE0());
																																																	__eflags = _t752;
																																																	if(_t752 != 0) {
																																																		L110:
																																																		E01335EFD( &_v20);
																																																		return E013481F0(_t752);
																																																	} else {
																																																		__eflags = _t775;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E01339389(_t552, _t752, _t775, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0132C550(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E01348213(0x136b979, _t552, _t752, _t775);
																																																				E01335EA5( &_v20, 0);
																																																				_t776 =  *0x1384a3c; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t776;
																																																				_t753 = E0132BD50(_a8, E0132BCE0());
																																																				__eflags = _t753;
																																																				if(_t753 != 0) {
																																																					L117:
																																																					E01335EFD( &_v20);
																																																					return E013481F0(_t753);
																																																				} else {
																																																					__eflags = _t776;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E013393F1(_t552, __edx, _t753, _t776, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0132C550(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E01348213(0x136b979, _t552, _t753, _t776);
																																																							E01335EA5( &_v20, 0);
																																																							_t777 =  *0x1384a58; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t777;
																																																							_t754 = E0132BD50(_a8, E0132BCE0());
																																																							__eflags = _t754;
																																																							if(_t754 != 0) {
																																																								L124:
																																																								E01335EFD( &_v20);
																																																								return E013481F0(_t754);
																																																							} else {
																																																								__eflags = _t777;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									__eflags = E0133946C(_t552, _t754, _t777, __eflags) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0132C550(__eflags);
																																																										asm("int3");
																																																										_push(8);
																																																										E01348213(0x136b979, _t552, _t754, _t777);
																																																										E01335EA5( &_v20, 0);
																																																										_t778 =  *0x1384a28; // 0x0
																																																										_v4 = _v4 & 0x00000000;
																																																										_v16 = _t778;
																																																										_t755 = E0132BD50(_a8, E0132BCE0());
																																																										__eflags = _t755;
																																																										if(_t755 != 0) {
																																																											L131:
																																																											E01335EFD( &_v20);
																																																											return E013481F0(_t755);
																																																										} else {
																																																											__eflags = _t778;
																																																											if(__eflags == 0) {
																																																												_push(_a8);
																																																												_push( &_v16);
																																																												__eflags = E013394D8(_t552, _t755, _t778, __eflags) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E0132C550(__eflags);
																																																													asm("int3");
																																																													_push(8);
																																																													E01348213(0x136b979, _t552, _t755, _t778);
																																																													E01335EA5( &_v20, 0);
																																																													_t779 =  *0x1384a5c; // 0x0
																																																													_v4 = _v4 & 0x00000000;
																																																													_v16 = _t779;
																																																													_t756 = E0132BD50(_a8, E0132BCE0());
																																																													__eflags = _t756;
																																																													if(_t756 != 0) {
																																																														L138:
																																																														E01335EFD( &_v20);
																																																														return E013481F0(_t756);
																																																													} else {
																																																														__eflags = _t779;
																																																														if(__eflags == 0) {
																																																															_push(_a8);
																																																															_push( &_v16);
																																																															_t466 = E01339544(_t552, _t756, _t779, __eflags);
																																																															_pop(_t672);
																																																															__eflags = _t466 - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E0132C550(__eflags);
																																																																asm("int3");
																																																																_push(_t779);
																																																																_push(_t756);
																																																																_t780 = _t672;
																																																																_t757 = _t780;
																																																																asm("stosd");
																																																																asm("stosd");
																																																																asm("stosd");
																																																																asm("stosd");
																																																																_t469 = _v76;
																																																																 *(_t780 + 0x10) =  *(_t780 + 0x10) & 0x00000000;
																																																																 *(_t780 + 0x14) =  *(_t780 + 0x14) & 0x00000000;
																																																																__eflags =  *((intOrPtr*)(_t469 + 0x14)) - 8;
																																																																_t673 =  *((intOrPtr*)(_t469 + 0x10));
																																																																if( *((intOrPtr*)(_t469 + 0x14)) >= 8) {
																																																																	_t469 =  *_t469;
																																																																}
																																																																_push(_t673);
																																																																E0133657C(_t552, _t780, _t735, _t757, _t469);
																																																																return _t780;
																																																															} else {
																																																																_t756 = _v16;
																																																																_v16 = _t756;
																																																																_v4 = 1;
																																																																E01335C34(_t756);
																																																																 *0x136d26c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t756 + 4))))();
																																																																 *0x1384a5c = _t756;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t756 = _t779;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t755 = _v16;
																																																													_v16 = _t755;
																																																													_v4 = 1;
																																																													E01335C34(_t755);
																																																													 *0x136d26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t755 + 4))))();
																																																													 *0x1384a28 = _t755;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t755 = _t778;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t754 = _v16;
																																																										_v16 = _t754;
																																																										_v4 = 1;
																																																										E01335C34(_t754);
																																																										 *0x136d26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t754 + 4))))();
																																																										 *0x1384a58 = _t754;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t754 = _t777;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t753 = _v16;
																																																							_v16 = _t753;
																																																							_v4 = 1;
																																																							E01335C34(_t753);
																																																							 *0x136d26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t753 + 4))))();
																																																							 *0x1384a3c = _t753;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t753 = _t776;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t752 = _v16;
																																																				_v16 = _t752;
																																																				_v4 = 1;
																																																				E01335C34(_t752);
																																																				 *0x136d26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t752 + 4))))();
																																																				 *0x1384a38 = _t752;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t752 = _t775;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t751 = _v16;
																																																	_v16 = _t751;
																																																	_v4 = 1;
																																																	E01335C34(_t751);
																																																	 *0x136d26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t751 + 4))))();
																																																	 *0x1384a0c = _t751;
																																																	goto L103;
																																																}
																																															} else {
																																																_t751 = _t774;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t750 = _v16;
																																														_v16 = _t750;
																																														_v4 = 1;
																																														E01335C34(_t750);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t750 + 4))))();
																																														 *0x1384a34 = _t750;
																																														goto L96;
																																													}
																																												} else {
																																													_t750 = _t773;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t749 = _v16;
																																											_v16 = _t749;
																																											_v4 = 1;
																																											E01335C34(_t749);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t749 + 4))))();
																																											 *0x1384a20 = _t749;
																																											goto L89;
																																										}
																																									} else {
																																										_t749 = _t772;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t748 = _v16;
																																								_v16 = _t748;
																																								_v4 = 1;
																																								E01335C34(_t748);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t748 + 4))))();
																																								 *0x1384a24 = _t748;
																																								goto L82;
																																							}
																																						} else {
																																							_t748 = _t771;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t747 = _v16;
																																					_v16 = _t747;
																																					_v4 = 1;
																																					E01335C34(_t747);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t747 + 4))))();
																																					 *0x1384a50 = _t747;
																																					goto L75;
																																				}
																																			} else {
																																				_t747 = _t770;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t746 = _v16;
																																		_v16 = _t746;
																																		_v4 = 1;
																																		E01335C34(_t746);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t746 + 4))))();
																																		 *0x1384a54 = _t746;
																																		goto L68;
																																	}
																																} else {
																																	_t746 = _t769;
																																	goto L68;
																																}
																															}
																														} else {
																															_t745 = _v16;
																															_v16 = _t745;
																															_v4 = 1;
																															E01335C34(_t745);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t745 + 4))))();
																															 *0x1384a1c = _t745;
																															goto L61;
																														}
																													} else {
																														_t745 = _t768;
																														goto L61;
																													}
																												}
																											} else {
																												_t744 = _v16;
																												_v16 = _t744;
																												_v4 = 1;
																												E01335C34(_t744);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t744 + 4))))();
																												 *0x1384a4c = _t744;
																												goto L54;
																											}
																										} else {
																											_t744 = _t767;
																											goto L54;
																										}
																									}
																								} else {
																									_t743 = _v16;
																									_v16 = _t743;
																									_v4 = 1;
																									E01335C34(_t743);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t743 + 4))))();
																									 *0x1384a18 = _t743;
																									goto L47;
																								}
																							} else {
																								_t743 = _t766;
																								goto L47;
																							}
																						}
																					} else {
																						_t742 = _v16;
																						_v16 = _t742;
																						_v4 = 1;
																						E01335C34(_t742);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t742 + 4))))();
																						 *0x1384a48 = _t742;
																						goto L40;
																					}
																				} else {
																					_t742 = _t765;
																					goto L40;
																				}
																			}
																		} else {
																			_t741 = _v16;
																			_v16 = _t741;
																			_v4 = 1;
																			E01335C34(_t741);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t741 + 4))))();
																			 *0x1384a14 = _t741;
																			goto L33;
																		}
																	} else {
																		_t741 = _t764;
																		goto L33;
																	}
																}
															} else {
																_t740 = _v16;
																_v16 = _t740;
																_v4 = 1;
																E01335C34(_t740);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t740 + 4))))();
																 *0x1384a44 = _t740;
																goto L26;
															}
														} else {
															_t740 = _t763;
															goto L26;
														}
													}
												} else {
													_t739 = _v16;
													_v16 = _t739;
													_v4 = 1;
													E01335C34(_t739);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t739 + 4))))();
													 *0x1384a30 = _t739;
													goto L19;
												}
											} else {
												_t739 = _t762;
												goto L19;
											}
										}
									} else {
										_t738 = _v16;
										_v16 = _t738;
										_v4 = 1;
										E01335C34(_t738);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t738 + 4))))();
										 *0x1384a10 = _t738;
										goto L12;
									}
								} else {
									_t738 = _t761;
									goto L12;
								}
							}
						} else {
							_t737 = _v16;
							_v16 = _t737;
							_v4 = 1;
							E01335C34(_t737);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t737 + 4))))();
							 *0x1384a40 = _t737;
							goto L5;
						}
					} else {
						_t737 = _t760;
						goto L5;
					}
				}
			}

0x013376e0
0x013376e0
0x013376e0
0x013376e7
0x013376f1
0x013376f6
0x01337701
0x01337705
0x01337711
0x01337716
0x0133771a
0x0133775f
0x01337762
0x0133776e
0x0133771c
0x0133771e
0x01337724
0x0133772a
0x01337732
0x01337735
0x0133776f
0x01337774
0x01337775
0x0133777c
0x01337786
0x0133778b
0x01337796
0x0133779a
0x013377ab
0x013377ad
0x013377af
0x013377f4
0x013377f7
0x01337803
0x013377b1
0x013377b1
0x013377b3
0x013377b9
0x013377bf
0x013377c7
0x013377ca
0x01337804
0x01337809
0x0133780a
0x01337811
0x0133781b
0x01337820
0x0133782b
0x0133782f
0x01337840
0x01337842
0x01337844
0x01337889
0x0133788c
0x01337898
0x01337846
0x01337846
0x01337848
0x0133784e
0x01337854
0x0133785c
0x0133785f
0x01337899
0x0133789e
0x0133789f
0x013378a6
0x013378b0
0x013378b5
0x013378c0
0x013378c4
0x013378d5
0x013378d7
0x013378d9
0x0133791e
0x01337921
0x0133792d
0x013378db
0x013378db
0x013378dd
0x013378e3
0x013378e9
0x013378f1
0x013378f4
0x0133792e
0x01337933
0x01337934
0x0133793b
0x01337945
0x0133794a
0x01337955
0x01337959
0x0133796a
0x0133796c
0x0133796e
0x013379b3
0x013379b6
0x013379c2
0x01337970
0x01337970
0x01337972
0x01337978
0x0133797e
0x01337986
0x01337989
0x013379c3
0x013379c8
0x013379c9
0x013379d0
0x013379da
0x013379df
0x013379ea
0x013379ee
0x013379ff
0x01337a01
0x01337a03
0x01337a48
0x01337a4b
0x01337a57
0x01337a05
0x01337a05
0x01337a07
0x01337a0d
0x01337a13
0x01337a1b
0x01337a1e
0x01337a58
0x01337a5d
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a94
0x01337a96
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c
0x01337a20
0x01337a20
0x01337a23
0x01337a27
0x01337a2b
0x01337a38
0x01337a40
0x01337a42
0x00000000
0x01337a42
0x01337a09
0x01337a09
0x00000000
0x01337a09
0x01337a07
0x0133798b
0x0133798b
0x0133798e
0x01337992
0x01337996
0x013379a3
0x013379ab
0x013379ad
0x00000000
0x013379ad
0x01337974
0x01337974
0x00000000
0x01337974
0x01337972
0x013378f6
0x013378f6
0x013378f9
0x013378fd
0x01337901
0x0133790e
0x01337916
0x01337918
0x00000000
0x01337918
0x013378df
0x013378df
0x00000000
0x013378df
0x013378dd
0x01337861
0x01337861
0x01337864
0x01337868
0x0133786c
0x01337879
0x01337881
0x01337883
0x00000000
0x01337883
0x0133784a
0x0133784a
0x00000000
0x0133784a
0x01337848
0x013377cc
0x013377cc
0x013377cf
0x013377d3
0x013377d7
0x013377e4
0x013377ec
0x013377ee
0x00000000
0x013377ee
0x013377b5
0x013377b5
0x00000000
0x013377b5
0x013377b3
0x01337737
0x01337737
0x0133773a
0x0133773e
0x01337742
0x0133774f
0x01337757
0x01337759
0x00000000
0x01337759
0x01337720
0x01337720
0x00000000
0x01337720
0x0133771e

APIs

__EH_prolog3.LIBCMT ref: 013376E7
std::_Lockit::_Lockit.LIBCPMT ref: 013376F1

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

collate.LIBCPMT ref: 0133772B
std::_Facet_Register.LIBCPMT ref: 01337742
std::_Lockit::~_Lockit.LIBCPMT ref: 01337762

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: f474c21b4dca28774308655069e5af5967e377df73a22f2ea32c571cf2829f55
Instruction ID: 8ab11cd1f752b3d0d793be884135bd86b9d2ccb7982d9349fc996ef5610410bc
Opcode Fuzzy Hash: f474c21b4dca28774308655069e5af5967e377df73a22f2ea32c571cf2829f55
Instruction Fuzzy Hash: 1501DE7590022ADBCF12FBACD444BBEBBB9BFD0328F244509D514AB285DF349A01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01337934 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E01337934(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v60;
				intOrPtr* _t204;
				void* _t374;
				intOrPtr* _t377;
				void* _t540;
				intOrPtr _t541;
				intOrPtr* _t594;
				intOrPtr* _t595;
				intOrPtr* _t596;
				intOrPtr* _t597;
				intOrPtr* _t598;
				intOrPtr* _t599;
				intOrPtr* _t600;
				intOrPtr* _t601;
				intOrPtr* _t602;
				intOrPtr* _t603;
				intOrPtr* _t604;
				intOrPtr* _t605;
				intOrPtr* _t606;
				intOrPtr* _t607;
				intOrPtr* _t608;
				void* _t609;
				void* _t612;
				intOrPtr* _t613;
				intOrPtr* _t614;
				intOrPtr* _t615;
				intOrPtr* _t616;
				intOrPtr* _t617;
				intOrPtr* _t618;
				intOrPtr* _t619;
				intOrPtr* _t620;
				intOrPtr* _t621;
				intOrPtr* _t622;
				intOrPtr* _t623;
				intOrPtr* _t624;
				intOrPtr* _t625;
				intOrPtr* _t626;
				void* _t627;
				void* _t628;

				_t591 = __edx;
				_t444 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t612 =  *0x1384a14; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t612;
				_t204 = E0132BD50(_a8, E0132BCE0());
				_t593 = _t204;
				if(_t204 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t593);
				} else {
					if(_t612 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338E9F(__ebx, _t593, _t612, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t593, _t612);
							E01335EA5( &_v20, 0);
							_t613 =  *0x1384a48; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t613;
							_t594 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t594;
							if(_t594 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t594);
							} else {
								__eflags = _t613;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338F07(_t444, _t594, _t613, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t444, _t594, _t613);
										E01335EA5( &_v20, 0);
										_t614 =  *0x1384a18; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t614;
										_t595 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t595;
										if(_t595 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t595);
										} else {
											__eflags = _t614;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01338F6F(_t444, _t595, _t614, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t444, _t595, _t614);
													E01335EA5( &_v20, 0);
													_t615 =  *0x1384a4c; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t615;
													_t596 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t596;
													if(_t596 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t596);
													} else {
														__eflags = _t615;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01338FD7(_t444, _t596, _t615, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t444, _t596, _t615);
																E01335EA5( &_v20, 0);
																_t616 =  *0x1384a1c; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t616;
																_t597 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t597;
																if(_t597 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t597);
																} else {
																	__eflags = _t616;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0133903F(_t444, _t597, _t616, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t444, _t597, _t616);
																			E01335EA5( &_v20, 0);
																			_t617 =  *0x1384a54; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t617;
																			_t598 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t598;
																			if(_t598 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t598);
																			} else {
																				__eflags = _t617;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E013390A7(_t444, _t598, _t617, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t444, _t598, _t617);
																						E01335EA5( &_v20, 0);
																						_t618 =  *0x1384a50; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t618;
																						_t599 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t599;
																						if(_t599 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t599);
																						} else {
																							__eflags = _t618;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0133912B(_t444, _t599, _t618, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t444, _t599, _t618);
																									E01335EA5( &_v20, 0);
																									_t619 =  *0x1384a24; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t619;
																									_t600 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t600;
																									if(_t600 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t600);
																									} else {
																										__eflags = _t619;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E013391B0(_t444, _t600, _t619, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t444, _t600, _t619);
																												E01335EA5( &_v20, 0);
																												_t620 =  *0x1384a20; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t620;
																												_t601 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t601;
																												if(_t601 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t601);
																												} else {
																													__eflags = _t620;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E01339234(_t444, _t601, _t620, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t444, _t601, _t620);
																															E01335EA5( &_v20, 0);
																															_t621 =  *0x1384a34; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t621;
																															_t602 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t602;
																															if(_t602 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t602);
																															} else {
																																__eflags = _t621;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E013392B9(_t444, _t602, _t621, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t444, _t602, _t621);
																																		E01335EA5( &_v20, 0);
																																		_t622 =  *0x1384a0c; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t622;
																																		_t603 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t603;
																																		if(_t603 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t603);
																																		} else {
																																			__eflags = _t622;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E01339321(_t444, _t603, _t622, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t444, _t603, _t622);
																																					E01335EA5( &_v20, 0);
																																					_t623 =  *0x1384a38; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t623;
																																					_t604 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t604;
																																					if(_t604 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t604);
																																					} else {
																																						__eflags = _t623;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E01339389(_t444, _t604, _t623, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t444, _t604, _t623);
																																								E01335EA5( &_v20, 0);
																																								_t624 =  *0x1384a3c; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t624;
																																								_t605 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t605;
																																								if(_t605 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t605);
																																								} else {
																																									__eflags = _t624;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E013393F1(_t444, __edx, _t605, _t624, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t444, _t605, _t624);
																																											E01335EA5( &_v20, 0);
																																											_t625 =  *0x1384a58; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t625;
																																											_t606 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t606;
																																											if(_t606 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t606);
																																											} else {
																																												__eflags = _t625;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E0133946C(_t444, _t606, _t625, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E01348213(0x136b979, _t444, _t606, _t625);
																																														E01335EA5( &_v20, 0);
																																														_t626 =  *0x1384a28; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t626;
																																														_t607 = E0132BD50(_a8, E0132BCE0());
																																														__eflags = _t607;
																																														if(_t607 != 0) {
																																															L103:
																																															E01335EFD( &_v20);
																																															return E013481F0(_t607);
																																														} else {
																																															__eflags = _t626;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E013394D8(_t444, _t607, _t626, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0132C550(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E01348213(0x136b979, _t444, _t607, _t626);
																																																	E01335EA5( &_v20, 0);
																																																	_t627 =  *0x1384a5c; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t627;
																																																	_t608 = E0132BD50(_a8, E0132BCE0());
																																																	__eflags = _t608;
																																																	if(_t608 != 0) {
																																																		L110:
																																																		E01335EFD( &_v20);
																																																		return E013481F0(_t608);
																																																	} else {
																																																		__eflags = _t627;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			_t374 = E01339544(_t444, _t608, _t627, __eflags);
																																																			_pop(_t540);
																																																			__eflags = _t374 - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0132C550(__eflags);
																																																				asm("int3");
																																																				_push(_t627);
																																																				_push(_t608);
																																																				_t628 = _t540;
																																																				_t609 = _t628;
																																																				asm("stosd");
																																																				asm("stosd");
																																																				asm("stosd");
																																																				asm("stosd");
																																																				_t377 = _v60;
																																																				 *(_t628 + 0x10) =  *(_t628 + 0x10) & 0x00000000;
																																																				 *(_t628 + 0x14) =  *(_t628 + 0x14) & 0x00000000;
																																																				__eflags =  *((intOrPtr*)(_t377 + 0x14)) - 8;
																																																				_t541 =  *((intOrPtr*)(_t377 + 0x10));
																																																				if( *((intOrPtr*)(_t377 + 0x14)) >= 8) {
																																																					_t377 =  *_t377;
																																																				}
																																																				_push(_t541);
																																																				E0133657C(_t444, _t628, _t591, _t609, _t377);
																																																				return _t628;
																																																			} else {
																																																				_t608 = _v16;
																																																				_v16 = _t608;
																																																				_v4 = 1;
																																																				E01335C34(_t608);
																																																				 *0x136d26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t608 + 4))))();
																																																				 *0x1384a5c = _t608;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t608 = _t627;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t607 = _v16;
																																																	_v16 = _t607;
																																																	_v4 = 1;
																																																	E01335C34(_t607);
																																																	 *0x136d26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t607 + 4))))();
																																																	 *0x1384a28 = _t607;
																																																	goto L103;
																																																}
																																															} else {
																																																_t607 = _t626;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t606 = _v16;
																																														_v16 = _t606;
																																														_v4 = 1;
																																														E01335C34(_t606);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t606 + 4))))();
																																														 *0x1384a58 = _t606;
																																														goto L96;
																																													}
																																												} else {
																																													_t606 = _t625;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t605 = _v16;
																																											_v16 = _t605;
																																											_v4 = 1;
																																											E01335C34(_t605);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t605 + 4))))();
																																											 *0x1384a3c = _t605;
																																											goto L89;
																																										}
																																									} else {
																																										_t605 = _t624;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t604 = _v16;
																																								_v16 = _t604;
																																								_v4 = 1;
																																								E01335C34(_t604);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t604 + 4))))();
																																								 *0x1384a38 = _t604;
																																								goto L82;
																																							}
																																						} else {
																																							_t604 = _t623;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t603 = _v16;
																																					_v16 = _t603;
																																					_v4 = 1;
																																					E01335C34(_t603);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t603 + 4))))();
																																					 *0x1384a0c = _t603;
																																					goto L75;
																																				}
																																			} else {
																																				_t603 = _t622;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t602 = _v16;
																																		_v16 = _t602;
																																		_v4 = 1;
																																		E01335C34(_t602);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t602 + 4))))();
																																		 *0x1384a34 = _t602;
																																		goto L68;
																																	}
																																} else {
																																	_t602 = _t621;
																																	goto L68;
																																}
																															}
																														} else {
																															_t601 = _v16;
																															_v16 = _t601;
																															_v4 = 1;
																															E01335C34(_t601);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t601 + 4))))();
																															 *0x1384a20 = _t601;
																															goto L61;
																														}
																													} else {
																														_t601 = _t620;
																														goto L61;
																													}
																												}
																											} else {
																												_t600 = _v16;
																												_v16 = _t600;
																												_v4 = 1;
																												E01335C34(_t600);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t600 + 4))))();
																												 *0x1384a24 = _t600;
																												goto L54;
																											}
																										} else {
																											_t600 = _t619;
																											goto L54;
																										}
																									}
																								} else {
																									_t599 = _v16;
																									_v16 = _t599;
																									_v4 = 1;
																									E01335C34(_t599);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t599 + 4))))();
																									 *0x1384a50 = _t599;
																									goto L47;
																								}
																							} else {
																								_t599 = _t618;
																								goto L47;
																							}
																						}
																					} else {
																						_t598 = _v16;
																						_v16 = _t598;
																						_v4 = 1;
																						E01335C34(_t598);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t598 + 4))))();
																						 *0x1384a54 = _t598;
																						goto L40;
																					}
																				} else {
																					_t598 = _t617;
																					goto L40;
																				}
																			}
																		} else {
																			_t597 = _v16;
																			_v16 = _t597;
																			_v4 = 1;
																			E01335C34(_t597);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t597 + 4))))();
																			 *0x1384a1c = _t597;
																			goto L33;
																		}
																	} else {
																		_t597 = _t616;
																		goto L33;
																	}
																}
															} else {
																_t596 = _v16;
																_v16 = _t596;
																_v4 = 1;
																E01335C34(_t596);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t596 + 4))))();
																 *0x1384a4c = _t596;
																goto L26;
															}
														} else {
															_t596 = _t615;
															goto L26;
														}
													}
												} else {
													_t595 = _v16;
													_v16 = _t595;
													_v4 = 1;
													E01335C34(_t595);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t595 + 4))))();
													 *0x1384a18 = _t595;
													goto L19;
												}
											} else {
												_t595 = _t614;
												goto L19;
											}
										}
									} else {
										_t594 = _v16;
										_v16 = _t594;
										_v4 = 1;
										E01335C34(_t594);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t594 + 4))))();
										 *0x1384a48 = _t594;
										goto L12;
									}
								} else {
									_t594 = _t613;
									goto L12;
								}
							}
						} else {
							_t593 = _v16;
							_v16 = _t593;
							_v4 = 1;
							E01335C34(_t593);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t593 + 4))))();
							 *0x1384a14 = _t593;
							goto L5;
						}
					} else {
						_t593 = _t612;
						goto L5;
					}
				}
			}

0x01337934
0x01337934
0x01337934
0x0133793b
0x01337945
0x0133794a
0x01337955
0x01337959
0x01337965
0x0133796a
0x0133796e
0x013379b3
0x013379b6
0x013379c2
0x01337970
0x01337972
0x01337978
0x0133797e
0x01337986
0x01337989
0x013379c3
0x013379c8
0x013379c9
0x013379d0
0x013379da
0x013379df
0x013379ea
0x013379ee
0x013379ff
0x01337a01
0x01337a03
0x01337a48
0x01337a4b
0x01337a57
0x01337a05
0x01337a05
0x01337a07
0x01337a0d
0x01337a13
0x01337a1b
0x01337a1e
0x01337a58
0x01337a5d
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a94
0x01337a96
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c
0x01337a20
0x01337a20
0x01337a23
0x01337a27
0x01337a2b
0x01337a38
0x01337a40
0x01337a42
0x00000000
0x01337a42
0x01337a09
0x01337a09
0x00000000
0x01337a09
0x01337a07
0x0133798b
0x0133798b
0x0133798e
0x01337992
0x01337996
0x013379a3
0x013379ab
0x013379ad
0x00000000
0x013379ad
0x01337974
0x01337974
0x00000000
0x01337974
0x01337972

APIs

__EH_prolog3.LIBCMT ref: 0133793B
std::_Lockit::_Lockit.LIBCPMT ref: 01337945

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

messages.LIBCPMT ref: 0133797F
std::_Facet_Register.LIBCPMT ref: 01337996
std::_Lockit::~_Lockit.LIBCPMT ref: 013379B6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: fae41d0caf773adb6d75ce092e6b7c3c47e44819993e2a402ee266469cca13f7
Instruction ID: db23ab6d1d9cc5906ac699a079cab314691905ce571943fe90abbff3a33e04a2
Opcode Fuzzy Hash: fae41d0caf773adb6d75ce092e6b7c3c47e44819993e2a402ee266469cca13f7
Instruction Fuzzy Hash: E901D27590022BCBCF11FBACC4447AEBBB5AFD4718F254609D510AB280CF749A018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 01343956 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01343956(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t95;
				void* _t166;
				signed int _t244;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int _t273;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				signed int _t280;
				signed int _t281;
				signed int _t282;
				void* _t290;

				_t202 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t290 - 0x14, 0);
				_t275 =  *0x1384a88; // 0x0
				 *(_t290 - 4) =  *(_t290 - 4) & 0x00000000;
				 *(_t290 - 0x10) = _t275;
				_t95 = E0132BD50( *((intOrPtr*)(_t290 + 8)), E0132BCE0());
				_t267 = _t95;
				if(_t95 != 0) {
					L5:
					E01335EFD(_t290 - 0x14);
					return E013481F0(_t267);
				} else {
					if(_t275 == 0) {
						_push( *((intOrPtr*)(_t290 + 8)));
						_push(_t290 - 0x10);
						__eflags = E01343F12(__ebx, _t267, _t275, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t267, _t275);
							E01335EA5(_t290 - 0x14, 0);
							_t276 =  *0x1384a8c; // 0x0
							 *(_t290 - 4) =  *(_t290 - 4) & 0x00000000;
							 *(_t290 - 0x10) = _t276;
							_t268 = E0132BD50( *((intOrPtr*)(_t290 + 8)), E0132BCE0());
							__eflags = _t268;
							if(_t268 != 0) {
								L12:
								E01335EFD(_t290 - 0x14);
								return E013481F0(_t268);
							} else {
								__eflags = _t276;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t290 + 8)));
									_push(_t290 - 0x10);
									__eflags = E01343F7A(_t202, _t268, _t276, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t202, _t268, _t276);
										E01335EA5(_t290 - 0x14, 0);
										_t277 =  *0x1384a90; // 0x0
										 *(_t290 - 4) =  *(_t290 - 4) & 0x00000000;
										 *(_t290 - 0x10) = _t277;
										_t269 = E0132BD50( *((intOrPtr*)(_t290 + 8)), E0132BCE0());
										__eflags = _t269;
										if(_t269 != 0) {
											L19:
											E01335EFD(_t290 - 0x14);
											return E013481F0(_t269);
										} else {
											__eflags = _t277;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t290 + 8)));
												_push(_t290 - 0x10);
												__eflags = E01343FE2(_t202, _t269, _t277, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t202, _t269, _t277);
													E01335EA5(_t290 - 0x14, 0);
													_t278 =  *0x1384a98; // 0x0
													 *(_t290 - 4) =  *(_t290 - 4) & 0x00000000;
													 *(_t290 - 0x10) = _t278;
													_t270 = E0132BD50( *((intOrPtr*)(_t290 + 8)), E0132BCE0());
													__eflags = _t270;
													if(_t270 != 0) {
														L26:
														E01335EFD(_t290 - 0x14);
														return E013481F0(_t270);
													} else {
														__eflags = _t278;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t290 + 8)));
															_push(_t290 - 0x10);
															__eflags = E0134404A(_t202, _t270, _t278, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t202, _t270, _t278);
																E01335EA5(_t290 - 0x14, 0);
																_t279 =  *0x1384a94; // 0x0
																 *(_t290 - 4) =  *(_t290 - 4) & 0x00000000;
																 *(_t290 - 0x10) = _t279;
																_t271 = E0132BD50( *((intOrPtr*)(_t290 + 8)), E0132BCE0());
																__eflags = _t271;
																if(_t271 != 0) {
																	L33:
																	E01335EFD(_t290 - 0x14);
																	return E013481F0(_t271);
																} else {
																	__eflags = _t279;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t290 + 8)));
																		_push(_t290 - 0x10);
																		__eflags = E013440CE(_t202, _t271, _t279, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t202, _t271, _t279);
																			E01335EA5(_t290 - 0x14, 0);
																			_t280 =  *0x1384a9c; // 0x0
																			 *(_t290 - 4) =  *(_t290 - 4) & 0x00000000;
																			 *(_t290 - 0x10) = _t280;
																			_t272 = E0132BD50( *((intOrPtr*)(_t290 + 8)), E0132BCE0());
																			__eflags = _t272;
																			if(_t272 != 0) {
																				L40:
																				E01335EFD(_t290 - 0x14);
																				return E013481F0(_t272);
																			} else {
																				__eflags = _t280;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t290 + 8)));
																					_push(_t290 - 0x10);
																					__eflags = E01344153(_t202, _t272, _t280, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t202, _t272, _t280);
																						E01335EA5(_t290 - 0x14, 0);
																						_t281 =  *0x1384aa0; // 0x0
																						 *(_t290 - 4) =  *(_t290 - 4) & 0x00000000;
																						 *(_t290 - 0x10) = _t281;
																						_t273 = E0132BD50( *((intOrPtr*)(_t290 + 8)), E0132BCE0());
																						__eflags = _t273;
																						if(_t273 != 0) {
																							L47:
																							E01335EFD(_t290 - 0x14);
																							return E013481F0(_t273);
																						} else {
																							__eflags = _t281;
																							if(__eflags == 0) {
																								_push( *((intOrPtr*)(_t290 + 8)));
																								_push(_t290 - 0x10);
																								_t166 = E013441BF(_t202, _t273, _t281, __eflags);
																								_pop(_t244);
																								__eflags = _t166 - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(4);
																									E01348213(0x136bdf5, _t202, _t273, _t281);
																									_t282 = _t244;
																									 *(_t290 - 0x10) = _t282;
																									 *((intOrPtr*)(_t282 + 4)) =  *((intOrPtr*)(_t290 + 0xc));
																									_push( *((intOrPtr*)(_t290 + 8)));
																									_t89 = _t290 - 4;
																									 *_t89 =  *(_t290 - 4) & 0x00000000;
																									__eflags =  *_t89;
																									 *_t282 = 0x136ecc0;
																									E01344EBF(_t202, _t244, _t273, _t282,  *_t89);
																									return E013481F0(_t282);
																								} else {
																									_t273 =  *(_t290 - 0x10);
																									 *(_t290 - 0x10) = _t273;
																									 *(_t290 - 4) = 1;
																									E01335C34(_t273);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t273 + 4))))();
																									 *0x1384aa0 = _t273;
																									goto L47;
																								}
																							} else {
																								_t273 = _t281;
																								goto L47;
																							}
																						}
																					} else {
																						_t272 =  *(_t290 - 0x10);
																						 *(_t290 - 0x10) = _t272;
																						 *(_t290 - 4) = 1;
																						E01335C34(_t272);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t272 + 4))))();
																						 *0x1384a9c = _t272;
																						goto L40;
																					}
																				} else {
																					_t272 = _t280;
																					goto L40;
																				}
																			}
																		} else {
																			_t271 =  *(_t290 - 0x10);
																			 *(_t290 - 0x10) = _t271;
																			 *(_t290 - 4) = 1;
																			E01335C34(_t271);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t271 + 4))))();
																			 *0x1384a94 = _t271;
																			goto L33;
																		}
																	} else {
																		_t271 = _t279;
																		goto L33;
																	}
																}
															} else {
																_t270 =  *(_t290 - 0x10);
																 *(_t290 - 0x10) = _t270;
																 *(_t290 - 4) = 1;
																E01335C34(_t270);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t270 + 4))))();
																 *0x1384a98 = _t270;
																goto L26;
															}
														} else {
															_t270 = _t278;
															goto L26;
														}
													}
												} else {
													_t269 =  *(_t290 - 0x10);
													 *(_t290 - 0x10) = _t269;
													 *(_t290 - 4) = 1;
													E01335C34(_t269);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t269 + 4))))();
													 *0x1384a90 = _t269;
													goto L19;
												}
											} else {
												_t269 = _t277;
												goto L19;
											}
										}
									} else {
										_t268 =  *(_t290 - 0x10);
										 *(_t290 - 0x10) = _t268;
										 *(_t290 - 4) = 1;
										E01335C34(_t268);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t268 + 4))))();
										 *0x1384a8c = _t268;
										goto L12;
									}
								} else {
									_t268 = _t276;
									goto L12;
								}
							}
						} else {
							_t267 =  *(_t290 - 0x10);
							 *(_t290 - 0x10) = _t267;
							 *(_t290 - 4) = 1;
							E01335C34(_t267);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t267 + 4))))();
							 *0x1384a88 = _t267;
							goto L5;
						}
					} else {
						_t267 = _t275;
						goto L5;
					}
				}
			}

0x01343956
0x01343956
0x0134395d
0x01343967
0x0134396c
0x01343977
0x0134397b
0x01343987
0x0134398c
0x01343990
0x013439d5
0x013439d8
0x013439e4
0x01343992
0x01343994
0x0134399a
0x013439a0
0x013439a8
0x013439ab
0x013439e5
0x013439ea
0x013439eb
0x013439f2
0x013439fc
0x01343a01
0x01343a0c
0x01343a10
0x01343a21
0x01343a23
0x01343a25
0x01343a6a
0x01343a6d
0x01343a79
0x01343a27
0x01343a27
0x01343a29
0x01343a2f
0x01343a35
0x01343a3d
0x01343a40
0x01343a7a
0x01343a7f
0x01343a80
0x01343a87
0x01343a91
0x01343a96
0x01343aa1
0x01343aa5
0x01343ab6
0x01343ab8
0x01343aba
0x01343aff
0x01343b02
0x01343b0e
0x01343abc
0x01343abc
0x01343abe
0x01343ac4
0x01343aca
0x01343ad2
0x01343ad5
0x01343b0f
0x01343b14
0x01343b15
0x01343b1c
0x01343b26
0x01343b2b
0x01343b36
0x01343b3a
0x01343b4b
0x01343b4d
0x01343b4f
0x01343b94
0x01343b97
0x01343ba3
0x01343b51
0x01343b51
0x01343b53
0x01343b59
0x01343b5f
0x01343b67
0x01343b6a
0x01343ba4
0x01343ba9
0x01343baa
0x01343bb1
0x01343bbb
0x01343bc0
0x01343bcb
0x01343bcf
0x01343be0
0x01343be2
0x01343be4
0x01343c29
0x01343c2c
0x01343c38
0x01343be6
0x01343be6
0x01343be8
0x01343bee
0x01343bf4
0x01343bfc
0x01343bff
0x01343c39
0x01343c3e
0x01343c3f
0x01343c46
0x01343c50
0x01343c55
0x01343c60
0x01343c64
0x01343c75
0x01343c77
0x01343c79
0x01343cbe
0x01343cc1
0x01343ccd
0x01343c7b
0x01343c7b
0x01343c7d
0x01343c83
0x01343c89
0x01343c91
0x01343c94
0x01343cce
0x01343cd3
0x01343cd4
0x01343cdb
0x01343ce5
0x01343cea
0x01343cf5
0x01343cf9
0x01343d0a
0x01343d0c
0x01343d0e
0x01343d53
0x01343d56
0x01343d62
0x01343d10
0x01343d10
0x01343d12
0x01343d18
0x01343d1e
0x01343d1f
0x01343d25
0x01343d26
0x01343d29
0x01343d63
0x01343d68
0x01343d69
0x01343d70
0x01343d75
0x01343d77
0x01343d7d
0x01343d80
0x01343d83
0x01343d83
0x01343d83
0x01343d87
0x01343d8d
0x01343d99
0x01343d2b
0x01343d2b
0x01343d2e
0x01343d32
0x01343d36
0x01343d43
0x01343d4b
0x01343d4d
0x00000000
0x01343d4d
0x01343d14
0x01343d14
0x00000000
0x01343d14
0x01343d12
0x01343c96
0x01343c96
0x01343c99
0x01343c9d
0x01343ca1
0x01343cae
0x01343cb6
0x01343cb8
0x00000000
0x01343cb8
0x01343c7f
0x01343c7f
0x00000000
0x01343c7f
0x01343c7d
0x01343c01
0x01343c01
0x01343c04
0x01343c08
0x01343c0c
0x01343c19
0x01343c21
0x01343c23
0x00000000
0x01343c23
0x01343bea
0x01343bea
0x00000000
0x01343bea
0x01343be8
0x01343b6c
0x01343b6c
0x01343b6f
0x01343b73
0x01343b77
0x01343b84
0x01343b8c
0x01343b8e
0x00000000
0x01343b8e
0x01343b55
0x01343b55
0x00000000
0x01343b55
0x01343b53
0x01343ad7
0x01343ad7
0x01343ada
0x01343ade
0x01343ae2
0x01343aef
0x01343af7
0x01343af9
0x00000000
0x01343af9
0x01343ac0
0x01343ac0
0x00000000
0x01343ac0
0x01343abe
0x01343a42
0x01343a42
0x01343a45
0x01343a49
0x01343a4d
0x01343a5a
0x01343a62
0x01343a64
0x00000000
0x01343a64
0x01343a2b
0x01343a2b
0x00000000
0x01343a2b
0x01343a29
0x013439ad
0x013439ad
0x013439b0
0x013439b4
0x013439b8
0x013439c5
0x013439cd
0x013439cf
0x00000000
0x013439cf
0x01343996
0x01343996
0x00000000
0x01343996
0x01343994

APIs

__EH_prolog3.LIBCMT ref: 0134395D
std::_Lockit::_Lockit.LIBCPMT ref: 01343967

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

messages.LIBCPMT ref: 013439A1
std::_Facet_Register.LIBCPMT ref: 013439B8
std::_Lockit::~_Lockit.LIBCPMT ref: 013439D8

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 5f168b06e36051545c2cddddc2a34d09a4ae8c60b3b34703e4f5646cd2cc1405
Instruction ID: af025039bf41149bc822d12a46b09acc10afc459f2d0802c6b2c7a68b1a73dc8
Opcode Fuzzy Hash: 5f168b06e36051545c2cddddc2a34d09a4ae8c60b3b34703e4f5646cd2cc1405
Instruction Fuzzy Hash: E801923590022A9BDF15FBACC8447BEBBB9BF90328F254509D514AB284DF34EA05CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0133780A Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0133780A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v68;
				intOrPtr* _t228;
				void* _t420;
				intOrPtr* _t423;
				void* _t606;
				intOrPtr _t607;
				intOrPtr* _t666;
				intOrPtr* _t667;
				intOrPtr* _t668;
				intOrPtr* _t669;
				intOrPtr* _t670;
				intOrPtr* _t671;
				intOrPtr* _t672;
				intOrPtr* _t673;
				intOrPtr* _t674;
				intOrPtr* _t675;
				intOrPtr* _t676;
				intOrPtr* _t677;
				intOrPtr* _t678;
				intOrPtr* _t679;
				intOrPtr* _t680;
				intOrPtr* _t681;
				intOrPtr* _t682;
				void* _t683;
				void* _t686;
				intOrPtr* _t687;
				intOrPtr* _t688;
				intOrPtr* _t689;
				intOrPtr* _t690;
				intOrPtr* _t691;
				intOrPtr* _t692;
				intOrPtr* _t693;
				intOrPtr* _t694;
				intOrPtr* _t695;
				intOrPtr* _t696;
				intOrPtr* _t697;
				intOrPtr* _t698;
				intOrPtr* _t699;
				intOrPtr* _t700;
				intOrPtr* _t701;
				intOrPtr* _t702;
				void* _t703;
				void* _t704;

				_t663 = __edx;
				_t498 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t686 =  *0x1384a30; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t686;
				_t228 = E0132BD50(_a8, E0132BCE0());
				_t665 = _t228;
				if(_t228 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t665);
				} else {
					if(_t686 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338DC7(__ebx, _t665, _t686, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t665, _t686);
							E01335EA5( &_v20, 0);
							_t687 =  *0x1384a44; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t687;
							_t666 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t666;
							if(_t666 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t666);
							} else {
								__eflags = _t687;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338E37(_t498, _t666, _t687, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t498, _t666, _t687);
										E01335EA5( &_v20, 0);
										_t688 =  *0x1384a14; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t688;
										_t667 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t667;
										if(_t667 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t667);
										} else {
											__eflags = _t688;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01338E9F(_t498, _t667, _t688, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t498, _t667, _t688);
													E01335EA5( &_v20, 0);
													_t689 =  *0x1384a48; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t689;
													_t668 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t668;
													if(_t668 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t668);
													} else {
														__eflags = _t689;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01338F07(_t498, _t668, _t689, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t498, _t668, _t689);
																E01335EA5( &_v20, 0);
																_t690 =  *0x1384a18; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t690;
																_t669 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t669;
																if(_t669 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t669);
																} else {
																	__eflags = _t690;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01338F6F(_t498, _t669, _t690, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t498, _t669, _t690);
																			E01335EA5( &_v20, 0);
																			_t691 =  *0x1384a4c; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t691;
																			_t670 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t670;
																			if(_t670 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t670);
																			} else {
																				__eflags = _t691;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E01338FD7(_t498, _t670, _t691, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t498, _t670, _t691);
																						E01335EA5( &_v20, 0);
																						_t692 =  *0x1384a1c; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t692;
																						_t671 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t671;
																						if(_t671 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t671);
																						} else {
																							__eflags = _t692;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0133903F(_t498, _t671, _t692, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t498, _t671, _t692);
																									E01335EA5( &_v20, 0);
																									_t693 =  *0x1384a54; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t693;
																									_t672 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t672;
																									if(_t672 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t672);
																									} else {
																										__eflags = _t693;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E013390A7(_t498, _t672, _t693, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t498, _t672, _t693);
																												E01335EA5( &_v20, 0);
																												_t694 =  *0x1384a50; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t694;
																												_t673 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t673;
																												if(_t673 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t673);
																												} else {
																													__eflags = _t694;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0133912B(_t498, _t673, _t694, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t498, _t673, _t694);
																															E01335EA5( &_v20, 0);
																															_t695 =  *0x1384a24; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t695;
																															_t674 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t674;
																															if(_t674 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t674);
																															} else {
																																__eflags = _t695;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E013391B0(_t498, _t674, _t695, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t498, _t674, _t695);
																																		E01335EA5( &_v20, 0);
																																		_t696 =  *0x1384a20; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t696;
																																		_t675 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t675;
																																		if(_t675 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t675);
																																		} else {
																																			__eflags = _t696;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E01339234(_t498, _t675, _t696, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t498, _t675, _t696);
																																					E01335EA5( &_v20, 0);
																																					_t697 =  *0x1384a34; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t697;
																																					_t676 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t676;
																																					if(_t676 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t676);
																																					} else {
																																						__eflags = _t697;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E013392B9(_t498, _t676, _t697, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t498, _t676, _t697);
																																								E01335EA5( &_v20, 0);
																																								_t698 =  *0x1384a0c; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t698;
																																								_t677 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t677;
																																								if(_t677 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t677);
																																								} else {
																																									__eflags = _t698;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E01339321(_t498, _t677, _t698, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t498, _t677, _t698);
																																											E01335EA5( &_v20, 0);
																																											_t699 =  *0x1384a38; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t699;
																																											_t678 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t678;
																																											if(_t678 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t678);
																																											} else {
																																												__eflags = _t699;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E01339389(_t498, _t678, _t699, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E01348213(0x136b979, _t498, _t678, _t699);
																																														E01335EA5( &_v20, 0);
																																														_t700 =  *0x1384a3c; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t700;
																																														_t679 = E0132BD50(_a8, E0132BCE0());
																																														__eflags = _t679;
																																														if(_t679 != 0) {
																																															L103:
																																															E01335EFD( &_v20);
																																															return E013481F0(_t679);
																																														} else {
																																															__eflags = _t700;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E013393F1(_t498, __edx, _t679, _t700, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0132C550(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E01348213(0x136b979, _t498, _t679, _t700);
																																																	E01335EA5( &_v20, 0);
																																																	_t701 =  *0x1384a58; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t701;
																																																	_t680 = E0132BD50(_a8, E0132BCE0());
																																																	__eflags = _t680;
																																																	if(_t680 != 0) {
																																																		L110:
																																																		E01335EFD( &_v20);
																																																		return E013481F0(_t680);
																																																	} else {
																																																		__eflags = _t701;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E0133946C(_t498, _t680, _t701, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0132C550(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E01348213(0x136b979, _t498, _t680, _t701);
																																																				E01335EA5( &_v20, 0);
																																																				_t702 =  *0x1384a28; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t702;
																																																				_t681 = E0132BD50(_a8, E0132BCE0());
																																																				__eflags = _t681;
																																																				if(_t681 != 0) {
																																																					L117:
																																																					E01335EFD( &_v20);
																																																					return E013481F0(_t681);
																																																				} else {
																																																					__eflags = _t702;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						__eflags = E013394D8(_t498, _t681, _t702, __eflags) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0132C550(__eflags);
																																																							asm("int3");
																																																							_push(8);
																																																							E01348213(0x136b979, _t498, _t681, _t702);
																																																							E01335EA5( &_v20, 0);
																																																							_t703 =  *0x1384a5c; // 0x0
																																																							_v4 = _v4 & 0x00000000;
																																																							_v16 = _t703;
																																																							_t682 = E0132BD50(_a8, E0132BCE0());
																																																							__eflags = _t682;
																																																							if(_t682 != 0) {
																																																								L124:
																																																								E01335EFD( &_v20);
																																																								return E013481F0(_t682);
																																																							} else {
																																																								__eflags = _t703;
																																																								if(__eflags == 0) {
																																																									_push(_a8);
																																																									_push( &_v16);
																																																									_t420 = E01339544(_t498, _t682, _t703, __eflags);
																																																									_pop(_t606);
																																																									__eflags = _t420 - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E0132C550(__eflags);
																																																										asm("int3");
																																																										_push(_t703);
																																																										_push(_t682);
																																																										_t704 = _t606;
																																																										_t683 = _t704;
																																																										asm("stosd");
																																																										asm("stosd");
																																																										asm("stosd");
																																																										asm("stosd");
																																																										_t423 = _v68;
																																																										 *(_t704 + 0x10) =  *(_t704 + 0x10) & 0x00000000;
																																																										 *(_t704 + 0x14) =  *(_t704 + 0x14) & 0x00000000;
																																																										__eflags =  *((intOrPtr*)(_t423 + 0x14)) - 8;
																																																										_t607 =  *((intOrPtr*)(_t423 + 0x10));
																																																										if( *((intOrPtr*)(_t423 + 0x14)) >= 8) {
																																																											_t423 =  *_t423;
																																																										}
																																																										_push(_t607);
																																																										E0133657C(_t498, _t704, _t663, _t683, _t423);
																																																										return _t704;
																																																									} else {
																																																										_t682 = _v16;
																																																										_v16 = _t682;
																																																										_v4 = 1;
																																																										E01335C34(_t682);
																																																										 *0x136d26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t682 + 4))))();
																																																										 *0x1384a5c = _t682;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t682 = _t703;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t681 = _v16;
																																																							_v16 = _t681;
																																																							_v4 = 1;
																																																							E01335C34(_t681);
																																																							 *0x136d26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t681 + 4))))();
																																																							 *0x1384a28 = _t681;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t681 = _t702;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t680 = _v16;
																																																				_v16 = _t680;
																																																				_v4 = 1;
																																																				E01335C34(_t680);
																																																				 *0x136d26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t680 + 4))))();
																																																				 *0x1384a58 = _t680;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t680 = _t701;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t679 = _v16;
																																																	_v16 = _t679;
																																																	_v4 = 1;
																																																	E01335C34(_t679);
																																																	 *0x136d26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t679 + 4))))();
																																																	 *0x1384a3c = _t679;
																																																	goto L103;
																																																}
																																															} else {
																																																_t679 = _t700;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t678 = _v16;
																																														_v16 = _t678;
																																														_v4 = 1;
																																														E01335C34(_t678);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t678 + 4))))();
																																														 *0x1384a38 = _t678;
																																														goto L96;
																																													}
																																												} else {
																																													_t678 = _t699;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t677 = _v16;
																																											_v16 = _t677;
																																											_v4 = 1;
																																											E01335C34(_t677);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t677 + 4))))();
																																											 *0x1384a0c = _t677;
																																											goto L89;
																																										}
																																									} else {
																																										_t677 = _t698;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t676 = _v16;
																																								_v16 = _t676;
																																								_v4 = 1;
																																								E01335C34(_t676);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t676 + 4))))();
																																								 *0x1384a34 = _t676;
																																								goto L82;
																																							}
																																						} else {
																																							_t676 = _t697;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t675 = _v16;
																																					_v16 = _t675;
																																					_v4 = 1;
																																					E01335C34(_t675);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t675 + 4))))();
																																					 *0x1384a20 = _t675;
																																					goto L75;
																																				}
																																			} else {
																																				_t675 = _t696;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t674 = _v16;
																																		_v16 = _t674;
																																		_v4 = 1;
																																		E01335C34(_t674);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t674 + 4))))();
																																		 *0x1384a24 = _t674;
																																		goto L68;
																																	}
																																} else {
																																	_t674 = _t695;
																																	goto L68;
																																}
																															}
																														} else {
																															_t673 = _v16;
																															_v16 = _t673;
																															_v4 = 1;
																															E01335C34(_t673);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t673 + 4))))();
																															 *0x1384a50 = _t673;
																															goto L61;
																														}
																													} else {
																														_t673 = _t694;
																														goto L61;
																													}
																												}
																											} else {
																												_t672 = _v16;
																												_v16 = _t672;
																												_v4 = 1;
																												E01335C34(_t672);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t672 + 4))))();
																												 *0x1384a54 = _t672;
																												goto L54;
																											}
																										} else {
																											_t672 = _t693;
																											goto L54;
																										}
																									}
																								} else {
																									_t671 = _v16;
																									_v16 = _t671;
																									_v4 = 1;
																									E01335C34(_t671);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t671 + 4))))();
																									 *0x1384a1c = _t671;
																									goto L47;
																								}
																							} else {
																								_t671 = _t692;
																								goto L47;
																							}
																						}
																					} else {
																						_t670 = _v16;
																						_v16 = _t670;
																						_v4 = 1;
																						E01335C34(_t670);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t670 + 4))))();
																						 *0x1384a4c = _t670;
																						goto L40;
																					}
																				} else {
																					_t670 = _t691;
																					goto L40;
																				}
																			}
																		} else {
																			_t669 = _v16;
																			_v16 = _t669;
																			_v4 = 1;
																			E01335C34(_t669);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t669 + 4))))();
																			 *0x1384a18 = _t669;
																			goto L33;
																		}
																	} else {
																		_t669 = _t690;
																		goto L33;
																	}
																}
															} else {
																_t668 = _v16;
																_v16 = _t668;
																_v4 = 1;
																E01335C34(_t668);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t668 + 4))))();
																 *0x1384a48 = _t668;
																goto L26;
															}
														} else {
															_t668 = _t689;
															goto L26;
														}
													}
												} else {
													_t667 = _v16;
													_v16 = _t667;
													_v4 = 1;
													E01335C34(_t667);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t667 + 4))))();
													 *0x1384a14 = _t667;
													goto L19;
												}
											} else {
												_t667 = _t688;
												goto L19;
											}
										}
									} else {
										_t666 = _v16;
										_v16 = _t666;
										_v4 = 1;
										E01335C34(_t666);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t666 + 4))))();
										 *0x1384a44 = _t666;
										goto L12;
									}
								} else {
									_t666 = _t687;
									goto L12;
								}
							}
						} else {
							_t665 = _v16;
							_v16 = _t665;
							_v4 = 1;
							E01335C34(_t665);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t665 + 4))))();
							 *0x1384a30 = _t665;
							goto L5;
						}
					} else {
						_t665 = _t686;
						goto L5;
					}
				}
			}

0x0133780a
0x0133780a
0x0133780a
0x01337811
0x0133781b
0x01337820
0x0133782b
0x0133782f
0x0133783b
0x01337840
0x01337844
0x01337889
0x0133788c
0x01337898
0x01337846
0x01337848
0x0133784e
0x01337854
0x0133785c
0x0133785f
0x01337899
0x0133789e
0x0133789f
0x013378a6
0x013378b0
0x013378b5
0x013378c0
0x013378c4
0x013378d5
0x013378d7
0x013378d9
0x0133791e
0x01337921
0x0133792d
0x013378db
0x013378db
0x013378dd
0x013378e3
0x013378e9
0x013378f1
0x013378f4
0x0133792e
0x01337933
0x01337934
0x0133793b
0x01337945
0x0133794a
0x01337955
0x01337959
0x0133796a
0x0133796c
0x0133796e
0x013379b3
0x013379b6
0x013379c2
0x01337970
0x01337970
0x01337972
0x01337978
0x0133797e
0x01337986
0x01337989
0x013379c3
0x013379c8
0x013379c9
0x013379d0
0x013379da
0x013379df
0x013379ea
0x013379ee
0x013379ff
0x01337a01
0x01337a03
0x01337a48
0x01337a4b
0x01337a57
0x01337a05
0x01337a05
0x01337a07
0x01337a0d
0x01337a13
0x01337a1b
0x01337a1e
0x01337a58
0x01337a5d
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a94
0x01337a96
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c
0x01337a20
0x01337a20
0x01337a23
0x01337a27
0x01337a2b
0x01337a38
0x01337a40
0x01337a42
0x00000000
0x01337a42
0x01337a09
0x01337a09
0x00000000
0x01337a09
0x01337a07
0x0133798b
0x0133798b
0x0133798e
0x01337992
0x01337996
0x013379a3
0x013379ab
0x013379ad
0x00000000
0x013379ad
0x01337974
0x01337974
0x00000000
0x01337974
0x01337972
0x013378f6
0x013378f6
0x013378f9
0x013378fd
0x01337901
0x0133790e
0x01337916
0x01337918
0x00000000
0x01337918
0x013378df
0x013378df
0x00000000
0x013378df
0x013378dd
0x01337861
0x01337861
0x01337864
0x01337868
0x0133786c
0x01337879
0x01337881
0x01337883
0x00000000
0x01337883
0x0133784a
0x0133784a
0x00000000
0x0133784a
0x01337848

APIs

__EH_prolog3.LIBCMT ref: 01337811
std::_Lockit::_Lockit.LIBCPMT ref: 0133781B

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

ctype.LIBCPMT ref: 01337855
std::_Facet_Register.LIBCPMT ref: 0133786C
std::_Lockit::~_Lockit.LIBCPMT ref: 0133788C

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registerctype
String ID:
API String ID: 83828444-0
Opcode ID: 4caead68a9befe9bf5861ae59bc0dfbf45ca7dd8fad9c33792126e3944891e44
Instruction ID: 72d8763e75aa31b780d9666a85f60c05d7b8cd5975617d923147e550298b7ca2
Opcode Fuzzy Hash: 4caead68a9befe9bf5861ae59bc0dfbf45ca7dd8fad9c33792126e3944891e44
Instruction Fuzzy Hash: 9E01D27590022B9BCF15FBACD4447AEBBB5BFD0318F244509D911AB284EF349A01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0133789F Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0133789F(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v64;
				intOrPtr* _t216;
				void* _t397;
				intOrPtr* _t400;
				void* _t573;
				intOrPtr _t574;
				intOrPtr* _t630;
				intOrPtr* _t631;
				intOrPtr* _t632;
				intOrPtr* _t633;
				intOrPtr* _t634;
				intOrPtr* _t635;
				intOrPtr* _t636;
				intOrPtr* _t637;
				intOrPtr* _t638;
				intOrPtr* _t639;
				intOrPtr* _t640;
				intOrPtr* _t641;
				intOrPtr* _t642;
				intOrPtr* _t643;
				intOrPtr* _t644;
				intOrPtr* _t645;
				void* _t646;
				void* _t649;
				intOrPtr* _t650;
				intOrPtr* _t651;
				intOrPtr* _t652;
				intOrPtr* _t653;
				intOrPtr* _t654;
				intOrPtr* _t655;
				intOrPtr* _t656;
				intOrPtr* _t657;
				intOrPtr* _t658;
				intOrPtr* _t659;
				intOrPtr* _t660;
				intOrPtr* _t661;
				intOrPtr* _t662;
				intOrPtr* _t663;
				intOrPtr* _t664;
				void* _t665;
				void* _t666;

				_t627 = __edx;
				_t471 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t649 =  *0x1384a44; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t649;
				_t216 = E0132BD50(_a8, E0132BCE0());
				_t629 = _t216;
				if(_t216 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t629);
				} else {
					if(_t649 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338E37(__ebx, _t629, _t649, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t629, _t649);
							E01335EA5( &_v20, 0);
							_t650 =  *0x1384a14; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t650;
							_t630 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t630;
							if(_t630 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t630);
							} else {
								__eflags = _t650;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338E9F(_t471, _t630, _t650, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t471, _t630, _t650);
										E01335EA5( &_v20, 0);
										_t651 =  *0x1384a48; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t651;
										_t631 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t631;
										if(_t631 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t631);
										} else {
											__eflags = _t651;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01338F07(_t471, _t631, _t651, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t471, _t631, _t651);
													E01335EA5( &_v20, 0);
													_t652 =  *0x1384a18; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t652;
													_t632 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t632;
													if(_t632 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t632);
													} else {
														__eflags = _t652;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01338F6F(_t471, _t632, _t652, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t471, _t632, _t652);
																E01335EA5( &_v20, 0);
																_t653 =  *0x1384a4c; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t653;
																_t633 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t633;
																if(_t633 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t633);
																} else {
																	__eflags = _t653;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01338FD7(_t471, _t633, _t653, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t471, _t633, _t653);
																			E01335EA5( &_v20, 0);
																			_t654 =  *0x1384a1c; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t654;
																			_t634 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t634;
																			if(_t634 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t634);
																			} else {
																				__eflags = _t654;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0133903F(_t471, _t634, _t654, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t471, _t634, _t654);
																						E01335EA5( &_v20, 0);
																						_t655 =  *0x1384a54; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t655;
																						_t635 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t635;
																						if(_t635 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t635);
																						} else {
																							__eflags = _t655;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E013390A7(_t471, _t635, _t655, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t471, _t635, _t655);
																									E01335EA5( &_v20, 0);
																									_t656 =  *0x1384a50; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t656;
																									_t636 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t636;
																									if(_t636 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t636);
																									} else {
																										__eflags = _t656;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0133912B(_t471, _t636, _t656, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t471, _t636, _t656);
																												E01335EA5( &_v20, 0);
																												_t657 =  *0x1384a24; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t657;
																												_t637 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t637;
																												if(_t637 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t637);
																												} else {
																													__eflags = _t657;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E013391B0(_t471, _t637, _t657, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t471, _t637, _t657);
																															E01335EA5( &_v20, 0);
																															_t658 =  *0x1384a20; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t658;
																															_t638 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t638;
																															if(_t638 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t638);
																															} else {
																																__eflags = _t658;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E01339234(_t471, _t638, _t658, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t471, _t638, _t658);
																																		E01335EA5( &_v20, 0);
																																		_t659 =  *0x1384a34; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t659;
																																		_t639 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t639;
																																		if(_t639 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t639);
																																		} else {
																																			__eflags = _t659;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E013392B9(_t471, _t639, _t659, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t471, _t639, _t659);
																																					E01335EA5( &_v20, 0);
																																					_t660 =  *0x1384a0c; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t660;
																																					_t640 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t640;
																																					if(_t640 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t640);
																																					} else {
																																						__eflags = _t660;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E01339321(_t471, _t640, _t660, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t471, _t640, _t660);
																																								E01335EA5( &_v20, 0);
																																								_t661 =  *0x1384a38; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t661;
																																								_t641 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t641;
																																								if(_t641 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t641);
																																								} else {
																																									__eflags = _t661;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E01339389(_t471, _t641, _t661, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t471, _t641, _t661);
																																											E01335EA5( &_v20, 0);
																																											_t662 =  *0x1384a3c; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t662;
																																											_t642 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t642;
																																											if(_t642 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t642);
																																											} else {
																																												__eflags = _t662;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E013393F1(_t471, __edx, _t642, _t662, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E01348213(0x136b979, _t471, _t642, _t662);
																																														E01335EA5( &_v20, 0);
																																														_t663 =  *0x1384a58; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t663;
																																														_t643 = E0132BD50(_a8, E0132BCE0());
																																														__eflags = _t643;
																																														if(_t643 != 0) {
																																															L103:
																																															E01335EFD( &_v20);
																																															return E013481F0(_t643);
																																														} else {
																																															__eflags = _t663;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																__eflags = E0133946C(_t471, _t643, _t663, __eflags) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0132C550(__eflags);
																																																	asm("int3");
																																																	_push(8);
																																																	E01348213(0x136b979, _t471, _t643, _t663);
																																																	E01335EA5( &_v20, 0);
																																																	_t664 =  *0x1384a28; // 0x0
																																																	_v4 = _v4 & 0x00000000;
																																																	_v16 = _t664;
																																																	_t644 = E0132BD50(_a8, E0132BCE0());
																																																	__eflags = _t644;
																																																	if(_t644 != 0) {
																																																		L110:
																																																		E01335EFD( &_v20);
																																																		return E013481F0(_t644);
																																																	} else {
																																																		__eflags = _t664;
																																																		if(__eflags == 0) {
																																																			_push(_a8);
																																																			_push( &_v16);
																																																			__eflags = E013394D8(_t471, _t644, _t664, __eflags) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E0132C550(__eflags);
																																																				asm("int3");
																																																				_push(8);
																																																				E01348213(0x136b979, _t471, _t644, _t664);
																																																				E01335EA5( &_v20, 0);
																																																				_t665 =  *0x1384a5c; // 0x0
																																																				_v4 = _v4 & 0x00000000;
																																																				_v16 = _t665;
																																																				_t645 = E0132BD50(_a8, E0132BCE0());
																																																				__eflags = _t645;
																																																				if(_t645 != 0) {
																																																					L117:
																																																					E01335EFD( &_v20);
																																																					return E013481F0(_t645);
																																																				} else {
																																																					__eflags = _t665;
																																																					if(__eflags == 0) {
																																																						_push(_a8);
																																																						_push( &_v16);
																																																						_t397 = E01339544(_t471, _t645, _t665, __eflags);
																																																						_pop(_t573);
																																																						__eflags = _t397 - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E0132C550(__eflags);
																																																							asm("int3");
																																																							_push(_t665);
																																																							_push(_t645);
																																																							_t666 = _t573;
																																																							_t646 = _t666;
																																																							asm("stosd");
																																																							asm("stosd");
																																																							asm("stosd");
																																																							asm("stosd");
																																																							_t400 = _v64;
																																																							 *(_t666 + 0x10) =  *(_t666 + 0x10) & 0x00000000;
																																																							 *(_t666 + 0x14) =  *(_t666 + 0x14) & 0x00000000;
																																																							__eflags =  *((intOrPtr*)(_t400 + 0x14)) - 8;
																																																							_t574 =  *((intOrPtr*)(_t400 + 0x10));
																																																							if( *((intOrPtr*)(_t400 + 0x14)) >= 8) {
																																																								_t400 =  *_t400;
																																																							}
																																																							_push(_t574);
																																																							E0133657C(_t471, _t666, _t627, _t646, _t400);
																																																							return _t666;
																																																						} else {
																																																							_t645 = _v16;
																																																							_v16 = _t645;
																																																							_v4 = 1;
																																																							E01335C34(_t645);
																																																							 *0x136d26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t645 + 4))))();
																																																							 *0x1384a5c = _t645;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t645 = _t665;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t644 = _v16;
																																																				_v16 = _t644;
																																																				_v4 = 1;
																																																				E01335C34(_t644);
																																																				 *0x136d26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t644 + 4))))();
																																																				 *0x1384a28 = _t644;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t644 = _t664;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t643 = _v16;
																																																	_v16 = _t643;
																																																	_v4 = 1;
																																																	E01335C34(_t643);
																																																	 *0x136d26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t643 + 4))))();
																																																	 *0x1384a58 = _t643;
																																																	goto L103;
																																																}
																																															} else {
																																																_t643 = _t663;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t642 = _v16;
																																														_v16 = _t642;
																																														_v4 = 1;
																																														E01335C34(_t642);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t642 + 4))))();
																																														 *0x1384a3c = _t642;
																																														goto L96;
																																													}
																																												} else {
																																													_t642 = _t662;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t641 = _v16;
																																											_v16 = _t641;
																																											_v4 = 1;
																																											E01335C34(_t641);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t641 + 4))))();
																																											 *0x1384a38 = _t641;
																																											goto L89;
																																										}
																																									} else {
																																										_t641 = _t661;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t640 = _v16;
																																								_v16 = _t640;
																																								_v4 = 1;
																																								E01335C34(_t640);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t640 + 4))))();
																																								 *0x1384a0c = _t640;
																																								goto L82;
																																							}
																																						} else {
																																							_t640 = _t660;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t639 = _v16;
																																					_v16 = _t639;
																																					_v4 = 1;
																																					E01335C34(_t639);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t639 + 4))))();
																																					 *0x1384a34 = _t639;
																																					goto L75;
																																				}
																																			} else {
																																				_t639 = _t659;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t638 = _v16;
																																		_v16 = _t638;
																																		_v4 = 1;
																																		E01335C34(_t638);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t638 + 4))))();
																																		 *0x1384a20 = _t638;
																																		goto L68;
																																	}
																																} else {
																																	_t638 = _t658;
																																	goto L68;
																																}
																															}
																														} else {
																															_t637 = _v16;
																															_v16 = _t637;
																															_v4 = 1;
																															E01335C34(_t637);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t637 + 4))))();
																															 *0x1384a24 = _t637;
																															goto L61;
																														}
																													} else {
																														_t637 = _t657;
																														goto L61;
																													}
																												}
																											} else {
																												_t636 = _v16;
																												_v16 = _t636;
																												_v4 = 1;
																												E01335C34(_t636);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t636 + 4))))();
																												 *0x1384a50 = _t636;
																												goto L54;
																											}
																										} else {
																											_t636 = _t656;
																											goto L54;
																										}
																									}
																								} else {
																									_t635 = _v16;
																									_v16 = _t635;
																									_v4 = 1;
																									E01335C34(_t635);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t635 + 4))))();
																									 *0x1384a54 = _t635;
																									goto L47;
																								}
																							} else {
																								_t635 = _t655;
																								goto L47;
																							}
																						}
																					} else {
																						_t634 = _v16;
																						_v16 = _t634;
																						_v4 = 1;
																						E01335C34(_t634);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t634 + 4))))();
																						 *0x1384a1c = _t634;
																						goto L40;
																					}
																				} else {
																					_t634 = _t654;
																					goto L40;
																				}
																			}
																		} else {
																			_t633 = _v16;
																			_v16 = _t633;
																			_v4 = 1;
																			E01335C34(_t633);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t633 + 4))))();
																			 *0x1384a4c = _t633;
																			goto L33;
																		}
																	} else {
																		_t633 = _t653;
																		goto L33;
																	}
																}
															} else {
																_t632 = _v16;
																_v16 = _t632;
																_v4 = 1;
																E01335C34(_t632);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t632 + 4))))();
																 *0x1384a18 = _t632;
																goto L26;
															}
														} else {
															_t632 = _t652;
															goto L26;
														}
													}
												} else {
													_t631 = _v16;
													_v16 = _t631;
													_v4 = 1;
													E01335C34(_t631);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t631 + 4))))();
													 *0x1384a48 = _t631;
													goto L19;
												}
											} else {
												_t631 = _t651;
												goto L19;
											}
										}
									} else {
										_t630 = _v16;
										_v16 = _t630;
										_v4 = 1;
										E01335C34(_t630);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t630 + 4))))();
										 *0x1384a14 = _t630;
										goto L12;
									}
								} else {
									_t630 = _t650;
									goto L12;
								}
							}
						} else {
							_t629 = _v16;
							_v16 = _t629;
							_v4 = 1;
							E01335C34(_t629);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t629 + 4))))();
							 *0x1384a44 = _t629;
							goto L5;
						}
					} else {
						_t629 = _t649;
						goto L5;
					}
				}
			}

0x0133789f
0x0133789f
0x0133789f
0x013378a6
0x013378b0
0x013378b5
0x013378c0
0x013378c4
0x013378d0
0x013378d5
0x013378d9
0x0133791e
0x01337921
0x0133792d
0x013378db
0x013378dd
0x013378e3
0x013378e9
0x013378f1
0x013378f4
0x0133792e
0x01337933
0x01337934
0x0133793b
0x01337945
0x0133794a
0x01337955
0x01337959
0x0133796a
0x0133796c
0x0133796e
0x013379b3
0x013379b6
0x013379c2
0x01337970
0x01337970
0x01337972
0x01337978
0x0133797e
0x01337986
0x01337989
0x013379c3
0x013379c8
0x013379c9
0x013379d0
0x013379da
0x013379df
0x013379ea
0x013379ee
0x013379ff
0x01337a01
0x01337a03
0x01337a48
0x01337a4b
0x01337a57
0x01337a05
0x01337a05
0x01337a07
0x01337a0d
0x01337a13
0x01337a1b
0x01337a1e
0x01337a58
0x01337a5d
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a94
0x01337a96
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c
0x01337a20
0x01337a20
0x01337a23
0x01337a27
0x01337a2b
0x01337a38
0x01337a40
0x01337a42
0x00000000
0x01337a42
0x01337a09
0x01337a09
0x00000000
0x01337a09
0x01337a07
0x0133798b
0x0133798b
0x0133798e
0x01337992
0x01337996
0x013379a3
0x013379ab
0x013379ad
0x00000000
0x013379ad
0x01337974
0x01337974
0x00000000
0x01337974
0x01337972
0x013378f6
0x013378f6
0x013378f9
0x013378fd
0x01337901
0x0133790e
0x01337916
0x01337918
0x00000000
0x01337918
0x013378df
0x013378df
0x00000000
0x013378df
0x013378dd

APIs

__EH_prolog3.LIBCMT ref: 013378A6
std::_Lockit::_Lockit.LIBCPMT ref: 013378B0

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

messages.LIBCPMT ref: 013378EA
std::_Facet_Register.LIBCPMT ref: 01337901
std::_Lockit::~_Lockit.LIBCPMT ref: 01337921

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID:
API String ID: 2750803064-0
Opcode ID: 988849fb1459fb7ba670ee58f547b26e36b80fdffc9848259c88420d820a1611
Instruction ID: 78038ed83bd1adb18619294b6300a90cc9eaa20b509e3637ba3ad0561d9bc4f6
Opcode Fuzzy Hash: 988849fb1459fb7ba670ee58f547b26e36b80fdffc9848259c88420d820a1611
Instruction Fuzzy Hash: B601227590022A8FCF10FBACD4047AEBBB5AFD0728F240509D510AB280DF349E00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 013438C1 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E013438C1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t107;
				void* _t189;
				signed int _t277;
				signed int _t305;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t311;
				signed int _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				void* _t330;

				_t229 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t330 - 0x14, 0);
				_t313 =  *0x1384a84; // 0x0
				 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
				 *(_t330 - 0x10) = _t313;
				_t107 = E0132BD50( *((intOrPtr*)(_t330 + 8)), E0132BCE0());
				_t304 = _t107;
				if(_t107 != 0) {
					L5:
					E01335EFD(_t330 - 0x14);
					return E013481F0(_t304);
				} else {
					if(_t313 == 0) {
						_push( *((intOrPtr*)(_t330 + 8)));
						_push(_t330 - 0x10);
						__eflags = E01343E70(__ebx, __edx, _t304, _t313, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t304, _t313);
							E01335EA5(_t330 - 0x14, 0);
							_t314 =  *0x1384a88; // 0x0
							 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
							 *(_t330 - 0x10) = _t314;
							_t305 = E0132BD50( *((intOrPtr*)(_t330 + 8)), E0132BCE0());
							__eflags = _t305;
							if(_t305 != 0) {
								L12:
								E01335EFD(_t330 - 0x14);
								return E013481F0(_t305);
							} else {
								__eflags = _t314;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t330 + 8)));
									_push(_t330 - 0x10);
									__eflags = E01343F12(_t229, _t305, _t314, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t229, _t305, _t314);
										E01335EA5(_t330 - 0x14, 0);
										_t315 =  *0x1384a8c; // 0x0
										 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
										 *(_t330 - 0x10) = _t315;
										_t306 = E0132BD50( *((intOrPtr*)(_t330 + 8)), E0132BCE0());
										__eflags = _t306;
										if(_t306 != 0) {
											L19:
											E01335EFD(_t330 - 0x14);
											return E013481F0(_t306);
										} else {
											__eflags = _t315;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t330 + 8)));
												_push(_t330 - 0x10);
												__eflags = E01343F7A(_t229, _t306, _t315, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t229, _t306, _t315);
													E01335EA5(_t330 - 0x14, 0);
													_t316 =  *0x1384a90; // 0x0
													 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
													 *(_t330 - 0x10) = _t316;
													_t307 = E0132BD50( *((intOrPtr*)(_t330 + 8)), E0132BCE0());
													__eflags = _t307;
													if(_t307 != 0) {
														L26:
														E01335EFD(_t330 - 0x14);
														return E013481F0(_t307);
													} else {
														__eflags = _t316;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t330 + 8)));
															_push(_t330 - 0x10);
															__eflags = E01343FE2(_t229, _t307, _t316, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t229, _t307, _t316);
																E01335EA5(_t330 - 0x14, 0);
																_t317 =  *0x1384a98; // 0x0
																 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																 *(_t330 - 0x10) = _t317;
																_t308 = E0132BD50( *((intOrPtr*)(_t330 + 8)), E0132BCE0());
																__eflags = _t308;
																if(_t308 != 0) {
																	L33:
																	E01335EFD(_t330 - 0x14);
																	return E013481F0(_t308);
																} else {
																	__eflags = _t317;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t330 + 8)));
																		_push(_t330 - 0x10);
																		__eflags = E0134404A(_t229, _t308, _t317, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t229, _t308, _t317);
																			E01335EA5(_t330 - 0x14, 0);
																			_t318 =  *0x1384a94; // 0x0
																			 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																			 *(_t330 - 0x10) = _t318;
																			_t309 = E0132BD50( *((intOrPtr*)(_t330 + 8)), E0132BCE0());
																			__eflags = _t309;
																			if(_t309 != 0) {
																				L40:
																				E01335EFD(_t330 - 0x14);
																				return E013481F0(_t309);
																			} else {
																				__eflags = _t318;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t330 + 8)));
																					_push(_t330 - 0x10);
																					__eflags = E013440CE(_t229, _t309, _t318, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t229, _t309, _t318);
																						E01335EA5(_t330 - 0x14, 0);
																						_t319 =  *0x1384a9c; // 0x0
																						 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																						 *(_t330 - 0x10) = _t319;
																						_t310 = E0132BD50( *((intOrPtr*)(_t330 + 8)), E0132BCE0());
																						__eflags = _t310;
																						if(_t310 != 0) {
																							L47:
																							E01335EFD(_t330 - 0x14);
																							return E013481F0(_t310);
																						} else {
																							__eflags = _t319;
																							if(__eflags == 0) {
																								_push( *((intOrPtr*)(_t330 + 8)));
																								_push(_t330 - 0x10);
																								__eflags = E01344153(_t229, _t310, _t319, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t229, _t310, _t319);
																									E01335EA5(_t330 - 0x14, 0);
																									_t320 =  *0x1384aa0; // 0x0
																									 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																									 *(_t330 - 0x10) = _t320;
																									_t311 = E0132BD50( *((intOrPtr*)(_t330 + 8)), E0132BCE0());
																									__eflags = _t311;
																									if(_t311 != 0) {
																										L54:
																										E01335EFD(_t330 - 0x14);
																										return E013481F0(_t311);
																									} else {
																										__eflags = _t320;
																										if(__eflags == 0) {
																											_push( *((intOrPtr*)(_t330 + 8)));
																											_push(_t330 - 0x10);
																											_t189 = E013441BF(_t229, _t311, _t320, __eflags);
																											_pop(_t277);
																											__eflags = _t189 - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(4);
																												E01348213(0x136bdf5, _t229, _t311, _t320);
																												_t321 = _t277;
																												 *(_t330 - 0x10) = _t321;
																												 *((intOrPtr*)(_t321 + 4)) =  *((intOrPtr*)(_t330 + 0xc));
																												_push( *((intOrPtr*)(_t330 + 8)));
																												_t101 = _t330 - 4;
																												 *_t101 =  *(_t330 - 4) & 0x00000000;
																												__eflags =  *_t101;
																												 *_t321 = 0x136ecc0;
																												E01344EBF(_t229, _t277, _t311, _t321,  *_t101);
																												return E013481F0(_t321);
																											} else {
																												_t311 =  *(_t330 - 0x10);
																												 *(_t330 - 0x10) = _t311;
																												 *(_t330 - 4) = 1;
																												E01335C34(_t311);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t311 + 4))))();
																												 *0x1384aa0 = _t311;
																												goto L54;
																											}
																										} else {
																											_t311 = _t320;
																											goto L54;
																										}
																									}
																								} else {
																									_t310 =  *(_t330 - 0x10);
																									 *(_t330 - 0x10) = _t310;
																									 *(_t330 - 4) = 1;
																									E01335C34(_t310);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t310 + 4))))();
																									 *0x1384a9c = _t310;
																									goto L47;
																								}
																							} else {
																								_t310 = _t319;
																								goto L47;
																							}
																						}
																					} else {
																						_t309 =  *(_t330 - 0x10);
																						 *(_t330 - 0x10) = _t309;
																						 *(_t330 - 4) = 1;
																						E01335C34(_t309);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t309 + 4))))();
																						 *0x1384a94 = _t309;
																						goto L40;
																					}
																				} else {
																					_t309 = _t318;
																					goto L40;
																				}
																			}
																		} else {
																			_t308 =  *(_t330 - 0x10);
																			 *(_t330 - 0x10) = _t308;
																			 *(_t330 - 4) = 1;
																			E01335C34(_t308);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t308 + 4))))();
																			 *0x1384a98 = _t308;
																			goto L33;
																		}
																	} else {
																		_t308 = _t317;
																		goto L33;
																	}
																}
															} else {
																_t307 =  *(_t330 - 0x10);
																 *(_t330 - 0x10) = _t307;
																 *(_t330 - 4) = 1;
																E01335C34(_t307);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t307 + 4))))();
																 *0x1384a90 = _t307;
																goto L26;
															}
														} else {
															_t307 = _t316;
															goto L26;
														}
													}
												} else {
													_t306 =  *(_t330 - 0x10);
													 *(_t330 - 0x10) = _t306;
													 *(_t330 - 4) = 1;
													E01335C34(_t306);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4))))();
													 *0x1384a8c = _t306;
													goto L19;
												}
											} else {
												_t306 = _t315;
												goto L19;
											}
										}
									} else {
										_t305 =  *(_t330 - 0x10);
										 *(_t330 - 0x10) = _t305;
										 *(_t330 - 4) = 1;
										E01335C34(_t305);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t305 + 4))))();
										 *0x1384a88 = _t305;
										goto L12;
									}
								} else {
									_t305 = _t314;
									goto L12;
								}
							}
						} else {
							_t304 =  *(_t330 - 0x10);
							 *(_t330 - 0x10) = _t304;
							 *(_t330 - 4) = 1;
							E01335C34(_t304);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t304 + 4))))();
							 *0x1384a84 = _t304;
							goto L5;
						}
					} else {
						_t304 = _t313;
						goto L5;
					}
				}
			}

0x013438c1
0x013438c1
0x013438c8
0x013438d2
0x013438d7
0x013438e2
0x013438e6
0x013438f2
0x013438f7
0x013438fb
0x01343940
0x01343943
0x0134394f
0x013438fd
0x013438ff
0x01343905
0x0134390b
0x01343913
0x01343916
0x01343950
0x01343955
0x01343956
0x0134395d
0x01343967
0x0134396c
0x01343977
0x0134397b
0x0134398c
0x0134398e
0x01343990
0x013439d5
0x013439d8
0x013439e4
0x01343992
0x01343992
0x01343994
0x0134399a
0x013439a0
0x013439a8
0x013439ab
0x013439e5
0x013439ea
0x013439eb
0x013439f2
0x013439fc
0x01343a01
0x01343a0c
0x01343a10
0x01343a21
0x01343a23
0x01343a25
0x01343a6a
0x01343a6d
0x01343a79
0x01343a27
0x01343a27
0x01343a29
0x01343a2f
0x01343a35
0x01343a3d
0x01343a40
0x01343a7a
0x01343a7f
0x01343a80
0x01343a87
0x01343a91
0x01343a96
0x01343aa1
0x01343aa5
0x01343ab6
0x01343ab8
0x01343aba
0x01343aff
0x01343b02
0x01343b0e
0x01343abc
0x01343abc
0x01343abe
0x01343ac4
0x01343aca
0x01343ad2
0x01343ad5
0x01343b0f
0x01343b14
0x01343b15
0x01343b1c
0x01343b26
0x01343b2b
0x01343b36
0x01343b3a
0x01343b4b
0x01343b4d
0x01343b4f
0x01343b94
0x01343b97
0x01343ba3
0x01343b51
0x01343b51
0x01343b53
0x01343b59
0x01343b5f
0x01343b67
0x01343b6a
0x01343ba4
0x01343ba9
0x01343baa
0x01343bb1
0x01343bbb
0x01343bc0
0x01343bcb
0x01343bcf
0x01343be0
0x01343be2
0x01343be4
0x01343c29
0x01343c2c
0x01343c38
0x01343be6
0x01343be6
0x01343be8
0x01343bee
0x01343bf4
0x01343bfc
0x01343bff
0x01343c39
0x01343c3e
0x01343c3f
0x01343c46
0x01343c50
0x01343c55
0x01343c60
0x01343c64
0x01343c75
0x01343c77
0x01343c79
0x01343cbe
0x01343cc1
0x01343ccd
0x01343c7b
0x01343c7b
0x01343c7d
0x01343c83
0x01343c89
0x01343c91
0x01343c94
0x01343cce
0x01343cd3
0x01343cd4
0x01343cdb
0x01343ce5
0x01343cea
0x01343cf5
0x01343cf9
0x01343d0a
0x01343d0c
0x01343d0e
0x01343d53
0x01343d56
0x01343d62
0x01343d10
0x01343d10
0x01343d12
0x01343d18
0x01343d1e
0x01343d1f
0x01343d25
0x01343d26
0x01343d29
0x01343d63
0x01343d68
0x01343d69
0x01343d70
0x01343d75
0x01343d77
0x01343d7d
0x01343d80
0x01343d83
0x01343d83
0x01343d83
0x01343d87
0x01343d8d
0x01343d99
0x01343d2b
0x01343d2b
0x01343d2e
0x01343d32
0x01343d36
0x01343d43
0x01343d4b
0x01343d4d
0x00000000
0x01343d4d
0x01343d14
0x01343d14
0x00000000
0x01343d14
0x01343d12
0x01343c96
0x01343c96
0x01343c99
0x01343c9d
0x01343ca1
0x01343cae
0x01343cb6
0x01343cb8
0x00000000
0x01343cb8
0x01343c7f
0x01343c7f
0x00000000
0x01343c7f
0x01343c7d
0x01343c01
0x01343c01
0x01343c04
0x01343c08
0x01343c0c
0x01343c19
0x01343c21
0x01343c23
0x00000000
0x01343c23
0x01343bea
0x01343bea
0x00000000
0x01343bea
0x01343be8
0x01343b6c
0x01343b6c
0x01343b6f
0x01343b73
0x01343b77
0x01343b84
0x01343b8c
0x01343b8e
0x00000000
0x01343b8e
0x01343b55
0x01343b55
0x00000000
0x01343b55
0x01343b53
0x01343ad7
0x01343ad7
0x01343ada
0x01343ade
0x01343ae2
0x01343aef
0x01343af7
0x01343af9
0x00000000
0x01343af9
0x01343ac0
0x01343ac0
0x00000000
0x01343ac0
0x01343abe
0x01343a42
0x01343a42
0x01343a45
0x01343a49
0x01343a4d
0x01343a5a
0x01343a62
0x01343a64
0x00000000
0x01343a64
0x01343a2b
0x01343a2b
0x00000000
0x01343a2b
0x01343a29
0x013439ad
0x013439ad
0x013439b0
0x013439b4
0x013439b8
0x013439c5
0x013439cd
0x013439cf
0x00000000
0x013439cf
0x01343996
0x01343996
0x00000000
0x01343996
0x01343994
0x01343918
0x01343918
0x0134391b
0x0134391f
0x01343923
0x01343930
0x01343938
0x0134393a
0x00000000
0x0134393a
0x01343901
0x01343901
0x00000000
0x01343901
0x013438ff

APIs

__EH_prolog3.LIBCMT ref: 013438C8
std::_Lockit::_Lockit.LIBCPMT ref: 013438D2

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

collate.LIBCPMT ref: 0134390C
std::_Facet_Register.LIBCPMT ref: 01343923
std::_Lockit::~_Lockit.LIBCPMT ref: 01343943

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercollate
String ID:
API String ID: 1007100420-0
Opcode ID: 601630d7d1b0edb3426a00bcd5329b7496f879488399cc846e0981d352631a62
Instruction ID: 5a949e743d531f57dd5f01b574089fa624eef8c71a67b55d7110d14ed138832a
Opcode Fuzzy Hash: 601630d7d1b0edb3426a00bcd5329b7496f879488399cc846e0981d352631a62
Instruction Fuzzy Hash: 9201D63590022B9BCF11FBACC4047AEBBB9BF90728F144009D514AB380DF34EE018B94

Uniqueness

Uniqueness Score: -1.00%

Function 01343B15 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01343B15(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t59;
				void* _t97;
				signed int _t145;
				signed int _t160;
				signed int _t161;
				signed int _t162;
				signed int _t164;
				signed int _t165;
				signed int _t166;
				signed int _t167;
				signed int _t168;
				void* _t173;

				_t121 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t173 - 0x14, 0);
				_t164 =  *0x1384a98; // 0x0
				 *(_t173 - 4) =  *(_t173 - 4) & 0x00000000;
				 *(_t173 - 0x10) = _t164;
				_t59 = E0132BD50( *((intOrPtr*)(_t173 + 8)), E0132BCE0());
				_t159 = _t59;
				if(_t59 != 0) {
					L5:
					E01335EFD(_t173 - 0x14);
					return E013481F0(_t159);
				} else {
					if(_t164 == 0) {
						_push( *((intOrPtr*)(_t173 + 8)));
						_push(_t173 - 0x10);
						__eflags = E0134404A(__ebx, _t159, _t164, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t159, _t164);
							E01335EA5(_t173 - 0x14, 0);
							_t165 =  *0x1384a94; // 0x0
							 *(_t173 - 4) =  *(_t173 - 4) & 0x00000000;
							 *(_t173 - 0x10) = _t165;
							_t160 = E0132BD50( *((intOrPtr*)(_t173 + 8)), E0132BCE0());
							__eflags = _t160;
							if(_t160 != 0) {
								L12:
								E01335EFD(_t173 - 0x14);
								return E013481F0(_t160);
							} else {
								__eflags = _t165;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t173 + 8)));
									_push(_t173 - 0x10);
									__eflags = E013440CE(_t121, _t160, _t165, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t121, _t160, _t165);
										E01335EA5(_t173 - 0x14, 0);
										_t166 =  *0x1384a9c; // 0x0
										 *(_t173 - 4) =  *(_t173 - 4) & 0x00000000;
										 *(_t173 - 0x10) = _t166;
										_t161 = E0132BD50( *((intOrPtr*)(_t173 + 8)), E0132BCE0());
										__eflags = _t161;
										if(_t161 != 0) {
											L19:
											E01335EFD(_t173 - 0x14);
											return E013481F0(_t161);
										} else {
											__eflags = _t166;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t173 + 8)));
												_push(_t173 - 0x10);
												__eflags = E01344153(_t121, _t161, _t166, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t121, _t161, _t166);
													E01335EA5(_t173 - 0x14, 0);
													_t167 =  *0x1384aa0; // 0x0
													 *(_t173 - 4) =  *(_t173 - 4) & 0x00000000;
													 *(_t173 - 0x10) = _t167;
													_t162 = E0132BD50( *((intOrPtr*)(_t173 + 8)), E0132BCE0());
													__eflags = _t162;
													if(_t162 != 0) {
														L26:
														E01335EFD(_t173 - 0x14);
														return E013481F0(_t162);
													} else {
														__eflags = _t167;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t173 + 8)));
															_push(_t173 - 0x10);
															_t97 = E013441BF(_t121, _t162, _t167, __eflags);
															_pop(_t145);
															__eflags = _t97 - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(4);
																E01348213(0x136bdf5, _t121, _t162, _t167);
																_t168 = _t145;
																 *(_t173 - 0x10) = _t168;
																 *((intOrPtr*)(_t168 + 4)) =  *((intOrPtr*)(_t173 + 0xc));
																_push( *((intOrPtr*)(_t173 + 8)));
																_t53 = _t173 - 4;
																 *_t53 =  *(_t173 - 4) & 0x00000000;
																__eflags =  *_t53;
																 *_t168 = 0x136ecc0;
																E01344EBF(_t121, _t145, _t162, _t168,  *_t53);
																return E013481F0(_t168);
															} else {
																_t162 =  *(_t173 - 0x10);
																 *(_t173 - 0x10) = _t162;
																 *(_t173 - 4) = 1;
																E01335C34(_t162);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t162 + 4))))();
																 *0x1384aa0 = _t162;
																goto L26;
															}
														} else {
															_t162 = _t167;
															goto L26;
														}
													}
												} else {
													_t161 =  *(_t173 - 0x10);
													 *(_t173 - 0x10) = _t161;
													 *(_t173 - 4) = 1;
													E01335C34(_t161);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t161 + 4))))();
													 *0x1384a9c = _t161;
													goto L19;
												}
											} else {
												_t161 = _t166;
												goto L19;
											}
										}
									} else {
										_t160 =  *(_t173 - 0x10);
										 *(_t173 - 0x10) = _t160;
										 *(_t173 - 4) = 1;
										E01335C34(_t160);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t160 + 4))))();
										 *0x1384a94 = _t160;
										goto L12;
									}
								} else {
									_t160 = _t165;
									goto L12;
								}
							}
						} else {
							_t159 =  *(_t173 - 0x10);
							 *(_t173 - 0x10) = _t159;
							 *(_t173 - 4) = 1;
							E01335C34(_t159);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t159 + 4))))();
							 *0x1384a98 = _t159;
							goto L5;
						}
					} else {
						_t159 = _t164;
						goto L5;
					}
				}
			}

0x01343b15
0x01343b15
0x01343b1c
0x01343b26
0x01343b2b
0x01343b36
0x01343b3a
0x01343b46
0x01343b4b
0x01343b4f
0x01343b94
0x01343b97
0x01343ba3
0x01343b51
0x01343b53
0x01343b59
0x01343b5f
0x01343b67
0x01343b6a
0x01343ba4
0x01343ba9
0x01343baa
0x01343bb1
0x01343bbb
0x01343bc0
0x01343bcb
0x01343bcf
0x01343be0
0x01343be2
0x01343be4
0x01343c29
0x01343c2c
0x01343c38
0x01343be6
0x01343be6
0x01343be8
0x01343bee
0x01343bf4
0x01343bfc
0x01343bff
0x01343c39
0x01343c3e
0x01343c3f
0x01343c46
0x01343c50
0x01343c55
0x01343c60
0x01343c64
0x01343c75
0x01343c77
0x01343c79
0x01343cbe
0x01343cc1
0x01343ccd
0x01343c7b
0x01343c7b
0x01343c7d
0x01343c83
0x01343c89
0x01343c91
0x01343c94
0x01343cce
0x01343cd3
0x01343cd4
0x01343cdb
0x01343ce5
0x01343cea
0x01343cf5
0x01343cf9
0x01343d0a
0x01343d0c
0x01343d0e
0x01343d53
0x01343d56
0x01343d62
0x01343d10
0x01343d10
0x01343d12
0x01343d18
0x01343d1e
0x01343d1f
0x01343d25
0x01343d26
0x01343d29
0x01343d63
0x01343d68
0x01343d69
0x01343d70
0x01343d75
0x01343d77
0x01343d7d
0x01343d80
0x01343d83
0x01343d83
0x01343d83
0x01343d87
0x01343d8d
0x01343d99
0x01343d2b
0x01343d2b
0x01343d2e
0x01343d32
0x01343d36
0x01343d43
0x01343d4b
0x01343d4d
0x00000000
0x01343d4d
0x01343d14
0x01343d14
0x00000000
0x01343d14
0x01343d12
0x01343c96
0x01343c96
0x01343c99
0x01343c9d
0x01343ca1
0x01343cae
0x01343cb6
0x01343cb8
0x00000000
0x01343cb8
0x01343c7f
0x01343c7f
0x00000000
0x01343c7f
0x01343c7d
0x01343c01
0x01343c01
0x01343c04
0x01343c08
0x01343c0c
0x01343c19
0x01343c21
0x01343c23
0x00000000
0x01343c23
0x01343bea
0x01343bea
0x00000000
0x01343bea
0x01343be8
0x01343b6c
0x01343b6c
0x01343b6f
0x01343b73
0x01343b77
0x01343b84
0x01343b8c
0x01343b8e
0x00000000
0x01343b8e
0x01343b55
0x01343b55
0x00000000
0x01343b55
0x01343b53

APIs

__EH_prolog3.LIBCMT ref: 01343B1C
std::_Lockit::_Lockit.LIBCPMT ref: 01343B26

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

moneypunct.LIBCPMT ref: 01343B60
std::_Facet_Register.LIBCPMT ref: 01343B77
std::_Lockit::~_Lockit.LIBCPMT ref: 01343B97

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 0bf84155277f7d378b0733c34175a707993149b954766126208d76be01b4088d
Instruction ID: f62a4f8e3ac83f97c1435860db4fbd568aecdf4246298eb926fa12832151531d
Opcode Fuzzy Hash: 0bf84155277f7d378b0733c34175a707993149b954766126208d76be01b4088d
Instruction Fuzzy Hash: 4A01923590022BDBDF15FBACD8447AEFBB5BF94328F254509D514AB280DF38EA018B95

Uniqueness

Uniqueness Score: -1.00%

Function 01343BAA Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01343BAA(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t47;
				void* _t74;
				signed int _t112;
				signed int _t124;
				signed int _t125;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t130;
				void* _t134;

				_t94 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t134 - 0x14, 0);
				_t127 =  *0x1384a94; // 0x0
				 *(_t134 - 4) =  *(_t134 - 4) & 0x00000000;
				 *(_t134 - 0x10) = _t127;
				_t47 = E0132BD50( *((intOrPtr*)(_t134 + 8)), E0132BCE0());
				_t123 = _t47;
				if(_t47 != 0) {
					L5:
					E01335EFD(_t134 - 0x14);
					return E013481F0(_t123);
				} else {
					if(_t127 == 0) {
						_push( *((intOrPtr*)(_t134 + 8)));
						_push(_t134 - 0x10);
						__eflags = E013440CE(__ebx, _t123, _t127, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t123, _t127);
							E01335EA5(_t134 - 0x14, 0);
							_t128 =  *0x1384a9c; // 0x0
							 *(_t134 - 4) =  *(_t134 - 4) & 0x00000000;
							 *(_t134 - 0x10) = _t128;
							_t124 = E0132BD50( *((intOrPtr*)(_t134 + 8)), E0132BCE0());
							__eflags = _t124;
							if(_t124 != 0) {
								L12:
								E01335EFD(_t134 - 0x14);
								return E013481F0(_t124);
							} else {
								__eflags = _t128;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t134 + 8)));
									_push(_t134 - 0x10);
									__eflags = E01344153(_t94, _t124, _t128, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t94, _t124, _t128);
										E01335EA5(_t134 - 0x14, 0);
										_t129 =  *0x1384aa0; // 0x0
										 *(_t134 - 4) =  *(_t134 - 4) & 0x00000000;
										 *(_t134 - 0x10) = _t129;
										_t125 = E0132BD50( *((intOrPtr*)(_t134 + 8)), E0132BCE0());
										__eflags = _t125;
										if(_t125 != 0) {
											L19:
											E01335EFD(_t134 - 0x14);
											return E013481F0(_t125);
										} else {
											__eflags = _t129;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t134 + 8)));
												_push(_t134 - 0x10);
												_t74 = E013441BF(_t94, _t125, _t129, __eflags);
												_pop(_t112);
												__eflags = _t74 - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(4);
													E01348213(0x136bdf5, _t94, _t125, _t129);
													_t130 = _t112;
													 *(_t134 - 0x10) = _t130;
													 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t134 + 0xc));
													_push( *((intOrPtr*)(_t134 + 8)));
													_t41 = _t134 - 4;
													 *_t41 =  *(_t134 - 4) & 0x00000000;
													__eflags =  *_t41;
													 *_t130 = 0x136ecc0;
													E01344EBF(_t94, _t112, _t125, _t130,  *_t41);
													return E013481F0(_t130);
												} else {
													_t125 =  *(_t134 - 0x10);
													 *(_t134 - 0x10) = _t125;
													 *(_t134 - 4) = 1;
													E01335C34(_t125);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t125 + 4))))();
													 *0x1384aa0 = _t125;
													goto L19;
												}
											} else {
												_t125 = _t129;
												goto L19;
											}
										}
									} else {
										_t124 =  *(_t134 - 0x10);
										 *(_t134 - 0x10) = _t124;
										 *(_t134 - 4) = 1;
										E01335C34(_t124);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t124 + 4))))();
										 *0x1384a9c = _t124;
										goto L12;
									}
								} else {
									_t124 = _t128;
									goto L12;
								}
							}
						} else {
							_t123 =  *(_t134 - 0x10);
							 *(_t134 - 0x10) = _t123;
							 *(_t134 - 4) = 1;
							E01335C34(_t123);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t123 + 4))))();
							 *0x1384a94 = _t123;
							goto L5;
						}
					} else {
						_t123 = _t127;
						goto L5;
					}
				}
			}

0x01343baa
0x01343baa
0x01343bb1
0x01343bbb
0x01343bc0
0x01343bcb
0x01343bcf
0x01343bdb
0x01343be0
0x01343be4
0x01343c29
0x01343c2c
0x01343c38
0x01343be6
0x01343be8
0x01343bee
0x01343bf4
0x01343bfc
0x01343bff
0x01343c39
0x01343c3e
0x01343c3f
0x01343c46
0x01343c50
0x01343c55
0x01343c60
0x01343c64
0x01343c75
0x01343c77
0x01343c79
0x01343cbe
0x01343cc1
0x01343ccd
0x01343c7b
0x01343c7b
0x01343c7d
0x01343c83
0x01343c89
0x01343c91
0x01343c94
0x01343cce
0x01343cd3
0x01343cd4
0x01343cdb
0x01343ce5
0x01343cea
0x01343cf5
0x01343cf9
0x01343d0a
0x01343d0c
0x01343d0e
0x01343d53
0x01343d56
0x01343d62
0x01343d10
0x01343d10
0x01343d12
0x01343d18
0x01343d1e
0x01343d1f
0x01343d25
0x01343d26
0x01343d29
0x01343d63
0x01343d68
0x01343d69
0x01343d70
0x01343d75
0x01343d77
0x01343d7d
0x01343d80
0x01343d83
0x01343d83
0x01343d83
0x01343d87
0x01343d8d
0x01343d99
0x01343d2b
0x01343d2b
0x01343d2e
0x01343d32
0x01343d36
0x01343d43
0x01343d4b
0x01343d4d
0x00000000
0x01343d4d
0x01343d14
0x01343d14
0x00000000
0x01343d14
0x01343d12
0x01343c96
0x01343c96
0x01343c99
0x01343c9d
0x01343ca1
0x01343cae
0x01343cb6
0x01343cb8
0x00000000
0x01343cb8
0x01343c7f
0x01343c7f
0x00000000
0x01343c7f
0x01343c7d
0x01343c01
0x01343c01
0x01343c04
0x01343c08
0x01343c0c
0x01343c19
0x01343c21
0x01343c23
0x00000000
0x01343c23
0x01343bea
0x01343bea
0x00000000
0x01343bea
0x01343be8

APIs

__EH_prolog3.LIBCMT ref: 01343BB1
std::_Lockit::_Lockit.LIBCPMT ref: 01343BBB

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

moneypunct.LIBCPMT ref: 01343BF5
std::_Facet_Register.LIBCPMT ref: 01343C0C
std::_Lockit::~_Lockit.LIBCPMT ref: 01343C2C

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: adfda0379a8d56135257cc89a075dc31fa7d992268647807aaea01f9aad31feb
Instruction ID: 150e383b639df91b6085e5250422cc4acb3d38a0380b01494ca9828e596b609f
Opcode Fuzzy Hash: adfda0379a8d56135257cc89a075dc31fa7d992268647807aaea01f9aad31feb
Instruction Fuzzy Hash: 5C01DE3590022BDBDF15FBACD9447AEBBB5BF90728F244509D514AB290CF34EE018B95

Uniqueness

Uniqueness Score: -1.00%

Function 01337D47 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E01337D47(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v32;
				intOrPtr* _t120;
				void* _t213;
				intOrPtr* _t216;
				void* _t309;
				intOrPtr _t310;
				intOrPtr* _t342;
				intOrPtr* _t343;
				intOrPtr* _t344;
				intOrPtr* _t345;
				intOrPtr* _t346;
				intOrPtr* _t347;
				intOrPtr* _t348;
				intOrPtr* _t349;
				void* _t350;
				void* _t353;
				intOrPtr* _t354;
				intOrPtr* _t355;
				intOrPtr* _t356;
				intOrPtr* _t357;
				intOrPtr* _t358;
				intOrPtr* _t359;
				intOrPtr* _t360;
				void* _t361;
				void* _t362;

				_t339 = __edx;
				_t255 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t353 =  *0x1384a24; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t353;
				_t120 = E0132BD50(_a8, E0132BCE0());
				_t341 = _t120;
				if(_t120 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t341);
				} else {
					if(_t353 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E013391B0(__ebx, _t341, _t353, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t341, _t353);
							E01335EA5( &_v20, 0);
							_t354 =  *0x1384a20; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t354;
							_t342 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t342;
							if(_t342 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t342);
							} else {
								__eflags = _t354;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01339234(_t255, _t342, _t354, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t255, _t342, _t354);
										E01335EA5( &_v20, 0);
										_t355 =  *0x1384a34; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t355;
										_t343 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t343;
										if(_t343 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t343);
										} else {
											__eflags = _t355;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E013392B9(_t255, _t343, _t355, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t255, _t343, _t355);
													E01335EA5( &_v20, 0);
													_t356 =  *0x1384a0c; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t356;
													_t344 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t344;
													if(_t344 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t344);
													} else {
														__eflags = _t356;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01339321(_t255, _t344, _t356, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t255, _t344, _t356);
																E01335EA5( &_v20, 0);
																_t357 =  *0x1384a38; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t357;
																_t345 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t345;
																if(_t345 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t345);
																} else {
																	__eflags = _t357;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01339389(_t255, _t345, _t357, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t255, _t345, _t357);
																			E01335EA5( &_v20, 0);
																			_t358 =  *0x1384a3c; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t358;
																			_t346 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t346;
																			if(_t346 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t346);
																			} else {
																				__eflags = _t358;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E013393F1(_t255, __edx, _t346, _t358, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t255, _t346, _t358);
																						E01335EA5( &_v20, 0);
																						_t359 =  *0x1384a58; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t359;
																						_t347 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t347;
																						if(_t347 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t347);
																						} else {
																							__eflags = _t359;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E0133946C(_t255, _t347, _t359, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t255, _t347, _t359);
																									E01335EA5( &_v20, 0);
																									_t360 =  *0x1384a28; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t360;
																									_t348 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t348;
																									if(_t348 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t348);
																									} else {
																										__eflags = _t360;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E013394D8(_t255, _t348, _t360, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t255, _t348, _t360);
																												E01335EA5( &_v20, 0);
																												_t361 =  *0x1384a5c; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t361;
																												_t349 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t349;
																												if(_t349 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t349);
																												} else {
																													__eflags = _t361;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														_t213 = E01339544(_t255, _t349, _t361, __eflags);
																														_pop(_t309);
																														__eflags = _t213 - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(_t361);
																															_push(_t349);
																															_t362 = _t309;
																															_t350 = _t362;
																															asm("stosd");
																															asm("stosd");
																															asm("stosd");
																															asm("stosd");
																															_t216 = _v32;
																															 *(_t362 + 0x10) =  *(_t362 + 0x10) & 0x00000000;
																															 *(_t362 + 0x14) =  *(_t362 + 0x14) & 0x00000000;
																															__eflags =  *((intOrPtr*)(_t216 + 0x14)) - 8;
																															_t310 =  *((intOrPtr*)(_t216 + 0x10));
																															if( *((intOrPtr*)(_t216 + 0x14)) >= 8) {
																																_t216 =  *_t216;
																															}
																															_push(_t310);
																															E0133657C(_t255, _t362, _t339, _t350, _t216);
																															return _t362;
																														} else {
																															_t349 = _v16;
																															_v16 = _t349;
																															_v4 = 1;
																															E01335C34(_t349);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t349 + 4))))();
																															 *0x1384a5c = _t349;
																															goto L61;
																														}
																													} else {
																														_t349 = _t361;
																														goto L61;
																													}
																												}
																											} else {
																												_t348 = _v16;
																												_v16 = _t348;
																												_v4 = 1;
																												E01335C34(_t348);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t348 + 4))))();
																												 *0x1384a28 = _t348;
																												goto L54;
																											}
																										} else {
																											_t348 = _t360;
																											goto L54;
																										}
																									}
																								} else {
																									_t347 = _v16;
																									_v16 = _t347;
																									_v4 = 1;
																									E01335C34(_t347);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t347 + 4))))();
																									 *0x1384a58 = _t347;
																									goto L47;
																								}
																							} else {
																								_t347 = _t359;
																								goto L47;
																							}
																						}
																					} else {
																						_t346 = _v16;
																						_v16 = _t346;
																						_v4 = 1;
																						E01335C34(_t346);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t346 + 4))))();
																						 *0x1384a3c = _t346;
																						goto L40;
																					}
																				} else {
																					_t346 = _t358;
																					goto L40;
																				}
																			}
																		} else {
																			_t345 = _v16;
																			_v16 = _t345;
																			_v4 = 1;
																			E01335C34(_t345);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t345 + 4))))();
																			 *0x1384a38 = _t345;
																			goto L33;
																		}
																	} else {
																		_t345 = _t357;
																		goto L33;
																	}
																}
															} else {
																_t344 = _v16;
																_v16 = _t344;
																_v4 = 1;
																E01335C34(_t344);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t344 + 4))))();
																 *0x1384a0c = _t344;
																goto L26;
															}
														} else {
															_t344 = _t356;
															goto L26;
														}
													}
												} else {
													_t343 = _v16;
													_v16 = _t343;
													_v4 = 1;
													E01335C34(_t343);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t343 + 4))))();
													 *0x1384a34 = _t343;
													goto L19;
												}
											} else {
												_t343 = _t355;
												goto L19;
											}
										}
									} else {
										_t342 = _v16;
										_v16 = _t342;
										_v4 = 1;
										E01335C34(_t342);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t342 + 4))))();
										 *0x1384a20 = _t342;
										goto L12;
									}
								} else {
									_t342 = _t354;
									goto L12;
								}
							}
						} else {
							_t341 = _v16;
							_v16 = _t341;
							_v4 = 1;
							E01335C34(_t341);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t341 + 4))))();
							 *0x1384a24 = _t341;
							goto L5;
						}
					} else {
						_t341 = _t353;
						goto L5;
					}
				}
			}

0x01337d47
0x01337d47
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d78
0x01337d7d
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85

APIs

__EH_prolog3.LIBCMT ref: 01337D4E
std::_Lockit::_Lockit.LIBCPMT ref: 01337D58

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

moneypunct.LIBCPMT ref: 01337D92
std::_Facet_Register.LIBCPMT ref: 01337DA9
std::_Lockit::~_Lockit.LIBCPMT ref: 01337DC9

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 45f8bbebe4f1afdfd2ba7cad3cde0ae683d1d583b8435322e1b34f9a1713ae25
Instruction ID: 8a4d76f040a4a9d9ae9e265e1c600efe1ee766a3284e33c158a146907e3d7de4
Opcode Fuzzy Hash: 45f8bbebe4f1afdfd2ba7cad3cde0ae683d1d583b8435322e1b34f9a1713ae25
Instruction Fuzzy Hash: 6701D67690022BDBCF11FBACC4487BDB7B5AFD4718F154009D5106B284DF7499018BD4

Uniqueness

Uniqueness Score: -1.00%

Function 01337DDC Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E01337DDC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v28;
				intOrPtr* _t108;
				void* _t190;
				intOrPtr* _t193;
				void* _t276;
				intOrPtr _t277;
				intOrPtr* _t306;
				intOrPtr* _t307;
				intOrPtr* _t308;
				intOrPtr* _t309;
				intOrPtr* _t310;
				intOrPtr* _t311;
				intOrPtr* _t312;
				void* _t313;
				void* _t316;
				intOrPtr* _t317;
				intOrPtr* _t318;
				intOrPtr* _t319;
				intOrPtr* _t320;
				intOrPtr* _t321;
				intOrPtr* _t322;
				void* _t323;
				void* _t324;

				_t303 = __edx;
				_t228 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t316 =  *0x1384a20; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t316;
				_t108 = E0132BD50(_a8, E0132BCE0());
				_t305 = _t108;
				if(_t108 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t305);
				} else {
					if(_t316 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01339234(__ebx, _t305, _t316, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t305, _t316);
							E01335EA5( &_v20, 0);
							_t317 =  *0x1384a34; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t317;
							_t306 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t306;
							if(_t306 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t306);
							} else {
								__eflags = _t317;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E013392B9(_t228, _t306, _t317, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t228, _t306, _t317);
										E01335EA5( &_v20, 0);
										_t318 =  *0x1384a0c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t318;
										_t307 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t307;
										if(_t307 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t307);
										} else {
											__eflags = _t318;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01339321(_t228, _t307, _t318, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t228, _t307, _t318);
													E01335EA5( &_v20, 0);
													_t319 =  *0x1384a38; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t319;
													_t308 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t308;
													if(_t308 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t308);
													} else {
														__eflags = _t319;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01339389(_t228, _t308, _t319, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t228, _t308, _t319);
																E01335EA5( &_v20, 0);
																_t320 =  *0x1384a3c; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t320;
																_t309 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t309;
																if(_t309 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t309);
																} else {
																	__eflags = _t320;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E013393F1(_t228, __edx, _t309, _t320, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t228, _t309, _t320);
																			E01335EA5( &_v20, 0);
																			_t321 =  *0x1384a58; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t321;
																			_t310 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t310;
																			if(_t310 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t310);
																			} else {
																				__eflags = _t321;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0133946C(_t228, _t310, _t321, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t228, _t310, _t321);
																						E01335EA5( &_v20, 0);
																						_t322 =  *0x1384a28; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t322;
																						_t311 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t311;
																						if(_t311 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t311);
																						} else {
																							__eflags = _t322;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E013394D8(_t228, _t311, _t322, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t228, _t311, _t322);
																									E01335EA5( &_v20, 0);
																									_t323 =  *0x1384a5c; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t323;
																									_t312 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t312;
																									if(_t312 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t312);
																									} else {
																										__eflags = _t323;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											_t190 = E01339544(_t228, _t312, _t323, __eflags);
																											_pop(_t276);
																											__eflags = _t190 - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(_t323);
																												_push(_t312);
																												_t324 = _t276;
																												_t313 = _t324;
																												asm("stosd");
																												asm("stosd");
																												asm("stosd");
																												asm("stosd");
																												_t193 = _v28;
																												 *(_t324 + 0x10) =  *(_t324 + 0x10) & 0x00000000;
																												 *(_t324 + 0x14) =  *(_t324 + 0x14) & 0x00000000;
																												__eflags =  *((intOrPtr*)(_t193 + 0x14)) - 8;
																												_t277 =  *((intOrPtr*)(_t193 + 0x10));
																												if( *((intOrPtr*)(_t193 + 0x14)) >= 8) {
																													_t193 =  *_t193;
																												}
																												_push(_t277);
																												E0133657C(_t228, _t324, _t303, _t313, _t193);
																												return _t324;
																											} else {
																												_t312 = _v16;
																												_v16 = _t312;
																												_v4 = 1;
																												E01335C34(_t312);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t312 + 4))))();
																												 *0x1384a5c = _t312;
																												goto L54;
																											}
																										} else {
																											_t312 = _t323;
																											goto L54;
																										}
																									}
																								} else {
																									_t311 = _v16;
																									_v16 = _t311;
																									_v4 = 1;
																									E01335C34(_t311);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t311 + 4))))();
																									 *0x1384a28 = _t311;
																									goto L47;
																								}
																							} else {
																								_t311 = _t322;
																								goto L47;
																							}
																						}
																					} else {
																						_t310 = _v16;
																						_v16 = _t310;
																						_v4 = 1;
																						E01335C34(_t310);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t310 + 4))))();
																						 *0x1384a58 = _t310;
																						goto L40;
																					}
																				} else {
																					_t310 = _t321;
																					goto L40;
																				}
																			}
																		} else {
																			_t309 = _v16;
																			_v16 = _t309;
																			_v4 = 1;
																			E01335C34(_t309);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t309 + 4))))();
																			 *0x1384a3c = _t309;
																			goto L33;
																		}
																	} else {
																		_t309 = _t320;
																		goto L33;
																	}
																}
															} else {
																_t308 = _v16;
																_v16 = _t308;
																_v4 = 1;
																E01335C34(_t308);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t308 + 4))))();
																 *0x1384a38 = _t308;
																goto L26;
															}
														} else {
															_t308 = _t319;
															goto L26;
														}
													}
												} else {
													_t307 = _v16;
													_v16 = _t307;
													_v4 = 1;
													E01335C34(_t307);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t307 + 4))))();
													 *0x1384a0c = _t307;
													goto L19;
												}
											} else {
												_t307 = _t318;
												goto L19;
											}
										}
									} else {
										_t306 = _v16;
										_v16 = _t306;
										_v4 = 1;
										E01335C34(_t306);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t306 + 4))))();
										 *0x1384a34 = _t306;
										goto L12;
									}
								} else {
									_t306 = _t317;
									goto L12;
								}
							}
						} else {
							_t305 = _v16;
							_v16 = _t305;
							_v4 = 1;
							E01335C34(_t305);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t305 + 4))))();
							 *0x1384a20 = _t305;
							goto L5;
						}
					} else {
						_t305 = _t316;
						goto L5;
					}
				}
			}

0x01337ddc
0x01337ddc
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e0d
0x01337e12
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a

APIs

__EH_prolog3.LIBCMT ref: 01337DE3
std::_Lockit::_Lockit.LIBCPMT ref: 01337DED

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

moneypunct.LIBCPMT ref: 01337E27
std::_Facet_Register.LIBCPMT ref: 01337E3E
std::_Lockit::~_Lockit.LIBCPMT ref: 01337E5E

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 18fb47f0554d8ec9a0671992b2e723d20db956002cb18a94d7d03497e9e5eef3
Instruction ID: 933927b7ea161b1d87819a35b87c090f2c51b31b381057b3ce72f65dc60bb096
Opcode Fuzzy Hash: 18fb47f0554d8ec9a0671992b2e723d20db956002cb18a94d7d03497e9e5eef3
Instruction Fuzzy Hash: 8501CC7590062A9BCB21FBACD4447AEBBA5AFD4728F244509D515AB280DF34DE018BA8

Uniqueness

Uniqueness Score: -1.00%

Function 01337C1D Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E01337C1D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v40;
				intOrPtr* _t144;
				void* _t259;
				intOrPtr* _t262;
				void* _t375;
				intOrPtr _t376;
				intOrPtr* _t414;
				intOrPtr* _t415;
				intOrPtr* _t416;
				intOrPtr* _t417;
				intOrPtr* _t418;
				intOrPtr* _t419;
				intOrPtr* _t420;
				intOrPtr* _t421;
				intOrPtr* _t422;
				intOrPtr* _t423;
				void* _t424;
				void* _t427;
				intOrPtr* _t428;
				intOrPtr* _t429;
				intOrPtr* _t430;
				intOrPtr* _t431;
				intOrPtr* _t432;
				intOrPtr* _t433;
				intOrPtr* _t434;
				intOrPtr* _t435;
				intOrPtr* _t436;
				void* _t437;
				void* _t438;

				_t411 = __edx;
				_t309 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t427 =  *0x1384a54; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t427;
				_t144 = E0132BD50(_a8, E0132BCE0());
				_t413 = _t144;
				if(_t144 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t413);
				} else {
					if(_t427 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E013390A7(__ebx, _t413, _t427, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t413, _t427);
							E01335EA5( &_v20, 0);
							_t428 =  *0x1384a50; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t428;
							_t414 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t414;
							if(_t414 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t414);
							} else {
								__eflags = _t428;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0133912B(_t309, _t414, _t428, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t309, _t414, _t428);
										E01335EA5( &_v20, 0);
										_t429 =  *0x1384a24; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t429;
										_t415 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t415;
										if(_t415 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t415);
										} else {
											__eflags = _t429;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E013391B0(_t309, _t415, _t429, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t309, _t415, _t429);
													E01335EA5( &_v20, 0);
													_t430 =  *0x1384a20; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t430;
													_t416 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t416;
													if(_t416 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t416);
													} else {
														__eflags = _t430;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E01339234(_t309, _t416, _t430, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t309, _t416, _t430);
																E01335EA5( &_v20, 0);
																_t431 =  *0x1384a34; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t431;
																_t417 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t417;
																if(_t417 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t417);
																} else {
																	__eflags = _t431;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E013392B9(_t309, _t417, _t431, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t309, _t417, _t431);
																			E01335EA5( &_v20, 0);
																			_t432 =  *0x1384a0c; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t432;
																			_t418 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t418;
																			if(_t418 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t418);
																			} else {
																				__eflags = _t432;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E01339321(_t309, _t418, _t432, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t309, _t418, _t432);
																						E01335EA5( &_v20, 0);
																						_t433 =  *0x1384a38; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t433;
																						_t419 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t419;
																						if(_t419 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t419);
																						} else {
																							__eflags = _t433;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E01339389(_t309, _t419, _t433, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t309, _t419, _t433);
																									E01335EA5( &_v20, 0);
																									_t434 =  *0x1384a3c; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t434;
																									_t420 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t420;
																									if(_t420 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t420);
																									} else {
																										__eflags = _t434;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E013393F1(_t309, __edx, _t420, _t434, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t309, _t420, _t434);
																												E01335EA5( &_v20, 0);
																												_t435 =  *0x1384a58; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t435;
																												_t421 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t421;
																												if(_t421 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t421);
																												} else {
																													__eflags = _t435;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E0133946C(_t309, _t421, _t435, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t309, _t421, _t435);
																															E01335EA5( &_v20, 0);
																															_t436 =  *0x1384a28; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t436;
																															_t422 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t422;
																															if(_t422 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t422);
																															} else {
																																__eflags = _t436;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E013394D8(_t309, _t422, _t436, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t309, _t422, _t436);
																																		E01335EA5( &_v20, 0);
																																		_t437 =  *0x1384a5c; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t437;
																																		_t423 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t423;
																																		if(_t423 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t423);
																																		} else {
																																			__eflags = _t437;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				_t259 = E01339544(_t309, _t423, _t437, __eflags);
																																				_pop(_t375);
																																				__eflags = _t259 - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(_t437);
																																					_push(_t423);
																																					_t438 = _t375;
																																					_t424 = _t438;
																																					asm("stosd");
																																					asm("stosd");
																																					asm("stosd");
																																					asm("stosd");
																																					_t262 = _v40;
																																					 *(_t438 + 0x10) =  *(_t438 + 0x10) & 0x00000000;
																																					 *(_t438 + 0x14) =  *(_t438 + 0x14) & 0x00000000;
																																					__eflags =  *((intOrPtr*)(_t262 + 0x14)) - 8;
																																					_t376 =  *((intOrPtr*)(_t262 + 0x10));
																																					if( *((intOrPtr*)(_t262 + 0x14)) >= 8) {
																																						_t262 =  *_t262;
																																					}
																																					_push(_t376);
																																					E0133657C(_t309, _t438, _t411, _t424, _t262);
																																					return _t438;
																																				} else {
																																					_t423 = _v16;
																																					_v16 = _t423;
																																					_v4 = 1;
																																					E01335C34(_t423);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t423 + 4))))();
																																					 *0x1384a5c = _t423;
																																					goto L75;
																																				}
																																			} else {
																																				_t423 = _t437;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t422 = _v16;
																																		_v16 = _t422;
																																		_v4 = 1;
																																		E01335C34(_t422);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t422 + 4))))();
																																		 *0x1384a28 = _t422;
																																		goto L68;
																																	}
																																} else {
																																	_t422 = _t436;
																																	goto L68;
																																}
																															}
																														} else {
																															_t421 = _v16;
																															_v16 = _t421;
																															_v4 = 1;
																															E01335C34(_t421);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t421 + 4))))();
																															 *0x1384a58 = _t421;
																															goto L61;
																														}
																													} else {
																														_t421 = _t435;
																														goto L61;
																													}
																												}
																											} else {
																												_t420 = _v16;
																												_v16 = _t420;
																												_v4 = 1;
																												E01335C34(_t420);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t420 + 4))))();
																												 *0x1384a3c = _t420;
																												goto L54;
																											}
																										} else {
																											_t420 = _t434;
																											goto L54;
																										}
																									}
																								} else {
																									_t419 = _v16;
																									_v16 = _t419;
																									_v4 = 1;
																									E01335C34(_t419);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t419 + 4))))();
																									 *0x1384a38 = _t419;
																									goto L47;
																								}
																							} else {
																								_t419 = _t433;
																								goto L47;
																							}
																						}
																					} else {
																						_t418 = _v16;
																						_v16 = _t418;
																						_v4 = 1;
																						E01335C34(_t418);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t418 + 4))))();
																						 *0x1384a0c = _t418;
																						goto L40;
																					}
																				} else {
																					_t418 = _t432;
																					goto L40;
																				}
																			}
																		} else {
																			_t417 = _v16;
																			_v16 = _t417;
																			_v4 = 1;
																			E01335C34(_t417);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t417 + 4))))();
																			 *0x1384a34 = _t417;
																			goto L33;
																		}
																	} else {
																		_t417 = _t431;
																		goto L33;
																	}
																}
															} else {
																_t416 = _v16;
																_v16 = _t416;
																_v4 = 1;
																E01335C34(_t416);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t416 + 4))))();
																 *0x1384a20 = _t416;
																goto L26;
															}
														} else {
															_t416 = _t430;
															goto L26;
														}
													}
												} else {
													_t415 = _v16;
													_v16 = _t415;
													_v4 = 1;
													E01335C34(_t415);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 4))))();
													 *0x1384a24 = _t415;
													goto L19;
												}
											} else {
												_t415 = _t429;
												goto L19;
											}
										}
									} else {
										_t414 = _v16;
										_v16 = _t414;
										_v4 = 1;
										E01335C34(_t414);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t414 + 4))))();
										 *0x1384a50 = _t414;
										goto L12;
									}
								} else {
									_t414 = _t428;
									goto L12;
								}
							}
						} else {
							_t413 = _v16;
							_v16 = _t413;
							_v4 = 1;
							E01335C34(_t413);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 4))))();
							 *0x1384a54 = _t413;
							goto L5;
						}
					} else {
						_t413 = _t427;
						goto L5;
					}
				}
			}

0x01337c1d
0x01337c1d
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c4e
0x01337c53
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b

APIs

__EH_prolog3.LIBCMT ref: 01337C24
std::_Lockit::_Lockit.LIBCPMT ref: 01337C2E

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

moneypunct.LIBCPMT ref: 01337C68
std::_Facet_Register.LIBCPMT ref: 01337C7F
std::_Lockit::~_Lockit.LIBCPMT ref: 01337C9F

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 84bb55e2509af1b7a9f473269350590d493c465a5b836f1bc592233f6e75dc97
Instruction ID: 7710811eae2b2cc01f4f31b383f4684ccc78879a05a2fecaf60ba2c62537292e
Opcode Fuzzy Hash: 84bb55e2509af1b7a9f473269350590d493c465a5b836f1bc592233f6e75dc97
Instruction Fuzzy Hash: AE01D27590022ACBCF11FBACC9447AEBBB5BFD0728F254409D410AB281DF389E058B98

Uniqueness

Uniqueness Score: -1.00%

Function 01337CB2 Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E01337CB2(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v36;
				intOrPtr* _t132;
				void* _t236;
				intOrPtr* _t239;
				void* _t342;
				intOrPtr _t343;
				intOrPtr* _t378;
				intOrPtr* _t379;
				intOrPtr* _t380;
				intOrPtr* _t381;
				intOrPtr* _t382;
				intOrPtr* _t383;
				intOrPtr* _t384;
				intOrPtr* _t385;
				intOrPtr* _t386;
				void* _t387;
				void* _t390;
				intOrPtr* _t391;
				intOrPtr* _t392;
				intOrPtr* _t393;
				intOrPtr* _t394;
				intOrPtr* _t395;
				intOrPtr* _t396;
				intOrPtr* _t397;
				intOrPtr* _t398;
				void* _t399;
				void* _t400;

				_t375 = __edx;
				_t282 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t390 =  *0x1384a50; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t390;
				_t132 = E0132BD50(_a8, E0132BCE0());
				_t377 = _t132;
				if(_t132 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t377);
				} else {
					if(_t390 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0133912B(__ebx, _t377, _t390, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t377, _t390);
							E01335EA5( &_v20, 0);
							_t391 =  *0x1384a24; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t391;
							_t378 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t378;
							if(_t378 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t378);
							} else {
								__eflags = _t391;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E013391B0(_t282, _t378, _t391, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t282, _t378, _t391);
										E01335EA5( &_v20, 0);
										_t392 =  *0x1384a20; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t392;
										_t379 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t379;
										if(_t379 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t379);
										} else {
											__eflags = _t392;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01339234(_t282, _t379, _t392, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t282, _t379, _t392);
													E01335EA5( &_v20, 0);
													_t393 =  *0x1384a34; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t393;
													_t380 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t380;
													if(_t380 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t380);
													} else {
														__eflags = _t393;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E013392B9(_t282, _t380, _t393, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t282, _t380, _t393);
																E01335EA5( &_v20, 0);
																_t394 =  *0x1384a0c; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t394;
																_t381 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t381;
																if(_t381 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t381);
																} else {
																	__eflags = _t394;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01339321(_t282, _t381, _t394, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t282, _t381, _t394);
																			E01335EA5( &_v20, 0);
																			_t395 =  *0x1384a38; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t395;
																			_t382 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t382;
																			if(_t382 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t382);
																			} else {
																				__eflags = _t395;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E01339389(_t282, _t382, _t395, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t282, _t382, _t395);
																						E01335EA5( &_v20, 0);
																						_t396 =  *0x1384a3c; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t396;
																						_t383 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t383;
																						if(_t383 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t383);
																						} else {
																							__eflags = _t396;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E013393F1(_t282, __edx, _t383, _t396, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t282, _t383, _t396);
																									E01335EA5( &_v20, 0);
																									_t397 =  *0x1384a58; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t397;
																									_t384 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t384;
																									if(_t384 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t384);
																									} else {
																										__eflags = _t397;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E0133946C(_t282, _t384, _t397, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t282, _t384, _t397);
																												E01335EA5( &_v20, 0);
																												_t398 =  *0x1384a28; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t398;
																												_t385 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t385;
																												if(_t385 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t385);
																												} else {
																													__eflags = _t398;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E013394D8(_t282, _t385, _t398, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t282, _t385, _t398);
																															E01335EA5( &_v20, 0);
																															_t399 =  *0x1384a5c; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t399;
																															_t386 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t386;
																															if(_t386 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t386);
																															} else {
																																__eflags = _t399;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	_t236 = E01339544(_t282, _t386, _t399, __eflags);
																																	_pop(_t342);
																																	__eflags = _t236 - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(_t399);
																																		_push(_t386);
																																		_t400 = _t342;
																																		_t387 = _t400;
																																		asm("stosd");
																																		asm("stosd");
																																		asm("stosd");
																																		asm("stosd");
																																		_t239 = _v36;
																																		 *(_t400 + 0x10) =  *(_t400 + 0x10) & 0x00000000;
																																		 *(_t400 + 0x14) =  *(_t400 + 0x14) & 0x00000000;
																																		__eflags =  *((intOrPtr*)(_t239 + 0x14)) - 8;
																																		_t343 =  *((intOrPtr*)(_t239 + 0x10));
																																		if( *((intOrPtr*)(_t239 + 0x14)) >= 8) {
																																			_t239 =  *_t239;
																																		}
																																		_push(_t343);
																																		E0133657C(_t282, _t400, _t375, _t387, _t239);
																																		return _t400;
																																	} else {
																																		_t386 = _v16;
																																		_v16 = _t386;
																																		_v4 = 1;
																																		E01335C34(_t386);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t386 + 4))))();
																																		 *0x1384a5c = _t386;
																																		goto L68;
																																	}
																																} else {
																																	_t386 = _t399;
																																	goto L68;
																																}
																															}
																														} else {
																															_t385 = _v16;
																															_v16 = _t385;
																															_v4 = 1;
																															E01335C34(_t385);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t385 + 4))))();
																															 *0x1384a28 = _t385;
																															goto L61;
																														}
																													} else {
																														_t385 = _t398;
																														goto L61;
																													}
																												}
																											} else {
																												_t384 = _v16;
																												_v16 = _t384;
																												_v4 = 1;
																												E01335C34(_t384);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t384 + 4))))();
																												 *0x1384a58 = _t384;
																												goto L54;
																											}
																										} else {
																											_t384 = _t397;
																											goto L54;
																										}
																									}
																								} else {
																									_t383 = _v16;
																									_v16 = _t383;
																									_v4 = 1;
																									E01335C34(_t383);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t383 + 4))))();
																									 *0x1384a3c = _t383;
																									goto L47;
																								}
																							} else {
																								_t383 = _t396;
																								goto L47;
																							}
																						}
																					} else {
																						_t382 = _v16;
																						_v16 = _t382;
																						_v4 = 1;
																						E01335C34(_t382);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t382 + 4))))();
																						 *0x1384a38 = _t382;
																						goto L40;
																					}
																				} else {
																					_t382 = _t395;
																					goto L40;
																				}
																			}
																		} else {
																			_t381 = _v16;
																			_v16 = _t381;
																			_v4 = 1;
																			E01335C34(_t381);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t381 + 4))))();
																			 *0x1384a0c = _t381;
																			goto L33;
																		}
																	} else {
																		_t381 = _t394;
																		goto L33;
																	}
																}
															} else {
																_t380 = _v16;
																_v16 = _t380;
																_v4 = 1;
																E01335C34(_t380);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t380 + 4))))();
																 *0x1384a34 = _t380;
																goto L26;
															}
														} else {
															_t380 = _t393;
															goto L26;
														}
													}
												} else {
													_t379 = _v16;
													_v16 = _t379;
													_v4 = 1;
													E01335C34(_t379);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t379 + 4))))();
													 *0x1384a20 = _t379;
													goto L19;
												}
											} else {
												_t379 = _t392;
												goto L19;
											}
										}
									} else {
										_t378 = _v16;
										_v16 = _t378;
										_v4 = 1;
										E01335C34(_t378);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t378 + 4))))();
										 *0x1384a24 = _t378;
										goto L12;
									}
								} else {
									_t378 = _t391;
									goto L12;
								}
							}
						} else {
							_t377 = _v16;
							_v16 = _t377;
							_v4 = 1;
							E01335C34(_t377);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t377 + 4))))();
							 *0x1384a50 = _t377;
							goto L5;
						}
					} else {
						_t377 = _t390;
						goto L5;
					}
				}
			}

0x01337cb2
0x01337cb2
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce3
0x01337ce8
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0

APIs

__EH_prolog3.LIBCMT ref: 01337CB9
std::_Lockit::_Lockit.LIBCPMT ref: 01337CC3

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

moneypunct.LIBCPMT ref: 01337CFD
std::_Facet_Register.LIBCPMT ref: 01337D14
std::_Lockit::~_Lockit.LIBCPMT ref: 01337D34

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 4d95966c9b5c7c9314e29486f0f1c629207f31f07bdf68b89c3b5083bd70edad
Instruction ID: 19f0808e3bba5857de547bd1e81d5058f25c4616f5c4abd8c2704d2ee446ca8e
Opcode Fuzzy Hash: 4d95966c9b5c7c9314e29486f0f1c629207f31f07bdf68b89c3b5083bd70edad
Instruction Fuzzy Hash: 5701007290022BCBCF00FBACC4487BEBBB4BFD0318F244509D910AB280DF349A018B84

Uniqueness

Uniqueness Score: -1.00%

Function 0134782B Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0134782B(intOrPtr* _a4) {
				intOrPtr _t7;
				intOrPtr _t12;
				intOrPtr _t13;
				signed int _t14;
				void* _t17;
				void* _t19;
				intOrPtr* _t20;

				EnterCriticalSection(0x1384af8);
				_t12 =  *0x1383010; // 0x80000002
				_t13 = _t12 + 1;
				 *0x1383010 = _t13;
				 *_a4 = _t13;
				_t14 =  *0x1384e68; // 0x0
				_t7 =  *0x1383010; // 0x80000002
				 *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c] + _t14 * 4)) + 4)) = _t7;
				LeaveCriticalSection(0x1384af8);
				_t19 = _t17;
				_push(_t19);
				_t20 =  *0x1384b14;
				if(_t20 == 0) {
					SetEvent( *0x1384af4);
					return ResetEvent( *0x1384af4);
				} else {
					 *0x136d26c(0x1384af0);
					return  *_t20();
				}
			}

0x01347835
0x0134783b
0x01347844
0x01347845
0x0134784c
0x01347854
0x0134785d
0x01347862
0x01347868
0x0134786e
0x013478c7
0x013478c8
0x013478d0
0x013478e9
0x013478fc
0x013478d2
0x013478d9
0x013478e2
0x013478e2

APIs

EnterCriticalSection.KERNEL32(01384AF8,?,?,01322627,0138571C,0136CCC0), ref: 01347835
LeaveCriticalSection.KERNEL32(01384AF8,?,?,01322627,0138571C,0136CCC0), ref: 01347868
RtlWakeAllConditionVariable.NTDLL ref: 013478DF
SetEvent.KERNEL32(?,01322627,0138571C,0136CCC0), ref: 013478E9
ResetEvent.KERNEL32(?,01322627,0138571C,0136CCC0), ref: 013478F5

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: fe801369c4707396fd68cc9f01f90521b1b494761ba26a3bea366a86b559c0e3
Instruction ID: f584aecef47344beafe77108a34ee00fc6972fa3cb250723a5a6dd6df81f35d4
Opcode Fuzzy Hash: fe801369c4707396fd68cc9f01f90521b1b494761ba26a3bea366a86b559c0e3
Instruction Fuzzy Hash: 91018C71A05321DFD725AF58F848A9C7BACFB09B11F01402AE8469BB18CBB46C01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01326090 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97
libraryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E01326090(void* __ebx, WCHAR* __ecx) {
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t26;
				short _t27;
				int _t30;
				signed int _t31;
				signed int _t41;
				short* _t57;
				void* _t59;
				signed int _t60;
				void* _t61;
				WCHAR* _t62;
				intOrPtr* _t64;
				void* _t65;
				WCHAR* _t66;
				void* _t67;

				_t46 = __ebx;
				_t66 = _t67 - 0x210;
				_push(0xffffffff);
				_push(0x1369b6d);
				_push( *[fs:0x0]);
				_t26 =  *0x1383020; // 0xc9209188
				_t27 = _t26 ^ _t66;
				_t66[0x106] = _t27;
				_push(_t59);
				_push(_t27);
				 *[fs:0x0] = _t66 - 0xc;
				_t64 = __ecx;
				 *(_t66 - 0x10) = __ecx;
				 *((intOrPtr*)(_t66 - 0x14)) = __ecx;
				 *((intOrPtr*)(__ecx)) = 0x13792b8;
				 *(__ecx + 4) = 0;
				 *(_t66 - 4) = 0;
				 *(__ecx + 8) = 0;
				_t30 = GetSystemDirectoryW(_t66, 0x105);
				if(_t30 == 0) {
					L7:
					_t60 = 0;
					__eflags = 0;
					L8:
					_t31 =  *(_t64 + 4);
					if(_t60 != _t31) {
						 *((intOrPtr*)( *_t64 + 4))();
						 *(_t64 + 4) = _t60;
						_t31 = _t60;
					}
					if(_t31 == 0) {
						 *((intOrPtr*)(_t64 + 8)) = GetLastError();
					}
					 *(_t66 - 4) = 0xffffffff;
					 *[fs:0x0] =  *((intOrPtr*)(_t66 - 0xc));
					_pop(_t61);
					_pop(_t65);
					return E01347708(_t64, _t46, _t66[0x106] ^ _t66, _t57, _t61, _t65);
				}
				_t73 = _t30 - 0x105;
				if(_t30 >= 0x105) {
					goto L7;
				}
				E01321FC0(__ebx, _t59, _t64, _t73, _t66);
				 *(_t66 - 4) = 1;
				E013227C0(__ebx, _t66 - 0x10, _t59, _t64, 0x137b2dc, 1);
				E013227C0(__ebx, _t66 - 0x10, _t59, _t64, L"ntdll.dll", 9);
				_t62 =  *(_t66 - 0x10);
				_t41 = E01348B51(_t62, 0x5c);
				if(_t41 != 0) {
					_t41 = LoadLibraryExW(_t62, 0, 0);
					_t60 = _t41;
				} else {
					_t60 = 0;
				}
				 *(_t66 - 4) = 0;
				_t57 =  &(( *(_t66 - 0x10))[0xfffffffffffffff8]);
				asm("lock xadd [edx+0xc], eax");
				if((_t41 | 0xffffffff) - 1 <= 0) {
					 *((intOrPtr*)( *( *_t57) + 4))(_t57);
				}
				goto L8;
			}

0x01326090
0x01326091
0x0132609e
0x013260a0
0x013260ab
0x013260af
0x013260b4
0x013260b6
0x013260bd
0x013260be
0x013260c2
0x013260c8
0x013260ca
0x013260cd
0x013260d0
0x013260d6
0x013260dd
0x013260ed
0x013260f4
0x013260fc
0x01326177
0x01326177
0x01326177
0x01326179
0x01326179
0x0132617e
0x01326184
0x01326187
0x0132618a
0x0132618a
0x0132618e
0x01326196
0x01326196
0x01326199
0x013261a5
0x013261ad
0x013261ae
0x013261c3
0x013261c3
0x013260fe
0x01326103
0x00000000
0x00000000
0x0132610c
0x01326111
0x0132611f
0x0132612e
0x01326133
0x01326139
0x01326143
0x0132614e
0x01326154
0x01326145
0x01326145
0x01326145
0x01326156
0x01326160
0x01326163
0x0132616b
0x01326172
0x01326172
0x00000000

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 013260F4
GetLastError.KERNEL32 ref: 01326190

Part of subcall function 01321FC0: FindResourceW.KERNEL32(00000000,?,00000006,?,00000000,0136938D,000000FF,?,80070057,?,?,00000000,00000010,01321B09,?), ref: 01322040

LoadLibraryExW.KERNEL32(?,00000000,00000000,00000009,0137B2DC,00000001,00000000), ref: 0132614E

Strings

ntdll.dll, xrefs: 01326126

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: DirectoryErrorFindLastLibraryLoadResourceSystem
String ID: ntdll.dll
API String ID: 4113295189-2227199552
Opcode ID: 171d7c56dc7618657c0acf0fc22147038e0062f15893c81bed08b22bbeee16ca
Instruction ID: 52e70d9b54db507c1937fb8a722add0ef13cfaf82e9ed4a6bb01054a3916c682
Opcode Fuzzy Hash: 171d7c56dc7618657c0acf0fc22147038e0062f15893c81bed08b22bbeee16ca
Instruction Fuzzy Hash: 80318EB16006199FDB20EF68CC45BAEB7F8BF44714F24861DE825D72D1EB74A504CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0133D2C2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E0133D2C2(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				void* _t34;
				signed int _t38;
				signed int _t39;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t51;
				intOrPtr* _t52;
				signed int _t54;
				void* _t60;
				void* _t65;
				intOrPtr _t68;
				void* _t69;
				void* _t73;

				_t73 = __eflags;
				_push(0x30);
				E01348213(0x136c301, __ebx, __edi, __esi);
				_t50 = __ecx;
				 *((intOrPtr*)(_t69 - 0x10)) = __ecx;
				_t32 = E01336203(_t73, _t69 - 0x3c);
				_t51 = _t50 + 0x2c;
				_t54 = 0xb;
				memcpy(_t51, _t32, _t54 << 2);
				_t34 = E01356A36(_t60, _t32);
				_t68 =  *((intOrPtr*)(_t69 - 0x10));
				_t65 = _t34;
				 *((intOrPtr*)(_t69 - 0x10)) = _t68;
				 *((intOrPtr*)(_t68 + 8)) = 0;
				 *((intOrPtr*)(_t68 + 0x10)) = 0;
				 *((intOrPtr*)(_t68 + 0x14)) = 0;
				 *((intOrPtr*)(_t68 + 0x18)) = 0;
				_push(_t51);
				_push(0);
				 *((intOrPtr*)(_t69 - 4)) = 0;
				 *((intOrPtr*)(_t68 + 8)) = E0132FB50(_t69,  *((intOrPtr*)(_t65 + 0x1c)));
				E01336FF9(_t68, 0, _t65);
				if( *((char*)(_t68 + 0x28)) == 0) {
					_t38 =  *((intOrPtr*)(_t65 + 0x29));
				} else {
					_t38 =  *((intOrPtr*)(_t65 + 0x28));
				}
				_t39 = _t38;
				 *(_t68 + 0x1c) = _t39;
				if(_t39 < 0 || _t39 >= 0x7f) {
					 *(_t68 + 0x1c) =  *(_t68 + 0x1c) & 0x00000000;
				}
				_t52 = _t68 + 0x20;
				E0133E2F7(_t68, _t52,  *((char*)(_t65 + 0x2b)),  *((char*)(_t65 + 0x2a)),  *((char*)(_t65 + 0x2e)));
				_t47 = E0133E2F7(_t68, _t68 + 0x24,  *((char*)(_t65 + 0x2d)),  *((char*)(_t65 + 0x2c)),  *((char*)(_t65 + 0x2f)));
				if( *((char*)(_t69 + 0xc)) != 0) {
					_t47 = 0x76782b24;
					 *_t52 = 0x76782b24;
					 *((intOrPtr*)(_t68 + 0x24)) = 0x76782b24;
				}
				return E013481F0(_t47);
			}

0x0133d2c2
0x0133d2c2
0x0133d2c9
0x0133d2ce
0x0133d2d0
0x0133d2d7
0x0133d2dc
0x0133d2e3
0x0133d2e6
0x0133d2e8
0x0133d2ed
0x0133d2f0
0x0133d2f4
0x0133d2f7
0x0133d2fa
0x0133d2fd
0x0133d300
0x0133d303
0x0133d304
0x0133d308
0x0133d313
0x0133d31b
0x0133d324
0x0133d32b
0x0133d326
0x0133d326
0x0133d326
0x0133d32e
0x0133d331
0x0133d336
0x0133d33d
0x0133d33d
0x0133d345
0x0133d356
0x0133d370
0x0133d379
0x0133d37b
0x0133d380
0x0133d382
0x0133d382
0x0133d38a

APIs

__EH_prolog3.LIBCMT ref: 0133D2C9

Part of subcall function 01336FF9: _Maklocstr.LIBCPMT ref: 01337019
Part of subcall function 01336FF9: _Maklocstr.LIBCPMT ref: 01337036
Part of subcall function 01336FF9: _Maklocstr.LIBCPMT ref: 01337053
Part of subcall function 01336FF9: _Maklocchr.LIBCPMT ref: 01337065
Part of subcall function 01336FF9: _Maklocchr.LIBCPMT ref: 01337078

_Mpunct.LIBCPMT ref: 0133D356
_Mpunct.LIBCPMT ref: 0133D370

Strings

$+xv, xrefs: 0133D37B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 9212cf869a4fadaf9598a45a5977adc31e260caa0ee3e08f6db02092598d457a
Instruction ID: 4ea6791bc8008c21bee1b0305faa2c8cb84778be7b50a4dc31df2c941a133496
Opcode Fuzzy Hash: 9212cf869a4fadaf9598a45a5977adc31e260caa0ee3e08f6db02092598d457a
Instruction Fuzzy Hash: 8F21C1B1904B526FD721DFB9C490B3BBEFCAB4C614F040A5AE599C7A01D734EA05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01344DF4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E01344DF4(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				void* _t34;
				signed int _t38;
				signed int _t39;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t51;
				intOrPtr* _t52;
				signed int _t54;
				void* _t60;
				void* _t65;
				intOrPtr _t68;
				void* _t69;
				void* _t73;

				_t73 = __eflags;
				_push(0x30);
				E01348213(0x136c301, __ebx, __edi, __esi);
				_t50 = __ecx;
				 *((intOrPtr*)(_t69 - 0x10)) = __ecx;
				_t32 = E01336203(_t73, _t69 - 0x3c);
				_t51 = _t50 + 0x2c;
				_t54 = 0xb;
				memcpy(_t51, _t32, _t54 << 2);
				_t34 = E01356A36(_t60, _t32);
				_t68 =  *((intOrPtr*)(_t69 - 0x10));
				_t65 = _t34;
				 *((intOrPtr*)(_t69 - 0x10)) = _t68;
				 *((intOrPtr*)(_t68 + 8)) = 0;
				 *((intOrPtr*)(_t68 + 0x10)) = 0;
				 *((intOrPtr*)(_t68 + 0x14)) = 0;
				 *((intOrPtr*)(_t68 + 0x18)) = 0;
				_push(_t51);
				_push(0);
				 *((intOrPtr*)(_t69 - 4)) = 0;
				 *((intOrPtr*)(_t68 + 8)) = E0132FB50(_t69,  *((intOrPtr*)(_t65 + 0x1c)));
				E013437AE(_t68, 0, _t65);
				if( *((char*)(_t68 + 0x28)) == 0) {
					_t38 =  *((intOrPtr*)(_t65 + 0x29));
				} else {
					_t38 =  *((intOrPtr*)(_t65 + 0x28));
				}
				_t39 = _t38;
				 *(_t68 + 0x1c) = _t39;
				if(_t39 < 0 || _t39 >= 0x7f) {
					 *(_t68 + 0x1c) =  *(_t68 + 0x1c) & 0x00000000;
				}
				_t52 = _t68 + 0x20;
				E0133E2F7(_t68, _t52,  *((char*)(_t65 + 0x2b)),  *((char*)(_t65 + 0x2a)),  *((char*)(_t65 + 0x2e)));
				_t47 = E0133E2F7(_t68, _t68 + 0x24,  *((char*)(_t65 + 0x2d)),  *((char*)(_t65 + 0x2c)),  *((char*)(_t65 + 0x2f)));
				if( *((char*)(_t69 + 0xc)) != 0) {
					_t47 = 0x76782b24;
					 *_t52 = 0x76782b24;
					 *((intOrPtr*)(_t68 + 0x24)) = 0x76782b24;
				}
				return E013481F0(_t47);
			}

0x01344df4
0x01344df4
0x01344dfb
0x01344e00
0x01344e02
0x01344e09
0x01344e0e
0x01344e15
0x01344e18
0x01344e1a
0x01344e1f
0x01344e22
0x01344e26
0x01344e29
0x01344e2c
0x01344e2f
0x01344e32
0x01344e35
0x01344e36
0x01344e3a
0x01344e45
0x01344e4d
0x01344e56
0x01344e5d
0x01344e58
0x01344e58
0x01344e58
0x01344e60
0x01344e63
0x01344e68
0x01344e6f
0x01344e6f
0x01344e77
0x01344e88
0x01344ea2
0x01344eab
0x01344ead
0x01344eb2
0x01344eb4
0x01344eb4
0x01344ebc

APIs

__EH_prolog3.LIBCMT ref: 01344DFB
_Mpunct.LIBCPMT ref: 01344E88
_Mpunct.LIBCPMT ref: 01344EA2

Strings

$+xv, xrefs: 01344EAD

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 3dc6a3e25664288ef182db5ed1cef0e665e3d65d7feecbd2575a332ab63f685a
Instruction ID: 0b5f5145a5c082f2f16a0f74b268d29424c8d886a7c112b28bae8d28393f2abb
Opcode Fuzzy Hash: 3dc6a3e25664288ef182db5ed1cef0e665e3d65d7feecbd2575a332ab63f685a
Instruction Fuzzy Hash: D921C1B1904B926FD721DF78C490B3BBEF8AB18608F044A6AE499C7E01D734E641CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0134C012 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0134C012(WCHAR* _a4) {
				struct HINSTANCE__* _t4;

				_t4 = LoadLibraryExW(_a4, 0, 0x800);
				if(_t4 != 0) {
					return _t4;
				} else {
					if(GetLastError() != 0x57 || E01350B03(_a4, L"api-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}

0x0134c01f
0x0134c027
0x0134c05c
0x0134c029
0x0134c032
0x00000000
0x0134c059
0x0134c058
0x0134c058

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0134BFC3,00000000,?,01384EA4,?,?,?,0134C166,00000004,InitializeCriticalSectionEx,0136F92C,InitializeCriticalSectionEx), ref: 0134C01F
GetLastError.KERNEL32(?,0134BFC3,00000000,?,01384EA4,?,?,?,0134C166,00000004,InitializeCriticalSectionEx,0136F92C,InitializeCriticalSectionEx,00000000,?,0134BF1D), ref: 0134C029
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0134C051

Strings

api-ms-, xrefs: 0134C036

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 055d89f03530e77d9cc4b2218204a03d1fef4dca4e154020af7dfc43ded1b135
Instruction ID: 1f3023aac55228038a9fd6023516e6646c30bd4a85926a12b2796c343140ece8
Opcode Fuzzy Hash: 055d89f03530e77d9cc4b2218204a03d1fef4dca4e154020af7dfc43ded1b135
Instruction Fuzzy Hash: 1EE04F70380208B7EF715EA5EC06F593F9D9F01B99F209020FA4CE84E6D7A2F45196C4

Uniqueness

Uniqueness Score: -1.00%

Function 0132E350 Relevance: 6.4, APIs: 4, Instructions: 426
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0132E350(void* __ebx, void* __edi, intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, void* _a20, intOrPtr _a24, intOrPtr* _a28, intOrPtr* _a32) {
				signed int _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				void* _v28;
				void* _v44;
				intOrPtr _v48;
				char _v52;
				void* _v68;
				signed int _v72;
				intOrPtr* _v76;
				intOrPtr* _v80;
				signed int _v84;
				char _v88;
				void* _v92;
				signed int _v96;
				intOrPtr* _v100;
				char _v104;
				signed int _v108;
				intOrPtr* _v112;
				char _v116;
				signed char _v120;
				char _v124;
				char* _v128;
				void* __esi;
				signed int _t210;
				signed int _t211;
				signed int _t216;
				intOrPtr _t243;
				intOrPtr* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				intOrPtr* _t259;
				intOrPtr* _t264;
				intOrPtr _t267;
				signed int _t268;
				short* _t276;
				char* _t277;
				intOrPtr* _t289;
				intOrPtr* _t293;
				signed short _t312;
				intOrPtr _t326;
				void* _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;
				intOrPtr* _t330;
				intOrPtr _t334;
				intOrPtr* _t336;
				intOrPtr* _t337;
				void* _t341;
				char _t349;
				signed int _t351;
				void* _t359;
				intOrPtr* _t365;
				intOrPtr* _t369;
				intOrPtr* _t370;
				void* _t371;
				void* _t372;
				void* _t375;
				signed char _t376;
				intOrPtr* _t380;
				signed int _t381;
				void* _t382;
				intOrPtr _t383;
				void* _t384;
				void* _t386;
				signed int _t388;
				void* _t390;
				char* _t391;
				short* _t397;
				signed int _t401;
				void* _t402;
				void* _t404;
				void* _t405;
				intOrPtr _t430;

				_t327 = __ebx;
				_t399 = _t401;
				_push(0xffffffff);
				_push(0x136afc7);
				_push( *[fs:0x0]);
				_t402 = _t401 - 0x68;
				_t210 =  *0x1383020; // 0xc9209188
				_t211 = _t210 ^ _t401;
				_v20 = _t211;
				_push(__edi);
				_push(_t211);
				 *[fs:0x0] =  &_v16;
				_t328 = _a32;
				_t371 = _a20;
				_t380 = _a28;
				_v108 = _a8;
				_v92 = _t371;
				_v112 = _t380;
				_v80 = _t328;
				_v72 = 0;
				if(_t328 == 0) {
					L4:
					_t388 = 0;
				} else {
					_t326 =  *_t380;
					if(_t326 == 0x2b || _t326 == 0x2d) {
						_t388 = 1;
					} else {
						goto L4;
					}
				}
				_v84 = _t388;
				if(( *(_t371 + 0x14) & 0x00003000) == 0x3000) {
					_t14 = _t388 + 2; // 0x2
					_t216 = _t14;
					_t372 = "pP";
					if(_t216 <= _t328 &&  *((char*)(_t380 + _t388)) == 0x30) {
						_t328 =  *((intOrPtr*)(_t380 + _t388 + 1));
						if(_t328 == 0x78 || _t328 == 0x58) {
							_t388 = _t216;
							_v84 = _t388;
						}
					}
				} else {
					_t372 = "eE";
				}
				_v120 = E013569F0(_t328, _t380, _t372);
				_v88 = 0x2e;
				_v88 =  *((intOrPtr*)( *((intOrPtr*)(E01356A36(_t372, _t388)))));
				_t381 = E013569F0(_t328, _t380,  &_v88);
				_v8 = 0;
				_t329 =  *((intOrPtr*)( *((intOrPtr*)(_v92 + 0x30)) + 4));
				_v100 = _t329;
				_v96 = _t329;
				 *((intOrPtr*)( *_t329 + 4))();
				_v72 = 1;
				_v76 = E0132B500(_t327, _t381,  &_v104);
				_t404 = _t402 + 0x14;
				_v72 = 1;
				_v72 = 0;
				_v8 = 0xffffffff;
				_t330 = _v96;
				if(_t330 != 0) {
					_t370 =  *((intOrPtr*)( *((intOrPtr*)( *_t330 + 8))))();
					if(_t370 != 0) {
						 *((intOrPtr*)( *_t370))(1);
					}
				}
				asm("xorps xmm0, xmm0");
				_v28 = 0;
				_v24 = 0;
				asm("movups [ebp-0x28], xmm0");
				E01323ED0(_t327,  &_v44, _t381, _t388, 0, _v80);
				_v8 = 1;
				_t333 =  >=  ? _v44 :  &_v44;
				_t334 = _v112;
				 *((intOrPtr*)( *((intOrPtr*)( *_v76 + 0x2c))))(_t334, _v80 + _t334,  >=  ? _v44 :  &_v44);
				_v8 = 2;
				_t336 =  *((intOrPtr*)( *((intOrPtr*)(_v92 + 0x30)) + 4));
				_v112 = _t336;
				 *((intOrPtr*)( *_t336 + 4))();
				_v72 = _v72 | 0x00000002;
				_t243 = E0132ED70(_t327,  &_v116);
				_v72 = _v72 & 0xfffffffd;
				_t405 = _t404 + 4;
				_v76 = _t243;
				_v8 = 1;
				_t337 = _v112;
				if(_t337 != 0) {
					_t369 =  *((intOrPtr*)( *((intOrPtr*)( *_t337 + 8))))();
					if(_t369 != 0) {
						 *((intOrPtr*)( *_t369))(1);
					}
					_t243 = _v76;
				}
				E0132E9D0( &_v68);
				_v8 = 3;
				_v96 =  *((intOrPtr*)( *((intOrPtr*)( *_v76 + 0x10))))() & 0x0000ffff;
				if(_t381 != _v80) {
					_t312 =  *((intOrPtr*)( *((intOrPtr*)( *_v76 + 0xc))))();
					_t314 =  >=  ? _v44 :  &_v44;
					 *((short*)(( >=  ? _v44 :  &_v44) + _t381 * 2)) = _t312 & 0x0000ffff;
				}
				_t382 =  ==  ? _v120 : _t381;
				_t251 =  >=  ? _v68 :  &_v68;
				_v80 = _t251;
				_t252 =  *_t251;
				if(_t252 == 0x7f) {
					L29:
					_t341 = _v92;
					_t253 = _v28;
					_v84 = _t253;
					_t430 =  *((intOrPtr*)(_t341 + 0x24));
					_t383 =  *((intOrPtr*)(_t341 + 0x20));
					if(_t430 < 0 || _t430 <= 0 && _t383 == 0 || _t383 <= _t253) {
						_t384 = 0;
					} else {
						_t384 = _t383 - _t253;
					}
					_t255 =  *(_t341 + 0x14) & 0x000001c0;
					if(_t255 == 0x40) {
						_push(_t388);
						_t257 =  >=  ? _v44 :  &_v44;
						_t259 = E0132DE40(_a4,  &_v104, _a12, _a16,  >=  ? _v44 :  &_v44);
					} else {
						if(_t255 == 0x100) {
							_push(_t388);
							_t287 =  >=  ? _v44 :  &_v44;
							_t289 = E0132DE40(_a4,  &_v104, _a12, _a16,  >=  ? _v44 :  &_v44);
							_push(_t384);
							_a16 =  *((intOrPtr*)(_t289 + 4));
							_a12 =  *_t289;
							_t259 = E0132DDC0(_a4,  &_v104,  *_t289,  *((intOrPtr*)(_t289 + 4)), _a24);
							_t384 = 0;
						} else {
							_push(_t384);
							_t293 = E0132DDC0(_a4,  &_v104, _a12, _a16, _a24);
							_t384 = 0;
							_push(_t388);
							_t295 =  >=  ? _v44 :  &_v44;
							_a12 =  *_t293;
							_a16 =  *((intOrPtr*)(_t293 + 4));
							_t259 = E0132DE40(_a4,  &_v104,  *_t293,  *((intOrPtr*)(_t293 + 4)),  >=  ? _v44 :  &_v44);
						}
					}
					_a12 =  *_t259;
					_t261 =  >=  ? _v44 :  &_v44;
					_v84 = _v84 - _t388;
					_push(_v84);
					_a16 =  *((intOrPtr*)(_t259 + 4));
					_t264 = E0132DE40(_a4,  &_v104,  *_t259,  *((intOrPtr*)(_t259 + 4)), ( >=  ? _v44 :  &_v44) + _t388 * 2);
					_t375 = _v92;
					_push(_t384);
					_t385 = _v108;
					_a12 =  *_t264;
					_a16 =  *((intOrPtr*)(_t264 + 4));
					 *((intOrPtr*)(_t375 + 0x20)) = 0;
					 *((intOrPtr*)(_t375 + 0x24)) = 0;
					E0132DDC0(_a4, _v108,  *_t264,  *((intOrPtr*)(_t264 + 4)), _a24);
					_v8 = 1;
					_t267 = _v48;
					_t388 = LocalFree;
					if(_t267 < 0x10) {
						L45:
						_v52 = 0;
						_v48 = 0xf;
						_v68 = 0;
						_v8 = 0xffffffff;
						_t268 = _v24;
						if(_t268 < 8) {
							L50:
							_v28 = 0;
							_v44 = 0;
							_v24 = 7;
							 *[fs:0x0] = _v16;
							_pop(_t386);
							_pop(_t390);
							return E01347708(_t385, _t327, _v20 ^ _t399, _t375, _t386, _t390);
						} else {
							_t348 = _v44;
							_t375 = _t348;
							if(2 + _t268 * 2 < 0x1000) {
								L48:
								if(_t348 != 0) {
									LocalFree(_t348);
								}
								goto L50;
							} else {
								_t348 =  *(_t375 - 4);
								if(_t375 - 4 > 0x1f) {
									goto L52;
								} else {
									goto L48;
								}
							}
						}
					} else {
						_t359 = _v68;
						_t375 = _t359;
						if(_t267 + 1 < 0x1000) {
							L43:
							if(_t359 != 0) {
								LocalFree(_t359);
							}
							goto L45;
						} else {
							_t348 =  *(_t375 - 4);
							if(_t375 - 4 > 0x1f) {
								goto L52;
							} else {
								goto L43;
							}
						}
					}
				} else {
					while(_t252 > 0) {
						_t348 = _t252;
						if(_t348 >= _t382 - _t388) {
							goto L29;
						} else {
							_t375 = _v28;
							_t385 = _t382 - _t348;
							if(_t375 < _t385) {
								E01324650(_t327, _t348, _t385);
								L52:
								E0134C5C2(_t327, _t348, _t375, _t385);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_t376 = _v120;
								_push(_t388);
								_t391 = _v128;
								 *_t391 = 0x25;
								_t276 = _t391 + 1;
								if((_t376 & 0x00000020) != 0) {
									 *_t276 = 0x2b;
									_t276 = _t276 + 1;
								}
								if((_t376 & 0x00000010) != 0) {
									 *_t276 = 0x23;
									_t276 = _t276 + 1;
								}
								_t349 = _v124;
								 *_t276 = 0x2a2e;
								_t277 = _t276 + 2;
								if(_t349 != 0) {
									 *_t277 = _t349;
									_t277 = _t277 + 1;
								}
								_t351 = _t376 & 0x00003000;
								if((_t376 & 0x00000004) == 0) {
									if(_t351 != 0x2000) {
										if(_t351 != 0x3000) {
											 *_t277 = 0x65 + (_t351 & 0xffffff00 | _t351 != 0x00001000) * 2;
											 *((char*)(_t277 + 1)) = 0;
											return _t391;
										} else {
											 *_t277 = 0x61;
											 *((char*)(_t277 + 1)) = 0;
											return _t391;
										}
									} else {
										goto L65;
									}
								} else {
									if(_t351 == 0x2000) {
										L65:
										 *_t277 = 0x66;
										 *((char*)(_t277 + 1)) = 0;
										return _t391;
									} else {
										if(_t351 != 0x3000) {
											 *_t277 = 0x45 + (_t351 & 0xffffff00 | _t351 != 0x00001000) * 2;
											 *((char*)(_t277 + 1)) = 0;
											return _t391;
										} else {
											 *_t277 = 0x41;
											 *((char*)(_t277 + 1)) = 0;
											return _t391;
										}
									}
								}
							} else {
								if(_v24 - _t375 < 1) {
									E0132B110(_t327,  &_v44, _t385, _t388, 1, _v108, _t385, 1, _v96);
								} else {
									_t88 = _t375 + 1; // 0x1
									_v28 = _t88;
									_t306 =  >=  ? _v44 :  &_v44;
									_t397 = ( >=  ? _v44 :  &_v44) + _t385 * 2;
									_t96 = _t397 + 2; // 0x2
									E01348FF0(_t96, _t397, 2 + (_t375 - _t385) * 2);
									_t405 = _t405 + 0xc;
									 *_t397 = _v96;
									_t388 = _v84;
								}
								_t365 =  >  ? _v80 + 1 : _v80;
								_v80 = _t365;
								_t252 =  *_t365;
								if(_t252 != 0x7f) {
									continue;
								} else {
									goto L29;
								}
							}
						}
						goto L69;
					}
					goto L29;
				}
				L69:
			}

0x0132e350
0x0132e351
0x0132e353
0x0132e355
0x0132e360
0x0132e361
0x0132e364
0x0132e369
0x0132e36b
0x0132e36f
0x0132e370
0x0132e374
0x0132e37a
0x0132e380
0x0132e383
0x0132e386
0x0132e389
0x0132e38c
0x0132e38f
0x0132e392
0x0132e39b
0x0132e3ae
0x0132e3ae
0x0132e39d
0x0132e39d
0x0132e3a1
0x0132e3a7
0x00000000
0x00000000
0x00000000
0x0132e3a1
0x0132e3b8
0x0132e3c0
0x0132e3c9
0x0132e3c9
0x0132e3cc
0x0132e3d3
0x0132e3db
0x0132e3e2
0x0132e3e9
0x0132e3eb
0x0132e3eb
0x0132e3e2
0x0132e3c2
0x0132e3c2
0x0132e3c2
0x0132e3f5
0x0132e3fd
0x0132e40a
0x0132e41a
0x0132e41c
0x0132e429
0x0132e42c
0x0132e42f
0x0132e434
0x0132e43a
0x0132e447
0x0132e44a
0x0132e452
0x0132e458
0x0132e45b
0x0132e462
0x0132e467
0x0132e470
0x0132e474
0x0132e47a
0x0132e47a
0x0132e474
0x0132e47f
0x0132e482
0x0132e48e
0x0132e495
0x0132e499
0x0132e49e
0x0132e4af
0x0132e4b6
0x0132e4c6
0x0132e4c8
0x0132e4d2
0x0132e4d5
0x0132e4da
0x0132e4dd
0x0132e4e5
0x0132e4ea
0x0132e4ee
0x0132e4f1
0x0132e4f4
0x0132e4f8
0x0132e4fd
0x0132e506
0x0132e50a
0x0132e510
0x0132e510
0x0132e512
0x0132e512
0x0132e51b
0x0132e520
0x0132e531
0x0132e539
0x0132e543
0x0132e54f
0x0132e553
0x0132e55a
0x0132e55c
0x0132e567
0x0132e56b
0x0132e56e
0x0132e572
0x0132e606
0x0132e606
0x0132e609
0x0132e60c
0x0132e60f
0x0132e613
0x0132e616
0x0132e626
0x0132e622
0x0132e622
0x0132e622
0x0132e62b
0x0132e633
0x0132e6cd
0x0132e6ce
0x0132e6e0
0x0132e639
0x0132e63e
0x0132e68a
0x0132e68b
0x0132e69d
0x0132e6a2
0x0132e6ac
0x0132e6b7
0x0132e6ba
0x0132e6c2
0x0132e640
0x0132e640
0x0132e651
0x0132e656
0x0132e65c
0x0132e665
0x0132e66f
0x0132e676
0x0132e679
0x0132e67e
0x0132e63e
0x0132e6f4
0x0132e6f7
0x0132e6fb
0x0132e6fe
0x0132e701
0x0132e712
0x0132e717
0x0132e71a
0x0132e723
0x0132e72a
0x0132e72d
0x0132e730
0x0132e737
0x0132e73e
0x0132e746
0x0132e74a
0x0132e74d
0x0132e756
0x0132e77d
0x0132e77d
0x0132e784
0x0132e78b
0x0132e78f
0x0132e796
0x0132e79c
0x0132e7c5
0x0132e7c7
0x0132e7ce
0x0132e7d4
0x0132e7de
0x0132e7e6
0x0132e7e7
0x0132e7f5
0x0132e79e
0x0132e79e
0x0132e7a8
0x0132e7af
0x0132e7be
0x0132e7c0
0x0132e7c3
0x0132e7c3
0x00000000
0x0132e7b1
0x0132e7b1
0x0132e7bc
0x00000000
0x00000000
0x00000000
0x00000000
0x0132e7bc
0x0132e7af
0x0132e758
0x0132e758
0x0132e75c
0x0132e763
0x0132e776
0x0132e778
0x0132e77b
0x0132e77b
0x00000000
0x0132e765
0x0132e765
0x0132e770
0x00000000
0x00000000
0x00000000
0x00000000
0x0132e770
0x0132e763
0x0132e578
0x0132e578
0x0132e580
0x0132e589
0x00000000
0x0132e58b
0x0132e58b
0x0132e58e
0x0132e592
0x0132e7f6
0x0132e7fb
0x0132e7fb
0x0132e800
0x0132e801
0x0132e802
0x0132e803
0x0132e804
0x0132e805
0x0132e806
0x0132e807
0x0132e808
0x0132e809
0x0132e80a
0x0132e80b
0x0132e80c
0x0132e80d
0x0132e80e
0x0132e80f
0x0132e810
0x0132e814
0x0132e815
0x0132e819
0x0132e81c
0x0132e822
0x0132e824
0x0132e827
0x0132e827
0x0132e82b
0x0132e82d
0x0132e830
0x0132e830
0x0132e831
0x0132e835
0x0132e83a
0x0132e83f
0x0132e841
0x0132e843
0x0132e843
0x0132e846
0x0132e84f
0x0132e88d
0x0132e8a1
0x0132e8bf
0x0132e8c1
0x0132e8c8
0x0132e8a3
0x0132e8a5
0x0132e8a7
0x0132e8ae
0x0132e8ae
0x00000000
0x00000000
0x00000000
0x0132e851
0x0132e857
0x0132e88f
0x0132e891
0x0132e893
0x0132e89a
0x0132e859
0x0132e85f
0x0132e87d
0x0132e87f
0x0132e886
0x0132e861
0x0132e863
0x0132e865
0x0132e86c
0x0132e86c
0x0132e85f
0x0132e857
0x0132e598
0x0132e5a2
0x0132e5e7
0x0132e5a4
0x0132e5a4
0x0132e5aa
0x0132e5b0
0x0132e5b6
0x0132e5c1
0x0132e5c6
0x0132e5ce
0x0132e5d1
0x0132e5d4
0x0132e5d4
0x0132e5f6
0x0132e5f9
0x0132e5fc
0x0132e600
0x00000000
0x00000000
0x00000000
0x00000000
0x0132e600
0x0132e592
0x00000000
0x0132e589
0x00000000
0x0132e578
0x00000000

APIs

_strcspn.LIBCMT ref: 0132E3F0
_strcspn.LIBCMT ref: 0132E412
LocalFree.KERNEL32(?), ref: 0132E77B
LocalFree.KERNEL32(?), ref: 0132E7C3

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: FreeLocal_strcspn
String ID:
API String ID: 2585785616-0
Opcode ID: 9db9eeaea6d2acfc36446889284937fb12b0adac7cf5f085258dfaa4e02c543d
Instruction ID: c90d27bb2af0b02db82e629553cfa085ec9e815d5a5d2de939c87c477e733c32
Opcode Fuzzy Hash: 9db9eeaea6d2acfc36446889284937fb12b0adac7cf5f085258dfaa4e02c543d
Instruction Fuzzy Hash: 53F18775A00259DFDF14DFA8C885AEEBBF9FF48318F244129E915AB250D730EA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0136738B Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E0136738B(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				char _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				int _t186;
				signed char* _t190;
				signed char _t195;
				intOrPtr _t198;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				char _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed int _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				signed int _t273;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				signed int _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(0x136cc58);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0x1383020; // 0xc9209188
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0x13852f8 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_t186 = GetConsoleOutputCP();
				_t317 =  *((char*)(_t265 + 0x14));
				_v116 = _t186;
				if( *((char*)(_t265 + 0x14)) == 0) {
					E013506A0(_t265, _t291, _t317);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0x13852f8 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							_t195 =  *((intOrPtr*)(_t300 + _t273 + 0x2d));
							__eflags = _t195 & 0x00000004;
							if((_t195 & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								_t198 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc))));
								__eflags =  *((intOrPtr*)(_t198 + _t273 * 2)) - _t267;
								if( *((intOrPtr*)(_t198 + _t273 * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									__eflags = _t217 - _v88;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0x13852f8 + _v84 * 4) + _t300 + 0x2d) =  *( *(0x13852f8 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E0135BEE5(_t273, _t292,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										__eflags = _t224 - 0xffffffff;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *((char*)(_t300 + _t273 + 0x2d)) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E0135BEE5(_t273, _t292);
								_t316 = _t315 + 0x10;
								__eflags = _t200 - 0xffffffff;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0x1383930; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								__eflags = _t281 - _t302;
								if(_t281 > _t302) {
									__eflags = _t302;
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0x13852f8 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									__eflags = _t281 - 4;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E01365C61( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									__eflags = _t238 - 0xffffffff;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										__eflags = _t240;
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0x1383930)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									__eflags = _t302;
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0x13852f8 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E01348FF0( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0x13852f8 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E01365C61( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E0136002B(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E01347708(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

0x01367390
0x01367392
0x0136739d
0x0136739e
0x013673a1
0x013673a6
0x013673a8
0x013673ae
0x013673b2
0x013673b8
0x013673bd
0x013673c3
0x013673c6
0x013673c9
0x013673cc
0x013673cf
0x013673d2
0x013673dc
0x013673e3
0x013673eb
0x013673ee
0x013673f4
0x013673f8
0x013673fb
0x013673ff
0x013673ff
0x01367407
0x0136740f
0x01367414
0x01367415
0x01367416
0x01367417
0x0136741a
0x0136741c
0x01367422
0x01367428
0x0136742b
0x0136742d
0x01367430
0x01367439
0x0136743f
0x01367442
0x01367449
0x01367450
0x01367453
0x0136758d
0x01367591
0x01367594
0x013675b7
0x013675bd
0x013675bf
0x013675c3
0x013675f4
0x013675f7
0x013675f9
0x00000000
0x013675c5
0x013675c5
0x013675c8
0x013675cb
0x013675ce
0x01367718
0x01367726
0x0136772f
0x013675d4
0x013675de
0x013675e3
0x013675e6
0x013675e9
0x013675ef
0x00000000
0x013675ef
0x013675e9
0x013675ce
0x01367596
0x0136759d
0x013675a0
0x013675a3
0x013675a5
0x013675a8
0x013675af
0x013675b1
0x013675fa
0x013675fd
0x013675fe
0x01367603
0x01367606
0x01367609
0x0136760f
0x00000000
0x0136760f
0x01367609
0x01367459
0x0136745c
0x0136745e
0x01367460
0x01367464
0x01367465
0x01367469
0x00000000
0x00000000
0x00000000
0x01367469
0x0136746e
0x01367470
0x01367475
0x01367535
0x0136753c
0x0136753d
0x01367540
0x01367542
0x013676f2
0x013676f4
0x00000000
0x013676f6
0x013676f6
0x013676f9
0x01367708
0x0136770c
0x0136770d
0x0136770d
0x00000000
0x01367711
0x00000000
0x01367548
0x0136754d
0x01367550
0x01367553
0x01367559
0x01367562
0x0136756d
0x01367572
0x01367575
0x01367578
0x01367581
0x01367581
0x01367584
0x00000000
0x01367584
0x01367578
0x0136747b
0x0136747e
0x01367484
0x01367486
0x01367493
0x01367494
0x01367497
0x0136749a
0x0136749f
0x013676c3
0x013676c5
0x013676c7
0x013676ca
0x013676cd
0x013676d9
0x013676dc
0x013676de
0x013676df
0x013676e3
0x013676e6
0x013676e6
0x013676ea
0x013676ea
0x013676ea
0x013676ed
0x013676ed
0x013674a5
0x013674a5
0x013674a8
0x013674aa
0x013674ad
0x013674af
0x013674b3
0x013674b4
0x013674b5
0x013674b9
0x013674be
0x013674c8
0x013674cd
0x013674d0
0x013674d0
0x013674d3
0x013674d6
0x013674d8
0x013674db
0x013674e4
0x013674e8
0x013674e9
0x013674f0
0x013674f6
0x013674fe
0x01367509
0x0136750e
0x01367519
0x0136751e
0x01367524
0x0136752d
0x01367587
0x01367587
0x01367612
0x01367617
0x01367629
0x0136762e
0x01367631
0x01367636
0x01367651
0x01367734
0x0136773a
0x01367657
0x01367657
0x01367662
0x01367664
0x01367667
0x01367670
0x0136767a
0x00000000
0x0136767c
0x0136767e
0x01367680
0x01367699
0x00000000
0x0136769f
0x013676a3
0x013676a9
0x013676ac
0x013676b2
0x013676b5
0x00000000
0x013676b5
0x013676a3
0x01367699
0x0136767a
0x01367670
0x01367651
0x01367636
0x01367524
0x0136749f
0x01367475
0x00000000
0x013676b8
0x013676b8
0x013676c1
0x0136773c
0x01367741
0x01367749
0x0136774a
0x0136774b
0x01367757
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(C9209188,?,00000000,?), ref: 013673EE

Part of subcall function 0136002B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0135C527,?,00000000,-00000008), ref: 013600D7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 01367649
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 01367691
GetLastError.KERNEL32 ref: 01367734

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8624ce05ab42ea92484b3f226e45b0a5db3a46d23918fa2531ff00198c69b081
Instruction ID: 1e7728b74c7ac59c8b9ae639d162da9c6c0ce35b367baba2d3c5267f8c26cae0
Opcode Fuzzy Hash: 8624ce05ab42ea92484b3f226e45b0a5db3a46d23918fa2531ff00198c69b081
Instruction Fuzzy Hash: 68D17AB5E002589FCF15CFACD8809ADBBB9FF49318F58816AE955EB345D730A902CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01338872 Relevance: 6.3, APIs: 4, Instructions: 313
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E01338872(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t143;
				short _t145;
				signed int _t150;
				intOrPtr _t153;
				void* _t158;
				signed short _t169;
				char _t170;
				intOrPtr _t171;
				signed int _t173;
				void* _t174;
				intOrPtr* _t176;
				intOrPtr* _t183;
				signed int _t187;
				intOrPtr _t190;
				void* _t196;
				intOrPtr* _t198;
				intOrPtr* _t202;
				signed int _t203;
				void* _t208;
				void* _t209;
				signed int _t211;
				intOrPtr _t213;
				signed int _t226;
				intOrPtr _t236;
				char _t237;
				signed int _t240;
				void* _t242;
				signed int _t243;
				intOrPtr _t245;
				intOrPtr _t246;
				signed int _t248;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr _t255;
				intOrPtr* _t257;
				char _t258;
				intOrPtr _t260;
				void* _t261;
				void* _t262;
				void* _t263;
				intOrPtr _t276;

				_push(0x5c);
				E01348246(0x136be37, __ebx, __edi, __esi);
				_t213 =  *((intOrPtr*)(_t261 + 0x24));
				_t255 =  *((intOrPtr*)(_t261 + 0x18));
				_t248 =  *(_t261 + 0x20);
				 *((intOrPtr*)(_t261 - 0x68)) =  *((intOrPtr*)(_t261 + 0xc));
				 *((intOrPtr*)(_t261 - 0x4c)) = _t255;
				 *(_t261 - 0x44) = _t248;
				 *((intOrPtr*)(_t261 - 0x60)) = _t213;
				if(_t213 == 0) {
					L4:
					_t211 = 0;
					__eflags = 0;
					L5:
					_t270 = ( *(_t255 + 0x14) & 0x00003000) - 0x3000;
					if(( *(_t255 + 0x14) & 0x00003000) == 0x3000) {
						_t10 = _t211 + 2; // 0x2
						_t143 = _t10;
						_t242 = "pP";
						__eflags = _t143 - _t213;
						if(_t143 > _t213) {
							L12:
							 *(_t261 - 0x58) = E013569F0(_t213, _t248, _t242);
							_t145 = 0x2e;
							 *((short*)(_t261 - 0x48)) = _t145;
							 *((char*)(_t261 - 0x48)) =  *((intOrPtr*)( *((intOrPtr*)(E01356A36(_t242, _t255)))));
							_t150 = E013569F0(_t213, _t248, _t261 - 0x48);
							_t263 = _t262 + 0x10;
							 *(_t261 - 0x64) = _t150;
							E0132FD10(_t261 - 0x54,  *((intOrPtr*)(_t255 + 0x30)));
							 *(_t261 - 4) =  *(_t261 - 4) & 0x00000000;
							_t153 = E0133780A(_t211, _t242, _t248, _t255, _t270, _t261 - 0x54);
							 *(_t261 - 4) =  *(_t261 - 4) | 0xffffffff;
							 *((intOrPtr*)(_t261 - 0x5c)) = _t153;
							E0132C710(_t261 - 0x54);
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_t250 =  *((intOrPtr*)(_t261 - 0x60));
							_push( *((intOrPtr*)(_t261 - 0x60)));
							_push(0);
							 *(_t261 - 0x18) = 0;
							 *(_t261 - 0x14) = 0;
							E013365EF(_t211, _t261 - 0x28, _t242,  *((intOrPtr*)(_t261 - 0x60)));
							_t271 =  *(_t261 - 0x14) - 8;
							_t158 = _t261 - 0x28;
							 *(_t261 - 4) = 1;
							if( *(_t261 - 0x14) >= 8) {
								_t158 =  *(_t261 - 0x28);
							}
							E013434F0( *((intOrPtr*)(_t261 - 0x5c)),  *(_t261 - 0x44), _t250 +  *(_t261 - 0x44), _t158);
							E0132FD10(_t261 - 0x54,  *((intOrPtr*)(_t255 + 0x30)));
							 *(_t261 - 4) = 2;
							_t251 = E01338030(_t211, _t242, _t250, _t255, _t271, _t261 - 0x54);
							 *(_t261 - 4) = 1;
							 *((intOrPtr*)(_t261 - 0x5c)) = _t251;
							E0132C710(_t261 - 0x54);
							 *0x136d26c(_t261 - 0x40);
							 *((intOrPtr*)( *((intOrPtr*)( *_t251 + 0x14))))();
							 *(_t261 - 4) = 3;
							_t169 = E01335AF0(_t251);
							_t252 =  *(_t261 - 0x64);
							_t243 = _t169 & 0x0000ffff;
							 *(_t261 - 0x44) = _t243;
							if(_t252 ==  *((intOrPtr*)(_t261 - 0x60))) {
								_t252 =  *(_t261 - 0x58);
							} else {
								_t240 = E013348F0( *((intOrPtr*)(_t261 - 0x5c))) & 0x0000ffff;
								_t208 = _t261 - 0x28;
								if( *(_t261 - 0x14) >= 8) {
									_t208 =  *(_t261 - 0x28);
								}
								_t243 =  *(_t261 - 0x44);
								 *(_t208 + _t252 * 2) = _t240;
							}
							_t257 = _t261 - 0x40;
							if( *((intOrPtr*)(_t261 - 0x2c)) >= 0x10) {
								_t257 =  *((intOrPtr*)(_t261 - 0x40));
							}
							while(1) {
								_t170 =  *_t257;
								if(_t170 == 0x7f) {
									break;
								}
								__eflags = _t170;
								if(_t170 <= 0) {
									break;
								}
								_t237 = _t170;
								__eflags = _t237 - _t252 - _t211;
								if(_t237 >= _t252 - _t211) {
									break;
								}
								_push(_t243);
								_t252 = _t252 - _t237;
								E013432AC(_t261 - 0x28, _t252, 1);
								__eflags =  *((char*)(_t257 + 1));
								if( *((char*)(_t257 + 1)) > 0) {
									_t257 = _t257 + 1;
									__eflags = _t257;
								}
								_t243 =  *(_t261 - 0x44);
							}
							_t171 =  *((intOrPtr*)(_t261 - 0x4c));
							_t226 =  *(_t261 - 0x18);
							 *(_t261 - 0x58) = _t226;
							_t276 =  *((intOrPtr*)(_t171 + 0x24));
							if(_t276 < 0 || _t276 <= 0 &&  *((intOrPtr*)(_t171 + 0x20)) <= 0) {
								L32:
								_t258 = 0;
								__eflags = 0;
								goto L33;
							} else {
								_t260 =  *((intOrPtr*)(_t171 + 0x20));
								if(_t260 <= _t226) {
									goto L32;
								}
								_t258 = _t260 - _t226;
								L33:
								_t173 =  *(_t171 + 0x14) & 0x000001c0;
								if(_t173 == 0x40) {
									__eflags =  *(_t261 - 0x14) - 8;
									_t174 = _t261 - 0x28;
									if( *(_t261 - 0x14) >= 8) {
										_t174 =  *(_t261 - 0x28);
									}
									_t253 =  *((intOrPtr*)(_t261 + 8));
									_push(_t211);
									_push(_t174);
									_push( *((intOrPtr*)(_t261 + 0x14)));
									_push( *((intOrPtr*)(_t261 + 0x10)));
									L44:
									_push(_t261 - 0x54);
									_push(_t253);
									_t176 = E0133E3D8();
									L45:
									_t244 =  *((intOrPtr*)(_t176 + 4));
									_t227 =  *_t176;
									 *((intOrPtr*)(_t261 + 0x10)) =  *_t176;
									 *((intOrPtr*)(_t261 + 0x14)) =  *((intOrPtr*)(_t176 + 4));
									 *(_t261 - 0x44) = _t261 - 0x28;
									if( *(_t261 - 0x14) >= 8) {
										 *(_t261 - 0x44) =  *(_t261 - 0x28);
									}
									_t183 = E0133E3D8(_t253, _t261 - 0x54, _t227, _t244,  *(_t261 - 0x44) + _t211 * 2,  *(_t261 - 0x58) - _t211);
									_t245 =  *((intOrPtr*)(_t261 - 0x4c));
									_t259 =  *((intOrPtr*)(_t261 - 0x68));
									 *(_t245 + 0x20) =  *(_t245 + 0x20) & 0x00000000;
									 *(_t245 + 0x24) =  *(_t245 + 0x24) & 0x00000000;
									 *((intOrPtr*)(_t261 + 0x10)) =  *_t183;
									 *((intOrPtr*)(_t261 + 0x14)) =  *((intOrPtr*)(_t183 + 4));
									E0133EF6D(_t253,  *((intOrPtr*)(_t261 - 0x68)),  *_t183,  *((intOrPtr*)(_t183 + 4)),  *((intOrPtr*)(_t261 + 0x1c)), _t258);
									E01323480(_t211, _t261 - 0x40);
									_t187 =  *(_t261 - 0x14);
									if(_t187 >= 8) {
										_t230 =  *(_t261 - 0x28);
										_t190 = 2 + _t187 * 2;
										 *((intOrPtr*)(_t261 - 0x4c)) = _t190;
										 *(_t261 - 0x44) =  *(_t261 - 0x28);
										if(_t190 >= 0x1000) {
											E01323C20(_t211, _t261 - 0x44, _t261 - 0x4c);
											_t190 =  *((intOrPtr*)(_t261 - 0x4c));
											_t230 =  *(_t261 - 0x44);
										}
										_push(_t190);
										E013284D0(_t230);
									}
									return E01348204(_t211, _t253, _t259);
								}
								if(_t173 == 0x100) {
									__eflags =  *(_t261 - 0x14) - 8;
									_t196 = _t261 - 0x28;
									if( *(_t261 - 0x14) >= 8) {
										_t196 =  *(_t261 - 0x28);
									}
									_t253 =  *((intOrPtr*)(_t261 + 8));
									_t198 = E0133E3D8( *((intOrPtr*)(_t261 + 8)), _t261 - 0x54,  *((intOrPtr*)(_t261 + 0x10)),  *((intOrPtr*)(_t261 + 0x14)), _t196, _t211);
									 *((intOrPtr*)(_t261 + 0x14)) =  *((intOrPtr*)(_t198 + 4));
									 *((intOrPtr*)(_t261 + 0x10)) =  *_t198;
									_t176 = E0133EF6D( *((intOrPtr*)(_t261 + 8)), _t261 - 0x54,  *_t198,  *((intOrPtr*)(_t198 + 4)),  *((intOrPtr*)(_t261 + 0x1c)), _t258);
									_t258 = 0;
									goto L45;
								}
								_t253 =  *((intOrPtr*)(_t261 + 8));
								_t202 = E0133EF6D(_t253, _t261 - 0x54,  *((intOrPtr*)(_t261 + 0x10)),  *((intOrPtr*)(_t261 + 0x14)),  *((intOrPtr*)(_t261 + 0x1c)), _t258);
								_t263 = _t263 + 0x18;
								_t258 = 0;
								_t236 =  *_t202;
								_t246 =  *((intOrPtr*)(_t202 + 4));
								_t203 = _t261 - 0x28;
								 *((intOrPtr*)(_t261 + 0x10)) = _t236;
								 *((intOrPtr*)(_t261 + 0x14)) = _t246;
								if( *(_t261 - 0x14) >= 8) {
									_t203 =  *(_t261 - 0x28);
								}
								_push(_t211);
								_push(_t203);
								_push(_t246);
								_push(_t236);
								goto L44;
							}
						}
						__eflags =  *((char*)(_t248 + _t211)) - 0x30;
						if( *((char*)(_t248 + _t211)) != 0x30) {
							goto L12;
						}
						_t213 =  *((intOrPtr*)(_t248 + _t211 + 1));
						__eflags = _t213 - 0x78;
						if(_t213 == 0x78) {
							L11:
							_t211 = _t143;
							goto L12;
						}
						__eflags = _t213 - 0x58;
						if(_t213 != 0x58) {
							goto L12;
						}
						goto L11;
					}
					_t242 = "eE";
					goto L12;
				}
				_t209 =  *_t248;
				if(_t209 == 0x2b || _t209 == 0x2d) {
					_t211 = 1;
					goto L5;
				} else {
					goto L4;
				}
			}

0x01338872
0x01338879
0x0133887e
0x01338884
0x01338887
0x0133888a
0x0133888d
0x01338890
0x01338893
0x01338898
0x013388a9
0x013388a9
0x013388a9
0x013388ab
0x013388b5
0x013388b7
0x013388c0
0x013388c0
0x013388c3
0x013388c8
0x013388ca
0x013388e2
0x013388e9
0x013388ee
0x013388ef
0x013388fc
0x01338904
0x01338909
0x0133890c
0x01338915
0x0133891a
0x01338922
0x01338927
0x0133892f
0x01338932
0x0133893c
0x01338940
0x01338941
0x01338942
0x01338945
0x01338948
0x01338949
0x0133894a
0x0133894d
0x01338950
0x01338955
0x01338959
0x0133895c
0x01338963
0x01338965
0x01338965
0x01338974
0x0133897f
0x01338987
0x01338992
0x01338994
0x0133899b
0x0133899e
0x013389ae
0x013389b6
0x013389ba
0x013389be
0x013389c3
0x013389c6
0x013389c9
0x013389cf
0x013389f1
0x013389d1
0x013389dd
0x013389e0
0x013389e3
0x013389e5
0x013389e5
0x013389e8
0x013389eb
0x013389eb
0x013389f8
0x013389fb
0x013389fd
0x013389fd
0x01338a29
0x01338a29
0x01338a2d
0x00000000
0x00000000
0x01338a02
0x01338a04
0x00000000
0x00000000
0x01338a06
0x01338a0d
0x01338a0f
0x00000000
0x00000000
0x01338a11
0x01338a12
0x01338a1a
0x01338a1f
0x01338a23
0x01338a25
0x01338a25
0x01338a25
0x01338a26
0x01338a26
0x01338a2f
0x01338a32
0x01338a35
0x01338a38
0x01338a3c
0x01338a51
0x01338a51
0x01338a51
0x00000000
0x01338a46
0x01338a46
0x01338a4b
0x00000000
0x00000000
0x01338a4d
0x01338a53
0x01338a56
0x01338a5e
0x01338ae7
0x01338aeb
0x01338aee
0x01338af0
0x01338af0
0x01338af3
0x01338af6
0x01338af7
0x01338af8
0x01338afb
0x01338afe
0x01338b01
0x01338b02
0x01338b03
0x01338b0b
0x01338b0f
0x01338b12
0x01338b17
0x01338b1a
0x01338b1d
0x01338b20
0x01338b25
0x01338b25
0x01338b3c
0x01338b41
0x01338b4d
0x01338b50
0x01338b54
0x01338b5c
0x01338b5f
0x01338b62
0x01338b6d
0x01338b72
0x01338b78
0x01338b7a
0x01338b7d
0x01338b84
0x01338b87
0x01338b8f
0x01338b99
0x01338b9e
0x01338ba3
0x01338ba3
0x01338ba6
0x01338ba8
0x01338bae
0x01338bb6
0x01338bb6
0x01338a69
0x01338aa4
0x01338aa8
0x01338aab
0x01338aad
0x01338aad
0x01338ab0
0x01338ac0
0x01338acf
0x01338ad8
0x01338adb
0x01338ae3
0x00000000
0x01338ae3
0x01338a6b
0x01338a7d
0x01338a82
0x01338a85
0x01338a8b
0x01338a8d
0x01338a90
0x01338a93
0x01338a96
0x01338a99
0x01338a9b
0x01338a9b
0x01338a9e
0x01338a9f
0x01338aa0
0x01338aa1
0x00000000
0x01338aa1
0x01338a3c
0x013388cc
0x013388d0
0x00000000
0x00000000
0x013388d2
0x013388d6
0x013388d9
0x013388e0
0x013388e0
0x00000000
0x013388e0
0x013388db
0x013388de
0x00000000
0x00000000
0x00000000
0x013388de
0x013388b9
0x00000000
0x013388b9
0x0133889a
0x0133889e
0x013388a6
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 01338879
_strcspn.LIBCMT ref: 013388E4
_strcspn.LIBCMT ref: 01338904
ctype.LIBCPMT ref: 01338974

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: f8cf3f35778ec984313ba82c5ca7c6b6bfae375a0e249c0a3e4c46509918983d
Instruction ID: c2daecf9c5561d9bae7ef6cf76bd31fe3126818fcf25c9d1e0bcfe837a231b18
Opcode Fuzzy Hash: f8cf3f35778ec984313ba82c5ca7c6b6bfae375a0e249c0a3e4c46509918983d
Instruction Fuzzy Hash: C4C18C7190024ADFDF15DF98C9809EEBBB9FF88318F14415AE905BB210D734AE46CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01332A16 Relevance: 6.3, APIs: 4, Instructions: 310
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E01332A16(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _t137;
				short _t139;
				intOrPtr _t144;
				intOrPtr _t147;
				intOrPtr _t152;
				char _t163;
				char _t164;
				intOrPtr _t165;
				signed int _t167;
				intOrPtr _t168;
				intOrPtr* _t170;
				intOrPtr* _t177;
				intOrPtr _t181;
				intOrPtr _t184;
				intOrPtr _t190;
				intOrPtr* _t192;
				intOrPtr* _t196;
				intOrPtr _t197;
				intOrPtr _t202;
				intOrPtr _t203;
				char _t205;
				intOrPtr _t207;
				intOrPtr _t220;
				intOrPtr _t230;
				char _t231;
				char _t234;
				void* _t236;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr* _t241;
				intOrPtr* _t244;
				intOrPtr _t245;
				intOrPtr _t248;
				intOrPtr* _t250;
				char _t251;
				intOrPtr _t253;
				void* _t254;
				void* _t255;
				void* _t256;
				intOrPtr _t269;

				_push(0x5c);
				E01348246(0x136b9bb, __ebx, __edi, __esi);
				_t207 =  *((intOrPtr*)(_t254 + 0x24));
				_t248 =  *((intOrPtr*)(_t254 + 0x18));
				_t241 =  *((intOrPtr*)(_t254 + 0x20));
				 *((intOrPtr*)(_t254 - 0x68)) =  *((intOrPtr*)(_t254 + 0xc));
				 *((intOrPtr*)(_t254 - 0x4c)) = _t248;
				 *((intOrPtr*)(_t254 - 0x5c)) = _t241;
				 *((intOrPtr*)(_t254 - 0x44)) = _t207;
				if(_t207 == 0) {
					L4:
					_t205 = 0;
					__eflags = 0;
					L5:
					if(( *(_t248 + 0x14) & 0x00003000) == 0x3000) {
						_t10 = _t205 + 2; // 0x2
						_t137 = _t10;
						_t236 = "pP";
						__eflags = _t137 - _t207;
						if(_t137 > _t207) {
							L12:
							 *((intOrPtr*)(_t254 - 0x58)) = E013569F0(_t207, _t241, _t236);
							_t139 = 0x2e;
							 *((short*)(_t254 - 0x48)) = _t139;
							 *((char*)(_t254 - 0x48)) =  *((intOrPtr*)( *((intOrPtr*)(E01356A36(_t236, _t248)))));
							_t144 = E013569F0(_t207, _t241, _t254 - 0x48);
							_t256 = _t255 + 0x10;
							 *((intOrPtr*)(_t254 - 0x64)) = _t144;
							E0132FD10(_t254 - 0x54,  *((intOrPtr*)(_t248 + 0x30)));
							 *(_t254 - 4) =  *(_t254 - 4) & 0x00000000;
							_t147 = E0132C590(_t205, _t241, _t248, _t254 - 0x54);
							 *(_t254 - 4) =  *(_t254 - 4) | 0xffffffff;
							 *((intOrPtr*)(_t254 - 0x60)) = _t147;
							E0132C710(_t254 - 0x54);
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_t243 =  *((intOrPtr*)(_t254 - 0x44));
							 *((intOrPtr*)(_t254 - 0x18)) = 0;
							 *((intOrPtr*)(_t254 - 0x14)) = 0;
							E01324FB0(_t205, _t254 - 0x28,  *((intOrPtr*)(_t254 - 0x44)), _t248, 0,  *((intOrPtr*)(_t254 - 0x44)));
							_t264 =  *((intOrPtr*)(_t254 - 0x14)) - 0x10;
							_t152 = _t254 - 0x28;
							 *(_t254 - 4) = 1;
							if( *((intOrPtr*)(_t254 - 0x14)) >= 0x10) {
								_t152 =  *((intOrPtr*)(_t254 - 0x28));
							}
							E01335B08( *((intOrPtr*)(_t254 - 0x60)),  *((intOrPtr*)(_t254 - 0x5c)), _t243 +  *((intOrPtr*)(_t254 - 0x5c)), _t152);
							E0132FD10(_t254 - 0x54,  *((intOrPtr*)(_t248 + 0x30)));
							 *(_t254 - 4) = 2;
							_t244 = E01332823(_t205, _t243, _t248, _t264);
							 *(_t254 - 4) = 1;
							 *((intOrPtr*)(_t254 - 0x60)) = _t244;
							E0132C710(_t254 - 0x54);
							 *0x136d26c(_t254 - 0x40, _t254 - 0x54);
							 *((intOrPtr*)( *((intOrPtr*)( *_t244 + 0x14))))();
							 *(_t254 - 4) = 3;
							_t163 = E01335AF0(_t244);
							_t245 =  *((intOrPtr*)(_t254 - 0x64));
							 *((char*)(_t254 - 0x5c)) = _t163;
							if(_t245 ==  *((intOrPtr*)(_t254 - 0x44))) {
								_t245 =  *((intOrPtr*)(_t254 - 0x58));
							} else {
								_t234 = E013348F0( *((intOrPtr*)(_t254 - 0x60)));
								_t202 = _t254 - 0x28;
								if( *((intOrPtr*)(_t254 - 0x14)) >= 0x10) {
									_t202 =  *((intOrPtr*)(_t254 - 0x28));
								}
								 *((char*)(_t202 + _t245)) = _t234;
							}
							_t250 = _t254 - 0x40;
							if( *((intOrPtr*)(_t254 - 0x2c)) >= 0x10) {
								_t250 =  *((intOrPtr*)(_t254 - 0x40));
							}
							while(1) {
								_t164 =  *_t250;
								if(_t164 == 0x7f) {
									break;
								}
								__eflags = _t164;
								if(_t164 <= 0) {
									break;
								}
								_t231 = _t164;
								__eflags = _t231 - _t245 - _t205;
								if(_t231 >= _t245 - _t205) {
									break;
								}
								_t245 = _t245 - _t231;
								E013359C7(_t205, _t254 - 0x28, _t245, 1,  *((intOrPtr*)(_t254 - 0x5c)));
								__eflags =  *((char*)(_t250 + 1));
								if( *((char*)(_t250 + 1)) > 0) {
									_t250 = _t250 + 1;
									__eflags = _t250;
								}
							}
							_t165 =  *((intOrPtr*)(_t254 - 0x4c));
							_t220 =  *((intOrPtr*)(_t254 - 0x18));
							 *((intOrPtr*)(_t254 - 0x58)) = _t220;
							_t269 =  *((intOrPtr*)(_t165 + 0x24));
							if(_t269 < 0 || _t269 <= 0 &&  *((intOrPtr*)(_t165 + 0x20)) <= 0) {
								L31:
								_t251 = 0;
								__eflags = 0;
								goto L32;
							} else {
								_t253 =  *((intOrPtr*)(_t165 + 0x20));
								if(_t253 <= _t220) {
									goto L31;
								}
								_t251 = _t253 - _t220;
								L32:
								_t167 =  *(_t165 + 0x14) & 0x000001c0;
								if(_t167 == 0x40) {
									__eflags =  *((intOrPtr*)(_t254 - 0x14)) - 0x10;
									_t168 = _t254 - 0x28;
									if( *((intOrPtr*)(_t254 - 0x14)) >= 0x10) {
										_t168 =  *((intOrPtr*)(_t254 - 0x28));
									}
									_t246 =  *((intOrPtr*)(_t254 + 8));
									_push(_t205);
									_push(_t168);
									_push( *((intOrPtr*)(_t254 + 0x14)));
									_push( *((intOrPtr*)(_t254 + 0x10)));
									L43:
									_push(_t254 - 0x54);
									_push(_t246);
									_t170 = E013347C7();
									L44:
									_t237 =  *((intOrPtr*)(_t170 + 4));
									_t221 =  *_t170;
									 *((intOrPtr*)(_t254 + 0x10)) =  *_t170;
									 *((intOrPtr*)(_t254 + 0x14)) =  *((intOrPtr*)(_t170 + 4));
									 *((intOrPtr*)(_t254 - 0x44)) = _t254 - 0x28;
									if( *((intOrPtr*)(_t254 - 0x14)) >= 0x10) {
										 *((intOrPtr*)(_t254 - 0x44)) =  *((intOrPtr*)(_t254 - 0x28));
									}
									_t177 = E013347C7(_t246, _t254 - 0x54, _t221, _t237,  *((intOrPtr*)(_t254 - 0x44)) + _t205,  *((intOrPtr*)(_t254 - 0x58)) - _t205);
									_t238 =  *((intOrPtr*)(_t254 - 0x4c));
									_t252 =  *((intOrPtr*)(_t254 - 0x68));
									 *(_t238 + 0x20) =  *(_t238 + 0x20) & 0x00000000;
									 *(_t238 + 0x24) =  *(_t238 + 0x24) & 0x00000000;
									 *((intOrPtr*)(_t254 + 0x10)) =  *_t177;
									 *((intOrPtr*)(_t254 + 0x14)) =  *((intOrPtr*)(_t177 + 4));
									E013347FA(_t246,  *((intOrPtr*)(_t254 - 0x68)),  *_t177,  *((intOrPtr*)(_t177 + 4)),  *((intOrPtr*)(_t254 + 0x1c)), _t251);
									E01323480(_t205, _t254 - 0x40);
									_t181 =  *((intOrPtr*)(_t254 - 0x14));
									if(_t181 >= 0x10) {
										_t224 =  *((intOrPtr*)(_t254 - 0x28));
										_t184 = _t181 + 1;
										 *((intOrPtr*)(_t254 - 0x4c)) = _t184;
										 *((intOrPtr*)(_t254 - 0x44)) =  *((intOrPtr*)(_t254 - 0x28));
										if(_t184 >= 0x1000) {
											E01323C20(_t205, _t254 - 0x44, _t254 - 0x4c);
											_t184 =  *((intOrPtr*)(_t254 - 0x4c));
											_t224 =  *((intOrPtr*)(_t254 - 0x44));
										}
										_push(_t184);
										E013284D0(_t224);
									}
									return E01348204(_t205, _t246, _t252);
								}
								if(_t167 == 0x100) {
									__eflags =  *((intOrPtr*)(_t254 - 0x14)) - 0x10;
									_t190 = _t254 - 0x28;
									if( *((intOrPtr*)(_t254 - 0x14)) >= 0x10) {
										_t190 =  *((intOrPtr*)(_t254 - 0x28));
									}
									_t246 =  *((intOrPtr*)(_t254 + 8));
									_t192 = E013347C7( *((intOrPtr*)(_t254 + 8)), _t254 - 0x54,  *((intOrPtr*)(_t254 + 0x10)),  *((intOrPtr*)(_t254 + 0x14)), _t190, _t205);
									 *((intOrPtr*)(_t254 + 0x14)) =  *((intOrPtr*)(_t192 + 4));
									 *((intOrPtr*)(_t254 + 0x10)) =  *_t192;
									_t170 = E013347FA( *((intOrPtr*)(_t254 + 8)), _t254 - 0x54,  *_t192,  *((intOrPtr*)(_t192 + 4)),  *((intOrPtr*)(_t254 + 0x1c)), _t251);
									_t251 = 0;
									goto L44;
								}
								_t246 =  *((intOrPtr*)(_t254 + 8));
								_t196 = E013347FA(_t246, _t254 - 0x54,  *((intOrPtr*)(_t254 + 0x10)),  *((intOrPtr*)(_t254 + 0x14)),  *((intOrPtr*)(_t254 + 0x1c)), _t251);
								_t256 = _t256 + 0x18;
								_t251 = 0;
								_t230 =  *_t196;
								_t239 =  *((intOrPtr*)(_t196 + 4));
								_t197 = _t254 - 0x28;
								 *((intOrPtr*)(_t254 + 0x10)) = _t230;
								 *((intOrPtr*)(_t254 + 0x14)) = _t239;
								if( *((intOrPtr*)(_t254 - 0x14)) >= 0x10) {
									_t197 =  *((intOrPtr*)(_t254 - 0x28));
								}
								_push(_t205);
								_push(_t197);
								_push(_t239);
								_push(_t230);
								goto L43;
							}
						}
						__eflags =  *((char*)(_t241 + _t205)) - 0x30;
						if( *((char*)(_t241 + _t205)) != 0x30) {
							goto L12;
						}
						_t207 =  *((intOrPtr*)(_t241 + _t205 + 1));
						__eflags = _t207 - 0x78;
						if(_t207 == 0x78) {
							L11:
							_t205 = _t137;
							goto L12;
						}
						__eflags = _t207 - 0x58;
						if(_t207 != 0x58) {
							goto L12;
						}
						goto L11;
					}
					_t236 = "eE";
					goto L12;
				}
				_t203 =  *_t241;
				if(_t203 == 0x2b || _t203 == 0x2d) {
					_t205 = 1;
					goto L5;
				} else {
					goto L4;
				}
			}

0x01332a16
0x01332a1d
0x01332a22
0x01332a28
0x01332a2b
0x01332a2e
0x01332a31
0x01332a34
0x01332a37
0x01332a3c
0x01332a4d
0x01332a4d
0x01332a4d
0x01332a4f
0x01332a5b
0x01332a64
0x01332a64
0x01332a67
0x01332a6c
0x01332a6e
0x01332a86
0x01332a8d
0x01332a92
0x01332a93
0x01332aa0
0x01332aa8
0x01332aad
0x01332ab0
0x01332ab9
0x01332abe
0x01332ac6
0x01332acb
0x01332ad3
0x01332ad6
0x01332ae0
0x01332ae4
0x01332ae5
0x01332ae6
0x01332ae9
0x01332aee
0x01332af1
0x01332af4
0x01332af9
0x01332afd
0x01332b00
0x01332b07
0x01332b09
0x01332b09
0x01332b18
0x01332b23
0x01332b2b
0x01332b36
0x01332b38
0x01332b3f
0x01332b42
0x01332b52
0x01332b5a
0x01332b5e
0x01332b62
0x01332b67
0x01332b6a
0x01332b70
0x01332b8d
0x01332b72
0x01332b7e
0x01332b80
0x01332b83
0x01332b85
0x01332b85
0x01332b88
0x01332b88
0x01332b94
0x01332b97
0x01332b99
0x01332b99
0x01332bc4
0x01332bc4
0x01332bc8
0x00000000
0x00000000
0x01332b9e
0x01332ba0
0x00000000
0x00000000
0x01332ba2
0x01332ba9
0x01332bab
0x00000000
0x00000000
0x01332bb0
0x01332bb8
0x01332bbd
0x01332bc1
0x01332bc3
0x01332bc3
0x01332bc3
0x01332bc1
0x01332bca
0x01332bcd
0x01332bd0
0x01332bd3
0x01332bd7
0x01332bec
0x01332bec
0x01332bec
0x00000000
0x01332be1
0x01332be1
0x01332be6
0x00000000
0x00000000
0x01332be8
0x01332bee
0x01332bf1
0x01332bf9
0x01332c82
0x01332c86
0x01332c89
0x01332c8b
0x01332c8b
0x01332c8e
0x01332c91
0x01332c92
0x01332c93
0x01332c96
0x01332c99
0x01332c9c
0x01332c9d
0x01332c9e
0x01332ca6
0x01332caa
0x01332cad
0x01332cb2
0x01332cb5
0x01332cb8
0x01332cbb
0x01332cc0
0x01332cc0
0x01332cd6
0x01332cdb
0x01332ce7
0x01332cea
0x01332cee
0x01332cf6
0x01332cf9
0x01332cfc
0x01332d07
0x01332d0c
0x01332d12
0x01332d14
0x01332d17
0x01332d18
0x01332d1b
0x01332d23
0x01332d2d
0x01332d32
0x01332d37
0x01332d37
0x01332d3a
0x01332d3c
0x01332d42
0x01332d4a
0x01332d4a
0x01332c04
0x01332c3f
0x01332c43
0x01332c46
0x01332c48
0x01332c48
0x01332c4b
0x01332c5b
0x01332c6a
0x01332c73
0x01332c76
0x01332c7e
0x00000000
0x01332c7e
0x01332c06
0x01332c18
0x01332c1d
0x01332c20
0x01332c26
0x01332c28
0x01332c2b
0x01332c2e
0x01332c31
0x01332c34
0x01332c36
0x01332c36
0x01332c39
0x01332c3a
0x01332c3b
0x01332c3c
0x00000000
0x01332c3c
0x01332bd7
0x01332a70
0x01332a74
0x00000000
0x00000000
0x01332a76
0x01332a7a
0x01332a7d
0x01332a84
0x01332a84
0x00000000
0x01332a84
0x01332a7f
0x01332a82
0x00000000
0x00000000
0x00000000
0x01332a82
0x01332a5d
0x00000000
0x01332a5d
0x01332a3e
0x01332a42
0x01332a4a
0x00000000
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 01332A1D
_strcspn.LIBCMT ref: 01332A88
_strcspn.LIBCMT ref: 01332AA8
ctype.LIBCPMT ref: 01332B18

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 38a31f6c9788f9075077644f3a17c4db814218d1564ac1a97779c13783d36b57
Instruction ID: f89f8fadd1cac1b688476f00cde8202961316333cb65aac5ab55be451c8b91eb
Opcode Fuzzy Hash: 38a31f6c9788f9075077644f3a17c4db814218d1564ac1a97779c13783d36b57
Instruction Fuzzy Hash: 3DC18D7190024A9FEF19DFD8C9809EEBBB9FF98318F144019E905AB250D734AE45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01344F20 Relevance: 6.3, APIs: 4, Instructions: 277
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E01344F20(void* __ebx, void* __ecx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				signed int _t70;
				intOrPtr* _t73;
				void* _t75;
				intOrPtr _t79;
				intOrPtr* _t81;
				intOrPtr* _t84;
				intOrPtr _t89;
				intOrPtr* _t98;
				intOrPtr _t99;
				intOrPtr _t104;
				void* _t133;
				signed int _t138;
				signed char _t139;
				signed int _t141;
				void* _t142;
				void* _t144;
				intOrPtr* _t146;
				intOrPtr* _t148;
				intOrPtr* _t150;
				intOrPtr* _t151;
				void* _t152;
				void* _t153;
				void* _t157;
				void* _t158;
				void* _t159;
				void* _t160;

				_t160 = __eflags;
				_t143 = __esi;
				_push(8);
				E01348213(0x136c9d3, __ebx, __edi, __esi);
				_t104 =  *((intOrPtr*)(_t152 + 0x10));
				_push(0);
				_push(0);
				_t70 = E01343E70(_t104, __edx, __edi, __esi, _t160);
				_t141 =  *(_t152 + 0x14);
				_t138 = 1 << _t70 >> 1;
				if(( *(_t152 + 0xc) & 1) != 0) {
					_t99 = E0132BCE0();
					if(_t141 != 0) {
						_push(_t141);
						_t143 = _t99;
						_t70 = E01334403(_t104, _t141, _t99, __eflags, _t104, E013438C1(_t104, _t138, _t141, _t99, __eflags), _t143);
						_t153 = _t153 + 0x10;
					} else {
						 *((intOrPtr*)(_t152 - 0x10)) = _t99;
						_t151 = E013284C0(0x10);
						 *((intOrPtr*)(_t152 - 0x14)) = _t151;
						_pop(_t133);
						_t163 = _t151;
						if(_t151 == 0) {
							_t143 = 0;
							__eflags = 0;
						} else {
							 *(_t151 + 4) =  *(_t151 + 4) & _t141;
							 *_t151 = 0x136ebbc;
							 *((intOrPtr*)(_t151 + 8)) = E0134710D(_t104, _t133, _t163);
							 *(_t151 + 0xc) = _t138;
						}
						_t70 = E01334403(_t104, _t141, _t143, _t163, _t104, _t143,  *((intOrPtr*)(_t152 - 0x10)));
						_t153 = _t153 + 0xc;
					}
				}
				_t139 =  *(_t152 + 0xc);
				if((_t139 & 0x00000020) != 0) {
					_t143 = E0132BCE0();
					if(_t141 != 0) {
						_push(_t141);
						_t70 = E01334403(_t104, _t141, _t143, __eflags, _t104, E01343956(_t104, _t141, _t143, __eflags), _t143);
						_t153 = _t153 + 0x10;
					} else {
						_t98 = E013284C0(8);
						 *((intOrPtr*)(_t152 - 0x14)) = _t98;
						_t166 = _t98;
						if(_t98 == 0) {
							_t98 = 0;
							__eflags = 0;
						} else {
							 *(_t98 + 4) =  *(_t98 + 4) & _t141;
							 *_t98 = 0x136ebd8;
						}
						_t70 = E01334403(_t104, _t141, _t143, _t166, _t104, _t98, _t143);
						_t153 = _t153 + 0xc;
					}
					_t139 =  *(_t152 + 0xc);
				}
				if((_t139 & 0x00000004) != 0) {
					 *((intOrPtr*)(_t152 - 0x10)) = E0132BCE0();
					if(_t141 != 0) {
						_push(_t141);
						_t81 = E013439EB(_t104, _t141, _t143, __eflags);
					} else {
						_t81 = E013284C0(8);
						 *((intOrPtr*)(_t152 - 0x14)) = _t81;
						_t169 = _t81;
						if(_t81 == 0) {
							_t81 = 0;
						} else {
							 *(_t81 + 4) =  *(_t81 + 4) & _t141;
							 *_t81 = 0x136ebf4;
						}
					}
					_t147 = _t104;
					E01334403(_t104, _t141, _t104, _t169, _t104, _t81,  *((intOrPtr*)(_t152 - 0x10)));
					_t157 = _t153 + 0xc;
					 *((intOrPtr*)(_t152 - 0x10)) = E0132BCE0();
					if(_t141 != 0) {
						_push(_t141);
						_t84 = E01343A80(_t104, _t141, _t147, __eflags);
					} else {
						_t84 = E013284C0(8);
						 *((intOrPtr*)(_t152 - 0x14)) = _t84;
						_t171 = _t84;
						if(_t84 == 0) {
							_t84 = 0;
						} else {
							 *(_t84 + 4) =  *(_t84 + 4) & _t141;
							 *_t84 = 0x136ec0c;
						}
					}
					E01334403(_t104, _t141, _t147, _t171, _t147, _t84,  *((intOrPtr*)(_t152 - 0x10)));
					_t158 = _t157 + 0xc;
					 *((intOrPtr*)(_t152 - 0x10)) = E0132BCE0();
					if(_t141 != 0) {
						_push(_t141);
						_t148 = E01343BAA(_t104, _t141, _t147, __eflags);
					} else {
						_t148 = E013284C0(0x58);
						 *((intOrPtr*)(_t152 - 0x14)) = _t148;
						 *(_t152 - 4) = 7;
						_t173 = _t148;
						if(_t148 == 0) {
							_t148 = 0;
							__eflags = 0;
						} else {
							 *((intOrPtr*)(_t148 + 4)) = 0;
							 *(_t152 - 4) = 8;
							 *_t148 = 0x136ec24;
							 *((char*)(_t148 + 0x28)) = 0;
							E01344DF4(_t104, _t148, _t141, _t148, _t173,  *((intOrPtr*)(_t152 + 8)), 0);
							 *_t148 = 0x136ec58;
						}
						 *(_t152 - 4) =  *(_t152 - 4) | 0xffffffff;
					}
					E01334403(_t104, _t141, _t148, _t173, _t104, _t148,  *((intOrPtr*)(_t152 - 0x10)));
					_t159 = _t158 + 0xc;
					_t89 = E0132BCE0();
					if(_t141 != 0) {
						_push(_t141);
						_t149 = _t89;
						_t70 = E01334403(_t104, _t141, _t89, __eflags, _t104, E01343B15(_t104, _t141, _t89, __eflags), _t149);
						_t153 = _t159 + 0x10;
					} else {
						 *((intOrPtr*)(_t152 - 0x10)) = _t89;
						_t150 = E013284C0(0x58);
						 *((intOrPtr*)(_t152 - 0x14)) = _t150;
						 *(_t152 - 4) = 0xd;
						_t175 = _t150;
						if(_t150 == 0) {
							_t150 = 0;
							__eflags = 0;
						} else {
							 *(_t150 + 4) =  *(_t150 + 4) & _t141;
							 *(_t152 - 4) = 0xe;
							 *_t150 = 0x136ec24;
							 *((char*)(_t150 + 0x28)) = 1;
							E01344DF4(_t104, _t150, _t141, _t150, _t175,  *((intOrPtr*)(_t152 + 8)), _t141);
							 *_t150 = 0x136ec8c;
						}
						 *(_t152 - 4) =  *(_t152 - 4) | 0xffffffff;
						_t70 = E01334403(_t104, _t141, _t150, _t175, _t104, _t150,  *((intOrPtr*)(_t152 - 0x10)));
						_t153 = _t159 + 0xc;
					}
					_t139 =  *(_t152 + 0xc);
				}
				if((_t139 & 0x00000010) != 0) {
					_t144 = E0132BCE0();
					if(_t141 != 0) {
						_push(_t141);
						_t73 = E01343C3F(_t104, _t141, _t144, __eflags);
					} else {
						_t79 = E013284C0(0x44);
						 *((intOrPtr*)(_t152 - 0x14)) = _t79;
						 *(_t152 - 4) = 0x12;
						_t178 = _t79;
						if(_t79 == 0) {
							_t73 = 0;
							__eflags = 0;
						} else {
							_push(_t141);
							_push( *((intOrPtr*)(_t152 + 8)));
							_t73 = E01343D69(_t79, _t144, _t178);
						}
						 *(_t152 - 4) =  *(_t152 - 4) | 0xffffffff;
					}
					E01334403(_t104, _t141, _t144, _t178, _t104, _t73, _t144);
					_t75 = E0132BCE0();
					if(_t141 != 0) {
						_push(_t141);
						_t145 = _t75;
						_t70 = E01334403(_t104, _t141, _t75, __eflags, _t104, E01343CD4(_t104, _t141, _t75, __eflags), _t145);
					} else {
						_t142 = _t75;
						_t146 = E013284C0(0xc);
						 *((intOrPtr*)(_t152 - 0x14)) = _t146;
						_t180 = _t146;
						if(_t146 == 0) {
							_t146 = 0;
							__eflags = 0;
						} else {
							 *(_t146 + 4) =  *(_t146 + 4) & 0x00000000;
							 *_t146 = 0x136ecec;
							 *(_t146 + 8) =  *(_t146 + 8) & 0x00000000;
							E01344EF7(_t104, _t142,  *((intOrPtr*)(_t152 + 8)));
						}
						_t70 = E01334403(_t104, _t142, _t146, _t180, _t104, _t146, _t142);
					}
				}
				return E013481F0(_t70);
			}

0x01344f20
0x01344f20
0x01344f20
0x01344f27
0x01344f2c
0x01344f31
0x01344f32
0x01344f33
0x01344f38
0x01344f44
0x01344f49
0x01344f50
0x01344f57
0x01344f94
0x01344f95
0x01344f9f
0x01344fa4
0x01344f59
0x01344f5b
0x01344f63
0x01344f65
0x01344f68
0x01344f69
0x01344f6b
0x01344f83
0x01344f83
0x01344f6d
0x01344f6d
0x01344f70
0x01344f7b
0x01344f7e
0x01344f7e
0x01344f8a
0x01344f8f
0x01344f8f
0x01344f57
0x01344fa7
0x01344fad
0x01344fb9
0x01344fbd
0x01344fe8
0x01344ff1
0x01344ff6
0x01344fbf
0x01344fc1
0x01344fc6
0x01344fca
0x01344fcc
0x01344fd9
0x01344fd9
0x01344fce
0x01344fce
0x01344fd1
0x01344fd1
0x01344fde
0x01344fe3
0x01344fe3
0x01344ff9
0x01344ff9
0x01344fff
0x0134500f
0x01345014
0x01345034
0x01345035
0x01345016
0x01345018
0x0134501d
0x01345021
0x01345023
0x01345030
0x01345025
0x01345025
0x01345028
0x01345028
0x01345023
0x0134503e
0x01345042
0x01345047
0x01345054
0x01345059
0x01345079
0x0134507a
0x0134505b
0x0134505d
0x01345062
0x01345066
0x01345068
0x01345075
0x0134506a
0x0134506a
0x0134506d
0x0134506d
0x01345068
0x01345085
0x0134508a
0x01345097
0x0134509c
0x013450e3
0x013450ea
0x0134509e
0x013450a5
0x013450a8
0x013450ab
0x013450b2
0x013450b4
0x013450db
0x013450db
0x013450b6
0x013450b8
0x013450c1
0x013450c5
0x013450cb
0x013450ce
0x013450d3
0x013450d3
0x013450dd
0x013450dd
0x013450f1
0x013450f6
0x013450fe
0x01345105
0x0134515b
0x0134515c
0x01345166
0x0134516b
0x01345107
0x01345109
0x01345111
0x01345114
0x01345117
0x0134511e
0x01345120
0x01345146
0x01345146
0x01345122
0x01345122
0x0134512b
0x0134512f
0x01345135
0x01345139
0x0134513e
0x0134513e
0x0134514b
0x01345151
0x01345156
0x01345156
0x0134516e
0x0134516e
0x01345174
0x01345184
0x01345188
0x013451b5
0x013451b6
0x0134518a
0x0134518c
0x01345192
0x01345195
0x0134519c
0x0134519e
0x013451ad
0x013451ad
0x013451a0
0x013451a0
0x013451a1
0x013451a6
0x013451a6
0x013451af
0x013451af
0x013451c1
0x013451ce
0x013451d5
0x01345213
0x01345214
0x0134521e
0x013451d7
0x013451d9
0x013451e0
0x013451e2
0x013451e6
0x013451e8
0x01345204
0x01345204
0x013451ea
0x013451ea
0x013451f3
0x013451f9
0x013451fd
0x013451fd
0x01345209
0x0134520e
0x013451d5
0x0134522b

APIs

__EH_prolog3.LIBCMT ref: 01344F27
collate.LIBCPMT ref: 01344F33

Part of subcall function 01343E70: __EH_prolog3_GS.LIBCMT ref: 01343E77
Part of subcall function 01343E70: __Getcoll.LIBCPMT ref: 01343EDB

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

__Getcoll.LIBCPMT ref: 01344F76

Part of subcall function 01343CD4: __EH_prolog3.LIBCMT ref: 01343CDB
Part of subcall function 01343CD4: std::_Lockit::_Lockit.LIBCPMT ref: 01343CE5
Part of subcall function 01343CD4: std::_Lockit::~_Lockit.LIBCPMT ref: 01343D56

Part of subcall function 01334403: __EH_prolog3.LIBCMT ref: 0133440A
Part of subcall function 01334403: std::_Lockit::_Lockit.LIBCPMT ref: 01334414
Part of subcall function 01334403: std::_Lockit::~_Lockit.LIBCPMT ref: 013344BB

numpunct.LIBCPMT ref: 013451A6

Part of subcall function 013284C0: LocalAlloc.KERNEL32(00000040,00000000,0134839D,00000000,C9209188,?,00000000,?,00000000,?,0136CB8D,000000FF,?,013217D5,00000000,0136D3BA), ref: 013284C6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_$Getcoll$AllocH_prolog3_Localcollatenumpunct
String ID:
API String ID: 2732324234-0
Opcode ID: 24b8bce8c25e0bb192f667b2dcac5d361b11929ee611fba5abab1a95c727a439
Instruction ID: cb3498fd160ede28e70683d311cde1c10948fc4a5e897f4567b8e2d1ccd6b347
Opcode Fuzzy Hash: 24b8bce8c25e0bb192f667b2dcac5d361b11929ee611fba5abab1a95c727a439
Instruction Fuzzy Hash: E491DA75C01326ABEB21BB7C8804B7FBAECFF9126CF11452DE9556B244EA34990487E1

Uniqueness

Uniqueness Score: -1.00%

Function 0134AFD5 Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 67%

			E0134AFD5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x1380e08);
				E013485D0(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E01348FF0(_t107, E01349690(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E01348FF0(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x1384e78; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x136d26c();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E01358037(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x1380e28);
									E013485D0(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E0134AFD5(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E0134BCE4(_t103, _t108[0x18], E01349690( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E0134BCF4(_t103, _t108[0x18], E01349690( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E01349690();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x0134afd5
0x0134afd7
0x0134afdc
0x0134afe1
0x0134afe3
0x0134afe6
0x0134afeb
0x0134b0fb
0x0134b0fb
0x0134b0fb
0x00000000
0x0134affa
0x0134affa
0x0134afff
0x0134b009
0x0134b00b
0x0134b010
0x0134b015
0x0134b015
0x0134b017
0x0134b01a
0x0134b01f
0x0134b041
0x0134b041
0x0134b044
0x0134b047
0x0134b065
0x0134b068
0x0134b0a7
0x0134b0aa
0x0134b0ad
0x0134b0d2
0x0134b0d4
0x00000000
0x0134b0d6
0x0134b0d6
0x0134b0d8
0x00000000
0x0134b0da
0x0134b0da
0x0134b0df
0x0134b0e3
0x0134b0e3
0x0134b0e4
0x00000000
0x0134b0e4
0x0134b0d8
0x0134b0af
0x0134b0af
0x0134b0b1
0x00000000
0x0134b0b3
0x0134b0b3
0x0134b0b5
0x00000000
0x0134b0b7
0x0134b0c8
0x00000000
0x0134b0cd
0x0134b0b5
0x0134b0b1
0x0134b06a
0x0134b06a
0x0134b06e
0x00000000
0x0134b074
0x0134b074
0x0134b076
0x00000000
0x0134b07c
0x0134b083
0x0134b08b
0x0134b08f
0x0134b091
0x0134b094
0x0134b099
0x0134b09a
0x00000000
0x0134b09a
0x0134b094
0x00000000
0x0134b08f
0x0134b076
0x0134b06e
0x0134b049
0x0134b049
0x00000000
0x0134b049
0x0134b026
0x0134b026
0x0134b02b
0x0134b030
0x00000000
0x0134b032
0x0134b034
0x0134b03d
0x0134b04c
0x0134b04e
0x0134b10d
0x0134b10d
0x0134b112
0x0134b113
0x0134b115
0x0134b11a
0x0134b11f
0x0134b122
0x0134b125
0x0134b128
0x0134b131
0x0134b131
0x0134b12a
0x0134b12a
0x0134b12a
0x0134b134
0x0134b138
0x0134b13b
0x0134b13c
0x0134b13d
0x0134b13e
0x0134b141
0x0134b14a
0x0134b14a
0x0134b14d
0x0134b183
0x0134b14f
0x0134b14f
0x0134b14f
0x0134b152
0x0134b169
0x0134b169
0x0134b152
0x0134b188
0x0134b192
0x0134b19e
0x0134b05c
0x0134b05c
0x0134b061
0x0134b062
0x0134b09c
0x0134b0a3
0x0134b0e7
0x0134b0e7
0x0134b0ee
0x0134b0fd
0x0134b100
0x0134b10c
0x0134b10c
0x0134b04e
0x0134b030
0x00000000
0x00000000
0x00000000
0x0134afff

APIs

___AdjustPointer.LIBCMT ref: 0134B09C
___AdjustPointer.LIBCMT ref: 0134B0BF
___AdjustPointer.LIBCMT ref: 0134B15B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f6251fe08af75ba267d5e064c8e6e952058816a539a7fc06257c22ec54a724bb
Instruction ID: 8d10f7b15196c73b02ea605593a56778be462384f86351e1934f3e48afc2ff2a
Opcode Fuzzy Hash: f6251fe08af75ba267d5e064c8e6e952058816a539a7fc06257c22ec54a724bb
Instruction Fuzzy Hash: 7651BD72600306AFEB299F59D840B6AFBE8FF14319F14452DEE1647698E731F880CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0132C9B1 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0132CA1A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0132CA80
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0132CB4F

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Locinfo::_$Locinfo_ctorLocinfo_dtorLockitLockit::_
String ID:
API String ID: 2022693140-0
Opcode ID: c35f3765e86bdd8adfa2e19b002abfa77888e933168d70deb2adc030499345f0
Instruction ID: 5e4c358a0abb728ea1152e5a042b30d285e00ff93676b1d3235f9171d6b0d604
Opcode Fuzzy Hash: c35f3765e86bdd8adfa2e19b002abfa77888e933168d70deb2adc030499345f0
Instruction Fuzzy Hash: 275182B1D05298DEEF11DBA8D9447DEBFB4AF21308F185099C444A7281E7769A08D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01357B18 Relevance: 6.1, APIs: 4, Instructions: 79
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E01357B18(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t15 = E0136002B(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E01357C14(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E0134C656(GetLastError());
									_t18 =  *((intOrPtr*)(E0134C6B0()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E01357C52(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E0134C656(GetLastError());
						_t18 =  *((intOrPtr*)(E0134C6B0()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E01357C52(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E01357CD7(_a8);
				return 0;
			}

0x01357b1e
0x01357b23
0x01357b3a
0x01357b6c
0x01357b76
0x01357b8f
0x01357b95
0x01357ba3
0x01357bb0
0x01357bb7
0x01357bd0
0x01357bd3
0x01357bb9
0x01357bc0
0x01357bcb
0x01357bcb
0x01357bd5
0x01357bd6
0x00000000
0x01357bd6
0x01357b9a
0x01357ba1
0x00000000
0x00000000
0x00000000
0x01357ba1
0x01357b7f
0x01357b8a
0x00000000
0x01357b8a
0x01357b3c
0x01357b42
0x01357b55
0x01357b58
0x01357b5a
0x01357b5c
0x00000000
0x01357b5c
0x01357b48
0x01357b4f
0x00000000
0x00000000
0x00000000
0x01357b4f
0x01357b28
0x00000000

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168c3c9717464654f65c469349aca48e9fa70f472839fa787250ff2361aa9a79
Instruction ID: 2a8ee481071842f3bd2c49282e4f82c0a5f20268fcc93f7566cd3d3787f114e0
Opcode Fuzzy Hash: 168c3c9717464654f65c469349aca48e9fa70f472839fa787250ff2361aa9a79
Instruction Fuzzy Hash: 5621D27120021AAFCBA1AF79CC40D6B77ADEF00BACB418925FE15D7640EB30EC4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 01329020 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01329020(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				signed int _t9;
				signed int _t11;
				signed int _t13;
				signed int _t16;
				long _t19;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t31;
				void* _t36;
				void* _t37;
				signed int* _t38;

				_t37 = __edx;
				_t36 = __ecx;
				_t19 = GetLastError();
				_t38 = E01328630(_a4, L"Call to ShellExecute() for verb<", _t37, L"> returned:");
				E01328570(_t36, _t38);
				while( *_t38 != 0) {
					_t38 =  &(_t38[0]);
				}
				_t9 = 0xd;
				_t24 = L"\r\n" - _t38;
				do {
					 *_t38 = _t9;
					_t38 =  &(_t38[0]);
					_t9 =  *(_t24 + _t38) & 0x0000ffff;
				} while (_t9 != 0);
				 *_t38 = 0;
				_t26 = L"Last error=" - _t38;
				_t11 = 0x4c;
				do {
					 *_t38 = _t11;
					_t38 =  &(_t38[0]);
					_t11 =  *(_t26 + _t38) & 0x0000ffff;
				} while (_t11 != 0);
				 *_t38 = 0;
				_t28 = L"\r\n" - _t38;
				_t13 = 0xd;
				do {
					 *_t38 = _t13;
					_t38 =  &(_t38[0]);
					_t13 =  *(_t28 + _t38) & 0x0000ffff;
				} while (_t13 != 0);
				 *_t38 = 0;
				E01328570(_t19, _t38);
				while( *_t38 != 0) {
					_t38 =  &(_t38[0]);
				}
				_t16 = 0xd;
				_t31 = L"\r\n" - _t38;
				do {
					 *_t38 = _t16;
					_t38 =  &(_t38[0]);
					_t16 =  *(_t31 + _t38) & 0x0000ffff;
				} while (_t16 != 0);
				 *_t38 = 0;
				return _t38;
			}

0x01329023
0x01329025
0x0132903c
0x01329046
0x0132904c
0x01329055
0x01329057
0x0132905a
0x01329065
0x0132906a
0x01329070
0x01329070
0x01329073
0x01329076
0x0132907a
0x01329086
0x01329089
0x0132908b
0x01329090
0x01329090
0x01329093
0x01329096
0x0132909a
0x013290a6
0x013290a9
0x013290ab
0x013290b0
0x013290b0
0x013290b3
0x013290b6
0x013290ba
0x013290c5
0x013290c8
0x013290d1
0x013290d3
0x013290d6
0x013290e1
0x013290e6
0x013290f0
0x013290f0
0x013290f3
0x013290f6
0x013290fa
0x01329101
0x01329109

APIs

GetLastError.KERNEL32(00000000,00000000,73AD4CE0,01328B3A,00000000,?,?,?,?,?,?,?,00000000,0136A285,000000FF), ref: 01329027

Strings

> returned:, xrefs: 01329036
Last error=, xrefs: 01329081
Call to ShellExecute() for verb<, xrefs: 01329031

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: 9002d052863b00d8b122e891a76df354a2efc04ca128ff2606d720dc7295f2c7
Instruction ID: e0a941688153a757890a42ddfa82c4ebc42476e8774104d0b2d6d18718e0e675
Opcode Fuzzy Hash: 9002d052863b00d8b122e891a76df354a2efc04ca128ff2606d720dc7295f2c7
Instruction Fuzzy Hash: D7219D69A20272C6CB302F3C840473AA2F1EF5466DF25446FD8C9D7399FA7D8881C391

Uniqueness

Uniqueness Score: -1.00%

Function 01334403 Relevance: 6.1, APIs: 4, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E01334403(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr* _a12, signed int _a16) {
				intOrPtr _v0;
				signed int _v4;
				intOrPtr* _v16;
				char _v20;
				intOrPtr* _t55;
				intOrPtr* _t61;
				intOrPtr _t66;
				signed int _t69;
				void* _t70;
				signed int _t74;
				signed int _t75;
				signed int _t81;
				signed int _t82;
				signed int _t103;
				signed int _t110;
				signed int _t112;
				signed int* _t113;
				signed int _t115;
				signed int _t116;
				intOrPtr _t117;
				signed int _t123;
				signed int _t124;
				void* _t129;
				void* _t133;

				_push(8);
				E01348213(0x136bbce, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t115 = _a8;
				_v4 = _v4 & 0x00000000;
				_t81 = _a16;
				if( *(_t115 + 0xc) > _t81) {
					L7:
					 *0x136d26c();
					 *((intOrPtr*)( *((intOrPtr*)( *_a12 + 4))))();
					_t21 = _t115 + 8; // 0x6c61766e
					_t55 =  *((intOrPtr*)( *_t21 + _t81 * 4));
					_v16 = _t55;
					if(_t55 != 0) {
						 *0x136d26c();
						_t61 =  *((intOrPtr*)( *((intOrPtr*)( *_t55 + 8))))();
						_v16 = _t61;
						if(_t61 != 0) {
							 *0x136d26c(1);
							 *((intOrPtr*)( *((intOrPtr*)( *_t61))))();
						}
					}
					_t29 = _t115 + 8; // 0x6c61766e
					 *((intOrPtr*)( *_t29 + _t81 * 4)) = _a12;
					return E013481F0(E01335EFD( &_v20));
				} else {
					_t123 = _t81 + 1;
					if(_t123 < 0x28) {
						_t123 = 0x28;
					}
					_push(_t123 << 2);
					_t8 = _t115 + 8; // 0x6c61766e
					_push( *_t8);
					_t66 = E01356C5B();
					if(_t66 == 0) {
						E01332056(__eflags);
						asm("int3");
						_t129 = _t133;
						_push(_t123);
						_push(_t115);
						_t116 = _a8;
						_t124 = 0;
						__eflags = _t116;
						if(_t116 == 0) {
							E013320D0("bad locale name");
							asm("int3");
							_push(_t129);
							_t69 = E01357001(0, 0);
							__eflags = _t69;
							if(_t69 == 0) {
								_t69 = 0x137b6c9;
							}
							_push(_t124);
							_t45 = _v0 + 0x24; // 0x137b6ed
							_t70 = E0132C8A0(_t45, _t69);
							_push(_a8);
							_push(_a4);
							_push(_v0);
							L12();
							return _t70;
						} else {
							__eflags =  *_t116 - 0x2a;
							if( *_t116 != 0x2a) {
								L15:
								_t112 = _a8;
								__eflags = _t112;
								if(_t112 != 0) {
									__eflags = _t112 - 0x3f;
									if(_t112 != 0x3f) {
										_push(_t81);
										_t82 = _t124;
										do {
											_t74 = 1 << _t82 >> 1;
											__eflags = _t112 & _t74;
											if((_t112 & _t74) != 0) {
												E01357001(_t82, _t116);
												_t112 = _a8;
											}
											_t82 = _t82 + 1;
											__eflags = _t82 - 5;
										} while (_t82 <= 5);
										_t75 = E01357001(_t124, _t116);
									} else {
										_push(_t116);
										goto L17;
									}
								} else {
									_push(_t124);
									L17:
									_push(_t124);
									_t75 = E01357001();
								}
								_t124 = _t75;
							} else {
								__eflags =  *((char*)(_t116 + 1));
								if( *((char*)(_t116 + 1)) != 0) {
									goto L15;
								}
							}
							_t117 = _a4;
							_t41 = _t117 + 0x2c; // 0x137b6f5
							_t113 = _t41;
							__eflags = _t124;
							if(_t124 != 0) {
								_t103 =  *_t113;
								__eflags = _t103;
								if(_t103 == 0) {
									_t42 =  &(_t113[1]); // 0x137b6f9
									_t103 = _t42;
								}
								__eflags =  *_t103 - 0x2a;
								if( *_t103 != 0x2a) {
									L32:
									_push(_t124);
									goto L33;
								} else {
									_t43 = _t103 + 1; // 0x2a0000
									__eflags =  *_t43 & 0x000000ff;
									if(( *_t43 & 0x000000ff) != 0) {
										goto L32;
									}
								}
							} else {
								_push("*");
								L33:
								E0132C8A0(_t113);
							}
							return _t117;
						}
					} else {
						_t9 = _t115 + 0xc; // 0x73206469
						_t110 =  *_t9;
						 *((intOrPtr*)(_t115 + 8)) = _t66;
						while(_t110 < _t123) {
							_t11 = _t115 + 8; // 0x6c61766e
							 *( *_t11 + _t110 * 4) =  *( *_t11 + _t110 * 4) & 0x00000000;
							_t16 = _t115 + 0xc; // 0x73206469
							_t110 =  *_t16 + 1;
							__eflags = _t110;
							 *(_t115 + 0xc) = _t110;
						}
						goto L7;
					}
				}
			}

0x01334403
0x0133440a
0x01334414
0x01334419
0x0133441c
0x01334420
0x01334426
0x01334461
0x0133446b
0x01334474
0x01334476
0x01334479
0x0133447c
0x01334481
0x0133448a
0x01334493
0x01334495
0x0133449a
0x013344a4
0x013344ad
0x013344ad
0x0133449a
0x013344af
0x013344b5
0x013344c5
0x01334428
0x01334428
0x0133442e
0x01334432
0x01334432
0x01334438
0x01334439
0x01334439
0x0133443c
0x01334445
0x013344c6
0x013344cb
0x013344cd
0x013344cf
0x013344d0
0x013344d1
0x013344d4
0x013344d6
0x013344d8
0x0133456b
0x01334570
0x01334571
0x01334578
0x0133457f
0x01334581
0x01334583
0x01334583
0x01334588
0x0133458d
0x01334590
0x01334595
0x01334598
0x0133459b
0x0133459c
0x013345a6
0x013344de
0x013344de
0x013344e1
0x013344e9
0x013344e9
0x013344ec
0x013344ee
0x013344fb
0x013344fe
0x01334503
0x01334504
0x01334506
0x0133450d
0x0133450f
0x01334511
0x01334515
0x0133451a
0x0133451e
0x0133451f
0x01334520
0x01334520
0x01334527
0x01334500
0x01334500
0x00000000
0x01334500
0x013344f0
0x013344f0
0x013344f1
0x013344f1
0x013344f2
0x013344f8
0x0133452f
0x013344e3
0x013344e3
0x013344e7
0x00000000
0x00000000
0x013344e7
0x01334531
0x01334534
0x01334534
0x01334537
0x01334539
0x01334542
0x01334544
0x01334546
0x01334548
0x01334548
0x01334548
0x0133454b
0x0133454e
0x01334558
0x01334558
0x00000000
0x01334550
0x01334550
0x01334554
0x01334556
0x00000000
0x00000000
0x01334556
0x0133453b
0x0133453b
0x01334559
0x0133455b
0x0133455b
0x01334565
0x01334565
0x01334447
0x01334447
0x01334447
0x0133444a
0x0133445d
0x0133444f
0x01334452
0x01334456
0x01334459
0x01334459
0x0133445a
0x0133445a
0x00000000
0x0133445d
0x01334445

APIs

__EH_prolog3.LIBCMT ref: 0133440A
std::_Lockit::_Lockit.LIBCPMT ref: 01334414
std::_Lockit::~_Lockit.LIBCPMT ref: 013344BB
Concurrency::cancel_current_task.LIBCPMT ref: 013344C6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskH_prolog3Lockit::_Lockit::~_
String ID:
API String ID: 4244582100-0
Opcode ID: 25b5f120295bfbf42b63cc34e28a486dd4cf61d04960f13e113977d6a974b127
Instruction ID: a17dbd0710a89c2f7446b88c69a6896544e45831c45964d24bda74889d62a209
Opcode Fuzzy Hash: 25b5f120295bfbf42b63cc34e28a486dd4cf61d04960f13e113977d6a974b127
Instruction Fuzzy Hash: 5E216B34A106169FDB04EF58C890A6DBB65FF85724F04C459E915AB3A0CB30ED10CF84

Uniqueness

Uniqueness Score: -1.00%

Function 01331400 Relevance: 6.1, APIs: 4, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E01331400(void* __ecx, WCHAR* __edx) {
				struct _OVERLAPPED* _v8;
				char _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				intOrPtr _v28;
				signed int _t14;
				void* _t19;
				int _t22;
				void* _t24;
				void* _t29;
				void* _t32;
				signed int _t34;

				_push(0xffffffff);
				_push(0x136b6bd);
				_push( *[fs:0x0]);
				_t14 =  *0x1383020; // 0xc9209188
				_push(_t14 ^ _t34);
				 *[fs:0x0] =  &_v16;
				_t29 = __ecx;
				_t32 = CreateFileW(__edx, 0x40000000, 1, 0, 4, 0x80, 0);
				_v28 = 0x1379700;
				_v24 = _t32;
				_v8 = 0;
				SetFilePointer(_t32, 0, 0, 2);
				_t24 = 0;
				_t19 = _t29;
				if( *_t29 != 0) {
					do {
						_t19 = _t19 + 2;
						_t24 = _t24 + 1;
					} while ( *_t19 != 0);
				}
				_v20 = 0;
				_t22 = WriteFile(_t32, _t29, _t24 + _t24,  &_v20, 0);
				_v8 = 0xffffffff;
				_v28 = 0x1379700;
				if(_t32 != 0) {
					_t22 = CloseHandle(_t32);
					_v24 = 0;
				}
				 *[fs:0x0] = _v16;
				return _t22;
			}

0x01331403
0x01331405
0x01331410
0x01331416
0x0133141d
0x01331421
0x01331427
0x01331442
0x01331444
0x0133144b
0x0133144e
0x0133145c
0x01331462
0x01331464
0x01331469
0x01331470
0x01331470
0x01331473
0x01331474
0x01331470
0x0133147f
0x0133148d
0x01331493
0x0133149a
0x013314a3
0x013314a6
0x013314ac
0x013314ac
0x013314b6
0x013314c3

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,C9209188), ref: 0133143C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 0133145C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 0133148D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 013314A6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 8a4d4bfac6490020eb2394acc183afa5f306d7d7d3e450b4ecde7e2715c82804
Instruction ID: 7e9c670ec770b999123645b9e250821af07ec1b7b8fe57f9b80f490cb3eb5170
Opcode Fuzzy Hash: 8a4d4bfac6490020eb2394acc183afa5f306d7d7d3e450b4ecde7e2715c82804
Instruction Fuzzy Hash: 07218171A41318EBD7319F54DC09F9ABBBCFB45B28F208219F611A72C0D7B45605CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0133815A Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0133815A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _t36;
				void* _t52;
				intOrPtr* _t55;
				void* _t78;
				intOrPtr _t79;
				void* _t87;
				intOrPtr* _t90;
				void* _t91;
				void* _t94;
				void* _t95;
				void* _t96;

				_t87 = __edx;
				_t66 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t94 =  *0x1384a28; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t94;
				_t36 = E0132BD50(_a8, E0132BCE0());
				_t89 = _t36;
				if(_t36 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t89);
				} else {
					if(_t94 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E013394D8(__ebx, _t89, _t94, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t89, _t94);
							E01335EA5( &_v20, 0);
							_t95 =  *0x1384a5c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t95;
							_t90 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t90;
							if(_t90 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t90);
							} else {
								__eflags = _t95;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									_t52 = E01339544(_t66, _t90, _t95, __eflags);
									_pop(_t78);
									__eflags = _t52 - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(_t95);
										_push(_t90);
										_t96 = _t78;
										_t91 = _t96;
										asm("stosd");
										asm("stosd");
										asm("stosd");
										asm("stosd");
										_t55 = _v4;
										 *(_t96 + 0x10) =  *(_t96 + 0x10) & 0x00000000;
										 *(_t96 + 0x14) =  *(_t96 + 0x14) & 0x00000000;
										__eflags =  *((intOrPtr*)(_t55 + 0x14)) - 8;
										_t79 =  *((intOrPtr*)(_t55 + 0x10));
										if( *((intOrPtr*)(_t55 + 0x14)) >= 8) {
											_t55 =  *_t55;
										}
										_push(_t79);
										E0133657C(_t66, _t96, _t87, _t91, _t55);
										return _t96;
									} else {
										_t90 = _v16;
										_v16 = _t90;
										_v4 = 1;
										E01335C34(_t90);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t90 + 4))))();
										 *0x1384a5c = _t90;
										goto L12;
									}
								} else {
									_t90 = _t95;
									goto L12;
								}
							}
						} else {
							_t89 = _v16;
							_v16 = _t89;
							_v4 = 1;
							E01335C34(_t89);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t89 + 4))))();
							 *0x1384a28 = _t89;
							goto L5;
						}
					} else {
						_t89 = _t94;
						goto L5;
					}
				}
			}

0x0133815a
0x0133815a
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x0133818b
0x01338190
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198

APIs

__EH_prolog3.LIBCMT ref: 01338161
std::_Lockit::_Lockit.LIBCPMT ref: 0133816B

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 013381BC
std::_Lockit::~_Lockit.LIBCPMT ref: 013381DC

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 581d8a951b4f234072977b925dfaadcfc9bfd45432af737017ad270080e442d3
Instruction ID: 81b32e28c20127ac1f38dbd2bb52251bb15bc0580dce1c497a3df44edded3fe1
Opcode Fuzzy Hash: 581d8a951b4f234072977b925dfaadcfc9bfd45432af737017ad270080e442d3
Instruction Fuzzy Hash: 5A01C43590022A9BCF11FBACC4447BEB7A5AFD4328F254549E5116B290CF749A058B94

Uniqueness

Uniqueness Score: -1.00%

Function 013381EF Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E013381EF(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				intOrPtr* _v0;
				signed int _v4;
				void* _v16;
				char _v20;
				void* _t29;
				intOrPtr* _t32;
				void* _t45;
				intOrPtr _t46;
				void* _t51;
				intOrPtr* _t53;
				void* _t54;
				void* _t57;
				void* _t58;

				_t51 = __edx;
				_t39 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t57 =  *0x1384a5c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t57;
				_t53 = E0132BD50(_a8, E0132BCE0());
				if(_t53 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t53);
				} else {
					if(_t57 == 0) {
						_push(_a8);
						_push( &_v16);
						_t29 = E01339544(__ebx, _t53, _t57, __eflags);
						_pop(_t45);
						__eflags = _t29 - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(_t57);
							_push(_t53);
							_t58 = _t45;
							_t54 = _t58;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_t32 = _v0;
							 *(_t58 + 0x10) =  *(_t58 + 0x10) & 0x00000000;
							 *(_t58 + 0x14) =  *(_t58 + 0x14) & 0x00000000;
							__eflags =  *((intOrPtr*)(_t32 + 0x14)) - 8;
							_t46 =  *((intOrPtr*)(_t32 + 0x10));
							if( *((intOrPtr*)(_t32 + 0x14)) >= 8) {
								_t32 =  *_t32;
							}
							_push(_t46);
							E0133657C(_t39, _t58, _t51, _t54, _t32);
							return _t58;
						} else {
							_t53 = _v16;
							_v16 = _t53;
							_v4 = 1;
							E01335C34(_t53);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t53 + 4))))();
							 *0x1384a5c = _t53;
							goto L5;
						}
					} else {
						_t53 = _t57;
						goto L5;
					}
				}
			}

0x013381ef
0x013381ef
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d

APIs

__EH_prolog3.LIBCMT ref: 013381F6
std::_Lockit::_Lockit.LIBCPMT ref: 01338200

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01338251
std::_Lockit::~_Lockit.LIBCPMT ref: 01338271

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 299886f5c0d27ede0125f0003115bd7efaff037f72b3d662949d042b32f44b4e
Instruction ID: 28a8bce8cdfa1d5eed9098bca47e1c4c78d813a34f861846e4cc902f69286691
Opcode Fuzzy Hash: 299886f5c0d27ede0125f0003115bd7efaff037f72b3d662949d042b32f44b4e
Instruction Fuzzy Hash: 9D01D23590022ACBDF11FFECC4047AEBBB5BFD0718F254549E810AB284DF749A018B98

Uniqueness

Uniqueness Score: -1.00%

Function 013380C5 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E013380C5(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				intOrPtr* _v8;
				void* _v16;
				char _v20;
				intOrPtr* _t48;
				void* _t75;
				intOrPtr* _t78;
				void* _t111;
				intOrPtr _t112;
				void* _t123;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t128;
				void* _t131;
				intOrPtr* _t132;
				void* _t133;
				void* _t134;

				_t123 = __edx;
				_t93 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t131 =  *0x1384a58; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t131;
				_t48 = E0132BD50(_a8, E0132BCE0());
				_t125 = _t48;
				if(_t48 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t125);
				} else {
					if(_t131 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0133946C(__ebx, _t125, _t131, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t125, _t131);
							E01335EA5( &_v20, 0);
							_t132 =  *0x1384a28; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t132;
							_t126 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t126;
							if(_t126 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t126);
							} else {
								__eflags = _t132;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E013394D8(_t93, _t126, _t132, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t93, _t126, _t132);
										E01335EA5( &_v20, 0);
										_t133 =  *0x1384a5c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t133;
										_t127 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t127;
										if(_t127 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t127);
										} else {
											__eflags = _t133;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												_t75 = E01339544(_t93, _t127, _t133, __eflags);
												_pop(_t111);
												__eflags = _t75 - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(_t133);
													_push(_t127);
													_t134 = _t111;
													_t128 = _t134;
													asm("stosd");
													asm("stosd");
													asm("stosd");
													asm("stosd");
													_t78 = _v8;
													 *(_t134 + 0x10) =  *(_t134 + 0x10) & 0x00000000;
													 *(_t134 + 0x14) =  *(_t134 + 0x14) & 0x00000000;
													__eflags =  *((intOrPtr*)(_t78 + 0x14)) - 8;
													_t112 =  *((intOrPtr*)(_t78 + 0x10));
													if( *((intOrPtr*)(_t78 + 0x14)) >= 8) {
														_t78 =  *_t78;
													}
													_push(_t112);
													E0133657C(_t93, _t134, _t123, _t128, _t78);
													return _t134;
												} else {
													_t127 = _v16;
													_v16 = _t127;
													_v4 = 1;
													E01335C34(_t127);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t127 + 4))))();
													 *0x1384a5c = _t127;
													goto L19;
												}
											} else {
												_t127 = _t133;
												goto L19;
											}
										}
									} else {
										_t126 = _v16;
										_v16 = _t126;
										_v4 = 1;
										E01335C34(_t126);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t126 + 4))))();
										 *0x1384a28 = _t126;
										goto L12;
									}
								} else {
									_t126 = _t132;
									goto L12;
								}
							}
						} else {
							_t125 = _v16;
							_v16 = _t125;
							_v4 = 1;
							E01335C34(_t125);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t125 + 4))))();
							 *0x1384a58 = _t125;
							goto L5;
						}
					} else {
						_t125 = _t131;
						goto L5;
					}
				}
			}

0x013380c5
0x013380c5
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380f6
0x013380fb
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103

APIs

__EH_prolog3.LIBCMT ref: 013380CC
std::_Lockit::_Lockit.LIBCPMT ref: 013380D6

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01338127
std::_Lockit::~_Lockit.LIBCPMT ref: 01338147

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 8c56ef0fef6a9a6444f722d8e4946452b3d65a18f3eb242dbb838072ac267e1a
Instruction ID: a5551bf729675eeeabd0dfdbdc235b6fae98e84f1860a30e4d36a7d15d2e0083
Opcode Fuzzy Hash: 8c56ef0fef6a9a6444f722d8e4946452b3d65a18f3eb242dbb838072ac267e1a
Instruction Fuzzy Hash: AE01D67590021ADBCF01FBACC8447AEB7B5AFD0718F254549E5206B380DF349A05CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0133278E Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0133278E(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t32;
				void* _t48;
				void* _t49;
				intOrPtr* _t73;
				intOrPtr* _t74;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t86;
				void* _t91;

				_t61 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t91 - 0x14, 0);
				_t85 =  *0x1384880; // 0x0
				 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
				 *((intOrPtr*)(_t91 - 0x10)) = _t85;
				_t32 = E0132BD50( *((intOrPtr*)(_t91 + 8)), E0132BCE0());
				_t82 = _t32;
				if(_t32 != 0) {
					L5:
					E01335EFD(_t91 - 0x14);
					return E013481F0(_t82);
				} else {
					if(_t85 == 0) {
						_push( *((intOrPtr*)(_t91 + 8)));
						_push(_t91 - 0x10);
						__eflags = E01332E1B(__ebx, _t82, _t85, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t82, _t85);
							E01335EA5(_t91 - 0x14, 0);
							_t86 =  *0x1384884; // 0x0
							 *(_t91 - 4) =  *(_t91 - 4) & 0x00000000;
							 *((intOrPtr*)(_t91 - 0x10)) = _t86;
							_t83 = E0132BD50( *((intOrPtr*)(_t91 + 8)), E0132BCE0());
							__eflags = _t83;
							if(_t83 != 0) {
								L12:
								E01335EFD(_t91 - 0x14);
								return E013481F0(_t83);
							} else {
								__eflags = _t86;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t91 + 8)));
									_push(_t91 - 0x10);
									_t48 = E01332E83(_t61, _t83, _t86, __eflags);
									_pop(_t73);
									__eflags = _t48 - 0xffffffff;
									if(__eflags == 0) {
										_t49 = E0132C550(__eflags);
										asm("int3");
										_t74 =  *_t73;
										__eflags = _t74;
										if(_t74 != 0) {
											_push(_t86);
											_t87 = _t74;
											E0134C213( *((intOrPtr*)(_t74 + 8)));
											E0134C213( *((intOrPtr*)(_t74 + 0x10)));
											return E0134C213( *((intOrPtr*)(_t87 + 0x14)));
										} else {
											return _t49;
										}
									} else {
										_t83 =  *((intOrPtr*)(_t91 - 0x10));
										 *((intOrPtr*)(_t91 - 0x10)) = _t83;
										 *(_t91 - 4) = 1;
										E01335C34(_t83);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t83 + 4))))();
										 *0x1384884 = _t83;
										goto L12;
									}
								} else {
									_t83 = _t86;
									goto L12;
								}
							}
						} else {
							_t82 =  *((intOrPtr*)(_t91 - 0x10));
							 *((intOrPtr*)(_t91 - 0x10)) = _t82;
							 *(_t91 - 4) = 1;
							E01335C34(_t82);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t82 + 4))))();
							 *0x1384880 = _t82;
							goto L5;
						}
					} else {
						_t82 = _t85;
						goto L5;
					}
				}
			}

0x0133278e
0x0133278e
0x01332795
0x0133279f
0x013327a4
0x013327af
0x013327b3
0x013327bf
0x013327c4
0x013327c8
0x0133280d
0x01332810
0x0133281c
0x013327ca
0x013327cc
0x013327d2
0x013327d8
0x013327e0
0x013327e3
0x0133281d
0x01332822
0x01332823
0x0133282a
0x01332834
0x01332839
0x01332844
0x01332848
0x01332859
0x0133285b
0x0133285d
0x013328a2
0x013328a5
0x013328b1
0x0133285f
0x0133285f
0x01332861
0x01332867
0x0133286d
0x0133286e
0x01332874
0x01332875
0x01332878
0x013328b2
0x013328b7
0x013328b8
0x013328ba
0x013328bc
0x013348d0
0x013348d1
0x013348d6
0x013348de
0x013348ef
0x013328c2
0x013328c2
0x013328c2
0x0133287a
0x0133287a
0x0133287d
0x01332881
0x01332885
0x01332892
0x0133289a
0x0133289c
0x00000000
0x0133289c
0x01332863
0x01332863
0x00000000
0x01332863
0x01332861
0x013327e5
0x013327e5
0x013327e8
0x013327ec
0x013327f0
0x013327fd
0x01332805
0x01332807
0x00000000
0x01332807
0x013327ce
0x013327ce
0x00000000
0x013327ce
0x013327cc

APIs

__EH_prolog3.LIBCMT ref: 01332795
std::_Lockit::_Lockit.LIBCPMT ref: 0133279F

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 013327F0
std::_Lockit::~_Lockit.LIBCPMT ref: 01332810

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: a1513bd4f79f64ba4ce9e59dcd5b475b7cdba3c243cbb7f52e629f1e32f091c7
Instruction ID: 52a2a84bb6bc0ed333794266e571568c9414397aa8a7401235e9fa654d71c189
Opcode Fuzzy Hash: a1513bd4f79f64ba4ce9e59dcd5b475b7cdba3c243cbb7f52e629f1e32f091c7
Instruction Fuzzy Hash: 4801D23590022B9BCF15FBACD8047AEBBB9BFD032CF254509E410AB281DF349A01CB95

Uniqueness

Uniqueness Score: -1.00%

Function 013326F9 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E013326F9(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t44;
				void* _t71;
				void* _t72;
				intOrPtr* _t106;
				intOrPtr* _t107;
				intOrPtr* _t119;
				intOrPtr* _t120;
				intOrPtr* _t122;
				intOrPtr* _t123;
				intOrPtr* _t124;
				void* _t130;

				_t88 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t130 - 0x14, 0);
				_t122 =  *0x138487c; // 0x0
				 *(_t130 - 4) =  *(_t130 - 4) & 0x00000000;
				 *((intOrPtr*)(_t130 - 0x10)) = _t122;
				_t44 = E0132BD50( *((intOrPtr*)(_t130 + 8)), E0132BCE0());
				_t118 = _t44;
				if(_t44 != 0) {
					L5:
					E01335EFD(_t130 - 0x14);
					return E013481F0(_t118);
				} else {
					if(_t122 == 0) {
						_push( *((intOrPtr*)(_t130 + 8)));
						_push(_t130 - 0x10);
						__eflags = E01332DB3(__ebx, _t118, _t122, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t118, _t122);
							E01335EA5(_t130 - 0x14, 0);
							_t123 =  *0x1384880; // 0x0
							 *(_t130 - 4) =  *(_t130 - 4) & 0x00000000;
							 *((intOrPtr*)(_t130 - 0x10)) = _t123;
							_t119 = E0132BD50( *((intOrPtr*)(_t130 + 8)), E0132BCE0());
							__eflags = _t119;
							if(_t119 != 0) {
								L12:
								E01335EFD(_t130 - 0x14);
								return E013481F0(_t119);
							} else {
								__eflags = _t123;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t130 + 8)));
									_push(_t130 - 0x10);
									__eflags = E01332E1B(_t88, _t119, _t123, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t88, _t119, _t123);
										E01335EA5(_t130 - 0x14, 0);
										_t124 =  *0x1384884; // 0x0
										 *(_t130 - 4) =  *(_t130 - 4) & 0x00000000;
										 *((intOrPtr*)(_t130 - 0x10)) = _t124;
										_t120 = E0132BD50( *((intOrPtr*)(_t130 + 8)), E0132BCE0());
										__eflags = _t120;
										if(_t120 != 0) {
											L19:
											E01335EFD(_t130 - 0x14);
											return E013481F0(_t120);
										} else {
											__eflags = _t124;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t130 + 8)));
												_push(_t130 - 0x10);
												_t71 = E01332E83(_t88, _t120, _t124, __eflags);
												_pop(_t106);
												__eflags = _t71 - 0xffffffff;
												if(__eflags == 0) {
													_t72 = E0132C550(__eflags);
													asm("int3");
													_t107 =  *_t106;
													__eflags = _t107;
													if(_t107 != 0) {
														_push(_t124);
														_t125 = _t107;
														E0134C213( *((intOrPtr*)(_t107 + 8)));
														E0134C213( *((intOrPtr*)(_t107 + 0x10)));
														return E0134C213( *((intOrPtr*)(_t125 + 0x14)));
													} else {
														return _t72;
													}
												} else {
													_t120 =  *((intOrPtr*)(_t130 - 0x10));
													 *((intOrPtr*)(_t130 - 0x10)) = _t120;
													 *(_t130 - 4) = 1;
													E01335C34(_t120);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t120 + 4))))();
													 *0x1384884 = _t120;
													goto L19;
												}
											} else {
												_t120 = _t124;
												goto L19;
											}
										}
									} else {
										_t119 =  *((intOrPtr*)(_t130 - 0x10));
										 *((intOrPtr*)(_t130 - 0x10)) = _t119;
										 *(_t130 - 4) = 1;
										E01335C34(_t119);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t119 + 4))))();
										 *0x1384880 = _t119;
										goto L12;
									}
								} else {
									_t119 = _t123;
									goto L12;
								}
							}
						} else {
							_t118 =  *((intOrPtr*)(_t130 - 0x10));
							 *((intOrPtr*)(_t130 - 0x10)) = _t118;
							 *(_t130 - 4) = 1;
							E01335C34(_t118);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t118 + 4))))();
							 *0x138487c = _t118;
							goto L5;
						}
					} else {
						_t118 = _t122;
						goto L5;
					}
				}
			}

0x013326f9
0x013326f9
0x01332700
0x0133270a
0x0133270f
0x0133271a
0x0133271e
0x0133272a
0x0133272f
0x01332733
0x01332778
0x0133277b
0x01332787
0x01332735
0x01332737
0x0133273d
0x01332743
0x0133274b
0x0133274e
0x01332788
0x0133278d
0x0133278e
0x01332795
0x0133279f
0x013327a4
0x013327af
0x013327b3
0x013327c4
0x013327c6
0x013327c8
0x0133280d
0x01332810
0x0133281c
0x013327ca
0x013327ca
0x013327cc
0x013327d2
0x013327d8
0x013327e0
0x013327e3
0x0133281d
0x01332822
0x01332823
0x0133282a
0x01332834
0x01332839
0x01332844
0x01332848
0x01332859
0x0133285b
0x0133285d
0x013328a2
0x013328a5
0x013328b1
0x0133285f
0x0133285f
0x01332861
0x01332867
0x0133286d
0x0133286e
0x01332874
0x01332875
0x01332878
0x013328b2
0x013328b7
0x013328b8
0x013328ba
0x013328bc
0x013348d0
0x013348d1
0x013348d6
0x013348de
0x013348ef
0x013328c2
0x013328c2
0x013328c2
0x0133287a
0x0133287a
0x0133287d
0x01332881
0x01332885
0x01332892
0x0133289a
0x0133289c
0x00000000
0x0133289c
0x01332863
0x01332863
0x00000000
0x01332863
0x01332861
0x013327e5
0x013327e5
0x013327e8
0x013327ec
0x013327f0
0x013327fd
0x01332805
0x01332807
0x00000000
0x01332807
0x013327ce
0x013327ce
0x00000000
0x013327ce
0x013327cc
0x01332750
0x01332750
0x01332753
0x01332757
0x0133275b
0x01332768
0x01332770
0x01332772
0x00000000
0x01332772
0x01332739
0x01332739
0x00000000
0x01332739
0x01332737

APIs

__EH_prolog3.LIBCMT ref: 01332700
std::_Lockit::_Lockit.LIBCPMT ref: 0133270A

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 0133275B
std::_Lockit::~_Lockit.LIBCPMT ref: 0133277B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: e0e1911cea29772d6c292ee25f258ee04b2aa82971daf8bf686b79fd38158fc0
Instruction ID: 6dfba1ddc70c78e25346c9134d59fa4cf52b4b00cd26f49f134fc3f9b6681fc8
Opcode Fuzzy Hash: e0e1911cea29772d6c292ee25f258ee04b2aa82971daf8bf686b79fd38158fc0
Instruction Fuzzy Hash: DB01C03590022A9BCB01FBACD4446BEBBA5BFD4318F244109E920AB281CF349A01CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 013439EB Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E013439EB(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t83;
				void* _t143;
				signed int _t211;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				void* _t251;

				_t175 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t251 - 0x14, 0);
				_t238 =  *0x1384a8c; // 0x0
				 *(_t251 - 4) =  *(_t251 - 4) & 0x00000000;
				 *(_t251 - 0x10) = _t238;
				_t83 = E0132BD50( *((intOrPtr*)(_t251 + 8)), E0132BCE0());
				_t231 = _t83;
				if(_t83 != 0) {
					L5:
					E01335EFD(_t251 - 0x14);
					return E013481F0(_t231);
				} else {
					if(_t238 == 0) {
						_push( *((intOrPtr*)(_t251 + 8)));
						_push(_t251 - 0x10);
						__eflags = E01343F7A(__ebx, _t231, _t238, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t231, _t238);
							E01335EA5(_t251 - 0x14, 0);
							_t239 =  *0x1384a90; // 0x0
							 *(_t251 - 4) =  *(_t251 - 4) & 0x00000000;
							 *(_t251 - 0x10) = _t239;
							_t232 = E0132BD50( *((intOrPtr*)(_t251 + 8)), E0132BCE0());
							__eflags = _t232;
							if(_t232 != 0) {
								L12:
								E01335EFD(_t251 - 0x14);
								return E013481F0(_t232);
							} else {
								__eflags = _t239;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t251 + 8)));
									_push(_t251 - 0x10);
									__eflags = E01343FE2(_t175, _t232, _t239, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t175, _t232, _t239);
										E01335EA5(_t251 - 0x14, 0);
										_t240 =  *0x1384a98; // 0x0
										 *(_t251 - 4) =  *(_t251 - 4) & 0x00000000;
										 *(_t251 - 0x10) = _t240;
										_t233 = E0132BD50( *((intOrPtr*)(_t251 + 8)), E0132BCE0());
										__eflags = _t233;
										if(_t233 != 0) {
											L19:
											E01335EFD(_t251 - 0x14);
											return E013481F0(_t233);
										} else {
											__eflags = _t240;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t251 + 8)));
												_push(_t251 - 0x10);
												__eflags = E0134404A(_t175, _t233, _t240, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t175, _t233, _t240);
													E01335EA5(_t251 - 0x14, 0);
													_t241 =  *0x1384a94; // 0x0
													 *(_t251 - 4) =  *(_t251 - 4) & 0x00000000;
													 *(_t251 - 0x10) = _t241;
													_t234 = E0132BD50( *((intOrPtr*)(_t251 + 8)), E0132BCE0());
													__eflags = _t234;
													if(_t234 != 0) {
														L26:
														E01335EFD(_t251 - 0x14);
														return E013481F0(_t234);
													} else {
														__eflags = _t241;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t251 + 8)));
															_push(_t251 - 0x10);
															__eflags = E013440CE(_t175, _t234, _t241, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t175, _t234, _t241);
																E01335EA5(_t251 - 0x14, 0);
																_t242 =  *0x1384a9c; // 0x0
																 *(_t251 - 4) =  *(_t251 - 4) & 0x00000000;
																 *(_t251 - 0x10) = _t242;
																_t235 = E0132BD50( *((intOrPtr*)(_t251 + 8)), E0132BCE0());
																__eflags = _t235;
																if(_t235 != 0) {
																	L33:
																	E01335EFD(_t251 - 0x14);
																	return E013481F0(_t235);
																} else {
																	__eflags = _t242;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t251 + 8)));
																		_push(_t251 - 0x10);
																		__eflags = E01344153(_t175, _t235, _t242, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t175, _t235, _t242);
																			E01335EA5(_t251 - 0x14, 0);
																			_t243 =  *0x1384aa0; // 0x0
																			 *(_t251 - 4) =  *(_t251 - 4) & 0x00000000;
																			 *(_t251 - 0x10) = _t243;
																			_t236 = E0132BD50( *((intOrPtr*)(_t251 + 8)), E0132BCE0());
																			__eflags = _t236;
																			if(_t236 != 0) {
																				L40:
																				E01335EFD(_t251 - 0x14);
																				return E013481F0(_t236);
																			} else {
																				__eflags = _t243;
																				if(__eflags == 0) {
																					_push( *((intOrPtr*)(_t251 + 8)));
																					_push(_t251 - 0x10);
																					_t143 = E013441BF(_t175, _t236, _t243, __eflags);
																					_pop(_t211);
																					__eflags = _t143 - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(4);
																						E01348213(0x136bdf5, _t175, _t236, _t243);
																						_t244 = _t211;
																						 *(_t251 - 0x10) = _t244;
																						 *((intOrPtr*)(_t244 + 4)) =  *((intOrPtr*)(_t251 + 0xc));
																						_push( *((intOrPtr*)(_t251 + 8)));
																						_t77 = _t251 - 4;
																						 *_t77 =  *(_t251 - 4) & 0x00000000;
																						__eflags =  *_t77;
																						 *_t244 = 0x136ecc0;
																						E01344EBF(_t175, _t211, _t236, _t244,  *_t77);
																						return E013481F0(_t244);
																					} else {
																						_t236 =  *(_t251 - 0x10);
																						 *(_t251 - 0x10) = _t236;
																						 *(_t251 - 4) = 1;
																						E01335C34(_t236);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t236 + 4))))();
																						 *0x1384aa0 = _t236;
																						goto L40;
																					}
																				} else {
																					_t236 = _t243;
																					goto L40;
																				}
																			}
																		} else {
																			_t235 =  *(_t251 - 0x10);
																			 *(_t251 - 0x10) = _t235;
																			 *(_t251 - 4) = 1;
																			E01335C34(_t235);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t235 + 4))))();
																			 *0x1384a9c = _t235;
																			goto L33;
																		}
																	} else {
																		_t235 = _t242;
																		goto L33;
																	}
																}
															} else {
																_t234 =  *(_t251 - 0x10);
																 *(_t251 - 0x10) = _t234;
																 *(_t251 - 4) = 1;
																E01335C34(_t234);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t234 + 4))))();
																 *0x1384a94 = _t234;
																goto L26;
															}
														} else {
															_t234 = _t241;
															goto L26;
														}
													}
												} else {
													_t233 =  *(_t251 - 0x10);
													 *(_t251 - 0x10) = _t233;
													 *(_t251 - 4) = 1;
													E01335C34(_t233);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t233 + 4))))();
													 *0x1384a98 = _t233;
													goto L19;
												}
											} else {
												_t233 = _t240;
												goto L19;
											}
										}
									} else {
										_t232 =  *(_t251 - 0x10);
										 *(_t251 - 0x10) = _t232;
										 *(_t251 - 4) = 1;
										E01335C34(_t232);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t232 + 4))))();
										 *0x1384a90 = _t232;
										goto L12;
									}
								} else {
									_t232 = _t239;
									goto L12;
								}
							}
						} else {
							_t231 =  *(_t251 - 0x10);
							 *(_t251 - 0x10) = _t231;
							 *(_t251 - 4) = 1;
							E01335C34(_t231);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t231 + 4))))();
							 *0x1384a8c = _t231;
							goto L5;
						}
					} else {
						_t231 = _t238;
						goto L5;
					}
				}
			}

0x013439eb
0x013439eb
0x013439f2
0x013439fc
0x01343a01
0x01343a0c
0x01343a10
0x01343a1c
0x01343a21
0x01343a25
0x01343a6a
0x01343a6d
0x01343a79
0x01343a27
0x01343a29
0x01343a2f
0x01343a35
0x01343a3d
0x01343a40
0x01343a7a
0x01343a7f
0x01343a80
0x01343a87
0x01343a91
0x01343a96
0x01343aa1
0x01343aa5
0x01343ab6
0x01343ab8
0x01343aba
0x01343aff
0x01343b02
0x01343b0e
0x01343abc
0x01343abc
0x01343abe
0x01343ac4
0x01343aca
0x01343ad2
0x01343ad5
0x01343b0f
0x01343b14
0x01343b15
0x01343b1c
0x01343b26
0x01343b2b
0x01343b36
0x01343b3a
0x01343b4b
0x01343b4d
0x01343b4f
0x01343b94
0x01343b97
0x01343ba3
0x01343b51
0x01343b51
0x01343b53
0x01343b59
0x01343b5f
0x01343b67
0x01343b6a
0x01343ba4
0x01343ba9
0x01343baa
0x01343bb1
0x01343bbb
0x01343bc0
0x01343bcb
0x01343bcf
0x01343be0
0x01343be2
0x01343be4
0x01343c29
0x01343c2c
0x01343c38
0x01343be6
0x01343be6
0x01343be8
0x01343bee
0x01343bf4
0x01343bfc
0x01343bff
0x01343c39
0x01343c3e
0x01343c3f
0x01343c46
0x01343c50
0x01343c55
0x01343c60
0x01343c64
0x01343c75
0x01343c77
0x01343c79
0x01343cbe
0x01343cc1
0x01343ccd
0x01343c7b
0x01343c7b
0x01343c7d
0x01343c83
0x01343c89
0x01343c91
0x01343c94
0x01343cce
0x01343cd3
0x01343cd4
0x01343cdb
0x01343ce5
0x01343cea
0x01343cf5
0x01343cf9
0x01343d0a
0x01343d0c
0x01343d0e
0x01343d53
0x01343d56
0x01343d62
0x01343d10
0x01343d10
0x01343d12
0x01343d18
0x01343d1e
0x01343d1f
0x01343d25
0x01343d26
0x01343d29
0x01343d63
0x01343d68
0x01343d69
0x01343d70
0x01343d75
0x01343d77
0x01343d7d
0x01343d80
0x01343d83
0x01343d83
0x01343d83
0x01343d87
0x01343d8d
0x01343d99
0x01343d2b
0x01343d2b
0x01343d2e
0x01343d32
0x01343d36
0x01343d43
0x01343d4b
0x01343d4d
0x00000000
0x01343d4d
0x01343d14
0x01343d14
0x00000000
0x01343d14
0x01343d12
0x01343c96
0x01343c96
0x01343c99
0x01343c9d
0x01343ca1
0x01343cae
0x01343cb6
0x01343cb8
0x00000000
0x01343cb8
0x01343c7f
0x01343c7f
0x00000000
0x01343c7f
0x01343c7d
0x01343c01
0x01343c01
0x01343c04
0x01343c08
0x01343c0c
0x01343c19
0x01343c21
0x01343c23
0x00000000
0x01343c23
0x01343bea
0x01343bea
0x00000000
0x01343bea
0x01343be8
0x01343b6c
0x01343b6c
0x01343b6f
0x01343b73
0x01343b77
0x01343b84
0x01343b8c
0x01343b8e
0x00000000
0x01343b8e
0x01343b55
0x01343b55
0x00000000
0x01343b55
0x01343b53
0x01343ad7
0x01343ad7
0x01343ada
0x01343ade
0x01343ae2
0x01343aef
0x01343af7
0x01343af9
0x00000000
0x01343af9
0x01343ac0
0x01343ac0
0x00000000
0x01343ac0
0x01343abe
0x01343a42
0x01343a42
0x01343a45
0x01343a49
0x01343a4d
0x01343a5a
0x01343a62
0x01343a64
0x00000000
0x01343a64
0x01343a2b
0x01343a2b
0x00000000
0x01343a2b
0x01343a29

APIs

__EH_prolog3.LIBCMT ref: 013439F2
std::_Lockit::_Lockit.LIBCPMT ref: 013439FC

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01343A4D
std::_Lockit::~_Lockit.LIBCPMT ref: 01343A6D

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 341f3ac9ef3437db2db7ab68d9a1b42ebc0097120bb56c1d0e851a0da9a47ecc
Instruction ID: bd0ae1077e60b226b2353f6f32bd66e300fc8fef272ba1f9cf7e6171e36b1f04
Opcode Fuzzy Hash: 341f3ac9ef3437db2db7ab68d9a1b42ebc0097120bb56c1d0e851a0da9a47ecc
Instruction Fuzzy Hash: 9D01D63594022B9BDF11FBACC8447ADBBB5BF90328F154009D4106B390DF34EE058B90

Uniqueness

Uniqueness Score: -1.00%

Function 013379C9 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E013379C9(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v56;
				intOrPtr* _t192;
				void* _t351;
				intOrPtr* _t354;
				void* _t507;
				intOrPtr _t508;
				intOrPtr* _t558;
				intOrPtr* _t559;
				intOrPtr* _t560;
				intOrPtr* _t561;
				intOrPtr* _t562;
				intOrPtr* _t563;
				intOrPtr* _t564;
				intOrPtr* _t565;
				intOrPtr* _t566;
				intOrPtr* _t567;
				intOrPtr* _t568;
				intOrPtr* _t569;
				intOrPtr* _t570;
				intOrPtr* _t571;
				void* _t572;
				void* _t575;
				intOrPtr* _t576;
				intOrPtr* _t577;
				intOrPtr* _t578;
				intOrPtr* _t579;
				intOrPtr* _t580;
				intOrPtr* _t581;
				intOrPtr* _t582;
				intOrPtr* _t583;
				intOrPtr* _t584;
				intOrPtr* _t585;
				intOrPtr* _t586;
				intOrPtr* _t587;
				intOrPtr* _t588;
				void* _t589;
				void* _t590;

				_t555 = __edx;
				_t417 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t575 =  *0x1384a48; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t575;
				_t192 = E0132BD50(_a8, E0132BCE0());
				_t557 = _t192;
				if(_t192 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t557);
				} else {
					if(_t575 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338F07(__ebx, _t557, _t575, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t557, _t575);
							E01335EA5( &_v20, 0);
							_t576 =  *0x1384a18; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t576;
							_t558 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t558;
							if(_t558 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t558);
							} else {
								__eflags = _t576;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338F6F(_t417, _t558, _t576, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t417, _t558, _t576);
										E01335EA5( &_v20, 0);
										_t577 =  *0x1384a4c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t577;
										_t559 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t559;
										if(_t559 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t559);
										} else {
											__eflags = _t577;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01338FD7(_t417, _t559, _t577, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t417, _t559, _t577);
													E01335EA5( &_v20, 0);
													_t578 =  *0x1384a1c; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t578;
													_t560 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t560;
													if(_t560 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t560);
													} else {
														__eflags = _t578;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0133903F(_t417, _t560, _t578, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t417, _t560, _t578);
																E01335EA5( &_v20, 0);
																_t579 =  *0x1384a54; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t579;
																_t561 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t561;
																if(_t561 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t561);
																} else {
																	__eflags = _t579;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E013390A7(_t417, _t561, _t579, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t417, _t561, _t579);
																			E01335EA5( &_v20, 0);
																			_t580 =  *0x1384a50; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t580;
																			_t562 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t562;
																			if(_t562 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t562);
																			} else {
																				__eflags = _t580;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E0133912B(_t417, _t562, _t580, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t417, _t562, _t580);
																						E01335EA5( &_v20, 0);
																						_t581 =  *0x1384a24; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t581;
																						_t563 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t563;
																						if(_t563 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t563);
																						} else {
																							__eflags = _t581;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E013391B0(_t417, _t563, _t581, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t417, _t563, _t581);
																									E01335EA5( &_v20, 0);
																									_t582 =  *0x1384a20; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t582;
																									_t564 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t564;
																									if(_t564 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t564);
																									} else {
																										__eflags = _t582;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E01339234(_t417, _t564, _t582, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t417, _t564, _t582);
																												E01335EA5( &_v20, 0);
																												_t583 =  *0x1384a34; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t583;
																												_t565 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t565;
																												if(_t565 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t565);
																												} else {
																													__eflags = _t583;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E013392B9(_t417, _t565, _t583, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t417, _t565, _t583);
																															E01335EA5( &_v20, 0);
																															_t584 =  *0x1384a0c; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t584;
																															_t566 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t566;
																															if(_t566 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t566);
																															} else {
																																__eflags = _t584;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E01339321(_t417, _t566, _t584, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t417, _t566, _t584);
																																		E01335EA5( &_v20, 0);
																																		_t585 =  *0x1384a38; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t585;
																																		_t567 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t567;
																																		if(_t567 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t567);
																																		} else {
																																			__eflags = _t585;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E01339389(_t417, _t567, _t585, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t417, _t567, _t585);
																																					E01335EA5( &_v20, 0);
																																					_t586 =  *0x1384a3c; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t586;
																																					_t568 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t568;
																																					if(_t568 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t568);
																																					} else {
																																						__eflags = _t586;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E013393F1(_t417, __edx, _t568, _t586, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t417, _t568, _t586);
																																								E01335EA5( &_v20, 0);
																																								_t587 =  *0x1384a58; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t587;
																																								_t569 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t569;
																																								if(_t569 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t569);
																																								} else {
																																									__eflags = _t587;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E0133946C(_t417, _t569, _t587, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t417, _t569, _t587);
																																											E01335EA5( &_v20, 0);
																																											_t588 =  *0x1384a28; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t588;
																																											_t570 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t570;
																																											if(_t570 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t570);
																																											} else {
																																												__eflags = _t588;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													__eflags = E013394D8(_t417, _t570, _t588, __eflags) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(8);
																																														E01348213(0x136b979, _t417, _t570, _t588);
																																														E01335EA5( &_v20, 0);
																																														_t589 =  *0x1384a5c; // 0x0
																																														_v4 = _v4 & 0x00000000;
																																														_v16 = _t589;
																																														_t571 = E0132BD50(_a8, E0132BCE0());
																																														__eflags = _t571;
																																														if(_t571 != 0) {
																																															L103:
																																															E01335EFD( &_v20);
																																															return E013481F0(_t571);
																																														} else {
																																															__eflags = _t589;
																																															if(__eflags == 0) {
																																																_push(_a8);
																																																_push( &_v16);
																																																_t351 = E01339544(_t417, _t571, _t589, __eflags);
																																																_pop(_t507);
																																																__eflags = _t351 - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E0132C550(__eflags);
																																																	asm("int3");
																																																	_push(_t589);
																																																	_push(_t571);
																																																	_t590 = _t507;
																																																	_t572 = _t590;
																																																	asm("stosd");
																																																	asm("stosd");
																																																	asm("stosd");
																																																	asm("stosd");
																																																	_t354 = _v56;
																																																	 *(_t590 + 0x10) =  *(_t590 + 0x10) & 0x00000000;
																																																	 *(_t590 + 0x14) =  *(_t590 + 0x14) & 0x00000000;
																																																	__eflags =  *((intOrPtr*)(_t354 + 0x14)) - 8;
																																																	_t508 =  *((intOrPtr*)(_t354 + 0x10));
																																																	if( *((intOrPtr*)(_t354 + 0x14)) >= 8) {
																																																		_t354 =  *_t354;
																																																	}
																																																	_push(_t508);
																																																	E0133657C(_t417, _t590, _t555, _t572, _t354);
																																																	return _t590;
																																																} else {
																																																	_t571 = _v16;
																																																	_v16 = _t571;
																																																	_v4 = 1;
																																																	E01335C34(_t571);
																																																	 *0x136d26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t571 + 4))))();
																																																	 *0x1384a5c = _t571;
																																																	goto L103;
																																																}
																																															} else {
																																																_t571 = _t589;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t570 = _v16;
																																														_v16 = _t570;
																																														_v4 = 1;
																																														E01335C34(_t570);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t570 + 4))))();
																																														 *0x1384a28 = _t570;
																																														goto L96;
																																													}
																																												} else {
																																													_t570 = _t588;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t569 = _v16;
																																											_v16 = _t569;
																																											_v4 = 1;
																																											E01335C34(_t569);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t569 + 4))))();
																																											 *0x1384a58 = _t569;
																																											goto L89;
																																										}
																																									} else {
																																										_t569 = _t587;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t568 = _v16;
																																								_v16 = _t568;
																																								_v4 = 1;
																																								E01335C34(_t568);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t568 + 4))))();
																																								 *0x1384a3c = _t568;
																																								goto L82;
																																							}
																																						} else {
																																							_t568 = _t586;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t567 = _v16;
																																					_v16 = _t567;
																																					_v4 = 1;
																																					E01335C34(_t567);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t567 + 4))))();
																																					 *0x1384a38 = _t567;
																																					goto L75;
																																				}
																																			} else {
																																				_t567 = _t585;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t566 = _v16;
																																		_v16 = _t566;
																																		_v4 = 1;
																																		E01335C34(_t566);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t566 + 4))))();
																																		 *0x1384a0c = _t566;
																																		goto L68;
																																	}
																																} else {
																																	_t566 = _t584;
																																	goto L68;
																																}
																															}
																														} else {
																															_t565 = _v16;
																															_v16 = _t565;
																															_v4 = 1;
																															E01335C34(_t565);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t565 + 4))))();
																															 *0x1384a34 = _t565;
																															goto L61;
																														}
																													} else {
																														_t565 = _t583;
																														goto L61;
																													}
																												}
																											} else {
																												_t564 = _v16;
																												_v16 = _t564;
																												_v4 = 1;
																												E01335C34(_t564);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t564 + 4))))();
																												 *0x1384a20 = _t564;
																												goto L54;
																											}
																										} else {
																											_t564 = _t582;
																											goto L54;
																										}
																									}
																								} else {
																									_t563 = _v16;
																									_v16 = _t563;
																									_v4 = 1;
																									E01335C34(_t563);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t563 + 4))))();
																									 *0x1384a24 = _t563;
																									goto L47;
																								}
																							} else {
																								_t563 = _t581;
																								goto L47;
																							}
																						}
																					} else {
																						_t562 = _v16;
																						_v16 = _t562;
																						_v4 = 1;
																						E01335C34(_t562);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t562 + 4))))();
																						 *0x1384a50 = _t562;
																						goto L40;
																					}
																				} else {
																					_t562 = _t580;
																					goto L40;
																				}
																			}
																		} else {
																			_t561 = _v16;
																			_v16 = _t561;
																			_v4 = 1;
																			E01335C34(_t561);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t561 + 4))))();
																			 *0x1384a54 = _t561;
																			goto L33;
																		}
																	} else {
																		_t561 = _t579;
																		goto L33;
																	}
																}
															} else {
																_t560 = _v16;
																_v16 = _t560;
																_v4 = 1;
																E01335C34(_t560);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t560 + 4))))();
																 *0x1384a1c = _t560;
																goto L26;
															}
														} else {
															_t560 = _t578;
															goto L26;
														}
													}
												} else {
													_t559 = _v16;
													_v16 = _t559;
													_v4 = 1;
													E01335C34(_t559);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t559 + 4))))();
													 *0x1384a4c = _t559;
													goto L19;
												}
											} else {
												_t559 = _t577;
												goto L19;
											}
										}
									} else {
										_t558 = _v16;
										_v16 = _t558;
										_v4 = 1;
										E01335C34(_t558);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t558 + 4))))();
										 *0x1384a18 = _t558;
										goto L12;
									}
								} else {
									_t558 = _t576;
									goto L12;
								}
							}
						} else {
							_t557 = _v16;
							_v16 = _t557;
							_v4 = 1;
							E01335C34(_t557);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t557 + 4))))();
							 *0x1384a48 = _t557;
							goto L5;
						}
					} else {
						_t557 = _t575;
						goto L5;
					}
				}
			}

0x013379c9
0x013379c9
0x013379c9
0x013379d0
0x013379da
0x013379df
0x013379ea
0x013379ee
0x013379fa
0x013379ff
0x01337a03
0x01337a48
0x01337a4b
0x01337a57
0x01337a05
0x01337a07
0x01337a0d
0x01337a13
0x01337a1b
0x01337a1e
0x01337a58
0x01337a5d
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a94
0x01337a96
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c
0x01337a20
0x01337a20
0x01337a23
0x01337a27
0x01337a2b
0x01337a38
0x01337a40
0x01337a42
0x00000000
0x01337a42
0x01337a09
0x01337a09
0x00000000
0x01337a09
0x01337a07

APIs

__EH_prolog3.LIBCMT ref: 013379D0
std::_Lockit::_Lockit.LIBCPMT ref: 013379DA

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01337A2B
std::_Lockit::~_Lockit.LIBCPMT ref: 01337A4B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 1f9f11c17ecd3839a645e82a989b68ca868853fab35d413effa9e25acb0409f6
Instruction ID: e400d2ee66d2e56bcbf36df325dd57de470566807aee308b14ca6596803f820b
Opcode Fuzzy Hash: 1f9f11c17ecd3839a645e82a989b68ca868853fab35d413effa9e25acb0409f6
Instruction Fuzzy Hash: 7601D27590022A9BDF11FBACD4447AEBBB5AFE0328F254509D520AB380CF349A018B94

Uniqueness

Uniqueness Score: -1.00%

Function 01337B88 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E01337B88(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v44;
				intOrPtr* _t156;
				void* _t282;
				intOrPtr* _t285;
				void* _t408;
				intOrPtr _t409;
				intOrPtr* _t450;
				intOrPtr* _t451;
				intOrPtr* _t452;
				intOrPtr* _t453;
				intOrPtr* _t454;
				intOrPtr* _t455;
				intOrPtr* _t456;
				intOrPtr* _t457;
				intOrPtr* _t458;
				intOrPtr* _t459;
				intOrPtr* _t460;
				void* _t461;
				void* _t464;
				intOrPtr* _t465;
				intOrPtr* _t466;
				intOrPtr* _t467;
				intOrPtr* _t468;
				intOrPtr* _t469;
				intOrPtr* _t470;
				intOrPtr* _t471;
				intOrPtr* _t472;
				intOrPtr* _t473;
				intOrPtr* _t474;
				void* _t475;
				void* _t476;

				_t447 = __edx;
				_t336 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t464 =  *0x1384a1c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t464;
				_t156 = E0132BD50(_a8, E0132BCE0());
				_t449 = _t156;
				if(_t156 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t449);
				} else {
					if(_t464 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E0133903F(__ebx, _t449, _t464, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t449, _t464);
							E01335EA5( &_v20, 0);
							_t465 =  *0x1384a54; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t465;
							_t450 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t450;
							if(_t450 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t450);
							} else {
								__eflags = _t465;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E013390A7(_t336, _t450, _t465, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t336, _t450, _t465);
										E01335EA5( &_v20, 0);
										_t466 =  *0x1384a50; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t466;
										_t451 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t451;
										if(_t451 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t451);
										} else {
											__eflags = _t466;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0133912B(_t336, _t451, _t466, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t336, _t451, _t466);
													E01335EA5( &_v20, 0);
													_t467 =  *0x1384a24; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t467;
													_t452 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t452;
													if(_t452 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t452);
													} else {
														__eflags = _t467;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E013391B0(_t336, _t452, _t467, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t336, _t452, _t467);
																E01335EA5( &_v20, 0);
																_t468 =  *0x1384a20; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t468;
																_t453 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t453;
																if(_t453 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t453);
																} else {
																	__eflags = _t468;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E01339234(_t336, _t453, _t468, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t336, _t453, _t468);
																			E01335EA5( &_v20, 0);
																			_t469 =  *0x1384a34; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t469;
																			_t454 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t454;
																			if(_t454 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t454);
																			} else {
																				__eflags = _t469;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E013392B9(_t336, _t454, _t469, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t336, _t454, _t469);
																						E01335EA5( &_v20, 0);
																						_t470 =  *0x1384a0c; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t470;
																						_t455 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t455;
																						if(_t455 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t455);
																						} else {
																							__eflags = _t470;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E01339321(_t336, _t455, _t470, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t336, _t455, _t470);
																									E01335EA5( &_v20, 0);
																									_t471 =  *0x1384a38; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t471;
																									_t456 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t456;
																									if(_t456 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t456);
																									} else {
																										__eflags = _t471;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E01339389(_t336, _t456, _t471, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t336, _t456, _t471);
																												E01335EA5( &_v20, 0);
																												_t472 =  *0x1384a3c; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t472;
																												_t457 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t457;
																												if(_t457 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t457);
																												} else {
																													__eflags = _t472;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E013393F1(_t336, __edx, _t457, _t472, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t336, _t457, _t472);
																															E01335EA5( &_v20, 0);
																															_t473 =  *0x1384a58; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t473;
																															_t458 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t458;
																															if(_t458 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t458);
																															} else {
																																__eflags = _t473;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E0133946C(_t336, _t458, _t473, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t336, _t458, _t473);
																																		E01335EA5( &_v20, 0);
																																		_t474 =  *0x1384a28; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t474;
																																		_t459 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t459;
																																		if(_t459 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t459);
																																		} else {
																																			__eflags = _t474;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E013394D8(_t336, _t459, _t474, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t336, _t459, _t474);
																																					E01335EA5( &_v20, 0);
																																					_t475 =  *0x1384a5c; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t475;
																																					_t460 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t460;
																																					if(_t460 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t460);
																																					} else {
																																						__eflags = _t475;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							_t282 = E01339544(_t336, _t460, _t475, __eflags);
																																							_pop(_t408);
																																							__eflags = _t282 - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(_t475);
																																								_push(_t460);
																																								_t476 = _t408;
																																								_t461 = _t476;
																																								asm("stosd");
																																								asm("stosd");
																																								asm("stosd");
																																								asm("stosd");
																																								_t285 = _v44;
																																								 *(_t476 + 0x10) =  *(_t476 + 0x10) & 0x00000000;
																																								 *(_t476 + 0x14) =  *(_t476 + 0x14) & 0x00000000;
																																								__eflags =  *((intOrPtr*)(_t285 + 0x14)) - 8;
																																								_t409 =  *((intOrPtr*)(_t285 + 0x10));
																																								if( *((intOrPtr*)(_t285 + 0x14)) >= 8) {
																																									_t285 =  *_t285;
																																								}
																																								_push(_t409);
																																								E0133657C(_t336, _t476, _t447, _t461, _t285);
																																								return _t476;
																																							} else {
																																								_t460 = _v16;
																																								_v16 = _t460;
																																								_v4 = 1;
																																								E01335C34(_t460);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t460 + 4))))();
																																								 *0x1384a5c = _t460;
																																								goto L82;
																																							}
																																						} else {
																																							_t460 = _t475;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t459 = _v16;
																																					_v16 = _t459;
																																					_v4 = 1;
																																					E01335C34(_t459);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t459 + 4))))();
																																					 *0x1384a28 = _t459;
																																					goto L75;
																																				}
																																			} else {
																																				_t459 = _t474;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t458 = _v16;
																																		_v16 = _t458;
																																		_v4 = 1;
																																		E01335C34(_t458);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t458 + 4))))();
																																		 *0x1384a58 = _t458;
																																		goto L68;
																																	}
																																} else {
																																	_t458 = _t473;
																																	goto L68;
																																}
																															}
																														} else {
																															_t457 = _v16;
																															_v16 = _t457;
																															_v4 = 1;
																															E01335C34(_t457);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t457 + 4))))();
																															 *0x1384a3c = _t457;
																															goto L61;
																														}
																													} else {
																														_t457 = _t472;
																														goto L61;
																													}
																												}
																											} else {
																												_t456 = _v16;
																												_v16 = _t456;
																												_v4 = 1;
																												E01335C34(_t456);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t456 + 4))))();
																												 *0x1384a38 = _t456;
																												goto L54;
																											}
																										} else {
																											_t456 = _t471;
																											goto L54;
																										}
																									}
																								} else {
																									_t455 = _v16;
																									_v16 = _t455;
																									_v4 = 1;
																									E01335C34(_t455);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t455 + 4))))();
																									 *0x1384a0c = _t455;
																									goto L47;
																								}
																							} else {
																								_t455 = _t470;
																								goto L47;
																							}
																						}
																					} else {
																						_t454 = _v16;
																						_v16 = _t454;
																						_v4 = 1;
																						E01335C34(_t454);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t454 + 4))))();
																						 *0x1384a34 = _t454;
																						goto L40;
																					}
																				} else {
																					_t454 = _t469;
																					goto L40;
																				}
																			}
																		} else {
																			_t453 = _v16;
																			_v16 = _t453;
																			_v4 = 1;
																			E01335C34(_t453);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t453 + 4))))();
																			 *0x1384a20 = _t453;
																			goto L33;
																		}
																	} else {
																		_t453 = _t468;
																		goto L33;
																	}
																}
															} else {
																_t452 = _v16;
																_v16 = _t452;
																_v4 = 1;
																E01335C34(_t452);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t452 + 4))))();
																 *0x1384a24 = _t452;
																goto L26;
															}
														} else {
															_t452 = _t467;
															goto L26;
														}
													}
												} else {
													_t451 = _v16;
													_v16 = _t451;
													_v4 = 1;
													E01335C34(_t451);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t451 + 4))))();
													 *0x1384a50 = _t451;
													goto L19;
												}
											} else {
												_t451 = _t466;
												goto L19;
											}
										}
									} else {
										_t450 = _v16;
										_v16 = _t450;
										_v4 = 1;
										E01335C34(_t450);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t450 + 4))))();
										 *0x1384a54 = _t450;
										goto L12;
									}
								} else {
									_t450 = _t465;
									goto L12;
								}
							}
						} else {
							_t449 = _v16;
							_v16 = _t449;
							_v4 = 1;
							E01335C34(_t449);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t449 + 4))))();
							 *0x1384a1c = _t449;
							goto L5;
						}
					} else {
						_t449 = _t464;
						goto L5;
					}
				}
			}

0x01337b88
0x01337b88
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bb9
0x01337bbe
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6

APIs

__EH_prolog3.LIBCMT ref: 01337B8F
std::_Lockit::_Lockit.LIBCPMT ref: 01337B99

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01337BEA
std::_Lockit::~_Lockit.LIBCPMT ref: 01337C0A

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: fe71ae73ba991accec31a3dacc261a76ae0934d75639ab2ddc3125e171bb2c5e
Instruction ID: 87587d6367ef0bab062759474dd997116073fc79a906a5e82ce67e92a2ccd320
Opcode Fuzzy Hash: fe71ae73ba991accec31a3dacc261a76ae0934d75639ab2ddc3125e171bb2c5e
Instruction Fuzzy Hash: 8901D27590022B8BCF15FBACC4447AEBBB5AFD0328F244409D510AB281DF74DA01CBD8

Uniqueness

Uniqueness Score: -1.00%

Function 01337A5E Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E01337A5E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v52;
				intOrPtr* _t180;
				void* _t328;
				intOrPtr* _t331;
				void* _t474;
				intOrPtr _t475;
				intOrPtr* _t522;
				intOrPtr* _t523;
				intOrPtr* _t524;
				intOrPtr* _t525;
				intOrPtr* _t526;
				intOrPtr* _t527;
				intOrPtr* _t528;
				intOrPtr* _t529;
				intOrPtr* _t530;
				intOrPtr* _t531;
				intOrPtr* _t532;
				intOrPtr* _t533;
				intOrPtr* _t534;
				void* _t535;
				void* _t538;
				intOrPtr* _t539;
				intOrPtr* _t540;
				intOrPtr* _t541;
				intOrPtr* _t542;
				intOrPtr* _t543;
				intOrPtr* _t544;
				intOrPtr* _t545;
				intOrPtr* _t546;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				void* _t552;

				_t519 = __edx;
				_t390 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t538 =  *0x1384a18; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t538;
				_t180 = E0132BD50(_a8, E0132BCE0());
				_t521 = _t180;
				if(_t180 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t521);
				} else {
					if(_t538 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338F6F(__ebx, _t521, _t538, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t521, _t538);
							E01335EA5( &_v20, 0);
							_t539 =  *0x1384a4c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t539;
							_t522 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t522;
							if(_t522 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t522);
							} else {
								__eflags = _t539;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01338FD7(_t390, _t522, _t539, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t390, _t522, _t539);
										E01335EA5( &_v20, 0);
										_t540 =  *0x1384a1c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t540;
										_t523 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t523;
										if(_t523 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t523);
										} else {
											__eflags = _t540;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0133903F(_t390, _t523, _t540, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t390, _t523, _t540);
													E01335EA5( &_v20, 0);
													_t541 =  *0x1384a54; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t541;
													_t524 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t524;
													if(_t524 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t524);
													} else {
														__eflags = _t541;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E013390A7(_t390, _t524, _t541, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t390, _t524, _t541);
																E01335EA5( &_v20, 0);
																_t542 =  *0x1384a50; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t542;
																_t525 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t525;
																if(_t525 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t525);
																} else {
																	__eflags = _t542;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0133912B(_t390, _t525, _t542, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t390, _t525, _t542);
																			E01335EA5( &_v20, 0);
																			_t543 =  *0x1384a24; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t543;
																			_t526 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t526;
																			if(_t526 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t526);
																			} else {
																				__eflags = _t543;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E013391B0(_t390, _t526, _t543, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t390, _t526, _t543);
																						E01335EA5( &_v20, 0);
																						_t544 =  *0x1384a20; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t544;
																						_t527 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t527;
																						if(_t527 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t527);
																						} else {
																							__eflags = _t544;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E01339234(_t390, _t527, _t544, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t390, _t527, _t544);
																									E01335EA5( &_v20, 0);
																									_t545 =  *0x1384a34; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t545;
																									_t528 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t528;
																									if(_t528 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t528);
																									} else {
																										__eflags = _t545;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E013392B9(_t390, _t528, _t545, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t390, _t528, _t545);
																												E01335EA5( &_v20, 0);
																												_t546 =  *0x1384a0c; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t546;
																												_t529 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t529;
																												if(_t529 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t529);
																												} else {
																													__eflags = _t546;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E01339321(_t390, _t529, _t546, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t390, _t529, _t546);
																															E01335EA5( &_v20, 0);
																															_t547 =  *0x1384a38; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t547;
																															_t530 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t530;
																															if(_t530 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t530);
																															} else {
																																__eflags = _t547;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E01339389(_t390, _t530, _t547, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t390, _t530, _t547);
																																		E01335EA5( &_v20, 0);
																																		_t548 =  *0x1384a3c; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t548;
																																		_t531 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t531;
																																		if(_t531 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t531);
																																		} else {
																																			__eflags = _t548;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E013393F1(_t390, __edx, _t531, _t548, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t390, _t531, _t548);
																																					E01335EA5( &_v20, 0);
																																					_t549 =  *0x1384a58; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t549;
																																					_t532 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t532;
																																					if(_t532 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t532);
																																					} else {
																																						__eflags = _t549;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E0133946C(_t390, _t532, _t549, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t390, _t532, _t549);
																																								E01335EA5( &_v20, 0);
																																								_t550 =  *0x1384a28; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t550;
																																								_t533 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t533;
																																								if(_t533 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t533);
																																								} else {
																																									__eflags = _t550;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										__eflags = E013394D8(_t390, _t533, _t550, __eflags) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(8);
																																											E01348213(0x136b979, _t390, _t533, _t550);
																																											E01335EA5( &_v20, 0);
																																											_t551 =  *0x1384a5c; // 0x0
																																											_v4 = _v4 & 0x00000000;
																																											_v16 = _t551;
																																											_t534 = E0132BD50(_a8, E0132BCE0());
																																											__eflags = _t534;
																																											if(_t534 != 0) {
																																												L96:
																																												E01335EFD( &_v20);
																																												return E013481F0(_t534);
																																											} else {
																																												__eflags = _t551;
																																												if(__eflags == 0) {
																																													_push(_a8);
																																													_push( &_v16);
																																													_t328 = E01339544(_t390, _t534, _t551, __eflags);
																																													_pop(_t474);
																																													__eflags = _t328 - 0xffffffff;
																																													if(__eflags == 0) {
																																														E0132C550(__eflags);
																																														asm("int3");
																																														_push(_t551);
																																														_push(_t534);
																																														_t552 = _t474;
																																														_t535 = _t552;
																																														asm("stosd");
																																														asm("stosd");
																																														asm("stosd");
																																														asm("stosd");
																																														_t331 = _v52;
																																														 *(_t552 + 0x10) =  *(_t552 + 0x10) & 0x00000000;
																																														 *(_t552 + 0x14) =  *(_t552 + 0x14) & 0x00000000;
																																														__eflags =  *((intOrPtr*)(_t331 + 0x14)) - 8;
																																														_t475 =  *((intOrPtr*)(_t331 + 0x10));
																																														if( *((intOrPtr*)(_t331 + 0x14)) >= 8) {
																																															_t331 =  *_t331;
																																														}
																																														_push(_t475);
																																														E0133657C(_t390, _t552, _t519, _t535, _t331);
																																														return _t552;
																																													} else {
																																														_t534 = _v16;
																																														_v16 = _t534;
																																														_v4 = 1;
																																														E01335C34(_t534);
																																														 *0x136d26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t534 + 4))))();
																																														 *0x1384a5c = _t534;
																																														goto L96;
																																													}
																																												} else {
																																													_t534 = _t551;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t533 = _v16;
																																											_v16 = _t533;
																																											_v4 = 1;
																																											E01335C34(_t533);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t533 + 4))))();
																																											 *0x1384a28 = _t533;
																																											goto L89;
																																										}
																																									} else {
																																										_t533 = _t550;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t532 = _v16;
																																								_v16 = _t532;
																																								_v4 = 1;
																																								E01335C34(_t532);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t532 + 4))))();
																																								 *0x1384a58 = _t532;
																																								goto L82;
																																							}
																																						} else {
																																							_t532 = _t549;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t531 = _v16;
																																					_v16 = _t531;
																																					_v4 = 1;
																																					E01335C34(_t531);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t531 + 4))))();
																																					 *0x1384a3c = _t531;
																																					goto L75;
																																				}
																																			} else {
																																				_t531 = _t548;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t530 = _v16;
																																		_v16 = _t530;
																																		_v4 = 1;
																																		E01335C34(_t530);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t530 + 4))))();
																																		 *0x1384a38 = _t530;
																																		goto L68;
																																	}
																																} else {
																																	_t530 = _t547;
																																	goto L68;
																																}
																															}
																														} else {
																															_t529 = _v16;
																															_v16 = _t529;
																															_v4 = 1;
																															E01335C34(_t529);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t529 + 4))))();
																															 *0x1384a0c = _t529;
																															goto L61;
																														}
																													} else {
																														_t529 = _t546;
																														goto L61;
																													}
																												}
																											} else {
																												_t528 = _v16;
																												_v16 = _t528;
																												_v4 = 1;
																												E01335C34(_t528);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t528 + 4))))();
																												 *0x1384a34 = _t528;
																												goto L54;
																											}
																										} else {
																											_t528 = _t545;
																											goto L54;
																										}
																									}
																								} else {
																									_t527 = _v16;
																									_v16 = _t527;
																									_v4 = 1;
																									E01335C34(_t527);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t527 + 4))))();
																									 *0x1384a20 = _t527;
																									goto L47;
																								}
																							} else {
																								_t527 = _t544;
																								goto L47;
																							}
																						}
																					} else {
																						_t526 = _v16;
																						_v16 = _t526;
																						_v4 = 1;
																						E01335C34(_t526);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t526 + 4))))();
																						 *0x1384a24 = _t526;
																						goto L40;
																					}
																				} else {
																					_t526 = _t543;
																					goto L40;
																				}
																			}
																		} else {
																			_t525 = _v16;
																			_v16 = _t525;
																			_v4 = 1;
																			E01335C34(_t525);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t525 + 4))))();
																			 *0x1384a50 = _t525;
																			goto L33;
																		}
																	} else {
																		_t525 = _t542;
																		goto L33;
																	}
																}
															} else {
																_t524 = _v16;
																_v16 = _t524;
																_v4 = 1;
																E01335C34(_t524);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t524 + 4))))();
																 *0x1384a54 = _t524;
																goto L26;
															}
														} else {
															_t524 = _t541;
															goto L26;
														}
													}
												} else {
													_t523 = _v16;
													_v16 = _t523;
													_v4 = 1;
													E01335C34(_t523);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t523 + 4))))();
													 *0x1384a1c = _t523;
													goto L19;
												}
											} else {
												_t523 = _t540;
												goto L19;
											}
										}
									} else {
										_t522 = _v16;
										_v16 = _t522;
										_v4 = 1;
										E01335C34(_t522);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t522 + 4))))();
										 *0x1384a4c = _t522;
										goto L12;
									}
								} else {
									_t522 = _t539;
									goto L12;
								}
							}
						} else {
							_t521 = _v16;
							_v16 = _t521;
							_v4 = 1;
							E01335C34(_t521);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t521 + 4))))();
							 *0x1384a18 = _t521;
							goto L5;
						}
					} else {
						_t521 = _t538;
						goto L5;
					}
				}
			}

0x01337a5e
0x01337a5e
0x01337a5e
0x01337a65
0x01337a6f
0x01337a74
0x01337a7f
0x01337a83
0x01337a8f
0x01337a94
0x01337a98
0x01337add
0x01337ae0
0x01337aec
0x01337a9a
0x01337a9c
0x01337aa2
0x01337aa8
0x01337ab0
0x01337ab3
0x01337aed
0x01337af2
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b29
0x01337b2b
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31
0x01337ab5
0x01337ab5
0x01337ab8
0x01337abc
0x01337ac0
0x01337acd
0x01337ad5
0x01337ad7
0x00000000
0x01337ad7
0x01337a9e
0x01337a9e
0x00000000
0x01337a9e
0x01337a9c

APIs

__EH_prolog3.LIBCMT ref: 01337A65
std::_Lockit::_Lockit.LIBCPMT ref: 01337A6F

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01337AC0
std::_Lockit::~_Lockit.LIBCPMT ref: 01337AE0

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f59403fa0061669c381111c788a06b296d3824cff9efc390a538e29034ad5066
Instruction ID: 495f6af8e03ac9234a1871b55e45ecaff81b59bb8d8bc602f49f094bd0e6e879
Opcode Fuzzy Hash: f59403fa0061669c381111c788a06b296d3824cff9efc390a538e29034ad5066
Instruction Fuzzy Hash: F201CC7590022A9BDB11FBACC4446AEBBA5AFD0328F254109D511AB390DF349A068BD4

Uniqueness

Uniqueness Score: -1.00%

Function 01343A80 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01343A80(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t71;
				void* _t120;
				signed int _t178;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				signed int _t199;
				signed int _t201;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t205;
				signed int _t206;
				void* _t212;

				_t148 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t212 - 0x14, 0);
				_t201 =  *0x1384a90; // 0x0
				 *(_t212 - 4) =  *(_t212 - 4) & 0x00000000;
				 *(_t212 - 0x10) = _t201;
				_t71 = E0132BD50( *((intOrPtr*)(_t212 + 8)), E0132BCE0());
				_t195 = _t71;
				if(_t71 != 0) {
					L5:
					E01335EFD(_t212 - 0x14);
					return E013481F0(_t195);
				} else {
					if(_t201 == 0) {
						_push( *((intOrPtr*)(_t212 + 8)));
						_push(_t212 - 0x10);
						__eflags = E01343FE2(__ebx, _t195, _t201, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t195, _t201);
							E01335EA5(_t212 - 0x14, 0);
							_t202 =  *0x1384a98; // 0x0
							 *(_t212 - 4) =  *(_t212 - 4) & 0x00000000;
							 *(_t212 - 0x10) = _t202;
							_t196 = E0132BD50( *((intOrPtr*)(_t212 + 8)), E0132BCE0());
							__eflags = _t196;
							if(_t196 != 0) {
								L12:
								E01335EFD(_t212 - 0x14);
								return E013481F0(_t196);
							} else {
								__eflags = _t202;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t212 + 8)));
									_push(_t212 - 0x10);
									__eflags = E0134404A(_t148, _t196, _t202, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t148, _t196, _t202);
										E01335EA5(_t212 - 0x14, 0);
										_t203 =  *0x1384a94; // 0x0
										 *(_t212 - 4) =  *(_t212 - 4) & 0x00000000;
										 *(_t212 - 0x10) = _t203;
										_t197 = E0132BD50( *((intOrPtr*)(_t212 + 8)), E0132BCE0());
										__eflags = _t197;
										if(_t197 != 0) {
											L19:
											E01335EFD(_t212 - 0x14);
											return E013481F0(_t197);
										} else {
											__eflags = _t203;
											if(__eflags == 0) {
												_push( *((intOrPtr*)(_t212 + 8)));
												_push(_t212 - 0x10);
												__eflags = E013440CE(_t148, _t197, _t203, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t148, _t197, _t203);
													E01335EA5(_t212 - 0x14, 0);
													_t204 =  *0x1384a9c; // 0x0
													 *(_t212 - 4) =  *(_t212 - 4) & 0x00000000;
													 *(_t212 - 0x10) = _t204;
													_t198 = E0132BD50( *((intOrPtr*)(_t212 + 8)), E0132BCE0());
													__eflags = _t198;
													if(_t198 != 0) {
														L26:
														E01335EFD(_t212 - 0x14);
														return E013481F0(_t198);
													} else {
														__eflags = _t204;
														if(__eflags == 0) {
															_push( *((intOrPtr*)(_t212 + 8)));
															_push(_t212 - 0x10);
															__eflags = E01344153(_t148, _t198, _t204, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t148, _t198, _t204);
																E01335EA5(_t212 - 0x14, 0);
																_t205 =  *0x1384aa0; // 0x0
																 *(_t212 - 4) =  *(_t212 - 4) & 0x00000000;
																 *(_t212 - 0x10) = _t205;
																_t199 = E0132BD50( *((intOrPtr*)(_t212 + 8)), E0132BCE0());
																__eflags = _t199;
																if(_t199 != 0) {
																	L33:
																	E01335EFD(_t212 - 0x14);
																	return E013481F0(_t199);
																} else {
																	__eflags = _t205;
																	if(__eflags == 0) {
																		_push( *((intOrPtr*)(_t212 + 8)));
																		_push(_t212 - 0x10);
																		_t120 = E013441BF(_t148, _t199, _t205, __eflags);
																		_pop(_t178);
																		__eflags = _t120 - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(4);
																			E01348213(0x136bdf5, _t148, _t199, _t205);
																			_t206 = _t178;
																			 *(_t212 - 0x10) = _t206;
																			 *((intOrPtr*)(_t206 + 4)) =  *((intOrPtr*)(_t212 + 0xc));
																			_push( *((intOrPtr*)(_t212 + 8)));
																			_t65 = _t212 - 4;
																			 *_t65 =  *(_t212 - 4) & 0x00000000;
																			__eflags =  *_t65;
																			 *_t206 = 0x136ecc0;
																			E01344EBF(_t148, _t178, _t199, _t206,  *_t65);
																			return E013481F0(_t206);
																		} else {
																			_t199 =  *(_t212 - 0x10);
																			 *(_t212 - 0x10) = _t199;
																			 *(_t212 - 4) = 1;
																			E01335C34(_t199);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t199 + 4))))();
																			 *0x1384aa0 = _t199;
																			goto L33;
																		}
																	} else {
																		_t199 = _t205;
																		goto L33;
																	}
																}
															} else {
																_t198 =  *(_t212 - 0x10);
																 *(_t212 - 0x10) = _t198;
																 *(_t212 - 4) = 1;
																E01335C34(_t198);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t198 + 4))))();
																 *0x1384a9c = _t198;
																goto L26;
															}
														} else {
															_t198 = _t204;
															goto L26;
														}
													}
												} else {
													_t197 =  *(_t212 - 0x10);
													 *(_t212 - 0x10) = _t197;
													 *(_t212 - 4) = 1;
													E01335C34(_t197);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t197 + 4))))();
													 *0x1384a94 = _t197;
													goto L19;
												}
											} else {
												_t197 = _t203;
												goto L19;
											}
										}
									} else {
										_t196 =  *(_t212 - 0x10);
										 *(_t212 - 0x10) = _t196;
										 *(_t212 - 4) = 1;
										E01335C34(_t196);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t196 + 4))))();
										 *0x1384a98 = _t196;
										goto L12;
									}
								} else {
									_t196 = _t202;
									goto L12;
								}
							}
						} else {
							_t195 =  *(_t212 - 0x10);
							 *(_t212 - 0x10) = _t195;
							 *(_t212 - 4) = 1;
							E01335C34(_t195);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t195 + 4))))();
							 *0x1384a90 = _t195;
							goto L5;
						}
					} else {
						_t195 = _t201;
						goto L5;
					}
				}
			}

0x01343a80
0x01343a80
0x01343a87
0x01343a91
0x01343a96
0x01343aa1
0x01343aa5
0x01343ab1
0x01343ab6
0x01343aba
0x01343aff
0x01343b02
0x01343b0e
0x01343abc
0x01343abe
0x01343ac4
0x01343aca
0x01343ad2
0x01343ad5
0x01343b0f
0x01343b14
0x01343b15
0x01343b1c
0x01343b26
0x01343b2b
0x01343b36
0x01343b3a
0x01343b4b
0x01343b4d
0x01343b4f
0x01343b94
0x01343b97
0x01343ba3
0x01343b51
0x01343b51
0x01343b53
0x01343b59
0x01343b5f
0x01343b67
0x01343b6a
0x01343ba4
0x01343ba9
0x01343baa
0x01343bb1
0x01343bbb
0x01343bc0
0x01343bcb
0x01343bcf
0x01343be0
0x01343be2
0x01343be4
0x01343c29
0x01343c2c
0x01343c38
0x01343be6
0x01343be6
0x01343be8
0x01343bee
0x01343bf4
0x01343bfc
0x01343bff
0x01343c39
0x01343c3e
0x01343c3f
0x01343c46
0x01343c50
0x01343c55
0x01343c60
0x01343c64
0x01343c75
0x01343c77
0x01343c79
0x01343cbe
0x01343cc1
0x01343ccd
0x01343c7b
0x01343c7b
0x01343c7d
0x01343c83
0x01343c89
0x01343c91
0x01343c94
0x01343cce
0x01343cd3
0x01343cd4
0x01343cdb
0x01343ce5
0x01343cea
0x01343cf5
0x01343cf9
0x01343d0a
0x01343d0c
0x01343d0e
0x01343d53
0x01343d56
0x01343d62
0x01343d10
0x01343d10
0x01343d12
0x01343d18
0x01343d1e
0x01343d1f
0x01343d25
0x01343d26
0x01343d29
0x01343d63
0x01343d68
0x01343d69
0x01343d70
0x01343d75
0x01343d77
0x01343d7d
0x01343d80
0x01343d83
0x01343d83
0x01343d83
0x01343d87
0x01343d8d
0x01343d99
0x01343d2b
0x01343d2b
0x01343d2e
0x01343d32
0x01343d36
0x01343d43
0x01343d4b
0x01343d4d
0x00000000
0x01343d4d
0x01343d14
0x01343d14
0x00000000
0x01343d14
0x01343d12
0x01343c96
0x01343c96
0x01343c99
0x01343c9d
0x01343ca1
0x01343cae
0x01343cb6
0x01343cb8
0x00000000
0x01343cb8
0x01343c7f
0x01343c7f
0x00000000
0x01343c7f
0x01343c7d
0x01343c01
0x01343c01
0x01343c04
0x01343c08
0x01343c0c
0x01343c19
0x01343c21
0x01343c23
0x00000000
0x01343c23
0x01343bea
0x01343bea
0x00000000
0x01343bea
0x01343be8
0x01343b6c
0x01343b6c
0x01343b6f
0x01343b73
0x01343b77
0x01343b84
0x01343b8c
0x01343b8e
0x00000000
0x01343b8e
0x01343b55
0x01343b55
0x00000000
0x01343b55
0x01343b53
0x01343ad7
0x01343ad7
0x01343ada
0x01343ade
0x01343ae2
0x01343aef
0x01343af7
0x01343af9
0x00000000
0x01343af9
0x01343ac0
0x01343ac0
0x00000000
0x01343ac0
0x01343abe

APIs

__EH_prolog3.LIBCMT ref: 01343A87
std::_Lockit::_Lockit.LIBCPMT ref: 01343A91

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01343AE2
std::_Lockit::~_Lockit.LIBCPMT ref: 01343B02

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 603322be30ec7d115fa946aca40f1345d241d6f0f0c8e855f35902ef6f389fab
Instruction ID: 997761328ab1474e6dd04c0e92f98ad8119052733199dcfd79f46b0882902dcf
Opcode Fuzzy Hash: 603322be30ec7d115fa946aca40f1345d241d6f0f0c8e855f35902ef6f389fab
Instruction Fuzzy Hash: F301DE3590022B9BDF11FBACD4447AEBBB5BF90328F244509D425AB280EF74EE01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 01337AF3 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E01337AF3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v48;
				intOrPtr* _t168;
				void* _t305;
				intOrPtr* _t308;
				void* _t441;
				intOrPtr _t442;
				intOrPtr* _t486;
				intOrPtr* _t487;
				intOrPtr* _t488;
				intOrPtr* _t489;
				intOrPtr* _t490;
				intOrPtr* _t491;
				intOrPtr* _t492;
				intOrPtr* _t493;
				intOrPtr* _t494;
				intOrPtr* _t495;
				intOrPtr* _t496;
				intOrPtr* _t497;
				void* _t498;
				void* _t501;
				intOrPtr* _t502;
				intOrPtr* _t503;
				intOrPtr* _t504;
				intOrPtr* _t505;
				intOrPtr* _t506;
				intOrPtr* _t507;
				intOrPtr* _t508;
				intOrPtr* _t509;
				intOrPtr* _t510;
				intOrPtr* _t511;
				intOrPtr* _t512;
				void* _t513;
				void* _t514;

				_t483 = __edx;
				_t363 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t501 =  *0x1384a4c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t501;
				_t168 = E0132BD50(_a8, E0132BCE0());
				_t485 = _t168;
				if(_t168 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t485);
				} else {
					if(_t501 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01338FD7(__ebx, _t485, _t501, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t485, _t501);
							E01335EA5( &_v20, 0);
							_t502 =  *0x1384a1c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t502;
							_t486 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t486;
							if(_t486 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t486);
							} else {
								__eflags = _t502;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E0133903F(_t363, _t486, _t502, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t363, _t486, _t502);
										E01335EA5( &_v20, 0);
										_t503 =  *0x1384a54; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t503;
										_t487 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t487;
										if(_t487 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t487);
										} else {
											__eflags = _t503;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E013390A7(_t363, _t487, _t503, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t363, _t487, _t503);
													E01335EA5( &_v20, 0);
													_t504 =  *0x1384a50; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t504;
													_t488 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t488;
													if(_t488 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t488);
													} else {
														__eflags = _t504;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0133912B(_t363, _t488, _t504, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t363, _t488, _t504);
																E01335EA5( &_v20, 0);
																_t505 =  *0x1384a24; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t505;
																_t489 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t489;
																if(_t489 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t489);
																} else {
																	__eflags = _t505;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E013391B0(_t363, _t489, _t505, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t363, _t489, _t505);
																			E01335EA5( &_v20, 0);
																			_t506 =  *0x1384a20; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t506;
																			_t490 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t490;
																			if(_t490 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t490);
																			} else {
																				__eflags = _t506;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E01339234(_t363, _t490, _t506, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t363, _t490, _t506);
																						E01335EA5( &_v20, 0);
																						_t507 =  *0x1384a34; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t507;
																						_t491 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t491;
																						if(_t491 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t491);
																						} else {
																							__eflags = _t507;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								__eflags = E013392B9(_t363, _t491, _t507, __eflags) - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(8);
																									E01348213(0x136b979, _t363, _t491, _t507);
																									E01335EA5( &_v20, 0);
																									_t508 =  *0x1384a0c; // 0x0
																									_v4 = _v4 & 0x00000000;
																									_v16 = _t508;
																									_t492 = E0132BD50(_a8, E0132BCE0());
																									__eflags = _t492;
																									if(_t492 != 0) {
																										L54:
																										E01335EFD( &_v20);
																										return E013481F0(_t492);
																									} else {
																										__eflags = _t508;
																										if(__eflags == 0) {
																											_push(_a8);
																											_push( &_v16);
																											__eflags = E01339321(_t363, _t492, _t508, __eflags) - 0xffffffff;
																											if(__eflags == 0) {
																												E0132C550(__eflags);
																												asm("int3");
																												_push(8);
																												E01348213(0x136b979, _t363, _t492, _t508);
																												E01335EA5( &_v20, 0);
																												_t509 =  *0x1384a38; // 0x0
																												_v4 = _v4 & 0x00000000;
																												_v16 = _t509;
																												_t493 = E0132BD50(_a8, E0132BCE0());
																												__eflags = _t493;
																												if(_t493 != 0) {
																													L61:
																													E01335EFD( &_v20);
																													return E013481F0(_t493);
																												} else {
																													__eflags = _t509;
																													if(__eflags == 0) {
																														_push(_a8);
																														_push( &_v16);
																														__eflags = E01339389(_t363, _t493, _t509, __eflags) - 0xffffffff;
																														if(__eflags == 0) {
																															E0132C550(__eflags);
																															asm("int3");
																															_push(8);
																															E01348213(0x136b979, _t363, _t493, _t509);
																															E01335EA5( &_v20, 0);
																															_t510 =  *0x1384a3c; // 0x0
																															_v4 = _v4 & 0x00000000;
																															_v16 = _t510;
																															_t494 = E0132BD50(_a8, E0132BCE0());
																															__eflags = _t494;
																															if(_t494 != 0) {
																																L68:
																																E01335EFD( &_v20);
																																return E013481F0(_t494);
																															} else {
																																__eflags = _t510;
																																if(__eflags == 0) {
																																	_push(_a8);
																																	_push( &_v16);
																																	__eflags = E013393F1(_t363, __edx, _t494, _t510, __eflags) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E0132C550(__eflags);
																																		asm("int3");
																																		_push(8);
																																		E01348213(0x136b979, _t363, _t494, _t510);
																																		E01335EA5( &_v20, 0);
																																		_t511 =  *0x1384a58; // 0x0
																																		_v4 = _v4 & 0x00000000;
																																		_v16 = _t511;
																																		_t495 = E0132BD50(_a8, E0132BCE0());
																																		__eflags = _t495;
																																		if(_t495 != 0) {
																																			L75:
																																			E01335EFD( &_v20);
																																			return E013481F0(_t495);
																																		} else {
																																			__eflags = _t511;
																																			if(__eflags == 0) {
																																				_push(_a8);
																																				_push( &_v16);
																																				__eflags = E0133946C(_t363, _t495, _t511, __eflags) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E0132C550(__eflags);
																																					asm("int3");
																																					_push(8);
																																					E01348213(0x136b979, _t363, _t495, _t511);
																																					E01335EA5( &_v20, 0);
																																					_t512 =  *0x1384a28; // 0x0
																																					_v4 = _v4 & 0x00000000;
																																					_v16 = _t512;
																																					_t496 = E0132BD50(_a8, E0132BCE0());
																																					__eflags = _t496;
																																					if(_t496 != 0) {
																																						L82:
																																						E01335EFD( &_v20);
																																						return E013481F0(_t496);
																																					} else {
																																						__eflags = _t512;
																																						if(__eflags == 0) {
																																							_push(_a8);
																																							_push( &_v16);
																																							__eflags = E013394D8(_t363, _t496, _t512, __eflags) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E0132C550(__eflags);
																																								asm("int3");
																																								_push(8);
																																								E01348213(0x136b979, _t363, _t496, _t512);
																																								E01335EA5( &_v20, 0);
																																								_t513 =  *0x1384a5c; // 0x0
																																								_v4 = _v4 & 0x00000000;
																																								_v16 = _t513;
																																								_t497 = E0132BD50(_a8, E0132BCE0());
																																								__eflags = _t497;
																																								if(_t497 != 0) {
																																									L89:
																																									E01335EFD( &_v20);
																																									return E013481F0(_t497);
																																								} else {
																																									__eflags = _t513;
																																									if(__eflags == 0) {
																																										_push(_a8);
																																										_push( &_v16);
																																										_t305 = E01339544(_t363, _t497, _t513, __eflags);
																																										_pop(_t441);
																																										__eflags = _t305 - 0xffffffff;
																																										if(__eflags == 0) {
																																											E0132C550(__eflags);
																																											asm("int3");
																																											_push(_t513);
																																											_push(_t497);
																																											_t514 = _t441;
																																											_t498 = _t514;
																																											asm("stosd");
																																											asm("stosd");
																																											asm("stosd");
																																											asm("stosd");
																																											_t308 = _v48;
																																											 *(_t514 + 0x10) =  *(_t514 + 0x10) & 0x00000000;
																																											 *(_t514 + 0x14) =  *(_t514 + 0x14) & 0x00000000;
																																											__eflags =  *((intOrPtr*)(_t308 + 0x14)) - 8;
																																											_t442 =  *((intOrPtr*)(_t308 + 0x10));
																																											if( *((intOrPtr*)(_t308 + 0x14)) >= 8) {
																																												_t308 =  *_t308;
																																											}
																																											_push(_t442);
																																											E0133657C(_t363, _t514, _t483, _t498, _t308);
																																											return _t514;
																																										} else {
																																											_t497 = _v16;
																																											_v16 = _t497;
																																											_v4 = 1;
																																											E01335C34(_t497);
																																											 *0x136d26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t497 + 4))))();
																																											 *0x1384a5c = _t497;
																																											goto L89;
																																										}
																																									} else {
																																										_t497 = _t513;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t496 = _v16;
																																								_v16 = _t496;
																																								_v4 = 1;
																																								E01335C34(_t496);
																																								 *0x136d26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t496 + 4))))();
																																								 *0x1384a28 = _t496;
																																								goto L82;
																																							}
																																						} else {
																																							_t496 = _t512;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t495 = _v16;
																																					_v16 = _t495;
																																					_v4 = 1;
																																					E01335C34(_t495);
																																					 *0x136d26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t495 + 4))))();
																																					 *0x1384a58 = _t495;
																																					goto L75;
																																				}
																																			} else {
																																				_t495 = _t511;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t494 = _v16;
																																		_v16 = _t494;
																																		_v4 = 1;
																																		E01335C34(_t494);
																																		 *0x136d26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t494 + 4))))();
																																		 *0x1384a3c = _t494;
																																		goto L68;
																																	}
																																} else {
																																	_t494 = _t510;
																																	goto L68;
																																}
																															}
																														} else {
																															_t493 = _v16;
																															_v16 = _t493;
																															_v4 = 1;
																															E01335C34(_t493);
																															 *0x136d26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t493 + 4))))();
																															 *0x1384a38 = _t493;
																															goto L61;
																														}
																													} else {
																														_t493 = _t509;
																														goto L61;
																													}
																												}
																											} else {
																												_t492 = _v16;
																												_v16 = _t492;
																												_v4 = 1;
																												E01335C34(_t492);
																												 *0x136d26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t492 + 4))))();
																												 *0x1384a0c = _t492;
																												goto L54;
																											}
																										} else {
																											_t492 = _t508;
																											goto L54;
																										}
																									}
																								} else {
																									_t491 = _v16;
																									_v16 = _t491;
																									_v4 = 1;
																									E01335C34(_t491);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t491 + 4))))();
																									 *0x1384a34 = _t491;
																									goto L47;
																								}
																							} else {
																								_t491 = _t507;
																								goto L47;
																							}
																						}
																					} else {
																						_t490 = _v16;
																						_v16 = _t490;
																						_v4 = 1;
																						E01335C34(_t490);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t490 + 4))))();
																						 *0x1384a20 = _t490;
																						goto L40;
																					}
																				} else {
																					_t490 = _t506;
																					goto L40;
																				}
																			}
																		} else {
																			_t489 = _v16;
																			_v16 = _t489;
																			_v4 = 1;
																			E01335C34(_t489);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t489 + 4))))();
																			 *0x1384a24 = _t489;
																			goto L33;
																		}
																	} else {
																		_t489 = _t505;
																		goto L33;
																	}
																}
															} else {
																_t488 = _v16;
																_v16 = _t488;
																_v4 = 1;
																E01335C34(_t488);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t488 + 4))))();
																 *0x1384a50 = _t488;
																goto L26;
															}
														} else {
															_t488 = _t504;
															goto L26;
														}
													}
												} else {
													_t487 = _v16;
													_v16 = _t487;
													_v4 = 1;
													E01335C34(_t487);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t487 + 4))))();
													 *0x1384a54 = _t487;
													goto L19;
												}
											} else {
												_t487 = _t503;
												goto L19;
											}
										}
									} else {
										_t486 = _v16;
										_v16 = _t486;
										_v4 = 1;
										E01335C34(_t486);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t486 + 4))))();
										 *0x1384a1c = _t486;
										goto L12;
									}
								} else {
									_t486 = _t502;
									goto L12;
								}
							}
						} else {
							_t485 = _v16;
							_v16 = _t485;
							_v4 = 1;
							E01335C34(_t485);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t485 + 4))))();
							 *0x1384a4c = _t485;
							goto L5;
						}
					} else {
						_t485 = _t501;
						goto L5;
					}
				}
			}

0x01337af3
0x01337af3
0x01337af3
0x01337afa
0x01337b04
0x01337b09
0x01337b14
0x01337b18
0x01337b24
0x01337b29
0x01337b2d
0x01337b72
0x01337b75
0x01337b81
0x01337b2f
0x01337b31
0x01337b37
0x01337b3d
0x01337b45
0x01337b48
0x01337b82
0x01337b87
0x01337b88
0x01337b8f
0x01337b99
0x01337b9e
0x01337ba9
0x01337bad
0x01337bbe
0x01337bc0
0x01337bc2
0x01337c07
0x01337c0a
0x01337c16
0x01337bc4
0x01337bc4
0x01337bc6
0x01337bcc
0x01337bd2
0x01337bda
0x01337bdd
0x01337c17
0x01337c1c
0x01337c1d
0x01337c24
0x01337c2e
0x01337c33
0x01337c3e
0x01337c42
0x01337c53
0x01337c55
0x01337c57
0x01337c9c
0x01337c9f
0x01337cab
0x01337c59
0x01337c59
0x01337c5b
0x01337c61
0x01337c67
0x01337c6f
0x01337c72
0x01337cac
0x01337cb1
0x01337cb2
0x01337cb9
0x01337cc3
0x01337cc8
0x01337cd3
0x01337cd7
0x01337ce8
0x01337cea
0x01337cec
0x01337d31
0x01337d34
0x01337d40
0x01337cee
0x01337cee
0x01337cf0
0x01337cf6
0x01337cfc
0x01337d04
0x01337d07
0x01337d41
0x01337d46
0x01337d47
0x01337d4e
0x01337d58
0x01337d5d
0x01337d68
0x01337d6c
0x01337d7d
0x01337d7f
0x01337d81
0x01337dc6
0x01337dc9
0x01337dd5
0x01337d83
0x01337d83
0x01337d85
0x01337d8b
0x01337d91
0x01337d99
0x01337d9c
0x01337dd6
0x01337ddb
0x01337ddc
0x01337de3
0x01337ded
0x01337df2
0x01337dfd
0x01337e01
0x01337e12
0x01337e14
0x01337e16
0x01337e5b
0x01337e5e
0x01337e6a
0x01337e18
0x01337e18
0x01337e1a
0x01337e20
0x01337e26
0x01337e2e
0x01337e31
0x01337e6b
0x01337e70
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea7
0x01337ea9
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf
0x01337e33
0x01337e33
0x01337e36
0x01337e3a
0x01337e3e
0x01337e4b
0x01337e53
0x01337e55
0x00000000
0x01337e55
0x01337e1c
0x01337e1c
0x00000000
0x01337e1c
0x01337e1a
0x01337d9e
0x01337d9e
0x01337da1
0x01337da5
0x01337da9
0x01337db6
0x01337dbe
0x01337dc0
0x00000000
0x01337dc0
0x01337d87
0x01337d87
0x00000000
0x01337d87
0x01337d85
0x01337d09
0x01337d09
0x01337d0c
0x01337d10
0x01337d14
0x01337d21
0x01337d29
0x01337d2b
0x00000000
0x01337d2b
0x01337cf2
0x01337cf2
0x00000000
0x01337cf2
0x01337cf0
0x01337c74
0x01337c74
0x01337c77
0x01337c7b
0x01337c7f
0x01337c8c
0x01337c94
0x01337c96
0x00000000
0x01337c96
0x01337c5d
0x01337c5d
0x00000000
0x01337c5d
0x01337c5b
0x01337bdf
0x01337bdf
0x01337be2
0x01337be6
0x01337bea
0x01337bf7
0x01337bff
0x01337c01
0x00000000
0x01337c01
0x01337bc8
0x01337bc8
0x00000000
0x01337bc8
0x01337bc6
0x01337b4a
0x01337b4a
0x01337b4d
0x01337b51
0x01337b55
0x01337b62
0x01337b6a
0x01337b6c
0x00000000
0x01337b6c
0x01337b33
0x01337b33
0x00000000
0x01337b33
0x01337b31

APIs

__EH_prolog3.LIBCMT ref: 01337AFA
std::_Lockit::_Lockit.LIBCPMT ref: 01337B04

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01337B55
std::_Lockit::~_Lockit.LIBCPMT ref: 01337B75

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 400fedad6dec2fabc67b0ce2fb810262abc3abdb934937b3f028ba7d5b120b75
Instruction ID: 65c256df1ea937732637dbd37faf8e4c60a40b4d853af9b617fc1ff56f60919f
Opcode Fuzzy Hash: 400fedad6dec2fabc67b0ce2fb810262abc3abdb934937b3f028ba7d5b120b75
Instruction Fuzzy Hash: 7D01C07590022A9BCB15FBACD444AEEBBB5AFD0328F254109E614AB280CF349A058B95

Uniqueness

Uniqueness Score: -1.00%

Function 01343C3F Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01343C3F(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int _t35;
				void* _t51;
				signed int _t79;
				signed int _t88;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				void* _t95;

				_t67 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t95 - 0x14, 0);
				_t90 =  *0x1384a9c; // 0x0
				 *(_t95 - 4) =  *(_t95 - 4) & 0x00000000;
				 *(_t95 - 0x10) = _t90;
				_t35 = E0132BD50( *((intOrPtr*)(_t95 + 8)), E0132BCE0());
				_t87 = _t35;
				if(_t35 != 0) {
					L5:
					E01335EFD(_t95 - 0x14);
					return E013481F0(_t87);
				} else {
					if(_t90 == 0) {
						_push( *((intOrPtr*)(_t95 + 8)));
						_push(_t95 - 0x10);
						__eflags = E01344153(__ebx, _t87, _t90, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t87, _t90);
							E01335EA5(_t95 - 0x14, 0);
							_t91 =  *0x1384aa0; // 0x0
							 *(_t95 - 4) =  *(_t95 - 4) & 0x00000000;
							 *(_t95 - 0x10) = _t91;
							_t88 = E0132BD50( *((intOrPtr*)(_t95 + 8)), E0132BCE0());
							__eflags = _t88;
							if(_t88 != 0) {
								L12:
								E01335EFD(_t95 - 0x14);
								return E013481F0(_t88);
							} else {
								__eflags = _t91;
								if(__eflags == 0) {
									_push( *((intOrPtr*)(_t95 + 8)));
									_push(_t95 - 0x10);
									_t51 = E013441BF(_t67, _t88, _t91, __eflags);
									_pop(_t79);
									__eflags = _t51 - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(4);
										E01348213(0x136bdf5, _t67, _t88, _t91);
										_t92 = _t79;
										 *(_t95 - 0x10) = _t92;
										 *((intOrPtr*)(_t92 + 4)) =  *((intOrPtr*)(_t95 + 0xc));
										_push( *((intOrPtr*)(_t95 + 8)));
										_t29 = _t95 - 4;
										 *_t29 =  *(_t95 - 4) & 0x00000000;
										__eflags =  *_t29;
										 *_t92 = 0x136ecc0;
										E01344EBF(_t67, _t79, _t88, _t92,  *_t29);
										return E013481F0(_t92);
									} else {
										_t88 =  *(_t95 - 0x10);
										 *(_t95 - 0x10) = _t88;
										 *(_t95 - 4) = 1;
										E01335C34(_t88);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t88 + 4))))();
										 *0x1384aa0 = _t88;
										goto L12;
									}
								} else {
									_t88 = _t91;
									goto L12;
								}
							}
						} else {
							_t87 =  *(_t95 - 0x10);
							 *(_t95 - 0x10) = _t87;
							 *(_t95 - 4) = 1;
							E01335C34(_t87);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t87 + 4))))();
							 *0x1384a9c = _t87;
							goto L5;
						}
					} else {
						_t87 = _t90;
						goto L5;
					}
				}
			}

0x01343c3f
0x01343c3f
0x01343c46
0x01343c50
0x01343c55
0x01343c60
0x01343c64
0x01343c70
0x01343c75
0x01343c79
0x01343cbe
0x01343cc1
0x01343ccd
0x01343c7b
0x01343c7d
0x01343c83
0x01343c89
0x01343c91
0x01343c94
0x01343cce
0x01343cd3
0x01343cd4
0x01343cdb
0x01343ce5
0x01343cea
0x01343cf5
0x01343cf9
0x01343d0a
0x01343d0c
0x01343d0e
0x01343d53
0x01343d56
0x01343d62
0x01343d10
0x01343d10
0x01343d12
0x01343d18
0x01343d1e
0x01343d1f
0x01343d25
0x01343d26
0x01343d29
0x01343d63
0x01343d68
0x01343d69
0x01343d70
0x01343d75
0x01343d77
0x01343d7d
0x01343d80
0x01343d83
0x01343d83
0x01343d83
0x01343d87
0x01343d8d
0x01343d99
0x01343d2b
0x01343d2b
0x01343d2e
0x01343d32
0x01343d36
0x01343d43
0x01343d4b
0x01343d4d
0x00000000
0x01343d4d
0x01343d14
0x01343d14
0x00000000
0x01343d14
0x01343d12
0x01343c96
0x01343c96
0x01343c99
0x01343c9d
0x01343ca1
0x01343cae
0x01343cb6
0x01343cb8
0x00000000
0x01343cb8
0x01343c7f
0x01343c7f
0x00000000
0x01343c7f
0x01343c7d

APIs

__EH_prolog3.LIBCMT ref: 01343C46
std::_Lockit::_Lockit.LIBCPMT ref: 01343C50

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01343CA1
std::_Lockit::~_Lockit.LIBCPMT ref: 01343CC1

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 47af21057bead64497a72030042935df3178728d148ba79c6a1f2e0a23978d87
Instruction ID: a123568c399d7b6168290e15363f944f279450a249250f9433167bb8c24551c8
Opcode Fuzzy Hash: 47af21057bead64497a72030042935df3178728d148ba79c6a1f2e0a23978d87
Instruction Fuzzy Hash: 1201AD3590022A9BCF15ABA8D4047AEBBA5BF94728F244409D824AB280DF34EE058B95

Uniqueness

Uniqueness Score: -1.00%

Function 01343CD4 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01343CD4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t23;
				void* _t28;
				intOrPtr* _t46;
				intOrPtr* _t53;
				intOrPtr* _t54;
				void* _t56;

				_t40 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5(_t56 - 0x14, 0);
				_t53 =  *0x1384aa0; // 0x0
				 *(_t56 - 4) =  *(_t56 - 4) & 0x00000000;
				 *((intOrPtr*)(_t56 - 0x10)) = _t53;
				_t23 = E0132BD50( *((intOrPtr*)(_t56 + 8)), E0132BCE0());
				_t51 = _t23;
				if(_t23 != 0) {
					L5:
					E01335EFD(_t56 - 0x14);
					return E013481F0(_t51);
				} else {
					if(_t53 == 0) {
						_push( *((intOrPtr*)(_t56 + 8)));
						_push(_t56 - 0x10);
						_t28 = E013441BF(__ebx, _t51, _t53, __eflags);
						_pop(_t46);
						__eflags = _t28 - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(4);
							E01348213(0x136bdf5, __ebx, _t51, _t53);
							_t54 = _t46;
							 *((intOrPtr*)(_t56 - 0x10)) = _t54;
							 *((intOrPtr*)(_t54 + 4)) =  *((intOrPtr*)(_t56 + 0xc));
							_push( *((intOrPtr*)(_t56 + 8)));
							_t17 = _t56 - 4;
							 *_t17 =  *(_t56 - 4) & 0x00000000;
							__eflags =  *_t17;
							 *_t54 = 0x136ecc0;
							E01344EBF(_t40, _t46, _t51, _t54,  *_t17);
							return E013481F0(_t54);
						} else {
							_t51 =  *((intOrPtr*)(_t56 - 0x10));
							 *((intOrPtr*)(_t56 - 0x10)) = _t51;
							 *(_t56 - 4) = 1;
							E01335C34(_t51);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t51 + 4))))();
							 *0x1384aa0 = _t51;
							goto L5;
						}
					} else {
						_t51 = _t53;
						goto L5;
					}
				}
			}

0x01343cd4
0x01343cd4
0x01343cdb
0x01343ce5
0x01343cea
0x01343cf5
0x01343cf9
0x01343d05
0x01343d0a
0x01343d0e
0x01343d53
0x01343d56
0x01343d62
0x01343d10
0x01343d12
0x01343d18
0x01343d1e
0x01343d1f
0x01343d25
0x01343d26
0x01343d29
0x01343d63
0x01343d68
0x01343d69
0x01343d70
0x01343d75
0x01343d77
0x01343d7d
0x01343d80
0x01343d83
0x01343d83
0x01343d83
0x01343d87
0x01343d8d
0x01343d99
0x01343d2b
0x01343d2b
0x01343d2e
0x01343d32
0x01343d36
0x01343d43
0x01343d4b
0x01343d4d
0x00000000
0x01343d4d
0x01343d14
0x01343d14
0x00000000
0x01343d14
0x01343d12

APIs

__EH_prolog3.LIBCMT ref: 01343CDB
std::_Lockit::_Lockit.LIBCPMT ref: 01343CE5

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01343D36
std::_Lockit::~_Lockit.LIBCPMT ref: 01343D56

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 73a3facaf932ab988b7db02c992d4546cf764dec67e3d5aa1c271a01530ed44e
Instruction ID: 4bf9c04374d85e9bf1f7e2a0a8dd20915b7875be7ef94af21445af7c7c9c21ce
Opcode Fuzzy Hash: 73a3facaf932ab988b7db02c992d4546cf764dec67e3d5aa1c271a01530ed44e
Instruction Fuzzy Hash: 3F01D23590022A9FCF15FFACD4447AEBBB5BF90328F644509D511AB290DF34AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01337F06 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E01337F06(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				void* _v20;
				intOrPtr* _t84;
				void* _t144;
				intOrPtr* _t147;
				void* _t210;
				intOrPtr _t211;
				intOrPtr* _t234;
				intOrPtr* _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				intOrPtr* _t238;
				void* _t239;
				void* _t242;
				intOrPtr* _t243;
				intOrPtr* _t244;
				intOrPtr* _t245;
				intOrPtr* _t246;
				void* _t247;
				void* _t248;

				_t231 = __edx;
				_t174 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t242 =  *0x1384a0c; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t242;
				_t84 = E0132BD50(_a8, E0132BCE0());
				_t233 = _t84;
				if(_t84 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t233);
				} else {
					if(_t242 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01339321(__ebx, _t233, _t242, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t233, _t242);
							E01335EA5( &_v20, 0);
							_t243 =  *0x1384a38; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t243;
							_t234 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t234;
							if(_t234 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t234);
							} else {
								__eflags = _t243;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01339389(_t174, _t234, _t243, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t174, _t234, _t243);
										E01335EA5( &_v20, 0);
										_t244 =  *0x1384a3c; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t244;
										_t235 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t235;
										if(_t235 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t235);
										} else {
											__eflags = _t244;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E013393F1(_t174, __edx, _t235, _t244, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t174, _t235, _t244);
													E01335EA5( &_v20, 0);
													_t245 =  *0x1384a58; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t245;
													_t236 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t236;
													if(_t236 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t236);
													} else {
														__eflags = _t245;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E0133946C(_t174, _t236, _t245, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t174, _t236, _t245);
																E01335EA5( &_v20, 0);
																_t246 =  *0x1384a28; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t246;
																_t237 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t237;
																if(_t237 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t237);
																} else {
																	__eflags = _t246;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E013394D8(_t174, _t237, _t246, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t174, _t237, _t246);
																			E01335EA5( &_v20, 0);
																			_t247 =  *0x1384a5c; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t247;
																			_t238 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t238;
																			if(_t238 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t238);
																			} else {
																				__eflags = _t247;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					_t144 = E01339544(_t174, _t238, _t247, __eflags);
																					_pop(_t210);
																					__eflags = _t144 - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(_t247);
																						_push(_t238);
																						_t248 = _t210;
																						_t239 = _t248;
																						asm("stosd");
																						asm("stosd");
																						asm("stosd");
																						asm("stosd");
																						_t147 = _v20;
																						 *(_t248 + 0x10) =  *(_t248 + 0x10) & 0x00000000;
																						 *(_t248 + 0x14) =  *(_t248 + 0x14) & 0x00000000;
																						__eflags =  *((intOrPtr*)(_t147 + 0x14)) - 8;
																						_t211 =  *((intOrPtr*)(_t147 + 0x10));
																						if( *((intOrPtr*)(_t147 + 0x14)) >= 8) {
																							_t147 =  *_t147;
																						}
																						_push(_t211);
																						E0133657C(_t174, _t248, _t231, _t239, _t147);
																						return _t248;
																					} else {
																						_t238 = _v16;
																						_v16 = _t238;
																						_v4 = 1;
																						E01335C34(_t238);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t238 + 4))))();
																						 *0x1384a5c = _t238;
																						goto L40;
																					}
																				} else {
																					_t238 = _t247;
																					goto L40;
																				}
																			}
																		} else {
																			_t237 = _v16;
																			_v16 = _t237;
																			_v4 = 1;
																			E01335C34(_t237);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t237 + 4))))();
																			 *0x1384a28 = _t237;
																			goto L33;
																		}
																	} else {
																		_t237 = _t246;
																		goto L33;
																	}
																}
															} else {
																_t236 = _v16;
																_v16 = _t236;
																_v4 = 1;
																E01335C34(_t236);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t236 + 4))))();
																 *0x1384a58 = _t236;
																goto L26;
															}
														} else {
															_t236 = _t245;
															goto L26;
														}
													}
												} else {
													_t235 = _v16;
													_v16 = _t235;
													_v4 = 1;
													E01335C34(_t235);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t235 + 4))))();
													 *0x1384a3c = _t235;
													goto L19;
												}
											} else {
												_t235 = _t244;
												goto L19;
											}
										}
									} else {
										_t234 = _v16;
										_v16 = _t234;
										_v4 = 1;
										E01335C34(_t234);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t234 + 4))))();
										 *0x1384a38 = _t234;
										goto L12;
									}
								} else {
									_t234 = _t243;
									goto L12;
								}
							}
						} else {
							_t233 = _v16;
							_v16 = _t233;
							_v4 = 1;
							E01335C34(_t233);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t233 + 4))))();
							 *0x1384a0c = _t233;
							goto L5;
						}
					} else {
						_t233 = _t242;
						goto L5;
					}
				}
			}

0x01337f06
0x01337f06
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f37
0x01337f3c
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44

APIs

__EH_prolog3.LIBCMT ref: 01337F0D
std::_Lockit::_Lockit.LIBCPMT ref: 01337F17

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01337F68
std::_Lockit::~_Lockit.LIBCPMT ref: 01337F88

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 65a26e3d9146197f2def0d3c45879446e39b68083938bfa4dbc702c87c8cb15b
Instruction ID: 4bd972469faf662bdce1bbd149fe2a69211f105a05ed17f59b52885c60447335
Opcode Fuzzy Hash: 65a26e3d9146197f2def0d3c45879446e39b68083938bfa4dbc702c87c8cb15b
Instruction Fuzzy Hash: F401807590022ADBCB15FBACC4447BEBBA5BFD0328F248549D510AB281DF749A058B95

Uniqueness

Uniqueness Score: -1.00%

Function 01337F9B Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E01337F9B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _t72;
				void* _t121;
				intOrPtr* _t124;
				void* _t177;
				intOrPtr _t178;
				intOrPtr* _t198;
				intOrPtr* _t199;
				intOrPtr* _t200;
				intOrPtr* _t201;
				void* _t202;
				void* _t205;
				intOrPtr* _t206;
				intOrPtr* _t207;
				intOrPtr* _t208;
				void* _t209;
				void* _t210;

				_t195 = __edx;
				_t147 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t205 =  *0x1384a38; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t205;
				_t72 = E0132BD50(_a8, E0132BCE0());
				_t197 = _t72;
				if(_t72 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t197);
				} else {
					if(_t205 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E01339389(__ebx, _t197, _t205, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t197, _t205);
							E01335EA5( &_v20, 0);
							_t206 =  *0x1384a3c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t206;
							_t198 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t198;
							if(_t198 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t198);
							} else {
								__eflags = _t206;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E013393F1(_t147, __edx, _t198, _t206, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t147, _t198, _t206);
										E01335EA5( &_v20, 0);
										_t207 =  *0x1384a58; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t207;
										_t199 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t199;
										if(_t199 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t199);
										} else {
											__eflags = _t207;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E0133946C(_t147, _t199, _t207, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t147, _t199, _t207);
													E01335EA5( &_v20, 0);
													_t208 =  *0x1384a28; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t208;
													_t200 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t200;
													if(_t200 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t200);
													} else {
														__eflags = _t208;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E013394D8(_t147, _t200, _t208, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t147, _t200, _t208);
																E01335EA5( &_v20, 0);
																_t209 =  *0x1384a5c; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t209;
																_t201 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t201;
																if(_t201 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t201);
																} else {
																	__eflags = _t209;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		_t121 = E01339544(_t147, _t201, _t209, __eflags);
																		_pop(_t177);
																		__eflags = _t121 - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(_t209);
																			_push(_t201);
																			_t210 = _t177;
																			_t202 = _t210;
																			asm("stosd");
																			asm("stosd");
																			asm("stosd");
																			asm("stosd");
																			_t124 = _v16;
																			 *(_t210 + 0x10) =  *(_t210 + 0x10) & 0x00000000;
																			 *(_t210 + 0x14) =  *(_t210 + 0x14) & 0x00000000;
																			__eflags =  *((intOrPtr*)(_t124 + 0x14)) - 8;
																			_t178 =  *((intOrPtr*)(_t124 + 0x10));
																			if( *((intOrPtr*)(_t124 + 0x14)) >= 8) {
																				_t124 =  *_t124;
																			}
																			_push(_t178);
																			E0133657C(_t147, _t210, _t195, _t202, _t124);
																			return _t210;
																		} else {
																			_t201 = _v16;
																			_v16 = _t201;
																			_v4 = 1;
																			E01335C34(_t201);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t201 + 4))))();
																			 *0x1384a5c = _t201;
																			goto L33;
																		}
																	} else {
																		_t201 = _t209;
																		goto L33;
																	}
																}
															} else {
																_t200 = _v16;
																_v16 = _t200;
																_v4 = 1;
																E01335C34(_t200);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t200 + 4))))();
																 *0x1384a28 = _t200;
																goto L26;
															}
														} else {
															_t200 = _t208;
															goto L26;
														}
													}
												} else {
													_t199 = _v16;
													_v16 = _t199;
													_v4 = 1;
													E01335C34(_t199);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t199 + 4))))();
													 *0x1384a58 = _t199;
													goto L19;
												}
											} else {
												_t199 = _t207;
												goto L19;
											}
										}
									} else {
										_t198 = _v16;
										_v16 = _t198;
										_v4 = 1;
										E01335C34(_t198);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t198 + 4))))();
										 *0x1384a3c = _t198;
										goto L12;
									}
								} else {
									_t198 = _t206;
									goto L12;
								}
							}
						} else {
							_t197 = _v16;
							_v16 = _t197;
							_v4 = 1;
							E01335C34(_t197);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t197 + 4))))();
							 *0x1384a38 = _t197;
							goto L5;
						}
					} else {
						_t197 = _t205;
						goto L5;
					}
				}
			}

0x01337f9b
0x01337f9b
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fcc
0x01337fd1
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9

APIs

__EH_prolog3.LIBCMT ref: 01337FA2
std::_Lockit::_Lockit.LIBCPMT ref: 01337FAC

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01337FFD
std::_Lockit::~_Lockit.LIBCPMT ref: 0133801D

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 8d05618663fef792dc4624dcc2ce229c2cee89ebc9de29481fecbabd2706fa57
Instruction ID: b417faa4711f6ac951505d44b13ec32b28983d64336c44a5860e6c9312f0b29b
Opcode Fuzzy Hash: 8d05618663fef792dc4624dcc2ce229c2cee89ebc9de29481fecbabd2706fa57
Instruction Fuzzy Hash: A201D23590022ADBCF11FBACC4447AEBBB5BFE0328F254149E910AB280DF749E058B95

Uniqueness

Uniqueness Score: -1.00%

Function 01337E71 Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E01337E71(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				char _v20;
				intOrPtr* _v24;
				intOrPtr* _t96;
				void* _t167;
				intOrPtr* _t170;
				void* _t243;
				intOrPtr _t244;
				intOrPtr* _t270;
				intOrPtr* _t271;
				intOrPtr* _t272;
				intOrPtr* _t273;
				intOrPtr* _t274;
				intOrPtr* _t275;
				void* _t276;
				void* _t279;
				intOrPtr* _t280;
				intOrPtr* _t281;
				intOrPtr* _t282;
				intOrPtr* _t283;
				intOrPtr* _t284;
				void* _t285;
				void* _t286;

				_t267 = __edx;
				_t201 = __ebx;
				_push(8);
				E01348213(0x136b979, __ebx, __edi, __esi);
				E01335EA5( &_v20, 0);
				_t279 =  *0x1384a34; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t279;
				_t96 = E0132BD50(_a8, E0132BCE0());
				_t269 = _t96;
				if(_t96 != 0) {
					L5:
					E01335EFD( &_v20);
					return E013481F0(_t269);
				} else {
					if(_t279 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E013392B9(__ebx, _t269, _t279, __eflags) - 0xffffffff;
						if(__eflags == 0) {
							E0132C550(__eflags);
							asm("int3");
							_push(8);
							E01348213(0x136b979, __ebx, _t269, _t279);
							E01335EA5( &_v20, 0);
							_t280 =  *0x1384a0c; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t280;
							_t270 = E0132BD50(_a8, E0132BCE0());
							__eflags = _t270;
							if(_t270 != 0) {
								L12:
								E01335EFD( &_v20);
								return E013481F0(_t270);
							} else {
								__eflags = _t280;
								if(__eflags == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E01339321(_t201, _t270, _t280, __eflags) - 0xffffffff;
									if(__eflags == 0) {
										E0132C550(__eflags);
										asm("int3");
										_push(8);
										E01348213(0x136b979, _t201, _t270, _t280);
										E01335EA5( &_v20, 0);
										_t281 =  *0x1384a38; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t281;
										_t271 = E0132BD50(_a8, E0132BCE0());
										__eflags = _t271;
										if(_t271 != 0) {
											L19:
											E01335EFD( &_v20);
											return E013481F0(_t271);
										} else {
											__eflags = _t281;
											if(__eflags == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E01339389(_t201, _t271, _t281, __eflags) - 0xffffffff;
												if(__eflags == 0) {
													E0132C550(__eflags);
													asm("int3");
													_push(8);
													E01348213(0x136b979, _t201, _t271, _t281);
													E01335EA5( &_v20, 0);
													_t282 =  *0x1384a3c; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t282;
													_t272 = E0132BD50(_a8, E0132BCE0());
													__eflags = _t272;
													if(_t272 != 0) {
														L26:
														E01335EFD( &_v20);
														return E013481F0(_t272);
													} else {
														__eflags = _t282;
														if(__eflags == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E013393F1(_t201, __edx, _t272, _t282, __eflags) - 0xffffffff;
															if(__eflags == 0) {
																E0132C550(__eflags);
																asm("int3");
																_push(8);
																E01348213(0x136b979, _t201, _t272, _t282);
																E01335EA5( &_v20, 0);
																_t283 =  *0x1384a58; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t283;
																_t273 = E0132BD50(_a8, E0132BCE0());
																__eflags = _t273;
																if(_t273 != 0) {
																	L33:
																	E01335EFD( &_v20);
																	return E013481F0(_t273);
																} else {
																	__eflags = _t283;
																	if(__eflags == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E0133946C(_t201, _t273, _t283, __eflags) - 0xffffffff;
																		if(__eflags == 0) {
																			E0132C550(__eflags);
																			asm("int3");
																			_push(8);
																			E01348213(0x136b979, _t201, _t273, _t283);
																			E01335EA5( &_v20, 0);
																			_t284 =  *0x1384a28; // 0x0
																			_v4 = _v4 & 0x00000000;
																			_v16 = _t284;
																			_t274 = E0132BD50(_a8, E0132BCE0());
																			__eflags = _t274;
																			if(_t274 != 0) {
																				L40:
																				E01335EFD( &_v20);
																				return E013481F0(_t274);
																			} else {
																				__eflags = _t284;
																				if(__eflags == 0) {
																					_push(_a8);
																					_push( &_v16);
																					__eflags = E013394D8(_t201, _t274, _t284, __eflags) - 0xffffffff;
																					if(__eflags == 0) {
																						E0132C550(__eflags);
																						asm("int3");
																						_push(8);
																						E01348213(0x136b979, _t201, _t274, _t284);
																						E01335EA5( &_v20, 0);
																						_t285 =  *0x1384a5c; // 0x0
																						_v4 = _v4 & 0x00000000;
																						_v16 = _t285;
																						_t275 = E0132BD50(_a8, E0132BCE0());
																						__eflags = _t275;
																						if(_t275 != 0) {
																							L47:
																							E01335EFD( &_v20);
																							return E013481F0(_t275);
																						} else {
																							__eflags = _t285;
																							if(__eflags == 0) {
																								_push(_a8);
																								_push( &_v16);
																								_t167 = E01339544(_t201, _t275, _t285, __eflags);
																								_pop(_t243);
																								__eflags = _t167 - 0xffffffff;
																								if(__eflags == 0) {
																									E0132C550(__eflags);
																									asm("int3");
																									_push(_t285);
																									_push(_t275);
																									_t286 = _t243;
																									_t276 = _t286;
																									asm("stosd");
																									asm("stosd");
																									asm("stosd");
																									asm("stosd");
																									_t170 = _v24;
																									 *(_t286 + 0x10) =  *(_t286 + 0x10) & 0x00000000;
																									 *(_t286 + 0x14) =  *(_t286 + 0x14) & 0x00000000;
																									__eflags =  *((intOrPtr*)(_t170 + 0x14)) - 8;
																									_t244 =  *((intOrPtr*)(_t170 + 0x10));
																									if( *((intOrPtr*)(_t170 + 0x14)) >= 8) {
																										_t170 =  *_t170;
																									}
																									_push(_t244);
																									E0133657C(_t201, _t286, _t267, _t276, _t170);
																									return _t286;
																								} else {
																									_t275 = _v16;
																									_v16 = _t275;
																									_v4 = 1;
																									E01335C34(_t275);
																									 *0x136d26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t275 + 4))))();
																									 *0x1384a5c = _t275;
																									goto L47;
																								}
																							} else {
																								_t275 = _t285;
																								goto L47;
																							}
																						}
																					} else {
																						_t274 = _v16;
																						_v16 = _t274;
																						_v4 = 1;
																						E01335C34(_t274);
																						 *0x136d26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t274 + 4))))();
																						 *0x1384a28 = _t274;
																						goto L40;
																					}
																				} else {
																					_t274 = _t284;
																					goto L40;
																				}
																			}
																		} else {
																			_t273 = _v16;
																			_v16 = _t273;
																			_v4 = 1;
																			E01335C34(_t273);
																			 *0x136d26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t273 + 4))))();
																			 *0x1384a58 = _t273;
																			goto L33;
																		}
																	} else {
																		_t273 = _t283;
																		goto L33;
																	}
																}
															} else {
																_t272 = _v16;
																_v16 = _t272;
																_v4 = 1;
																E01335C34(_t272);
																 *0x136d26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t272 + 4))))();
																 *0x1384a3c = _t272;
																goto L26;
															}
														} else {
															_t272 = _t282;
															goto L26;
														}
													}
												} else {
													_t271 = _v16;
													_v16 = _t271;
													_v4 = 1;
													E01335C34(_t271);
													 *0x136d26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t271 + 4))))();
													 *0x1384a38 = _t271;
													goto L19;
												}
											} else {
												_t271 = _t281;
												goto L19;
											}
										}
									} else {
										_t270 = _v16;
										_v16 = _t270;
										_v4 = 1;
										E01335C34(_t270);
										 *0x136d26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t270 + 4))))();
										 *0x1384a0c = _t270;
										goto L12;
									}
								} else {
									_t270 = _t280;
									goto L12;
								}
							}
						} else {
							_t269 = _v16;
							_v16 = _t269;
							_v4 = 1;
							E01335C34(_t269);
							 *0x136d26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t269 + 4))))();
							 *0x1384a34 = _t269;
							goto L5;
						}
					} else {
						_t269 = _t279;
						goto L5;
					}
				}
			}

0x01337e71
0x01337e71
0x01337e71
0x01337e78
0x01337e82
0x01337e87
0x01337e92
0x01337e96
0x01337ea2
0x01337ea7
0x01337eab
0x01337ef0
0x01337ef3
0x01337eff
0x01337ead
0x01337eaf
0x01337eb5
0x01337ebb
0x01337ec3
0x01337ec6
0x01337f00
0x01337f05
0x01337f06
0x01337f0d
0x01337f17
0x01337f1c
0x01337f27
0x01337f2b
0x01337f3c
0x01337f3e
0x01337f40
0x01337f85
0x01337f88
0x01337f94
0x01337f42
0x01337f42
0x01337f44
0x01337f4a
0x01337f50
0x01337f58
0x01337f5b
0x01337f95
0x01337f9a
0x01337f9b
0x01337fa2
0x01337fac
0x01337fb1
0x01337fbc
0x01337fc0
0x01337fd1
0x01337fd3
0x01337fd5
0x0133801a
0x0133801d
0x01338029
0x01337fd7
0x01337fd7
0x01337fd9
0x01337fdf
0x01337fe5
0x01337fed
0x01337ff0
0x0133802a
0x0133802f
0x01338030
0x01338037
0x01338041
0x01338046
0x01338051
0x01338055
0x01338066
0x01338068
0x0133806a
0x013380af
0x013380b2
0x013380be
0x0133806c
0x0133806c
0x0133806e
0x01338074
0x0133807a
0x01338082
0x01338085
0x013380bf
0x013380c4
0x013380c5
0x013380cc
0x013380d6
0x013380db
0x013380e6
0x013380ea
0x013380fb
0x013380fd
0x013380ff
0x01338144
0x01338147
0x01338153
0x01338101
0x01338101
0x01338103
0x01338109
0x0133810f
0x01338117
0x0133811a
0x01338154
0x01338159
0x0133815a
0x01338161
0x0133816b
0x01338170
0x0133817b
0x0133817f
0x01338190
0x01338192
0x01338194
0x013381d9
0x013381dc
0x013381e8
0x01338196
0x01338196
0x01338198
0x0133819e
0x013381a4
0x013381ac
0x013381af
0x013381e9
0x013381ee
0x013381ef
0x013381f6
0x01338200
0x01338205
0x01338210
0x01338214
0x01338225
0x01338227
0x01338229
0x0133826e
0x01338271
0x0133827d
0x0133822b
0x0133822b
0x0133822d
0x01338233
0x01338239
0x0133823a
0x01338240
0x01338241
0x01338244
0x0133827e
0x01338283
0x01338287
0x01338288
0x01338289
0x0133828d
0x0133828f
0x01338290
0x01338291
0x01338292
0x01338293
0x01338296
0x0133829a
0x0133829e
0x013382a2
0x013382a5
0x013382a7
0x013382a7
0x013382a9
0x013382ad
0x013382b7
0x01338246
0x01338246
0x01338249
0x0133824d
0x01338251
0x0133825e
0x01338266
0x01338268
0x00000000
0x01338268
0x0133822f
0x0133822f
0x00000000
0x0133822f
0x0133822d
0x013381b1
0x013381b1
0x013381b4
0x013381b8
0x013381bc
0x013381c9
0x013381d1
0x013381d3
0x00000000
0x013381d3
0x0133819a
0x0133819a
0x00000000
0x0133819a
0x01338198
0x0133811c
0x0133811c
0x0133811f
0x01338123
0x01338127
0x01338134
0x0133813c
0x0133813e
0x00000000
0x0133813e
0x01338105
0x01338105
0x00000000
0x01338105
0x01338103
0x01338087
0x01338087
0x0133808a
0x0133808e
0x01338092
0x0133809f
0x013380a7
0x013380a9
0x00000000
0x013380a9
0x01338070
0x01338070
0x00000000
0x01338070
0x0133806e
0x01337ff2
0x01337ff2
0x01337ff5
0x01337ff9
0x01337ffd
0x0133800a
0x01338012
0x01338014
0x00000000
0x01338014
0x01337fdb
0x01337fdb
0x00000000
0x01337fdb
0x01337fd9
0x01337f5d
0x01337f5d
0x01337f60
0x01337f64
0x01337f68
0x01337f75
0x01337f7d
0x01337f7f
0x00000000
0x01337f7f
0x01337f46
0x01337f46
0x00000000
0x01337f46
0x01337f44
0x01337ec8
0x01337ec8
0x01337ecb
0x01337ecf
0x01337ed3
0x01337ee0
0x01337ee8
0x01337eea
0x00000000
0x01337eea
0x01337eb1
0x01337eb1
0x00000000
0x01337eb1
0x01337eaf

APIs

__EH_prolog3.LIBCMT ref: 01337E78
std::_Lockit::_Lockit.LIBCPMT ref: 01337E82

Part of subcall function 0132BCE0: std::_Lockit::_Lockit.LIBCPMT ref: 0132BD10
Part of subcall function 0132BCE0: std::_Lockit::~_Lockit.LIBCPMT ref: 0132BD38

std::_Facet_Register.LIBCPMT ref: 01337ED3
std::_Lockit::~_Lockit.LIBCPMT ref: 01337EF3

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d7d87bcc5e622fa1e69162e2bdc0e7251c57b50c84884b0e69035d62aa3965af
Instruction ID: 72950f18ddda45f6fee8cad519582b84dadcca236a7d5ce80eab4c6f5ab3ff67
Opcode Fuzzy Hash: d7d87bcc5e622fa1e69162e2bdc0e7251c57b50c84884b0e69035d62aa3965af
Instruction Fuzzy Hash: AA01D27590022B8BCF11FBACC4447AEBBB5AFD0728F254509D914AB780EF749E018B95

Uniqueness

Uniqueness Score: -1.00%

Function 01335C66 Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E01335C66(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t35;
				void* _t40;

				_push(4);
				E01348213(0x136bd8f, __ebx, __edi, __esi);
				E01335EA5(_t40 - 0x10, 0);
				_t35 =  *0x13848b8; // 0x0
				 *((intOrPtr*)(_t40 - 4)) = 0;
				if(_t35 == 0) {
					_t35 = E01335DC8(0);
					E01335DEB(_t35);
					_t3 = _t35 + 0x18; // 0x18
					 *((intOrPtr*)(_t35 + 0x10)) = 0x3f;
					E0132C8A0(_t3, 0x136e0f4);
					 *0x136d26c();
					 *((intOrPtr*)( *((intOrPtr*)( *_t35 + 4))))();
					 *0x13848ac = _t35;
					 *0x1384890 = _t35;
				}
				if( *((char*)(_t40 + 8)) != 0) {
					 *0x136d26c();
					 *((intOrPtr*)( *((intOrPtr*)( *_t35 + 4))))();
				}
				E01335EFD(_t40 - 0x10);
				return E013481F0(_t35);
			}

0x01335c66
0x01335c6d
0x01335c78
0x01335c7d
0x01335c83
0x01335c88
0x01335c90
0x01335c93
0x01335c9f
0x01335ca2
0x01335ca9
0x01335cb5
0x01335cbd
0x01335cbf
0x01335cc6
0x01335cc6
0x01335cd0
0x01335cd9
0x01335ce1
0x01335ce1
0x01335ce6
0x01335cf2

APIs

__EH_prolog3.LIBCMT ref: 01335C6D
std::_Lockit::_Lockit.LIBCPMT ref: 01335C78
std::_Lockit::~_Lockit.LIBCPMT ref: 01335CE6

Part of subcall function 01335DC8: std::locale::_Locimp::_Locimp.LIBCPMT ref: 01335DE0

std::locale::_Setgloballocale.LIBCPMT ref: 01335C93

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 5d3a4f8824a548e131954ddcc43812bd8e63eb5fa3295b28948f468922d7ee23
Instruction ID: 067ea858142561f332bdb05bf2252d6d1ed4398996c1d82ed0d34c674b734711
Opcode Fuzzy Hash: 5d3a4f8824a548e131954ddcc43812bd8e63eb5fa3295b28948f468922d7ee23
Instruction Fuzzy Hash: 5501DF75A002629BDB06FF68D80467D7FA5BFD4758B148009D81157384CF34AA03CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 01368C76 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E01368C76(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x1383a30, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E01368C5F();
					E01368C21();
					_t13 = WriteConsoleW( *0x1383a30, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x01368c93
0x01368c97
0x01368ca4
0x01368ca9
0x01368cc4
0x01368cc4
0x01368cca

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,01368643,?,00000001,?,?,?,01367788,?,?,00000000), ref: 01368C8D
GetLastError.KERNEL32(?,01368643,?,00000001,?,?,?,01367788,?,?,00000000,?,?,?,01367D0F,?), ref: 01368C99

Part of subcall function 01368C5F: CloseHandle.KERNEL32(FFFFFFFE,01368CA9,?,01368643,?,00000001,?,?,?,01367788,?,?,00000000,?,?), ref: 01368C6F

___initconout.LIBCMT ref: 01368CA9

Part of subcall function 01368C21: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,01368C50,01368630,?,?,01367788,?,?,00000000,?), ref: 01368C34

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,01368643,?,00000001,?,?,?,01367788,?,?,00000000,?), ref: 01368CBE

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ed0c3249240e4521f5dde1229f78f461616401a299b617e02b4b43622fc0523b
Instruction ID: d57f987ae145cafde7b38f7c0755cc644d2633c09c961f2c479c209c4d98adab
Opcode Fuzzy Hash: ed0c3249240e4521f5dde1229f78f461616401a299b617e02b4b43622fc0523b
Instruction Fuzzy Hash: 8FF01C36501655BBCF222FD9DD04999BF6AFF4DBA0F108450FE1995228D632C820EB91

Uniqueness

Uniqueness Score: -1.00%

Function 013478FD Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E013478FD(long _a4) {
				long _t3;
				intOrPtr* _t7;

				_t7 =  *0x1384b10;
				if(_t7 == 0) {
					LeaveCriticalSection(0x1384af8);
					_t3 = WaitForSingleObjectEx( *0x1384af4, _a4, 0);
					EnterCriticalSection(0x1384af8);
					return _t3;
				}
				 *0x136d26c(0x1384af0, 0x1384af8, _a4);
				return  *_t7();
			}

0x01347901
0x01347909
0x0134792a
0x0134793b
0x01347942
0x00000000
0x01347942
0x0134791a
0x00000000

APIs

SleepConditionVariableCS.KERNELBASE(?,0134789A,00000064), ref: 01347920
LeaveCriticalSection.KERNEL32(01384AF8,?,?,0134789A,00000064,?,?,013225B6,0138571C,C9209188,?,00000000,013693ED,000000FF,?,01321A26), ref: 0134792A
WaitForSingleObjectEx.KERNEL32(?,00000000,?,0134789A,00000064,?,?,013225B6,0138571C,C9209188,?,00000000,013693ED,000000FF,?,01321A26), ref: 0134793B
EnterCriticalSection.KERNEL32(01384AF8,?,0134789A,00000064,?,?,013225B6,0138571C,C9209188,?,00000000,013693ED,000000FF,?,01321A26), ref: 01347942

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 3856065ee6b7d236685a04caa704bc6bed2b88e7d9e71d693c8405dac4dd2349
Instruction ID: f1fbe66c84596daa4f308a897869f4834cd499864f0eadf96380d3ff9839c6be
Opcode Fuzzy Hash: 3856065ee6b7d236685a04caa704bc6bed2b88e7d9e71d693c8405dac4dd2349
Instruction Fuzzy Hash: 68E09235A45326E7DB222B91EC08F9DBF5CEF05B69F018014F5456AA24CBB418008BD8

Uniqueness

Uniqueness Score: -1.00%

Function 0135709D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0135712D

Strings

pow, xrefs: 01357105, 01357122

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: a781087d61c2ed31a99aab93f1ef0e1627368320a1a69e5bb38e58c4066004ae
Instruction ID: aa56609f80fb7673fb36eae5c222fca6c6511f8162fcdfd393e420e1b54edfc2
Opcode Fuzzy Hash: a781087d61c2ed31a99aab93f1ef0e1627368320a1a69e5bb38e58c4066004ae
Instruction Fuzzy Hash: 54517D61A0860796EBA6771CD940F7E7FEDEB40F58F604D59EC91422D9EB3084918F42

Uniqueness

Uniqueness Score: -1.00%

Function 01346C34 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E01346C34(void* __ecx, signed char* _a4, signed char* _a8, signed int _a12, signed int* _a16) {
				char _v5;
				char _v6;
				signed int _v12;
				signed char* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed char* _v32;
				void* __ebx;
				signed int* _t39;
				signed int _t40;
				void* _t41;
				char _t42;
				signed char* _t43;
				signed int _t44;
				signed char _t45;
				signed char _t46;
				signed char _t47;
				void* _t52;
				signed char* _t56;
				void* _t59;
				signed char _t61;
				signed char* _t63;
				signed int _t65;
				void* _t66;
				signed int _t67;
				void* _t69;
				signed char* _t74;
				signed char** _t75;
				void* _t77;
				signed char* _t78;
				signed int _t79;
				signed int _t83;
				signed int _t85;
				signed char* _t87;
				void* _t89;
				void* _t90;

				_t66 = __ecx;
				_t39 = _a16;
				_t90 = _t89 - 0x1c;
				if(_t39 != 0) {
					 *_t39 =  *_t39 & 0x00000000;
				}
				_t63 = _a4;
				_t87 = _t63;
				_t40 =  *_t63 & 0x000000ff;
				L4:
				_t41 = E01357400(_t63, _t66, _t79, _t40);
				_pop(_t66);
				if(_t41 != 0) {
					_t87 =  &(_t87[1]);
					__eflags = _t87;
					_t40 =  *_t87 & 0x000000ff;
					goto L4;
				}
				_t42 =  *_t87;
				_v6 = _t42;
				if(_t42 == 0x2d || _t42 == 0x2b) {
					_t87 =  &(_t87[1]);
					__eflags = _t87;
				} else {
					_v6 = 0x2b;
				}
				_t83 = _a12;
				if(_t83 < 0 || _t83 == 1 || _t83 > 0x24) {
					_t43 = _a8;
					__eflags = _t43;
					if(_t43 != 0) {
						 *_t43 = _t63;
					}
					goto L52;
				} else {
					if(_t83 <= 0) {
						_t45 =  *_t87;
						__eflags = _t45 - 0x30;
						if(_t45 == 0x30) {
							_t46 = _t87[1];
							__eflags = _t46 - 0x78;
							if(_t46 == 0x78) {
								L26:
								_t83 = 0x10;
								L27:
								_t87 =  &(_t87[2]);
								L28:
								_v20 = _t83;
								_v16 = _t87;
								L24:
								_t45 =  *_t87;
								if(_t45 == 0x30) {
									L23:
									_t87 =  &(_t87[1]);
									__eflags = _t87;
									goto L24;
								}
								L25:
								_t67 = 0;
								_v32 = _t87;
								_t65 = 0;
								_v24 = 0;
								_v28 = 0;
								_v5 = 0;
								_t47 = _t45;
								while(1) {
									_v12 = _t67;
									_t69 = E01349730("0123456789abcdefghijklmnopqrstuvwxyz", E0135113B(_t47), _t83);
									_t90 = _t90 + 0xc;
									if(_t69 == 0) {
										break;
									}
									_t51 = _v12;
									_t79 = "0123456789abcdefghijklmnopqrstuvwxyz";
									_v24 = _v12;
									_v28 = _t65;
									_v5 = _t69 - _t79;
									_t52 = E013482C0(_t83, 0, _t51, _t65);
									_t65 = _t79;
									asm("cdq");
									_t67 = _t52 + _v5;
									asm("adc ebx, edx");
									_t87 =  &(_t87[1]);
									__eflags = _t87;
									_t47 =  *_t87;
								}
								if(_v16 != _t87) {
									_t27 = _t83 + 0x136ed94; // 0x10101011
									_t74 = _t87 -  *_t27 - _v32;
									__eflags = _t74;
									if(_t74 < 0) {
										_t85 = _v12;
										L45:
										__eflags = _v6 - 0x2d;
										if(_v6 == 0x2d) {
											_t85 =  ~_t85;
											asm("adc ebx, 0x0");
											_t65 =  ~_t65;
										}
										L47:
										_t75 = _a8;
										__eflags = _t75;
										if(_t75 != 0) {
											 *_t75 = _t87;
										}
										_t44 = _t85;
										L53:
										return _t44;
									}
									__eflags = _t74;
									if(_t74 > 0) {
										L41:
										 *((intOrPtr*)(E0134C6B0())) = 0x22;
										_t56 = _a16;
										__eflags = _t56;
										if(_t56 != 0) {
											 *_t56 = 1;
										}
										_t85 = _t83 | 0xffffffff;
										_t65 = _t85;
										goto L47;
									}
									_t83 = _v12;
									asm("cdq");
									_t77 = _t83 - _v5;
									_t58 = _t65;
									asm("sbb eax, edx");
									__eflags = _t65 - _t65;
									if(__eflags < 0) {
										goto L41;
									}
									if(__eflags > 0) {
										L39:
										_t59 = E01348300(_t77, _t58, _v20, 0);
										__eflags = _t59 - _v24;
										if(_t59 != _v24) {
											goto L41;
										}
										__eflags = _t79 - _v28;
										if(_t79 == _v28) {
											goto L45;
										}
										goto L41;
									}
									__eflags = _t83 - _t77;
									if(_t83 < _t77) {
										goto L41;
									}
									goto L39;
								}
								_t78 = _a8;
								if(_t78 != 0) {
									 *_t78 = _a4;
								}
								L52:
								_t44 = 0;
								goto L53;
							}
							__eflags = _t46 - 0x58;
							if(_t46 == 0x58) {
								goto L26;
							}
							_t83 = 8;
							_v20 = _t83;
							_v16 = _t87;
							goto L23;
						}
						_t83 = 0xa;
						_v20 = _t83;
						_v16 = _t87;
						goto L25;
					}
					if(_t83 != 0x10 ||  *_t87 != 0x30) {
						goto L28;
					} else {
						_t61 = _t87[1];
						if(_t61 == 0x78) {
							goto L27;
						}
						if(_t61 != 0x58) {
							goto L28;
						}
						goto L27;
					}
				}
			}

0x01346c34
0x01346c37
0x01346c3a
0x01346c3f
0x01346c41
0x01346c41
0x01346c45
0x01346c4a
0x01346c4c
0x01346c55
0x01346c56
0x01346c5b
0x01346c5e
0x01346c51
0x01346c51
0x01346c52
0x00000000
0x01346c52
0x01346c60
0x01346c62
0x01346c67
0x01346c73
0x01346c73
0x01346c6d
0x01346c6d
0x01346c6d
0x01346c74
0x01346c79
0x01346de5
0x01346de8
0x01346dea
0x01346dec
0x01346dec
0x00000000
0x01346c91
0x01346c93
0x01346cac
0x01346cae
0x01346cb0
0x01346cbd
0x01346cc0
0x01346cc2
0x01346ced
0x01346cef
0x01346cf0
0x01346cf0
0x01346cf3
0x01346cf3
0x01346cf6
0x01346cd2
0x01346cd2
0x01346cd6
0x01346cd1
0x01346cd1
0x01346cd1
0x00000000
0x01346cd1
0x01346cd8
0x01346cd8
0x01346cda
0x01346cdd
0x01346cdf
0x01346ce2
0x01346ce5
0x01346ce8
0x01346d29
0x01346d2b
0x01346d40
0x01346d42
0x01346d47
0x00000000
0x00000000
0x01346cfb
0x01346cfe
0x01346d09
0x01346d0d
0x01346d10
0x01346d13
0x01346d1a
0x01346d20
0x01346d21
0x01346d23
0x01346d25
0x01346d25
0x01346d26
0x01346d26
0x01346d4c
0x01346d63
0x01346d6e
0x01346d6e
0x01346d71
0x01346dc6
0x01346dc9
0x01346dc9
0x01346dcd
0x01346dcf
0x01346dd1
0x01346dd4
0x01346dd4
0x01346dd6
0x01346dd6
0x01346dd9
0x01346ddb
0x01346ddd
0x01346ddd
0x01346ddf
0x01346df2
0x01346df6
0x01346df6
0x01346d73
0x01346d75
0x01346da7
0x01346dac
0x01346db2
0x01346db5
0x01346db7
0x01346db9
0x01346db9
0x01346dbf
0x01346dc2
0x00000000
0x01346dc2
0x01346d7b
0x01346d80
0x01346d81
0x01346d83
0x01346d85
0x01346d87
0x01346d89
0x00000000
0x00000000
0x01346d8b
0x01346d91
0x01346d98
0x01346d9d
0x01346da0
0x00000000
0x00000000
0x01346da2
0x01346da5
0x00000000
0x00000000
0x00000000
0x01346da5
0x01346d8d
0x01346d8f
0x00000000
0x00000000
0x00000000
0x01346d8f
0x01346d4e
0x01346d53
0x01346d5c
0x01346d5c
0x01346dee
0x01346dee
0x00000000
0x01346df0
0x01346cc4
0x01346cc6
0x00000000
0x00000000
0x01346cca
0x01346ccb
0x01346cce
0x00000000
0x01346cce
0x01346cb4
0x01346cb5
0x01346cb8
0x00000000
0x01346cb8
0x01346c98
0x00000000
0x01346c9f
0x01346c9f
0x01346ca4
0x00000000
0x00000000
0x01346ca8
0x00000000
0x00000000
0x00000000
0x01346caa
0x01346c98

APIs

__aulldiv.LIBCMT ref: 01346D98

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 01346CFE, 01346D35, 01346D3A
-, xrefs: 01346DC9

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: bc8661ab4b498279d30e3eca51bc05908ca93fb20bfc4c0451be068cf0e0d170
Instruction ID: 0f962f1e126babceead7bf74515403c141cd11c59a3477eea7140b5c84f6329d
Opcode Fuzzy Hash: bc8661ab4b498279d30e3eca51bc05908ca93fb20bfc4c0451be068cf0e0d170
Instruction Fuzzy Hash: 725115F0E042595BDF299F6C88527BEBFFAEF47208F04406AD9C1D7245C270A9828B94

Uniqueness

Uniqueness Score: -1.00%

Function 0132F860 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 167
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0132F860(void* __ebx, signed short __ecx) {
				intOrPtr _v8;
				signed short _v16;
				signed short _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				char _v76;
				char _v80;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				signed short _v96;
				signed short _v100;
				char _v148;
				signed short _v168;
				char _v176;
				signed short _v180;
				char _v184;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t65;
				signed int _t66;
				void* _t70;
				intOrPtr _t74;
				signed short _t75;
				signed int _t79;
				void* _t86;
				signed int _t96;
				void* _t111;
				intOrPtr* _t114;
				void* _t115;
				signed short _t116;
				intOrPtr _t119;
				void* _t124;
				void* _t125;
				intOrPtr _t127;
				intOrPtr* _t128;
				signed short _t129;
				intOrPtr* _t130;
				void* _t132;
				signed short _t134;
				signed int _t135;
				void* _t137;
				signed int _t140;
				void* _t144;
				signed int _t147;
				void* _t150;
				signed int _t151;
				void* _t152;
				void* _t161;

				_push(__ebx);
				_t111 = _t144;
				_t147 = (_t144 - 0x00000008 & 0xfffffff8) + 4;
				_v8 =  *((intOrPtr*)(_t111 + 4));
				_t140 = _t147;
				_push(0xffffffff);
				_push(0x136b2fd);
				_push( *[fs:0x0]);
				_push(_t111);
				_t65 =  *0x1383020; // 0xc9209188
				_t66 = _t65 ^ _t140;
				_v32 = _t66;
				_push(_t66);
				 *[fs:0x0] =  &_v24;
				_t134 = __ecx;
				_t127 = E01356A36(_t124, __ecx);
				_v88 = _t127;
				_t70 = E01336203(_t161,  &_v148);
				_v100 = _t134;
				asm("movups xmm0, [eax]");
				asm("movups [ebp-0x40], xmm0");
				asm("movups xmm0, [eax+0x10]");
				asm("movups [ebp-0x30], xmm0");
				asm("movq xmm0, [eax+0x20]");
				asm("movq [ebp-0x20], xmm0");
				_v36 =  *((intOrPtr*)(_t70 + 0x28));
				 *(_t134 + 8) = 0;
				 *(_t134 + 0x10) = 0;
				 *(_t134 + 0x14) = 0;
				_v16 = 0;
				E01336203(_t161,  &_v148);
				_t150 = _t147 - 0x78 + 8;
				if( *((char*)(_t111 + 0xc)) == 0) {
					_t128 =  *((intOrPtr*)(_t127 + 8));
				} else {
					_t128 = 0x137b6c9;
				}
				_t114 = _t128;
				_t17 = _t114 + 1; // 0x137b6ca
				_t125 = _t17;
				do {
					_t74 =  *_t114;
					_t114 = _t114 + 1;
				} while (_t74 != 0);
				_t115 = _t114 - _t125;
				_push(1);
				_t18 = _t115 + 1; // 0x137b6cb
				_t75 = _t18;
				_push(_t75);
				_v84 = _t75;
				_t116 = E01356A5E();
				_t151 = _t150 + 8;
				_v96 = _t116;
				if(_t116 == 0) {
					E01332056(__eflags);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t140);
					_push(0xffffffff);
					_push(0x136b34e);
					_push( *[fs:0x0]);
					_t152 = _t151 - 8;
					_push(_t134);
					_push(_t128);
					_t79 =  *0x1383020; // 0xc9209188
					_push(_t79 ^ _t151);
					 *[fs:0x0] =  &_v176;
					_t129 = _t116;
					_v180 = 0;
					_v168 = 0;
					_t135 = E01356078(_t111, _t129, _t134);
					_t130 = _t129 + 8;
					_v184 = _t135;
					_v180 = 1;
					__eflags = _t130 -  &_v184;
					if(_t130 !=  &_v184) {
						E0134C213( *_t130);
						_t152 = _t152 + 4;
						 *_t130 = _t135;
						_t135 = 0;
						__eflags = 0;
						_v36 = 0;
					}
					_v32 = 1;
					__eflags = 1;
					_v32 = 0;
					_v20 = 0xffffffff;
					_t86 = E0134C213(_t135);
					 *[fs:0x0] = _v28;
					return _t86;
				} else {
					_t88 = _v84;
					if(_v84 != 0) {
						E01348FF0(_t116, _t128, _t88);
						_t116 = _v96;
						_t151 = _t151 + 0xc;
					}
					 *(_t134 + 8) = _t116;
					_push( &_v76);
					 *(_t134 + 0x10) = E0132FBD0("false", 0);
					_push( &_v76);
					 *(_t134 + 0x14) = E0132FBD0("true", 0);
					_v100 = 0;
					if( *((char*)(_t111 + 0xc)) == 0) {
						_t119 = _v88;
						 *((short*)(_t134 + 0xc)) =  *( *(_t119 + 0x30)) & 0x0000ffff;
						_t96 =  *( *(_t119 + 0x34)) & 0x0000ffff;
					} else {
						_v80 = 0x2e;
						_v84 = 0;
						asm("xorps xmm0, xmm0");
						asm("movlpd [ebp-0x50], xmm0");
						E013362D2(_t116,  &_v84,  &_v80, 1,  &_v92,  &_v76);
						 *((short*)(_t134 + 0xc)) = _v84 & 0x0000ffff;
						asm("xorps xmm0, xmm0");
						_v80 = 0x2c;
						_v84 = 0;
						asm("movlpd [ebp-0x50], xmm0");
						E013362D2(_t116,  &_v84,  &_v80, 1,  &_v92,  &_v76);
						_t96 = _v84 & 0x0000ffff;
					}
					 *(_t134 + 0xe) = _t96;
					_v16 = 0xffffffff;
					 *[fs:0x0] = _v24;
					_pop(_t132);
					_pop(_t137);
					return E01347708(_t96, _t111, _v32 ^ _t140, _t125, _t132, _t137);
				}
			}

0x0132f860
0x0132f861
0x0132f869
0x0132f870
0x0132f874
0x0132f876
0x0132f878
0x0132f883
0x0132f884
0x0132f888
0x0132f88d
0x0132f88f
0x0132f894
0x0132f898
0x0132f89e
0x0132f8a5
0x0132f8ae
0x0132f8b1
0x0132f8b9
0x0132f8bc
0x0132f8bf
0x0132f8c3
0x0132f8c7
0x0132f8cb
0x0132f8d0
0x0132f8d8
0x0132f8db
0x0132f8e2
0x0132f8e9
0x0132f8f0
0x0132f8fe
0x0132f903
0x0132f90a
0x0132f913
0x0132f90c
0x0132f90c
0x0132f90c
0x0132f916
0x0132f918
0x0132f918
0x0132f920
0x0132f920
0x0132f922
0x0132f923
0x0132f927
0x0132f929
0x0132f92b
0x0132f92b
0x0132f92e
0x0132f92f
0x0132f937
0x0132f939
0x0132f93c
0x0132f941
0x0132fa3e
0x0132fa43
0x0132fa44
0x0132fa45
0x0132fa46
0x0132fa47
0x0132fa48
0x0132fa49
0x0132fa4a
0x0132fa4b
0x0132fa4c
0x0132fa4d
0x0132fa4e
0x0132fa4f
0x0132fa50
0x0132fa53
0x0132fa55
0x0132fa60
0x0132fa61
0x0132fa64
0x0132fa65
0x0132fa66
0x0132fa6d
0x0132fa71
0x0132fa77
0x0132fa79
0x0132fa80
0x0132fa8c
0x0132fa8e
0x0132fa94
0x0132fa97
0x0132fa9e
0x0132faa0
0x0132faa4
0x0132faa9
0x0132faac
0x0132faae
0x0132faae
0x0132fab0
0x0132fab0
0x0132fab8
0x0132fabb
0x0132fabe
0x0132fac1
0x0132fac9
0x0132fad4
0x0132fae1
0x0132f947
0x0132f947
0x0132f94c
0x0132f951
0x0132f956
0x0132f959
0x0132f959
0x0132f95f
0x0132f962
0x0132f972
0x0132f978
0x0132f988
0x0132f98f
0x0132f996
0x0132fa00
0x0132fa09
0x0132fa10
0x0132f998
0x0132f99b
0x0132f9a3
0x0132f9b0
0x0132f9b7
0x0132f9bd
0x0132f9c9
0x0132f9cd
0x0132f9d3
0x0132f9d7
0x0132f9e2
0x0132f9f2
0x0132f9f7
0x0132f9fb
0x0132fa13
0x0132fa17
0x0132fa21
0x0132fa29
0x0132fa2a
0x0132fa3b
0x0132fa3b

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0132FA3E

Strings

false, xrefs: 0132F965
true, xrefs: 0132F97B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: 68d8a7d53217918fb827f0bcc30c9941b69b67a8d49a042ccf629293fa4bdae6
Instruction ID: 16cf3026e7d329289acee8100a565e5d246e6adf1c98c1a83ba41212bd12789b
Opcode Fuzzy Hash: 68d8a7d53217918fb827f0bcc30c9941b69b67a8d49a042ccf629293fa4bdae6
Instruction Fuzzy Hash: 9351C5B1D003589FDB20DFA8C841BEEBBF8FF45708F14825AE845AB241E774A649CB51

Uniqueness

Uniqueness Score: -1.00%

Function 013422AA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E013422AA(void* __ebx, intOrPtr __ecx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed char _t68;
				intOrPtr _t70;
				intOrPtr* _t73;
				signed int _t92;
				intOrPtr _t95;
				intOrPtr* _t101;
				signed int _t103;
				intOrPtr _t111;
				void* _t123;
				intOrPtr* _t126;
				void* _t132;
				signed long long* _t133;
				signed long long* _t134;
				signed long long _t143;

				_t125 = __edi;
				_push(0x64);
				_t68 = E01348246(0x136c709, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t132 - 0x70)) = __ecx;
				asm("fldz");
				_t129 =  *(_t132 + 0x18);
				asm("fcom st0, st1");
				_t101 =  *((intOrPtr*)(_t132 + 8));
				asm("fnstsw ax");
				 *(_t132 - 0x6c) =  *(_t132 + 0x18);
				 *((char*)(_t132 - 0x58)) = 0;
				st1 =  *((long long*)(_t132 + 0x20));
				if((_t68 & 0x00000005) == 0) {
					 *((char*)(_t132 - 0x58)) = 1;
					asm("fchs");
				}
				_t143 =  *0x136ebb0;
				_t103 = 0;
				asm("fcom st0, st1");
				 *((intOrPtr*)(_t132 - 0x54)) = 0;
				asm("fnstsw ax");
				if((_t68 & 0x00000041) != 0) {
					L9:
					_push(_t103);
					st0 = _t143;
					 *_t133 = _t143;
					_t70 = E0132FCF0(_t132 - 0x38, 0x28, "%.0Lf", _t103);
					_t134 =  &(_t133[2]);
					 *((intOrPtr*)(_t132 - 0x68)) = _t70;
					if(_t70 >= 0) {
						E0132FD10(_t132 - 0x64,  *((intOrPtr*)(_t129 + 0x30)));
						 *(_t132 - 4) =  *(_t132 - 4) & 0x00000000;
						_t73 = E0133780A(_t101, _t123, _t125, _t129, __eflags, _t132 - 0x64);
						 *(_t132 - 4) =  *(_t132 - 4) | 0xffffffff;
						_t126 = _t73;
						 *((intOrPtr*)(_t132 - 0x5c)) = _t126;
						E0132C710(_t132 - 0x64);
						 *0x136d26c();
						 *(_t132 - 0x60) =  *((intOrPtr*)( *((intOrPtr*)( *_t126 + 0x30))))() & 0x0000ffff;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t125 =  *((intOrPtr*)(_t132 - 0x68));
						 *((intOrPtr*)(_t132 - 0x40)) = 0;
						 *(_t132 - 0x3c) = 0;
						E013365EF(_t101, _t132 - 0x50, _t123, _t125, 0, _t125, 0x30);
						__eflags =  *(_t132 - 0x3c) - 8;
						_t111 = _t132 - 0x50;
						 *(_t132 - 4) = 1;
						if( *(_t132 - 0x3c) >= 8) {
							_t111 =  *((intOrPtr*)(_t132 - 0x50));
						}
						 *0x136d26c(_t132 - 0x38, _t132 - 0x38 + _t125, _t111);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t132 - 0x5c)))) + 0x2c))))();
						_t129 =  *(_t132 - 0x60);
						E0133F08B(_t132 - 0x50,  *((intOrPtr*)(_t132 - 0x54)), _t129);
						_push(_t129);
						E01338284(_t134 - 0x18, _t132 - 0x50);
						_push( *((intOrPtr*)(_t132 - 0x58)));
						_push( *((intOrPtr*)(_t132 + 0x1c)));
						_push( *(_t132 - 0x6c));
						_push( *((intOrPtr*)(_t132 + 0x14)));
						_push( *((intOrPtr*)(_t132 + 0x10)));
						_push( *((intOrPtr*)(_t132 + 0xc)));
						_push(_t101);
						E0133E40D(_t101, _t123, _t125, _t129, __eflags);
						_t92 =  *(_t132 - 0x3c);
						__eflags = _t92 - 8;
						if(_t92 >= 8) {
							_t117 =  *((intOrPtr*)(_t132 - 0x50));
							_t95 = 2 + _t92 * 2;
							 *((intOrPtr*)(_t132 - 0x58)) = _t95;
							 *((intOrPtr*)(_t132 - 0x54)) =  *((intOrPtr*)(_t132 - 0x50));
							__eflags = _t95 - 0x1000;
							if(_t95 >= 0x1000) {
								E01323C20(_t101, _t132 - 0x54, _t132 - 0x58);
								_t95 =  *((intOrPtr*)(_t132 - 0x58));
								_t117 =  *((intOrPtr*)(_t132 - 0x54));
							}
							_push(_t95);
							E013284D0(_t117);
						}
					} else {
						 *_t101 =  *((intOrPtr*)(_t132 + 0xc));
						 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t132 + 0x10));
					}
					return E01348204(_t101, _t125, _t129);
				} else {
					_t143 =  *0x137b930;
					while(_t103 < 0x1388) {
						_t143 = _t143 / st0;
						_t103 = _t103 + 0xa;
						asm("fxch st0, st1");
						asm("fcom st0, st2");
						asm("fnstsw ax");
						if((_t68 & 0x00000041) != 0) {
							asm("fxch st0, st1");
							continue;
						}
						st0 = _t143;
						L8:
						 *((intOrPtr*)(_t132 - 0x54)) = _t103;
						goto L9;
					}
					st1 = _t143;
					goto L8;
				}
			}

0x013422aa
0x013422aa
0x013422b1
0x013422b6
0x013422b9
0x013422be
0x013422c1
0x013422c3
0x013422c6
0x013422c8
0x013422cb
0x013422cf
0x013422d4
0x013422d6
0x013422da
0x013422da
0x013422dc
0x013422e2
0x013422e4
0x013422e6
0x013422e9
0x013422ee
0x01342317
0x01342317
0x01342319
0x0134231e
0x01342329
0x0134232e
0x01342331
0x01342336
0x01342352
0x01342357
0x0134235f
0x01342364
0x01342368
0x0134236e
0x01342371
0x0134237f
0x0134238f
0x01342397
0x01342398
0x01342399
0x0134239a
0x0134239d
0x013423a2
0x013423a5
0x013423a8
0x013423ad
0x013423b1
0x013423b4
0x013423bb
0x013423bd
0x013423bd
0x013423d5
0x013423de
0x013423e0
0x013423ea
0x013423ef
0x013423f9
0x013423fe
0x01342404
0x01342407
0x0134240a
0x0134240d
0x01342410
0x01342413
0x01342414
0x01342419
0x0134241c
0x0134241f
0x01342421
0x01342424
0x0134242b
0x0134242e
0x01342431
0x01342436
0x01342440
0x01342445
0x0134244a
0x0134244a
0x0134244d
0x0134244f
0x01342455
0x01342338
0x0134233e
0x01342340
0x01342340
0x0134245d
0x013422f0
0x013422f0
0x013422fa
0x01342302
0x01342304
0x01342307
0x01342309
0x0134230b
0x01342310
0x013422f8
0x00000000
0x013422f8
0x01342312
0x01342314
0x01342314
0x00000000
0x01342314
0x01342348
0x00000000
0x01342348

APIs

__EH_prolog3_GS.LIBCMT ref: 013422B1
_swprintf.LIBCMT ref: 01342329

Part of subcall function 0133780A: __EH_prolog3.LIBCMT ref: 01337811
Part of subcall function 0133780A: std::_Lockit::_Lockit.LIBCPMT ref: 0133781B
Part of subcall function 0133780A: std::_Lockit::~_Lockit.LIBCPMT ref: 0133788C

Strings

%.0Lf, xrefs: 01342321

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~__swprintf
String ID: %.0Lf
API String ID: 2348759532-1402515088
Opcode ID: 359c3c2eaf40de2e0765d5d0233cc92904fa0a2720a7bb086d39fc0a2e4d9585
Instruction ID: 818f10b40e88413750c8a59bec6f492f266e3b53933b0316d4618f4d4a69d1e3
Opcode Fuzzy Hash: 359c3c2eaf40de2e0765d5d0233cc92904fa0a2720a7bb086d39fc0a2e4d9585
Instruction Fuzzy Hash: 85515971D00219AFCF05EFE4D844ADEBBB9FF48704F108959E502AB294EB34A905CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0134258E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0134258E(void* __ebx, intOrPtr __ecx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed char _t68;
				intOrPtr _t70;
				intOrPtr* _t73;
				signed int _t92;
				intOrPtr _t95;
				intOrPtr* _t101;
				signed int _t103;
				intOrPtr _t111;
				void* _t123;
				intOrPtr* _t126;
				void* _t132;
				signed long long* _t133;
				signed long long* _t134;
				signed long long _t143;

				_t125 = __edi;
				_push(0x64);
				_t68 = E01348246(0x136c781, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t132 - 0x70)) = __ecx;
				asm("fldz");
				_t129 =  *(_t132 + 0x18);
				asm("fcom st0, st1");
				_t101 =  *((intOrPtr*)(_t132 + 8));
				asm("fnstsw ax");
				 *(_t132 - 0x6c) =  *(_t132 + 0x18);
				 *((char*)(_t132 - 0x58)) = 0;
				st1 =  *((long long*)(_t132 + 0x20));
				if((_t68 & 0x00000005) == 0) {
					 *((char*)(_t132 - 0x58)) = 1;
					asm("fchs");
				}
				_t143 =  *0x136ebb0;
				_t103 = 0;
				asm("fcom st0, st1");
				 *((intOrPtr*)(_t132 - 0x54)) = 0;
				asm("fnstsw ax");
				if((_t68 & 0x00000041) != 0) {
					L9:
					_push(_t103);
					st0 = _t143;
					 *_t133 = _t143;
					_t70 = E0132FCF0(_t132 - 0x38, 0x28, "%.0Lf", _t103);
					_t134 =  &(_t133[2]);
					 *((intOrPtr*)(_t132 - 0x68)) = _t70;
					if(_t70 >= 0) {
						E0132FD10(_t132 - 0x64,  *((intOrPtr*)(_t129 + 0x30)));
						 *(_t132 - 4) =  *(_t132 - 4) & 0x00000000;
						_t73 = E0132B500(_t101, _t125, _t132 - 0x64);
						 *(_t132 - 4) =  *(_t132 - 4) | 0xffffffff;
						_t126 = _t73;
						 *((intOrPtr*)(_t132 - 0x5c)) = _t126;
						E0132C710(_t132 - 0x64);
						 *0x136d26c(0x30);
						 *(_t132 - 0x60) =  *((intOrPtr*)( *((intOrPtr*)( *_t126 + 0x30))))() & 0x0000ffff;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t125 =  *((intOrPtr*)(_t132 - 0x68));
						 *((intOrPtr*)(_t132 - 0x40)) = 0;
						 *(_t132 - 0x3c) = 0;
						E01323ED0(_t101, _t132 - 0x50,  *((intOrPtr*)(_t132 - 0x68)),  *((intOrPtr*)( *_t126 + 0x30)), 0,  *((intOrPtr*)(_t132 - 0x68)));
						__eflags =  *(_t132 - 0x3c) - 8;
						_t111 = _t132 - 0x50;
						 *(_t132 - 4) = 1;
						if( *(_t132 - 0x3c) >= 8) {
							_t111 =  *((intOrPtr*)(_t132 - 0x50));
						}
						 *0x136d26c();
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t132 - 0x5c)))) + 0x2c))))();
						_t129 =  *(_t132 - 0x60);
						E01324580(_t132 - 0x50, _t132,  *((intOrPtr*)(_t132 - 0x54)),  *(_t132 - 0x60));
						E01322A10(_t101, _t134 - 0x18, _t132 - 0x50,  *(_t132 - 0x60), _t132 - 0x38, _t132 - 0x38 + _t125, _t111);
						_push( *((intOrPtr*)(_t132 - 0x58)));
						_push( *((intOrPtr*)(_t132 + 0x1c)));
						_push( *(_t132 - 0x6c));
						_push( *((intOrPtr*)(_t132 + 0x14)));
						_push( *((intOrPtr*)(_t132 + 0x10)));
						_push( *((intOrPtr*)(_t132 + 0xc)));
						_push(_t101);
						E0133E991(_t101, _t123, _t125,  *(_t132 - 0x60), __eflags);
						_t92 =  *(_t132 - 0x3c);
						__eflags = _t92 - 8;
						if(_t92 >= 8) {
							_t117 =  *((intOrPtr*)(_t132 - 0x50));
							_t95 = 2 + _t92 * 2;
							 *((intOrPtr*)(_t132 - 0x58)) = _t95;
							 *((intOrPtr*)(_t132 - 0x54)) =  *((intOrPtr*)(_t132 - 0x50));
							__eflags = _t95 - 0x1000;
							if(_t95 >= 0x1000) {
								E01323C20(_t101, _t132 - 0x54, _t132 - 0x58);
								_t95 =  *((intOrPtr*)(_t132 - 0x58));
								_t117 =  *((intOrPtr*)(_t132 - 0x54));
							}
							_push(_t95);
							E013284D0(_t117);
						}
					} else {
						 *_t101 =  *((intOrPtr*)(_t132 + 0xc));
						 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t132 + 0x10));
					}
					return E01348204(_t101, _t125, _t129);
				} else {
					_t143 =  *0x137b930;
					while(_t103 < 0x1388) {
						_t143 = _t143 / st0;
						_t103 = _t103 + 0xa;
						asm("fxch st0, st1");
						asm("fcom st0, st2");
						asm("fnstsw ax");
						if((_t68 & 0x00000041) != 0) {
							asm("fxch st0, st1");
							continue;
						}
						st0 = _t143;
						L8:
						 *((intOrPtr*)(_t132 - 0x54)) = _t103;
						goto L9;
					}
					st1 = _t143;
					goto L8;
				}
			}

0x0134258e
0x0134258e
0x01342595
0x0134259a
0x0134259d
0x013425a2
0x013425a5
0x013425a7
0x013425aa
0x013425ac
0x013425af
0x013425b3
0x013425b8
0x013425ba
0x013425be
0x013425be
0x013425c0
0x013425c6
0x013425c8
0x013425ca
0x013425cd
0x013425d2
0x013425fb
0x013425fb
0x013425fd
0x01342602
0x0134260d
0x01342612
0x01342615
0x0134261a
0x01342636
0x0134263b
0x01342643
0x01342648
0x0134264c
0x01342652
0x01342655
0x01342663
0x01342673
0x0134267b
0x0134267c
0x0134267d
0x0134267e
0x01342681
0x01342686
0x01342689
0x0134268c
0x01342691
0x01342695
0x01342698
0x0134269f
0x013426a1
0x013426a1
0x013426b9
0x013426c2
0x013426c4
0x013426ce
0x013426dd
0x013426e2
0x013426e8
0x013426eb
0x013426ee
0x013426f1
0x013426f4
0x013426f7
0x013426f8
0x013426fd
0x01342700
0x01342703
0x01342705
0x01342708
0x0134270f
0x01342712
0x01342715
0x0134271a
0x01342724
0x01342729
0x0134272e
0x0134272e
0x01342731
0x01342733
0x01342739
0x0134261c
0x01342622
0x01342624
0x01342624
0x01342741
0x013425d4
0x013425d4
0x013425de
0x013425e6
0x013425e8
0x013425eb
0x013425ed
0x013425ef
0x013425f4
0x013425dc
0x00000000
0x013425dc
0x013425f6
0x013425f8
0x013425f8
0x00000000
0x013425f8
0x0134262c
0x00000000
0x0134262c

APIs

__EH_prolog3_GS.LIBCMT ref: 01342595
_swprintf.LIBCMT ref: 0134260D

Part of subcall function 0132B500: std::_Lockit::_Lockit.LIBCPMT ref: 0132B52D
Part of subcall function 0132B500: std::_Lockit::_Lockit.LIBCPMT ref: 0132B550
Part of subcall function 0132B500: std::_Lockit::~_Lockit.LIBCPMT ref: 0132B578
Part of subcall function 0132B500: std::_Lockit::~_Lockit.LIBCPMT ref: 0132B617

Strings

%.0Lf, xrefs: 01342605

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: f3042d60b9eba18d028806eed5d5b511295b969dd03667f2c2239499722687c0
Instruction ID: 0881189cf087beb2c03cc075c3d186d2e968c1a89789119345c6df5ab7f5b96d
Opcode Fuzzy Hash: f3042d60b9eba18d028806eed5d5b511295b969dd03667f2c2239499722687c0
Instruction Fuzzy Hash: 27515971D00219EBCF09EFE4D854ADEBBB9FF08714F208459E542AB294EB34A915CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01346607 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E01346607(void* __ebx, intOrPtr __ecx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed char _t67;
				intOrPtr _t69;
				intOrPtr* _t72;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr* _t99;
				intOrPtr _t101;
				intOrPtr _t109;
				void* _t121;
				intOrPtr* _t124;
				void* _t129;
				signed long long* _t130;
				signed long long* _t131;
				signed long long _t140;

				_t123 = __edi;
				_push(0x64);
				_t67 = E01348246(0x136cb0e, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t129 - 0x70)) = __ecx;
				asm("fldz");
				_t127 =  *((intOrPtr*)(_t129 + 0x18));
				asm("fcom st0, st1");
				_t99 =  *((intOrPtr*)(_t129 + 8));
				asm("fnstsw ax");
				 *((intOrPtr*)(_t129 - 0x6c)) =  *((intOrPtr*)(_t129 + 0x18));
				 *((char*)(_t129 - 0x54)) = 0;
				st1 =  *((long long*)(_t129 + 0x20));
				if((_t67 & 0x00000005) == 0) {
					 *((char*)(_t129 - 0x54)) = 1;
					asm("fchs");
				}
				_t140 =  *0x136ebb0;
				_t101 = 0;
				asm("fcom st0, st1");
				 *((intOrPtr*)(_t129 - 0x64)) = 0;
				asm("fnstsw ax");
				if((_t67 & 0x00000041) != 0) {
					L9:
					_push(_t101);
					st0 = _t140;
					 *_t130 = _t140;
					_t69 = E0132FCF0(_t129 - 0x38, 0x28, "%.0Lf", _t101);
					_t131 =  &(_t130[2]);
					 *((intOrPtr*)(_t129 - 0x68)) = _t69;
					if(_t69 >= 0) {
						E0132FD10(_t129 - 0x5c,  *((intOrPtr*)(_t127 + 0x30)));
						 *(_t129 - 4) =  *(_t129 - 4) & 0x00000000;
						_t72 = E0132C590(_t99, _t123, _t127, _t129 - 0x5c);
						 *(_t129 - 4) =  *(_t129 - 4) | 0xffffffff;
						_t124 = _t72;
						 *((intOrPtr*)(_t129 - 0x60)) = _t124;
						E0132C710(_t129 - 0x5c);
						 *0x136d26c(0x30);
						 *((char*)(_t129 - 0x58)) =  *((intOrPtr*)( *((intOrPtr*)( *_t124 + 0x20))))();
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t123 =  *((intOrPtr*)(_t129 - 0x68));
						 *((intOrPtr*)(_t129 - 0x40)) = 0;
						 *((intOrPtr*)(_t129 - 0x3c)) = 0;
						E01324FB0(_t99, _t129 - 0x50, _t123,  *((intOrPtr*)( *_t124 + 0x20)), 0, _t123);
						__eflags =  *((intOrPtr*)(_t129 - 0x3c)) - 0x10;
						_t109 = _t129 - 0x50;
						 *(_t129 - 4) = 1;
						if( *((intOrPtr*)(_t129 - 0x3c)) >= 0x10) {
							_t109 =  *((intOrPtr*)(_t129 - 0x50));
						}
						_t127 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t129 - 0x60)))) + 0x1c));
						 *0x136d26c(_t129 - 0x38, _t129 - 0x38 + _t123, _t109);
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t129 - 0x60)))) + 0x1c))))();
						E0132EA50(_t129 - 0x50,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t129 - 0x60)))) + 0x1c)),  *((intOrPtr*)(_t129 - 0x64)),  *((intOrPtr*)(_t129 - 0x58)));
						E01330170(_t99, _t131 - 0x18, _t121, _t123,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t129 - 0x60)))) + 0x1c)), _t129 - 0x50,  *((intOrPtr*)(_t129 - 0x58)));
						_push( *((intOrPtr*)(_t129 - 0x54)));
						_push( *((intOrPtr*)(_t129 + 0x1c)));
						_push( *((intOrPtr*)(_t129 - 0x6c)));
						_push( *((intOrPtr*)(_t129 + 0x14)));
						_push( *((intOrPtr*)(_t129 + 0x10)));
						_push( *((intOrPtr*)(_t129 + 0xc)));
						_push(_t99);
						E01345263(_t99, _t121, _t123, _t127, __eflags);
						_t90 =  *((intOrPtr*)(_t129 - 0x3c));
						__eflags = _t90 - 0x10;
						if(_t90 >= 0x10) {
							_t115 =  *((intOrPtr*)(_t129 - 0x50));
							_t93 = _t90 + 1;
							 *((intOrPtr*)(_t129 - 0x54)) = _t93;
							 *((intOrPtr*)(_t129 - 0x58)) =  *((intOrPtr*)(_t129 - 0x50));
							__eflags = _t93 - 0x1000;
							if(_t93 >= 0x1000) {
								E01323C20(_t99, _t129 - 0x58, _t129 - 0x54);
								_t93 =  *((intOrPtr*)(_t129 - 0x54));
								_t115 =  *((intOrPtr*)(_t129 - 0x58));
							}
							_push(_t93);
							E013284D0(_t115);
						}
					} else {
						 *_t99 =  *((intOrPtr*)(_t129 + 0xc));
						 *((intOrPtr*)(_t99 + 4)) =  *((intOrPtr*)(_t129 + 0x10));
					}
					return E01348204(_t99, _t123, _t127);
				} else {
					_t140 =  *0x137b930;
					while(_t101 < 0x1388) {
						_t140 = _t140 / st0;
						_t101 = _t101 + 0xa;
						asm("fxch st0, st1");
						asm("fcom st0, st2");
						asm("fnstsw ax");
						if((_t67 & 0x00000041) != 0) {
							asm("fxch st0, st1");
							continue;
						}
						st0 = _t140;
						L8:
						 *((intOrPtr*)(_t129 - 0x64)) = _t101;
						goto L9;
					}
					st1 = _t140;
					goto L8;
				}
			}

0x01346607
0x01346607
0x0134660e
0x01346613
0x01346616
0x0134661b
0x0134661e
0x01346620
0x01346623
0x01346625
0x01346628
0x0134662c
0x01346631
0x01346633
0x01346637
0x01346637
0x01346639
0x0134663f
0x01346641
0x01346643
0x01346646
0x0134664b
0x01346674
0x01346674
0x01346676
0x0134667b
0x01346686
0x0134668b
0x0134668e
0x01346693
0x013466af
0x013466b4
0x013466bc
0x013466c1
0x013466c5
0x013466cb
0x013466ce
0x013466dc
0x013466e6
0x013466f1
0x013466f2
0x013466f3
0x013466f4
0x013466f7
0x013466fc
0x013466ff
0x01346702
0x01346707
0x0134670b
0x0134670e
0x01346715
0x01346717
0x01346717
0x01346720
0x0134672f
0x01346738
0x01346743
0x01346754
0x01346759
0x0134675f
0x01346762
0x01346765
0x01346768
0x0134676b
0x0134676e
0x0134676f
0x01346774
0x01346777
0x0134677a
0x0134677c
0x0134677f
0x01346780
0x01346783
0x01346786
0x0134678b
0x01346795
0x0134679a
0x0134679f
0x0134679f
0x013467a2
0x013467a4
0x013467aa
0x01346695
0x0134669b
0x0134669d
0x0134669d
0x013467b2
0x0134664d
0x0134664d
0x01346657
0x0134665f
0x01346661
0x01346664
0x01346666
0x01346668
0x0134666d
0x01346655
0x00000000
0x01346655
0x0134666f
0x01346671
0x01346671
0x00000000
0x01346671
0x013466a5
0x00000000
0x013466a5

APIs

__EH_prolog3_GS.LIBCMT ref: 0134660E
_swprintf.LIBCMT ref: 01346686

Part of subcall function 0132C590: std::_Lockit::_Lockit.LIBCPMT ref: 0132C5BD
Part of subcall function 0132C590: std::_Lockit::_Lockit.LIBCPMT ref: 0132C5E0
Part of subcall function 0132C590: std::_Lockit::~_Lockit.LIBCPMT ref: 0132C608
Part of subcall function 0132C590: std::_Lockit::~_Lockit.LIBCPMT ref: 0132C6A7

Strings

%.0Lf, xrefs: 0134667E

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: aec9f795027a7e3a73dd079d39816d8b9b5101afc08c3113b8e4fe270050fac8
Instruction ID: 8eb89edcfccd2f99a148f4d8e99ffc98e0491907e05fcbdc18b9d511fa691c65
Opcode Fuzzy Hash: aec9f795027a7e3a73dd079d39816d8b9b5101afc08c3113b8e4fe270050fac8
Instruction Fuzzy Hash: F3516CB1D00219EBCF09EFE4D845ADDBBB9FF09714F10841AE502AB294EB35A915CF50

Uniqueness

Uniqueness Score: -1.00%

Function 01329620 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E01329620(void* __ebx, WCHAR* __ecx, WCHAR* __edx, intOrPtr _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				short _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void* __edi;
				void* __esi;
				signed int _t48;
				signed int _t49;
				intOrPtr _t51;
				int _t52;
				signed int _t70;
				short* _t74;
				short _t75;
				WCHAR* _t76;
				short _t77;
				WCHAR* _t78;
				short _t86;
				intOrPtr _t91;
				void* _t92;
				void* _t95;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				void* _t99;
				void* _t100;

				_t88 = __edx;
				_t74 = __ecx;
				_t73 = __ebx;
				_push(0xffffffff);
				_push(0x136a48e);
				_push( *[fs:0x0]);
				_t100 = _t99 - 0x2c;
				_t48 =  *0x1383020; // 0xc9209188
				_t49 = _t48 ^ _t98;
				_v20 = _t49;
				_push(_t49);
				 *[fs:0x0] =  &_v16;
				_t94 = __ecx;
				_t91 = _a4;
				_v52 = _t91;
				_v48 = 0;
				if( *((intOrPtr*)(__ecx + 0x10)) >= 0xf8) {
					_t51 =  *((intOrPtr*)(__ecx + 0x14));
					if(_t51 >= 8) {
						_t74 =  *((intOrPtr*)(__ecx));
					}
					if( *_t74 != 0x5c) {
						L8:
						_t75 = _t94;
						if(_t51 >= 8) {
							_t75 =  *_t94;
						}
						if( *((short*)(_t75 + 2)) == 0x3a) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						_t86 = _t94;
						if(_t51 >= 8) {
							_t86 =  *_t94;
						}
						if( *((short*)(_t86 + 2)) == 0x5c) {
							L12:
							_t76 = _t94;
							if(_t51 >= 8) {
								_t76 =  *_t94;
							}
							_t52 = PathIsUNCW(_t76);
							_t77 = _t94[0xa];
							_t88 = _t94;
							if(_t52 != 1) {
								if(_t77 >= 8) {
									_t88 =  *_t94;
								}
								if(_t94[8] < 4 || (E01350B03(_t88, L"\\\\?\\", 4) & 0xffffff00 | _t60 == 0x00000000) == 0) {
									_push(_t94);
									_t78 =  &_v44;
									E01322A10(_t73, _t78);
									_v8 = 2;
									_push(4);
									_push(L"\\\\?\\");
									goto L25;
								} else {
									goto L11;
								}
							} else {
								if(_t77 >= 8) {
									_t88 =  *_t94;
								}
								if(_t94[8] < 8) {
									L19:
									_push(_t94);
									E01322A10(_t73,  &_v44);
									_v8 = 1;
									_t96 = _v28;
									_t66 =  <  ? _t96 : 2;
									_t88 =  >=  ? _v44 :  &_v44;
									_t97 = _t96 - 2;
									_t78 =  &(( >=  ? _v44 :  &_v44)[ <  ? _t96 : 2]);
									E01348FF0( >=  ? _v44 :  &_v44, _t78, 2 + _t97 * 2);
									_v28 = _t97;
									_push(8);
									_push(L"\\\\?\\UNC\\");
									L25:
									_push(_t78);
									E01329EF0();
									asm("xorps xmm0, xmm0");
									_v48 = 1;
									asm("movups [edi], xmm0");
									 *((intOrPtr*)(_t91 + 0x10)) = 0;
									asm("movups xmm0, [ebp-0x28]");
									 *((intOrPtr*)(_t91 + 0x14)) = 0;
									_v44 = 0;
									asm("movups [edi], xmm0");
									asm("movq xmm0, [ebp-0x18]");
									asm("movq [edi+0x10], xmm0");
									_v28 = 0;
									_v24 = 7;
									_v8 = 0;
									_v28 = 0;
									_v44 = 0;
									_v24 = 7;
								} else {
									_t70 = E01350B03(_t88, L"\\\\?\\UNC\\", 8);
									_t100 = _t100 + 0xc;
									if((_t70 & 0xffffff00 | _t70 == 0x00000000) != 0) {
										L11:
										_push(_t94);
										E01322A10(_t73, _t91);
										_v8 = 0;
										_v48 = 1;
									} else {
										goto L19;
									}
								}
							}
						} else {
							goto L8;
						}
					}
				} else {
					_push(__ecx);
					E01322A10(__ebx, _t91);
					_v8 = 0;
					_v48 = 1;
				}
				 *[fs:0x0] = _v16;
				_pop(_t92);
				_pop(_t95);
				return E01347708(_t91, _t73, _v20 ^ _t98, _t88, _t92, _t95);
			}

0x01329620
0x01329620
0x01329620
0x01329623
0x01329625
0x01329630
0x01329631
0x01329634
0x01329639
0x0132963b
0x01329640
0x01329644
0x0132964a
0x0132964c
0x0132964f
0x01329652
0x01329660
0x0132967d
0x01329683
0x01329685
0x01329685
0x0132968b
0x0132969d
0x0132969d
0x013296a2
0x013296a4
0x013296a4
0x013296ab
0x00000000
0x00000000
0x00000000
0x00000000
0x0132968d
0x0132968d
0x01329692
0x01329694
0x01329694
0x0132969b
0x013296c8
0x013296c8
0x013296cd
0x013296cf
0x013296cf
0x013296d2
0x013296d8
0x013296db
0x013296e0
0x0132975c
0x0132975e
0x0132975e
0x01329766
0x01329789
0x0132978a
0x0132978d
0x01329792
0x01329799
0x0132979b
0x00000000
0x00000000
0x00000000
0x00000000
0x013296e2
0x013296e5
0x013296e7
0x013296e7
0x013296ef
0x0132970e
0x0132970e
0x01329712
0x01329717
0x01329723
0x0132972b
0x01329732
0x01329736
0x01329738
0x01329745
0x0132974d
0x01329750
0x01329752
0x013297a0
0x013297a0
0x013297a4
0x013297a9
0x013297ac
0x013297b3
0x013297b6
0x013297bf
0x013297c3
0x013297ca
0x013297ce
0x013297d1
0x013297d6
0x013297db
0x013297de
0x013297e5
0x013297e8
0x013297eb
0x013297ef
0x013296f1
0x013296fd
0x01329702
0x0132970c
0x013296ad
0x013296ad
0x013296b0
0x013296b5
0x013296bc
0x00000000
0x00000000
0x00000000
0x0132970c
0x013296ef
0x00000000
0x00000000
0x00000000
0x0132969b
0x01329662
0x01329662
0x01329665
0x0132966a
0x01329671
0x01329671
0x013297fb
0x01329803
0x01329804
0x01329812

Strings

\\?\UNC\, xrefs: 013296F7, 01329752
\\?\, xrefs: 0132976E, 0132979B

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: 63ee00cb074f39a5950f1511899885da244d656d0ebeaee41d0fe864b8573564
Instruction ID: 8eca25428565982f6e189baadba980eb1318c9689277d045a90aa679127d472d
Opcode Fuzzy Hash: 63ee00cb074f39a5950f1511899885da244d656d0ebeaee41d0fe864b8573564
Instruction Fuzzy Hash: A351E570A10225DBDB24DF68C885BAEBBF5FF9872CF14451DE801B7680DB75A984CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0134B5D1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E0134B5D1(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_t75 = E0134AEE7(_t96, __ecx, __edx, _t113, _t121, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E0134AEE7(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E01348868(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E0134879B(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E0134B1AC(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E01358037(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t82 = _t97 + 8;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x0134b5d1
0x0134b5d1
0x0134b5d8
0x0134b5e1
0x0134b700
0x0134b5e7
0x0134b5e9
0x0134b5f3
0x0134b5f6
0x0134b5fc
0x0134b606
0x0134b62b
0x0134b630
0x0134b635
0x0134b6fc
0x00000000
0x0134b6fd
0x0134b635
0x0134b606
0x0134b63b
0x0134b63e
0x0134b641
0x0134b647
0x0134b64d
0x0134b65f
0x0134b664
0x0134b667
0x0134b66a
0x0134b66d
0x0134b670
0x0134b676
0x0134b67c
0x0134b67f
0x0134b682
0x0134b691
0x0134b692
0x0134b692
0x0134b697
0x0134b6aa
0x0134b6ac
0x0134b6b1
0x0134b6bc
0x0134b6be
0x0134b6c0
0x0134b6dc
0x0134b6e1
0x0134b6e4
0x0134b6e4
0x0134b6bc
0x0134b6b1
0x0134b6ea
0x0134b6eb
0x0134b6ee
0x0134b6f1
0x0134b6f4
0x0134b6f7
0x0134b682
0x00000000
0x0134b676
0x0134b701
0x0134b706
0x0134b70a
0x0134b70d
0x0134b70e
0x0134b70f
0x0134b710
0x0134b715
0x0134b78d
0x0134b78f
0x0134b717
0x0134b717
0x0134b71d
0x00000000
0x0134b71f
0x0134b722
0x0134b725
0x0134b72c
0x0134b72f
0x0134b733
0x0134b765
0x0134b768
0x0134b76f
0x0134b775
0x0134b77f
0x0134b788
0x0134b788
0x0134b77f
0x0134b775
0x0134b789
0x0134b735
0x0134b735
0x0134b738
0x0134b738
0x0134b73c
0x00000000
0x00000000
0x0134b740
0x0134b754
0x0134b754
0x0134b742
0x0134b742
0x0134b748
0x00000000
0x0134b74a
0x0134b74a
0x0134b74d
0x0134b752
0x00000000
0x00000000
0x00000000
0x00000000
0x0134b752
0x0134b748
0x0134b75d
0x0134b75f
0x00000000
0x0134b761
0x0134b761
0x0134b761
0x00000000
0x0134b75f
0x0134b758
0x0134b75a
0x00000000
0x0134b75a
0x00000000
0x00000000
0x00000000
0x0134b725
0x0134b71d
0x0134b790
0x0134b794
0x0134b794

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0134B5F6

Strings

MOC, xrefs: 0134B608
RCC, xrefs: 0134B610

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 67f725986aecdb352fe99599cd168d2b6f6965cfd1ff248393d95297222c03ef
Instruction ID: d86d3e0b4e138f87f0a2bc4becb853999deac33ebf8bca6d12c9f2524dd5d955
Opcode Fuzzy Hash: 67f725986aecdb352fe99599cd168d2b6f6965cfd1ff248393d95297222c03ef
Instruction Fuzzy Hash: 70414771900209AFDF16CF98CD80AAEBBF5FF58318F188099FA05A7225D339E950DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0134217C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0134217C(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t54;
				intOrPtr* _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				signed int _t83;
				intOrPtr _t95;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t104;

				_t104 = __eflags;
				_t92 = __edx;
				E01348246(0x136c6cd, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t101 - 0x58)) = __ecx;
				_t76 =  *((intOrPtr*)(_t101 + 0x20));
				 *((intOrPtr*)(_t101 - 0x54)) =  *((intOrPtr*)(_t101 + 8));
				 *((intOrPtr*)(_t101 - 0x50)) =  *((intOrPtr*)(_t101 + 0x18));
				E0132FD10(_t101 - 0x4c,  *((intOrPtr*)( *((intOrPtr*)(_t101 + 0x18)) + 0x30)));
				 *(_t101 - 0x44) = 0;
				 *(_t101 - 4) = 0;
				_t54 = E0133780A(_t76, __edx, __edi, __esi, _t104, _t101 - 0x4c);
				 *(_t101 - 4) =  *(_t101 - 4) | 0xffffffff;
				E0132C710(_t101 - 0x4c);
				 *0x136d26c("0123456789-", "%.0Lf", _t101 - 0x28, 0x4c);
				 *((intOrPtr*)( *((intOrPtr*)( *_t54 + 0x2c))))();
				_t95 =  *((intOrPtr*)(_t76 + 0x10));
				_t83 = 0;
				 *((char*)(_t101 - 0x48)) = 0;
				if(_t95 != 0) {
					_t73 = _t76;
					if( *((intOrPtr*)(_t76 + 0x14)) >= 8) {
						_t73 =  *_t76;
					}
					if( *_t73 ==  *((intOrPtr*)(_t101 - 0x14))) {
						 *((char*)(_t101 - 0x48)) = 1;
						_t83 = 1;
						 *(_t101 - 0x44) = 1;
					}
				}
				_t98 = _t83;
				if(_t83 >= _t95) {
					L11:
					if( *((intOrPtr*)(_t76 + 0x14)) >= 8) {
						_t76 =  *_t76;
					}
					E013382F7(_t101 - 0x40, _t76 + _t83 * 2, _t98 - _t83);
					_t114 =  *((intOrPtr*)(_t101 - 0x30));
					 *(_t101 - 4) = 1;
					if( *((intOrPtr*)(_t101 - 0x30)) == 0) {
						E013433DC(_t101 - 0x40,  *((intOrPtr*)(_t101 - 0x28)));
					}
					_push( *((intOrPtr*)(_t101 - 0x28)));
					E01338284(_t102 - 0x18, _t101 - 0x40);
					_push( *((intOrPtr*)(_t101 - 0x48)));
					_push( *((intOrPtr*)(_t101 + 0x1c)));
					_push( *((intOrPtr*)(_t101 - 0x50)));
					_push( *((intOrPtr*)(_t101 + 0x14)));
					_push( *((intOrPtr*)(_t101 + 0x10)));
					_push( *((intOrPtr*)(_t101 + 0xc)));
					_push( *((intOrPtr*)(_t101 - 0x54)));
					E0133E40D(_t76, _t92, _t95,  *((intOrPtr*)(_t101 - 0x54)), _t114);
					E0133EFE1(_t101 - 0x40);
					return E01348204(_t76, _t95,  *((intOrPtr*)(_t101 - 0x54)));
				} else {
					while(1) {
						_t110 =  *((intOrPtr*)(_t76 + 0x14)) - 8;
						_t69 = _t76;
						if( *((intOrPtr*)(_t76 + 0x14)) >= 8) {
							_t69 =  *_t76;
						}
						if(E013366CD(_t110, _t101 - 0x28,  *(_t69 + _t98 * 2) & 0x0000ffff) >= 0xa) {
							break;
						}
						_t98 = _t98 + 1;
						if(_t98 < _t95) {
							continue;
						}
						break;
					}
					_t83 =  *(_t101 - 0x44);
					goto L11;
				}
			}

0x0134217c
0x0134217c
0x01342183
0x01342188
0x01342191
0x01342194
0x0134219a
0x013421a0
0x013421a7
0x013421aa
0x013421b1
0x013421b6
0x013421c0
0x013421da
0x013421e2
0x013421e4
0x013421e7
0x013421e9
0x013421ee
0x013421f4
0x013421f6
0x013421f8
0x013421f8
0x01342201
0x01342205
0x01342209
0x0134220a
0x0134220a
0x01342201
0x0134220d
0x01342211
0x0134223a
0x0134223e
0x01342240
0x01342240
0x0134224c
0x01342251
0x01342255
0x0134225c
0x01342264
0x01342264
0x01342269
0x01342275
0x0134227a
0x01342280
0x01342286
0x01342289
0x0134228c
0x0134228f
0x01342292
0x01342293
0x0134229b
0x013422a7
0x01342213
0x01342213
0x01342213
0x01342217
0x01342219
0x0134221b
0x0134221b
0x01342230
0x00000000
0x00000000
0x01342232
0x01342235
0x00000000
0x00000000
0x00000000
0x01342235
0x01342237
0x00000000
0x01342237

APIs

__EH_prolog3_GS.LIBCMT ref: 01342183

Part of subcall function 0133780A: __EH_prolog3.LIBCMT ref: 01337811
Part of subcall function 0133780A: std::_Lockit::_Lockit.LIBCPMT ref: 0133781B
Part of subcall function 0133780A: std::_Lockit::~_Lockit.LIBCPMT ref: 0133788C

Strings

%.0Lf, xrefs: 013421CE
0123456789-, xrefs: 013421D3

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2728201062-3094241602
Opcode ID: 26663ed105f01d9f94292499f27df8a363df51fa6d460b474cfccad9dd557277
Instruction ID: 1ea7a41562dd1961d74f46d6b93c5e7af7b3646dd7659a170000ca173d9b9cf2
Opcode Fuzzy Hash: 26663ed105f01d9f94292499f27df8a363df51fa6d460b474cfccad9dd557277
Instruction Fuzzy Hash: 68416C31900219DFCF05EFE8D8809EEBBB5FF09318F144169E911BB255DB30A95ACB54

Uniqueness

Uniqueness Score: -1.00%

Function 01342460 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E01342460(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t54;
				intOrPtr* _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				signed int _t83;
				void* _t92;
				intOrPtr _t95;
				signed int _t98;
				void* _t101;
				void* _t102;

				_t92 = __edx;
				E01348246(0x136c745, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t101 - 0x58)) = __ecx;
				_t76 =  *((intOrPtr*)(_t101 + 0x20));
				 *((intOrPtr*)(_t101 - 0x54)) =  *((intOrPtr*)(_t101 + 8));
				 *((intOrPtr*)(_t101 - 0x50)) =  *((intOrPtr*)(_t101 + 0x18));
				E0132FD10(_t101 - 0x4c,  *((intOrPtr*)( *((intOrPtr*)(_t101 + 0x18)) + 0x30)));
				 *(_t101 - 0x44) = 0;
				 *(_t101 - 4) = 0;
				_t54 = E0132B500(_t76, __edi, _t101 - 0x4c);
				 *(_t101 - 4) =  *(_t101 - 4) | 0xffffffff;
				E0132C710(_t101 - 0x4c);
				 *0x136d26c("0123456789-", "0123456789-", _t101 - 0x28, 0x4c);
				 *((intOrPtr*)( *((intOrPtr*)( *_t54 + 0x2c))))();
				_t95 =  *((intOrPtr*)(_t76 + 0x10));
				_t83 = 0;
				 *((char*)(_t101 - 0x48)) = 0;
				if(_t95 != 0) {
					_t73 = _t76;
					if( *((intOrPtr*)(_t76 + 0x14)) >= 8) {
						_t73 =  *_t76;
					}
					if( *_t73 ==  *((intOrPtr*)(_t101 - 0x14))) {
						 *((char*)(_t101 - 0x48)) = 1;
						_t83 = 1;
						 *(_t101 - 0x44) = 1;
					}
				}
				_t98 = _t83;
				if(_t83 >= _t95) {
					L11:
					if( *((intOrPtr*)(_t76 + 0x14)) >= 8) {
						_t76 =  *_t76;
					}
					E0132A110(_t101 - 0x40, _t76 + _t83 * 2, _t98 - _t83);
					_t114 =  *((intOrPtr*)(_t101 - 0x30));
					 *(_t101 - 4) = 1;
					if( *((intOrPtr*)(_t101 - 0x30)) == 0) {
						E01324540(_t101 - 0x40,  *((intOrPtr*)(_t101 - 0x28)));
					}
					_push( *((intOrPtr*)(_t101 - 0x28)));
					_push(_t101 - 0x40);
					E01322A10(_t76, _t102 - 0x18);
					_push( *((intOrPtr*)(_t101 - 0x48)));
					_push( *((intOrPtr*)(_t101 + 0x1c)));
					_push( *((intOrPtr*)(_t101 - 0x50)));
					_push( *((intOrPtr*)(_t101 + 0x14)));
					_push( *((intOrPtr*)(_t101 + 0x10)));
					_push( *((intOrPtr*)(_t101 + 0xc)));
					_push( *((intOrPtr*)(_t101 - 0x54)));
					E0133E991(_t76, _t92, _t95,  *((intOrPtr*)(_t101 - 0x54)), _t114);
					E01323CC0(_t101 - 0x40);
					return E01348204(_t76, _t95,  *((intOrPtr*)(_t101 - 0x54)));
				} else {
					while(1) {
						_t110 =  *((intOrPtr*)(_t76 + 0x14)) - 8;
						_t69 = _t76;
						if( *((intOrPtr*)(_t76 + 0x14)) >= 8) {
							_t69 =  *_t76;
						}
						if(E013366CD(_t110, _t101 - 0x28,  *(_t69 + _t98 * 2) & 0x0000ffff) >= 0xa) {
							break;
						}
						_t98 = _t98 + 1;
						if(_t98 < _t95) {
							continue;
						}
						break;
					}
					_t83 =  *(_t101 - 0x44);
					goto L11;
				}
			}

0x01342460
0x01342467
0x0134246c
0x01342475
0x01342478
0x0134247e
0x01342484
0x0134248b
0x0134248e
0x01342495
0x0134249a
0x013424a4
0x013424be
0x013424c6
0x013424c8
0x013424cb
0x013424cd
0x013424d2
0x013424d8
0x013424da
0x013424dc
0x013424dc
0x013424e5
0x013424e9
0x013424ed
0x013424ee
0x013424ee
0x013424e5
0x013424f1
0x013424f5
0x0134251e
0x01342522
0x01342524
0x01342524
0x01342530
0x01342535
0x01342539
0x01342540
0x01342548
0x01342548
0x0134254d
0x01342558
0x01342559
0x0134255e
0x01342564
0x0134256a
0x0134256d
0x01342570
0x01342573
0x01342576
0x01342577
0x0134257f
0x0134258b
0x013424f7
0x013424f7
0x013424f7
0x013424fb
0x013424fd
0x013424ff
0x013424ff
0x01342514
0x00000000
0x00000000
0x01342516
0x01342519
0x00000000
0x00000000
0x00000000
0x01342519
0x0134251b
0x00000000
0x0134251b

APIs

__EH_prolog3_GS.LIBCMT ref: 01342467

Part of subcall function 0132B500: std::_Lockit::_Lockit.LIBCPMT ref: 0132B52D
Part of subcall function 0132B500: std::_Lockit::_Lockit.LIBCPMT ref: 0132B550
Part of subcall function 0132B500: std::_Lockit::~_Lockit.LIBCPMT ref: 0132B578
Part of subcall function 0132B500: std::_Lockit::~_Lockit.LIBCPMT ref: 0132B617

Strings

0123456789-, xrefs: 013424B2
0123456789-, xrefs: 013424B7

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: e15bda1fb9ece99262fc4ad0929b79352602dbe2e08f99c5d222371e491f0ff0
Instruction ID: 73c223aad14fc537f5b14dcf14590aaa1b138a7c20ca8ce06d990650357f70c5
Opcode Fuzzy Hash: e15bda1fb9ece99262fc4ad0929b79352602dbe2e08f99c5d222371e491f0ff0
Instruction Fuzzy Hash: 48416C31900129DFCF05EFE8D8909EEBBB5FF08718F144059E901BB255DB30AA55CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 013464DB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E013464DB(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t52;
				intOrPtr* _t67;
				intOrPtr* _t71;
				intOrPtr* _t74;
				char _t81;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				void* _t99;
				void* _t100;

				_t90 = __edx;
				E01348246(0x136cad2, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t99 - 0x4c)) = __ecx;
				_t74 =  *((intOrPtr*)(_t99 + 0x20));
				 *((intOrPtr*)(_t99 - 0x48)) =  *((intOrPtr*)(_t99 + 8));
				 *((intOrPtr*)(_t99 - 0x44)) =  *((intOrPtr*)(_t99 + 0x18));
				E0132FD10(_t99 - 0x40,  *((intOrPtr*)( *((intOrPtr*)(_t99 + 0x18)) + 0x30)));
				 *((intOrPtr*)(_t99 - 0x38)) = 0;
				 *(_t99 - 4) = 0;
				_t52 = E0132C590(_t74, __edi, __esi, _t99 - 0x40);
				 *(_t99 - 4) =  *(_t99 - 4) | 0xffffffff;
				E0132C710(_t99 - 0x40);
				 *0x136d26c("0123456789-", "0123456789-", _t99 - 0x1c, 0x40);
				 *((intOrPtr*)( *((intOrPtr*)( *_t52 + 0x1c))))();
				_t93 =  *((intOrPtr*)(_t74 + 0x10));
				_t81 = 0;
				 *((char*)(_t99 - 0x3c)) = 0;
				if(_t93 != 0) {
					_t71 = _t74;
					if( *((intOrPtr*)(_t74 + 0x14)) >= 0x10) {
						_t71 =  *_t74;
					}
					if( *_t71 ==  *((intOrPtr*)(_t99 - 0x12))) {
						 *((char*)(_t99 - 0x3c)) = 1;
						_t81 = 1;
						 *((intOrPtr*)(_t99 - 0x38)) = 1;
					}
				}
				_t96 = _t81;
				if(_t81 >= _t93) {
					L11:
					if( *((intOrPtr*)(_t74 + 0x14)) >= 0x10) {
						_t74 =  *_t74;
					}
					_t97 = _t96 - _t81;
					E01323200(_t99 - 0x34, _t74 + _t81, _t96 - _t81);
					_t112 =  *((intOrPtr*)(_t99 - 0x24));
					 *(_t99 - 4) = 1;
					if( *((intOrPtr*)(_t99 - 0x24)) == 0) {
						E0132A240(_t99 - 0x34,  *((intOrPtr*)(_t99 - 0x1c)));
					}
					E01330170(_t74, _t100 - 0x18, _t90, _t93, _t97, _t99 - 0x34,  *((intOrPtr*)(_t99 - 0x1c)));
					_push( *((intOrPtr*)(_t99 - 0x3c)));
					_push( *((intOrPtr*)(_t99 + 0x1c)));
					_push( *((intOrPtr*)(_t99 - 0x44)));
					_push( *((intOrPtr*)(_t99 + 0x14)));
					_push( *((intOrPtr*)(_t99 + 0x10)));
					E01345263(_t74, _t90, _t93,  *((intOrPtr*)(_t99 - 0x48)), _t112);
					E01323480(_t74, _t99 - 0x34,  *((intOrPtr*)(_t99 - 0x48)),  *((intOrPtr*)(_t99 + 0xc)));
					return E01348204(_t74, _t93,  *((intOrPtr*)(_t99 - 0x48)));
				} else {
					while(1) {
						_t108 =  *((intOrPtr*)(_t74 + 0x14)) - 0x10;
						_t67 = _t74;
						if( *((intOrPtr*)(_t74 + 0x14)) >= 0x10) {
							_t67 =  *_t74;
						}
						if(E01343543(_t108, _t99 - 0x1c,  *(_t67 + _t96) & 0x000000ff) >= 0xa) {
							break;
						}
						_t96 = _t96 + 1;
						if(_t96 < _t93) {
							continue;
						}
						break;
					}
					_t81 =  *((intOrPtr*)(_t99 - 0x38));
					goto L11;
				}
			}

0x013464db
0x013464e2
0x013464e7
0x013464f0
0x013464f3
0x013464f9
0x013464ff
0x01346506
0x01346509
0x01346510
0x01346515
0x0134651f
0x01346539
0x01346541
0x01346543
0x01346546
0x01346548
0x0134654d
0x01346553
0x01346555
0x01346557
0x01346557
0x0134655e
0x01346562
0x01346566
0x01346567
0x01346567
0x0134655e
0x0134656a
0x0134656e
0x01346597
0x0134659b
0x0134659d
0x0134659d
0x0134659f
0x013465a9
0x013465ae
0x013465b2
0x013465b9
0x013465c1
0x013465c1
0x013465d2
0x013465d7
0x013465dd
0x013465e3
0x013465e6
0x013465e9
0x013465f0
0x013465f8
0x01346604
0x01346570
0x01346570
0x01346570
0x01346574
0x01346576
0x01346578
0x01346578
0x0134658d
0x00000000
0x00000000
0x0134658f
0x01346592
0x00000000
0x00000000
0x00000000
0x01346592
0x01346594
0x00000000
0x01346594

APIs

__EH_prolog3_GS.LIBCMT ref: 013464E2

Part of subcall function 0132C590: std::_Lockit::_Lockit.LIBCPMT ref: 0132C5BD
Part of subcall function 0132C590: std::_Lockit::_Lockit.LIBCPMT ref: 0132C5E0
Part of subcall function 0132C590: std::_Lockit::~_Lockit.LIBCPMT ref: 0132C608
Part of subcall function 0132C590: std::_Lockit::~_Lockit.LIBCPMT ref: 0132C6A7

Strings

0123456789-, xrefs: 01346532
0123456789-, xrefs: 0134652D

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: 6a74aef75cf113dbb1cbe573b4917caf2ac4cabbdadf24cfa8d0cbc55e49437a
Instruction ID: 6c9a461b0e80cc92de5ac17fa0fcb278760a4452160f0f1fa0cfe03dc2ddacb7
Opcode Fuzzy Hash: 6a74aef75cf113dbb1cbe573b4917caf2ac4cabbdadf24cfa8d0cbc55e49437a
Instruction Fuzzy Hash: 60417C71900219DFCF05EFA8D8809DE7BB5EF19318F14409AE511A7255DB34AA16CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013467B5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E013467B5(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t49;
				char _t50;
				char _t53;
				intOrPtr _t58;
				intOrPtr _t61;
				intOrPtr _t62;
				void* _t72;
				void* _t77;
				void* _t78;
				intOrPtr* _t87;
				intOrPtr* _t89;
				void* _t90;
				void* _t91;

				_push(0x34);
				E01348246(0x136bd1f, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t90 - 0x34)) = __ecx;
				 *((intOrPtr*)(_t90 - 0x3c)) =  *((intOrPtr*)(_t90 + 0x14));
				_t89 =  *((intOrPtr*)(_t90 + 8));
				 *((intOrPtr*)(_t90 - 0x38)) =  *((intOrPtr*)(_t90 + 0x1c));
				_t49 =  *0x136ecfc; // 0x782521
				 *((intOrPtr*)(_t90 - 0x18)) = _t49;
				_t50 =  *0x136ed00; // 0x0
				 *((char*)(_t90 - 0x14)) = _t50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t90 - 0x20)) = 0;
				 *((intOrPtr*)(_t90 - 0x1c)) = 0xf;
				 *((char*)(_t90 - 0x30)) = 0;
				 *((intOrPtr*)(_t90 - 4)) = 0;
				_t53 =  *((intOrPtr*)(_t90 + 0x24));
				if(_t53 != 0) {
					 *((char*)(_t90 - 0x16)) = _t53;
					 *((char*)(_t90 - 0x15)) =  *((intOrPtr*)(_t90 + 0x20));
				} else {
					 *((char*)(_t90 - 0x16)) =  *((intOrPtr*)(_t90 + 0x20));
				}
				_t87 = E0134C6B0();
				_t72 = 0x10;
				 *((intOrPtr*)(_t90 - 0x40)) =  *_t87;
				while(1) {
					E0132EA50(_t90 - 0x30, _t89, _t72, 0);
					_t58 = _t90 - 0x30;
					if( *((intOrPtr*)(_t90 - 0x1c)) >= 0x10) {
						_t58 =  *((intOrPtr*)(_t90 - 0x30));
					}
					_t77 = E01357F1C(_t58,  *((intOrPtr*)(_t90 - 0x20)), _t90 - 0x18,  *((intOrPtr*)(_t90 - 0x38)),  *((intOrPtr*)( *((intOrPtr*)(_t90 - 0x34)) + 8)));
					_t91 = _t91 + 0x14;
					if(_t77 != 0) {
						break;
					}
					if( *_t87 == 0x16) {
						E01330A70(_t72,  *((intOrPtr*)(_t90 - 0x3c)), _t87, _t89,  *( *((intOrPtr*)(_t90 - 0x3c)) + 0xc) | 0x00000004, 0);
						 *_t89 =  *((intOrPtr*)(_t90 + 0xc));
						 *((intOrPtr*)(_t89 + 4)) =  *((intOrPtr*)(_t90 + 0x10));
					} else {
						_t72 = _t72 + _t72;
						continue;
					}
					L15:
					E01323480(_t72, _t90 - 0x30);
					return E01348204(_t72, _t87, _t89);
				}
				 *_t87 =  *((intOrPtr*)(_t90 - 0x40));
				_t61 = _t90 - 0x30;
				if( *((intOrPtr*)(_t90 - 0x1c)) >= 0x10) {
					_t61 =  *((intOrPtr*)(_t90 - 0x30));
				}
				_t78 = _t77 + _t61;
				_t62 = _t90 - 0x30;
				if( *((intOrPtr*)(_t90 - 0x1c)) >= 0x10) {
					_t62 =  *((intOrPtr*)(_t90 - 0x30));
				}
				E01343895(_t78, _t89, _t62 + 1, _t78,  *((intOrPtr*)(_t90 + 0xc)),  *((intOrPtr*)(_t90 + 0x10)));
				goto L15;
			}

0x013467b5
0x013467bc
0x013467c1
0x013467ca
0x013467d0
0x013467d3
0x013467d6
0x013467db
0x013467de
0x013467e3
0x013467e8
0x013467e9
0x013467ea
0x013467eb
0x013467ee
0x013467f1
0x013467f8
0x013467fb
0x013467fe
0x01346803
0x0134680d
0x01346813
0x01346805
0x01346808
0x01346808
0x0134681b
0x0134681f
0x01346822
0x01346825
0x0134682b
0x01346834
0x01346837
0x01346839
0x01346839
0x01346852
0x01346854
0x01346859
0x00000000
0x00000000
0x0134685e
0x01346872
0x0134687d
0x0134687f
0x01346860
0x01346860
0x00000000
0x01346860
0x013468b5
0x013468b8
0x013468c4
0x013468c4
0x01346887
0x01346889
0x01346890
0x01346892
0x01346892
0x01346895
0x0134689b
0x0134689e
0x013468a0
0x013468a0
0x013468ad
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 013467BC
__cftoe.LIBCMT ref: 0134684D

Strings

!%x, xrefs: 013467D6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 645bbf2f4e77a99862e9f4d8c8849ec32bc700b14e5950f2db347077de66c416
Instruction ID: b636b5f1703d3ae830d10fc4726e8c30020f895982e2bc6233e382bae9e56200
Opcode Fuzzy Hash: 645bbf2f4e77a99862e9f4d8c8849ec32bc700b14e5950f2db347077de66c416
Instruction Fuzzy Hash: FA4148B4E1025AEFEF05DFA8D841AEEBBB5BF19208F044429F955AB311D730A905CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01342DB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E01342DB5(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				short _t52;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr* _t69;
				short _t71;
				signed int _t75;
				void* _t76;
				void* _t86;
				intOrPtr* _t89;
				void* _t90;
				void* _t91;

				_push(0x38);
				E01348246(0x136c7f1, __ebx, __edi, __esi);
				 *((intOrPtr*)(_t90 - 0x38)) = __ecx;
				_t69 =  *((intOrPtr*)(_t90 + 8));
				 *((intOrPtr*)(_t90 - 0x40)) =  *((intOrPtr*)(_t90 + 0x14));
				 *((intOrPtr*)(_t90 - 0x3c)) =  *((intOrPtr*)(_t90 + 0x1c));
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				 *(_t90 - 0x24) =  *(_t90 - 0x24) & 0x00000000;
				 *((intOrPtr*)(_t90 - 0x20)) = 7;
				 *((short*)(_t90 - 0x34)) = 0;
				 *(_t90 - 4) =  *(_t90 - 4) & 0;
				_t52 =  *((intOrPtr*)(_t90 + 0x24));
				_t71 =  *((char*)(_t90 + 0x20));
				if(_t52 != 0) {
					asm("cbw");
					 *((short*)(_t90 - 0x16)) = _t71;
					 *((short*)(_t90 - 0x18)) = _t52;
				} else {
					 *((short*)(_t90 - 0x18)) = _t71;
				}
				_t89 = E0134C6B0();
				_t86 = 0x10;
				 *((intOrPtr*)(_t90 - 0x44)) =  *_t89;
				while(1) {
					E01324580(_t90 - 0x34, _t90, _t86, 0);
					_t56 = _t90 - 0x34;
					if( *((intOrPtr*)(_t90 - 0x20)) >= 8) {
						_t56 =  *((intOrPtr*)(_t90 - 0x34));
					}
					_t75 = E01356774(_t56,  *(_t90 - 0x24), _t90 - 0x1c,  *((intOrPtr*)(_t90 - 0x3c)),  *((intOrPtr*)( *((intOrPtr*)(_t90 - 0x38)) + 8)));
					_t91 = _t91 + 0x14;
					if(_t75 != 0) {
						break;
					}
					if( *_t89 == 0x16) {
						E01330A70(_t69,  *((intOrPtr*)(_t90 - 0x40)), _t86, _t89,  *( *((intOrPtr*)(_t90 - 0x40)) + 0xc) | 0x00000004, 0);
						 *_t69 =  *((intOrPtr*)(_t90 + 0xc));
						 *((intOrPtr*)(_t69 + 4)) =  *((intOrPtr*)(_t90 + 0x10));
					} else {
						_t86 = _t86 + _t86;
						continue;
					}
					L15:
					E01323CC0(_t90 - 0x34);
					return E01348204(_t69, _t86, _t89);
				}
				 *_t89 =  *((intOrPtr*)(_t90 - 0x44));
				_t59 = _t90 - 0x34;
				__eflags =  *((intOrPtr*)(_t90 - 0x20)) - 8;
				if(__eflags >= 0) {
					_t59 =  *((intOrPtr*)(_t90 - 0x34));
				}
				_t76 = _t59 + _t75 * 2;
				_t60 = _t90 - 0x34;
				if(__eflags >= 0) {
					_t60 =  *((intOrPtr*)(_t90 - 0x34));
				}
				__eflags = _t60 + 2;
				E0133758A(_t76, _t69, _t60 + 2, _t76,  *((intOrPtr*)(_t90 + 0xc)),  *((intOrPtr*)(_t90 + 0x10)));
				goto L15;
			}

0x01342db5
0x01342dbc
0x01342dc1
0x01342dcf
0x01342dd2
0x01342dd8
0x01342ddd
0x01342dde
0x01342ddf
0x01342de4
0x01342de5
0x01342de6
0x01342de7
0x01342dea
0x01342dee
0x01342df5
0x01342df9
0x01342dfc
0x01342dff
0x01342e06
0x01342e0e
0x01342e10
0x01342e14
0x01342e08
0x01342e08
0x01342e08
0x01342e1d
0x01342e21
0x01342e24
0x01342e27
0x01342e2d
0x01342e36
0x01342e39
0x01342e3b
0x01342e3b
0x01342e54
0x01342e56
0x01342e5b
0x00000000
0x00000000
0x01342e60
0x01342e74
0x01342e7f
0x01342e81
0x01342e62
0x01342e62
0x00000000
0x01342e62
0x01342eb6
0x01342eb9
0x01342ec5
0x01342ec5
0x01342e89
0x01342e8b
0x01342e8e
0x01342e92
0x01342e94
0x01342e94
0x01342e97
0x01342e9a
0x01342e9d
0x01342e9f
0x01342e9f
0x01342ea5
0x01342eae
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 01342DBC
__cftoe.LIBCMT ref: 01342E4F

Strings

!%x, xrefs: 01342DCA

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 4cb623a1e9fa5eeb5c7bfb6ae800fbe672c4c87781cd3550f60c62b175440455
Instruction ID: 4e9c9dda0806bee7d63b7fe963c302dc26de6ffdf009c4b42dfaf49aa27963de
Opcode Fuzzy Hash: 4cb623a1e9fa5eeb5c7bfb6ae800fbe672c4c87781cd3550f60c62b175440455
Instruction Fuzzy Hash: F0311975A1120AEBDF14DFA8D9819EEB7F2BF58308F104469F905BB211E734AE45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0132D5D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0132D5D0(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				signed int _v8;
				char _v76;
				char _v82;
				signed int _v83;
				char _v84;
				intOrPtr _v88;
				void _v92;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t32;
				short* _t37;
				intOrPtr _t46;
				void* _t47;
				signed char _t49;
				signed char _t53;
				signed int _t59;
				intOrPtr _t61;
				void* _t62;
				intOrPtr _t64;
				void* _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x5c;
				_t32 =  *0x1383020; // 0xc9209188
				_v8 = _t32 ^ (_t66 & 0xfffffff8) - 0x0000005c;
				_t64 = _a16;
				_v88 = __ecx;
				_t46 = _v88;
				_v92 = 0x2b;
				_t49 =  *(_t64 + 0x14);
				_v84 = 0x25;
				_t35 =  !=  ? _v92 : _v83 & 0x000000ff;
				_t61 = _a4;
				_v83 =  !=  ? _v92 : _v83 & 0x000000ff;
				_t37 =  !=  ?  &_v82 :  &_v83;
				if((_t49 & 0x00000008) != 0) {
					 *_t37 = 0x23;
					_t37 = _t37 + 1;
				}
				 *_t37 = 0x3649;
				_t59 = _t49 & 0x00000e00;
				 *((char*)(_t37 + 2)) = 0x34;
				if(_t59 != 0x400) {
					if(_t59 == 0x800) {
						_t53 =  !(_t49 << 3) & 0x00000020 | 0x00000058;
					} else {
						_t53 = 0x64;
					}
				} else {
					_t53 = 0x6f;
				}
				_push(_a28);
				 *(_t37 + 3) = _t53;
				 *((char*)(_t37 + 4)) = 0;
				_push(E0132FCF0( &_v76, 0x40,  &_v84, _a24));
				_push( &_v76);
				_push(_a20);
				_push(_t64);
				_push(_a12);
				_push(_a8);
				E0132DED0(_t46, _t61, _t46);
				_t62 = _t61;
				_pop(_t65);
				_pop(_t47);
				return E01347708(_t61, _t47, _v8 ^ _t68 + 0x34, _t59, _t62, _t65);
			}

0x0132d5d6
0x0132d5d9
0x0132d5e0
0x0132d5eb
0x0132d5ee
0x0132d5f2
0x0132d5f6
0x0132d5fe
0x0132d609
0x0132d60f
0x0132d61a
0x0132d621
0x0132d629
0x0132d62f
0x0132d631
0x0132d634
0x0132d634
0x0132d637
0x0132d63c
0x0132d642
0x0132d64c
0x0132d658
0x0132d666
0x0132d65a
0x0132d65a
0x0132d65a
0x0132d64e
0x0132d64e
0x0132d64e
0x0132d669
0x0132d66c
0x0132d672
0x0132d68a
0x0132d68f
0x0132d690
0x0132d693
0x0132d694
0x0132d697
0x0132d69c
0x0132d6ad
0x0132d6ae
0x0132d6af
0x0132d6ba

APIs

_swprintf.LIBCMT ref: 0132D682

Strings

+, xrefs: 0132D5F6
%, xrefs: 0132D609

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 6655652677808dac910f4cbfeed266968a44ba04945e6d21f774e8316fe00158
Instruction ID: adae9e24f212c5561a99d2417f848dedeac031237145802e3a8f96fa22e7ba5d
Opcode Fuzzy Hash: 6655652677808dac910f4cbfeed266968a44ba04945e6d21f774e8316fe00158
Instruction Fuzzy Hash: 2F2105711083459FD721DF58C858B9BBBE9AF89318F04851DFA9887282C738D518C7E3

Uniqueness

Uniqueness Score: -1.00%

Function 0132D7B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0132D7B0(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v76;
				char _v82;
				signed int _v83;
				char _v84;
				intOrPtr _v88;
				void _v92;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t30;
				char* _t35;
				intOrPtr _t44;
				void* _t45;
				signed char _t47;
				signed char _t51;
				signed int _t57;
				intOrPtr _t59;
				void* _t60;
				intOrPtr _t62;
				void* _t63;
				signed int _t64;

				_t66 = (_t64 & 0xfffffff8) - 0x5c;
				_t30 =  *0x1383020; // 0xc9209188
				_v8 = _t30 ^ (_t64 & 0xfffffff8) - 0x0000005c;
				_t62 = _a16;
				_v88 = __ecx;
				_t44 = _v88;
				_v92 = 0x2b;
				_t47 =  *(_t62 + 0x14);
				_v84 = 0x25;
				_t33 =  !=  ? _v92 : _v83 & 0x000000ff;
				_t59 = _a4;
				_v83 =  !=  ? _v92 : _v83 & 0x000000ff;
				_t35 =  !=  ?  &_v82 :  &_v83;
				if((_t47 & 0x00000008) != 0) {
					 *_t35 = 0x23;
					_t35 = _t35 + 1;
				}
				 *_t35 = 0x6c;
				_t57 = _t47 & 0x00000e00;
				if(_t57 != 0x400) {
					if(_t57 == 0x800) {
						_t51 =  !(_t47 << 3) & 0x00000020 | 0x00000058;
					} else {
						_t51 = 0x64;
					}
				} else {
					_t51 = 0x6f;
				}
				 *(_t35 + 1) = _t51;
				 *((char*)(_t35 + 2)) = 0;
				_push(E0132FCF0( &_v76, 0x40,  &_v84, _a24));
				_push( &_v76);
				_push(_a20);
				_push(_t62);
				_push(_a12);
				_push(_a8);
				E0132DED0(_t44, _t59, _t44);
				_t60 = _t59;
				_pop(_t63);
				_pop(_t45);
				return E01347708(_t59, _t45, _v8 ^ _t66 + 0x00000030, _t57, _t60, _t63);
			}

0x0132d7b6
0x0132d7b9
0x0132d7c0
0x0132d7cb
0x0132d7ce
0x0132d7d2
0x0132d7d6
0x0132d7de
0x0132d7e9
0x0132d7ef
0x0132d7fa
0x0132d801
0x0132d809
0x0132d80f
0x0132d811
0x0132d814
0x0132d814
0x0132d817
0x0132d81a
0x0132d826
0x0132d832
0x0132d840
0x0132d834
0x0132d834
0x0132d834
0x0132d828
0x0132d828
0x0132d828
0x0132d846
0x0132d849
0x0132d85e
0x0132d863
0x0132d864
0x0132d867
0x0132d868
0x0132d86b
0x0132d870
0x0132d881
0x0132d882
0x0132d883
0x0132d88e

APIs

_swprintf.LIBCMT ref: 0132D859

Strings

%, xrefs: 0132D7E9
+, xrefs: 0132D7D6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 757c70d12a9d338b0d09fc1b31feff03eff09921ecfa41c824761a3b9f439261
Instruction ID: acc2d2aa377de8f08100ba54dc5777d7262916bd4a960fb50176d70835a3d2d5
Opcode Fuzzy Hash: 757c70d12a9d338b0d09fc1b31feff03eff09921ecfa41c824761a3b9f439261
Instruction Fuzzy Hash: 5321F4712083459FE711DF58D844B9BBFE9EB85304F04881DFA9887282C774D508C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0132D6C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0132D6C0(intOrPtr __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				char _v76;
				char _v82;
				signed int _v83;
				char _v84;
				intOrPtr _v88;
				void _v92;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t30;
				char* _t35;
				intOrPtr _t44;
				void* _t45;
				signed char _t47;
				signed char _t51;
				signed int _t57;
				intOrPtr _t59;
				void* _t60;
				intOrPtr _t62;
				void* _t63;
				signed int _t64;

				_t66 = (_t64 & 0xfffffff8) - 0x5c;
				_t30 =  *0x1383020; // 0xc9209188
				_v8 = _t30 ^ (_t64 & 0xfffffff8) - 0x0000005c;
				_t62 = _a16;
				_v88 = __ecx;
				_t44 = _v88;
				_v92 = 0x2b;
				_t47 =  *(_t62 + 0x14);
				_v84 = 0x25;
				_t33 =  !=  ? _v92 : _v83 & 0x000000ff;
				_t59 = _a4;
				_v83 =  !=  ? _v92 : _v83 & 0x000000ff;
				_t35 =  !=  ?  &_v82 :  &_v83;
				if((_t47 & 0x00000008) != 0) {
					 *_t35 = 0x23;
					_t35 = _t35 + 1;
				}
				 *_t35 = 0x6c;
				_t57 = _t47 & 0x00000e00;
				if(_t57 != 0x400) {
					if(_t57 == 0x800) {
						_t51 =  !(_t47 << 3) & 0x00000020 | 0x00000058;
					} else {
						_t51 = 0x75;
					}
				} else {
					_t51 = 0x6f;
				}
				 *(_t35 + 1) = _t51;
				 *((char*)(_t35 + 2)) = 0;
				_push(E0132FCF0( &_v76, 0x40,  &_v84, _a24));
				_push( &_v76);
				_push(_a20);
				_push(_t62);
				_push(_a12);
				_push(_a8);
				E0132DED0(_t44, _t59, _t44);
				_t60 = _t59;
				_pop(_t63);
				_pop(_t45);
				return E01347708(_t59, _t45, _v8 ^ _t66 + 0x00000030, _t57, _t60, _t63);
			}

0x0132d6c6
0x0132d6c9
0x0132d6d0
0x0132d6db
0x0132d6de
0x0132d6e2
0x0132d6e6
0x0132d6ee
0x0132d6f9
0x0132d6ff
0x0132d70a
0x0132d711
0x0132d719
0x0132d71f
0x0132d721
0x0132d724
0x0132d724
0x0132d727
0x0132d72a
0x0132d736
0x0132d742
0x0132d750
0x0132d744
0x0132d744
0x0132d744
0x0132d738
0x0132d738
0x0132d738
0x0132d756
0x0132d759
0x0132d76e
0x0132d773
0x0132d774
0x0132d777
0x0132d778
0x0132d77b
0x0132d780
0x0132d791
0x0132d792
0x0132d793
0x0132d79e

APIs

_swprintf.LIBCMT ref: 0132D769

Strings

%, xrefs: 0132D6F9
+, xrefs: 0132D6E6

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 51dd71fca00c97b8f51c5d6889d0f2c5543d5a3757748d6e7b2bb5d55ab77e2c
Instruction ID: 7f7d07a0a9ac05848a1e6715b0aa75b88d08ad5ef3ee355fa450c8ae14c6135d
Opcode Fuzzy Hash: 51dd71fca00c97b8f51c5d6889d0f2c5543d5a3757748d6e7b2bb5d55ab77e2c
Instruction Fuzzy Hash: 0F2103712083859FE711DF58C844B9BBBE9EB89304F04881DFA9487292C738D508CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 013280D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E013280D0(intOrPtr __ecx, void* __edx) {
				void* _v8;
				char _v16;
				void* _v20;
				intOrPtr _v24;
				void* _v28;
				void* __edi;
				void* __ebp;
				signed int _t18;
				void* _t23;
				intOrPtr _t26;
				void* _t28;
				intOrPtr* _t33;
				intOrPtr* _t38;
				void* _t39;
				void* _t41;
				void* _t42;
				intOrPtr _t43;
				signed int _t45;

				_t18 =  *0x1383020; // 0xc9209188
				 *[fs:0x0] =  &_v16;
				_t43 = __ecx;
				_v24 = __ecx;
				_v20 = 0;
				_v28 = 0;
				_v8 = 2;
				__imp__ConvertSidToStringSidW(__edx,  &_v28, _t18 ^ _t45, _t39, _t42,  *[fs:0x0], 0x136a19e, 0xffffffff);
				_t38 = _v28;
				asm("xorps xmm0, xmm0");
				asm("movups [esi], xmm0");
				 *(__ecx + 0x10) = 0;
				 *(__ecx + 0x14) = 0;
				if(_t38 == 0) {
					_push(0xb);
					_push(L"Invalid SID");
					E01323B40(_t28, __ecx, _t39);
					_v20 = 1;
				} else {
					_t33 = _t38;
					_t10 = _t33 + 2; // 0x2
					_t41 = _t10;
					do {
						_t26 =  *_t33;
						_t33 = _t33 + 2;
					} while (_t26 != 0);
					_push(_t33 - _t41 >> 1);
					_push(_t38);
					E01323B40(_t28, __ecx, _t41);
					_v20 = 1;
				}
				_v8 = 0;
				_t23 = _v28;
				if(_t23 != 0) {
					LocalFree(_t23);
					_v28 = 0;
				}
				 *[fs:0x0] = _v16;
				return _t43;
			}

0x013280e6
0x013280f1
0x013280f7
0x013280f9
0x013280fc
0x01328103
0x0132810a
0x01328116
0x0132811c
0x0132811f
0x01328122
0x01328125
0x0132812c
0x01328135
0x01328161
0x01328163
0x0132816a
0x0132816f
0x01328137
0x01328137
0x01328139
0x01328139
0x01328140
0x01328140
0x01328143
0x01328146
0x0132814f
0x01328150
0x01328153
0x01328158
0x01328158
0x01328176
0x0132817d
0x01328182
0x01328185
0x0132818b
0x0132818b
0x01328197
0x013281a4

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 01328116
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,C9209188), ref: 01328185

Strings

Invalid SID, xrefs: 01328163

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: 4c4d0acf22c23c3ad3c33095e08927baa5d80455a7b8f2d5efb0220f757b02e7
Instruction ID: 56bf0a2be9120bd3e2f95d54c09434bdfa8f6d362f53d0823bdcfde03699a335
Opcode Fuzzy Hash: 4c4d0acf22c23c3ad3c33095e08927baa5d80455a7b8f2d5efb0220f757b02e7
Instruction Fuzzy Hash: 9F219D70A00315DBDB20DF59C819BAFFBF8FB44B08F10864EE902A7280D7B966448B90

Uniqueness

Uniqueness Score: -1.00%

Function 0132C140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 74%

			E0132C140(intOrPtr __ecx, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				signed int _t28;
				intOrPtr _t35;
				intOrPtr _t42;
				intOrPtr _t46;
				signed int _t51;

				_t41 = __ecx;
				_push(0xffffffff);
				_push(0x136aaef);
				_push( *[fs:0x0]);
				_push(__ecx);
				_t28 =  *0x1383020; // 0xc9209188
				_push(_t28 ^ _t51);
				 *[fs:0x0] =  &_v16;
				_t46 = __ecx;
				_v20 = __ecx;
				E01335EA5(__ecx, 0);
				_v8 = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((char*)(__ecx + 8)) = 0;
				_v8 = 1;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((char*)(__ecx + 0x10)) = 0;
				_v8 = 2;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((short*)(__ecx + 0x18)) = 0;
				_v8 = 3;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((short*)(__ecx + 0x20)) = 0;
				_v8 = 4;
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				 *((char*)(__ecx + 0x28)) = 0;
				_v8 = 5;
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				 *((char*)(__ecx + 0x30)) = 0;
				_v8 = 6;
				_t33 = _a4;
				if(_a4 == 0) {
					E013320D0("bad locale name");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t35 =  *((intOrPtr*)(_t41 + 4));
					if(_t35 == 0) {
						return 0x137b6c9;
					} else {
						_t42 =  *((intOrPtr*)(_t35 + 0x18));
						if(_t42 == 0) {
							return _t35 + 0x1c;
						} else {
							return _t42;
						}
					}
				} else {
					E01335D63(__ecx, __ecx, _t33);
					_v8 = 0xffffffff;
					 *[fs:0x0] = _v16;
					return _t46;
				}
			}

0x0132c140
0x0132c143
0x0132c145
0x0132c150
0x0132c151
0x0132c153
0x0132c15a
0x0132c15e
0x0132c164
0x0132c166
0x0132c16b
0x0132c170
0x0132c177
0x0132c17e
0x0132c182
0x0132c186
0x0132c18d
0x0132c191
0x0132c197
0x0132c19e
0x0132c1a2
0x0132c1a6
0x0132c1a9
0x0132c1ad
0x0132c1b1
0x0132c1b4
0x0132c1b7
0x0132c1bb
0x0132c1be
0x0132c1c1
0x0132c1c5
0x0132c1ca
0x0132c1f6
0x0132c1fb
0x0132c1fc
0x0132c1fd
0x0132c1fe
0x0132c1ff
0x0132c200
0x0132c205
0x0132c21a
0x0132c207
0x0132c207
0x0132c20c
0x0132c214
0x0132c20e
0x0132c210
0x0132c210
0x0132c20c
0x0132c1cc
0x0132c1ce
0x0132c1d6
0x0132c1e2
0x0132c1ee
0x0132c1ee

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0132C16B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0132C1CE

Strings

bad locale name, xrefs: 0132C1F1

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: afb6f8e2967b5241d22fedc07d085b3650d0f87187975aad355b6c81b7f843e4
Instruction ID: 49cd3cf6a1a06004e211b48c8979d169e5ef9d3c03fdbfd1ee9dd75b4ecd847a
Opcode Fuzzy Hash: afb6f8e2967b5241d22fedc07d085b3650d0f87187975aad355b6c81b7f843e4
Instruction Fuzzy Hash: AC21F070809784DED721CF68C90474BBFF4AF15714F14868ED09597781D3B5A604CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01334077 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 72%

			E01334077(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t28;
				char _t37;
				intOrPtr _t40;
				void* _t45;
				intOrPtr* _t47;
				intOrPtr _t49;
				void* _t50;
				void* _t53;

				_t53 = __eflags;
				_push(0x34);
				E01348246(0x136bb4e, __ebx, __edi, __esi);
				_t49 = __ecx;
				_t47 = E01356A36(_t45, __ecx);
				E01336203(_t53, _t50 - 0x3c);
				 *((intOrPtr*)(_t50 - 0x40)) = _t49;
				 *((intOrPtr*)(_t49 + 8)) = 0;
				 *((intOrPtr*)(_t49 + 0x10)) = 0;
				 *((intOrPtr*)(_t49 + 0x14)) = 0;
				 *((intOrPtr*)(_t50 - 4)) = 0;
				E01336203(_t53, _t50 - 0x3c);
				_t40 =  *((intOrPtr*)(_t50 + 0xc));
				_t28 = 0x137b6c9;
				if(_t40 == 0) {
					_t28 =  *((intOrPtr*)(_t47 + 8));
				}
				_push(_t50 - 0x3c);
				_push(0);
				 *((intOrPtr*)(_t49 + 8)) = E0132FB50(_t50, _t28);
				_push(_t50 - 0x3c);
				_push(0);
				 *((intOrPtr*)(_t49 + 0x10)) = E0132FB50(_t50, "false");
				_push(_t50 - 0x3c);
				_push(0);
				 *((intOrPtr*)(_t49 + 0x14)) = E0132FB50(_t50, "true");
				if(_t40 == 0) {
					 *((char*)(_t49 + 0xc)) =  *((intOrPtr*)( *_t47));
					_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t47 + 4))));
				} else {
					 *((char*)(_t49 + 0xc)) = 0x2e;
					_t37 = 0x2c;
				}
				 *((char*)(_t49 + 0xd)) = _t37;
				return E01348204(_t40, _t47, _t49);
			}

0x01334077
0x01334077
0x0133407e
0x01334083
0x0133408a
0x01334090
0x01334097
0x0133409a
0x0133409d
0x013340a0
0x013340a3
0x013340aa
0x013340af
0x013340b2
0x013340bb
0x013340bd
0x013340bd
0x013340c3
0x013340c4
0x013340cc
0x013340d2
0x013340d3
0x013340df
0x013340e5
0x013340e6
0x013340f5
0x013340fa
0x01334108
0x0133410e
0x013340fc
0x013340fc
0x01334100
0x01334100
0x01334110
0x01334118

APIs

__EH_prolog3_GS.LIBCMT ref: 0133407E

Strings

false, xrefs: 013340D5
true, xrefs: 013340E8

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 5b383933b7486f9cbcbae4ac27621fd1c11100dfbfdeac0c2b63798ed15baa0e
Instruction ID: c072335370c4e9f19e47ce827c712743077eb49953fb05f48ddc227cd824c463
Opcode Fuzzy Hash: 5b383933b7486f9cbcbae4ac27621fd1c11100dfbfdeac0c2b63798ed15baa0e
Instruction Fuzzy Hash: 5711C4B5D00B46AFC721EFB8D851B9AFBF8AF19604F04851AE1A5CB750EB74E504CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01331E15 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01331E15(intOrPtr* __ecx, void* __eflags) {
				intOrPtr* _t13;

				_t13 = __ecx;
				E01331E68(__ecx);
				 *__ecx = 0x38;
				 *((intOrPtr*)(__ecx + 8)) = 0x1320000;
				 *((intOrPtr*)(__ecx + 4)) = 0x1320000;
				 *((intOrPtr*)(__ecx + 0xc)) = 0xe00;
				 *((intOrPtr*)(__ecx + 0x10)) = 0x136d324;
				if(E01330B00() < 0) {
					if(IsDebuggerPresent() != 0) {
						OutputDebugStringW(L"ERROR : Unable to initialize critical section in CAtlBaseModule\n");
					}
					 *0x138576c = 1;
				}
				return _t13;
			}

0x01331e16
0x01331e18
0x01331e22
0x01331e2b
0x01331e2e
0x01331e31
0x01331e38
0x01331e46
0x01331e50
0x01331e57
0x01331e57
0x01331e5d
0x01331e5d
0x01331e67

APIs

Part of subcall function 01330B00: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,C9209188,?,013693B0,000000FF), ref: 01330B27
Part of subcall function 01330B00: GetLastError.KERNEL32(?,00000000,00000000,C9209188,?,013693B0,000000FF), ref: 01330B31

IsDebuggerPresent.KERNEL32(?,?,0137FAD8), ref: 01331E48
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,0137FAD8), ref: 01331E57

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 01331E52

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: a28812a830bf57c0cba87e87268329cdfc0fc2837287ddcfd10323ea9c72c457
Instruction ID: 28761ee3f386e91c8ea8b75e83c2add2bc01108fbee2aed8707b2e41491e4d7a
Opcode Fuzzy Hash: a28812a830bf57c0cba87e87268329cdfc0fc2837287ddcfd10323ea9c72c457
Instruction Fuzzy Hash: 78E06D706007028FD334AFA9D5046467AE8AB45748F40C81DE485C2604D7B9E408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01326C20 Relevance: 5.2, APIs: 4, Instructions: 183
memoryCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E01326C20(signed int __ebx, void** __ecx, void* __edi, void* __esi, signed int _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				signed int _v52;
				char _v80;
				char _v100;
				void* __ebp;
				signed int _t52;
				signed int _t57;
				signed int _t63;
				void* _t65;
				long _t70;
				void* _t73;
				void* _t78;
				signed int _t88;
				void* _t89;
				void* _t95;
				intOrPtr* _t98;
				void* _t99;
				void* _t102;
				void* _t108;
				void** _t111;
				unsigned int _t116;
				signed int _t117;
				void* _t122;
				signed int _t123;

				_t90 = __ebx;
				_push(0xffffffff);
				_push(0x1369da0);
				_push( *[fs:0x0]);
				_t123 = _t122 - 0x24;
				_push(__ebx);
				_t52 =  *0x1383020; // 0xc9209188
				_push(_t52 ^ _t120);
				 *[fs:0x0] =  &_v16;
				_v20 = _t123;
				_t111 = __ecx;
				_t108 =  *__ecx;
				_t95 = _a4 - _t108 >> 2;
				_v32 = _t95;
				_t57 = __ecx[1] - _t108 >> 2;
				if(_t57 == 0x3fffffff) {
					L21:
					E01322ED0(_t95);
					goto L22;
				} else {
					_t6 = _t57 + 1; // 0x5
					_t90 = _t6;
					_v36 = _t90;
					_t116 = __ecx[2] - _t108 >> 2;
					_t108 = _t116 >> 1;
					if(_t116 > 0x3fffffff - _t108) {
						L20:
						E01323AF0(__eflags);
						goto L21;
					} else {
						_t90 =  >=  ? _t108 + _t116 : _t90;
						if(_t90 > 0x3fffffff) {
							goto L20;
						} else {
							_t70 = _t90 * 4;
							_v40 = _t70;
							_v24 = _t90;
							if(_t70 < 0x1000) {
								__eflags = _t70;
								if(_t70 == 0) {
									_t117 = 0;
									__eflags = 0;
									_v24 = _t90;
									goto L10;
								} else {
									_t88 = LocalAlloc(0x40, _t70);
									_t117 = _t88;
									_v28 = _t88;
									_v24 = _t90;
									_t95 = _v32;
								}
								goto L11;
							} else {
								_t13 = _t70 + 0x23; // 0x40000022
								_t95 = _t13;
								if(_t95 <= _t70) {
									goto L20;
								} else {
									_t89 = LocalAlloc(0x40, _t95);
									if(_t89 == 0) {
										L22:
										E0134C5C2(_t90, _t95, _t108, _t111);
										E01326A20(_t90, _v32, _v28);
										E01348C83(0, 0);
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(0xffffffff);
										_push(0x13693b0);
										_push( *[fs:0x0]);
										_t63 =  *0x1383020; // 0xc9209188
										_push(_t63 ^ _t123);
										_t65 =  &_v100;
										 *[fs:0x0] = _t65;
										__eflags = _v80;
										if(_v80 != 0) {
											__eflags = _t95;
											if(_t95 != 0) {
												_t65 = LocalFree(_t95);
											}
										}
										 *[fs:0x0] = _v20;
										return _t65;
									} else {
										_t14 = _t89 + 0x23; // 0x23
										_t117 = _t14 & 0xffffffe0;
										 *(_t117 - 4) = _t89;
										_t95 = _v32;
										L10:
										_v28 = _t117;
										L11:
										_v8 = 0;
										_t98 = _t117 + _t95 * 4;
										_v32 = _t98;
										 *_t98 =  *_a8;
										_t73 = _t111[1];
										_t99 =  *_t111;
										_t90 = _a4;
										if(_t90 != _t73) {
											_v48 = _t99;
											E01348FF0(_t117, _t99, _t90 - _t99);
											_t123 = _t123 + 0xc;
											_v52 = _t90;
											_t78 = _t111[1] - _t90;
											__eflags = _t78;
											_push(_t78);
											_push(_t90);
											_push(_v32 + 4);
										} else {
											_v44 = _t99;
											_push(_t73 - _t99);
											_push(_t99);
											_push(_t117);
										}
										E01348FF0();
										_t123 = _t123 + 0xc;
										_v8 = 0xffffffff;
										_t102 =  *_t111;
										if(_t102 == 0) {
											L19:
											 *_t111 = _t117;
											_t111[1] = _t117 + _v36 * 4;
											_t111[2] = _v40 + _t117;
											 *[fs:0x0] = _v16;
											return _v32;
										} else {
											if((_t111[2] - _t102 & 0xfffffffc) < 0x1000) {
												L18:
												LocalFree(_t102);
												goto L19;
											} else {
												_t108 =  *(_t102 - 4);
												_t95 = _t102 - _t108;
												if(_t95 - 4 > 0x1f) {
													goto L22;
												} else {
													_t102 = _t108;
													if(_t108 != 0) {
														goto L18;
													}
													goto L19;
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x01326c20
0x01326c23
0x01326c25
0x01326c30
0x01326c31
0x01326c34
0x01326c37
0x01326c3e
0x01326c42
0x01326c48
0x01326c4b
0x01326c4d
0x01326c54
0x01326c57
0x01326c5f
0x01326c67
0x01326dbc
0x01326dbc
0x00000000
0x01326c6d
0x01326c6d
0x01326c6d
0x01326c70
0x01326c78
0x01326c7d
0x01326c88
0x01326db7
0x01326db7
0x00000000
0x01326c8e
0x01326c93
0x01326c9c
0x00000000
0x01326ca2
0x01326ca2
0x01326ca9
0x01326cac
0x01326cb4
0x01326ce0
0x01326ce2
0x01326cfa
0x01326cfa
0x01326cfc
0x00000000
0x01326ce4
0x01326ce7
0x01326ced
0x01326cef
0x01326cf2
0x01326cf5
0x01326cf5
0x00000000
0x01326cb6
0x01326cb6
0x01326cb6
0x01326cbb
0x00000000
0x01326cc1
0x01326cc4
0x01326ccc
0x01326dc1
0x01326dc1
0x01326dcc
0x01326dd5
0x01326dda
0x01326ddb
0x01326ddc
0x01326ddd
0x01326dde
0x01326ddf
0x01326de3
0x01326de5
0x01326df0
0x01326df1
0x01326df8
0x01326df9
0x01326dfc
0x01326e02
0x01326e06
0x01326e08
0x01326e0a
0x01326e0d
0x01326e0d
0x01326e0a
0x01326e16
0x01326e21
0x01326cd2
0x01326cd2
0x01326cd5
0x01326cd8
0x01326cdb
0x01326cff
0x01326cff
0x01326d02
0x01326d02
0x01326d09
0x01326d0c
0x01326d14
0x01326d16
0x01326d19
0x01326d1b
0x01326d20
0x01326d2c
0x01326d36
0x01326d3b
0x01326d47
0x01326d4a
0x01326d4a
0x01326d4c
0x01326d4d
0x01326d4e
0x01326d22
0x01326d22
0x01326d27
0x01326d28
0x01326d29
0x01326d29
0x01326d4f
0x01326d54
0x01326d57
0x01326d5e
0x01326d62
0x01326d8d
0x01326d8d
0x01326d95
0x01326d9d
0x01326da6
0x01326db4
0x01326d64
0x01326d71
0x01326d86
0x01326d87
0x00000000
0x01326d73
0x01326d73
0x01326d76
0x01326d7e
0x00000000
0x01326d80
0x01326d80
0x01326d84
0x00000000
0x00000000
0x00000000
0x01326d84
0x01326d7e
0x01326d71
0x01326d62
0x01326ccc
0x01326cbb
0x01326cb4
0x01326c9c
0x01326c88

APIs

LocalAlloc.KERNEL32(00000040,40000022,C9209188,?,00000000,?,?,?,?,01369DA0,000000FF,?,01326432,00000000,?), ref: 01326CC4
LocalAlloc.KERNEL32(00000040,3FFFFFFF,C9209188,?,00000000,?,?,?,?,01369DA0,000000FF,?,01326432,00000000,?), ref: 01326CE7
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,01369DA0,000000FF,?,01326432,00000000), ref: 01326D87
LocalFree.KERNEL32(?,C9209188,00000000,013693B0,000000FF,?,00000000,00000000,01369DA0,000000FF,C9209188), ref: 01326E0D

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: eda21f24e4c1d87eacbe7d7c9718a06aba9a3190efbb916080e3a4314f978495
Instruction ID: 448fcb21c4313ca9cf67bc9878ac0757f2454bc24383c106efec93654e297781
Opcode Fuzzy Hash: eda21f24e4c1d87eacbe7d7c9718a06aba9a3190efbb916080e3a4314f978495
Instruction Fuzzy Hash: 185181B5A002199FDB18DF6CD985AAEBBB8FF08314F14862DED15E7384D731A940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01324A80 Relevance: 5.2, APIs: 4, Instructions: 169
memoryCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E01324A80(void* __ebx, signed int __edi, signed int _a4, intOrPtr _a12, intOrPtr _a16) {
				signed int _v4;
				intOrPtr _v16;
				char _v28;
				void* __ecx;
				void* __ebp;
				signed int _t44;
				void* _t47;
				signed int _t48;
				unsigned int _t50;
				void* _t51;
				void* _t52;
				long _t54;
				intOrPtr _t57;
				void* _t73;
				void** _t77;
				void** _t80;
				void* _t84;
				signed int _t90;
				signed int _t96;
				long _t97;
				signed int _t100;
				void* _t101;
				void* _t103;
				signed int _t105;
				signed int _t110;

				_t91 = __edi;
				_push(_t80);
				_t90 = _a4;
				_t77 = _t80;
				_t81 = 0x7ffffffe;
				_t96 = _t77[4];
				_v4 = _t96;
				if(0x7ffffffe - _t96 < _t90) {
					L22:
					E01323680(_t77, _t81, _t90, _t91, _t105);
					goto L23;
				} else {
					_t48 = _t96 + _t90;
					_a4 = _t48;
					_push(_t105);
					_t105 = _t77[5];
					_t100 = _t48 | 0x00000007;
					_push(__edi);
					if(_t100 <= 0x7ffffffe) {
						_t50 = _t105 >> 1;
						_t81 = 0x7ffffffe - _t50;
						__eflags = _t105 - _t81;
						if(__eflags <= 0) {
							_t51 = _t50 + _t105;
							__eflags = _t100 - _t51;
							_t96 =  <  ? _t51 : _t100;
							_t7 = _t96 + 1; // 0x7fffffff
							_t52 = _t7;
							__eflags = _t52 - 0x7fffffff;
							if(__eflags > 0) {
								goto L21;
							} else {
								_t54 = _t52 + _t52;
								__eflags = _t54 - 0x1000;
								if(__eflags < 0) {
									__eflags = _t54;
									if(_t54 == 0) {
										_t91 = 0;
										__eflags = 0;
									} else {
										_t91 = LocalAlloc(0x40, _t54);
									}
									goto L13;
								} else {
									goto L7;
								}
							}
						} else {
							_t96 = 0x7ffffffe;
							_t54 = 0xfffffffe;
							goto L7;
						}
					} else {
						_t96 = 0x7ffffffe;
						_t54 = 0xfffffffe;
						L7:
						_t8 = _t54 + 0x23; // 0x80000022
						_t81 = _t8;
						if(_t81 <= _t54) {
							L21:
							E01323AF0(__eflags);
							goto L22;
						} else {
							_t73 = LocalAlloc(0x40, _t81);
							if(_t73 == 0) {
								L23:
								E0134C5C2(_t77, _t81, _t90, _t91);
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t105);
								_push(0xffffffff);
								_push(E013692C0);
								_push( *[fs:0x0]);
								_push(_t96);
								_t44 =  *0x1383020; // 0xc9209188
								_push(_t44 ^ _t110);
								 *[fs:0x0] =  &_v28;
								_t97 = _t81;
								_t47 =  *(_t97 + 4);
								__eflags = _t47;
								if(_t47 != 0) {
									_t47 = LocalFree(_t47);
								}
								 *_t97 = 0;
								 *(_t97 + 4) = 0;
								 *[fs:0x0] = _v16;
								return _t47;
							} else {
								_t9 = _t73 + 0x23; // 0x23
								_t91 = _t9 & 0xffffffe0;
								 *(_t91 - 4) = _t73;
								L13:
								_t90 = _v4;
								_t77[4] = _a4;
								_t77[5] = _t96;
								_t84 = _t90 + _t90;
								_a4 = _t91 + _t84;
								_t57 = _a16;
								_push(_t84);
								_t101 = _t57 + _t57;
								_v4 = _t91 + (_t57 + _t90) * 2;
								if(_t105 < 8) {
									_push(_t77);
									_push(_t91);
									E01348FF0();
									E01348FF0(_a4, _a12, _t101);
									__eflags = 0;
									 *_v4 = 0;
									goto L20;
								} else {
									_t103 =  *_t77;
									_push(_t103);
									_push(_t91);
									E01348FF0();
									E01348FF0(_a4, _a12, _a16 + _a16);
									_t110 = _t110 + 0x18;
									 *_v4 = 0;
									if(2 + _t105 * 2 < 0x1000) {
										L17:
										if(_t103 == 0) {
											L20:
											 *_t77 = _t91;
											return _t77;
										} else {
											LocalFree(_t103);
											 *_t77 = _t91;
											return _t77;
										}
									} else {
										_t81 =  *(_t103 - 4);
										_t96 = _t103 - _t81;
										_t31 = _t96 - 4; // 0x7ffffffa
										if(_t31 > 0x1f) {
											goto L23;
										} else {
											_t103 = _t81;
											goto L17;
										}
									}
								}
							}
						}
					}
				}
			}

0x01324a80
0x01324a80
0x01324a81
0x01324a86
0x01324a88
0x01324a90
0x01324a95
0x01324a9b
0x01324bef
0x01324bef
0x00000000
0x01324aa1
0x01324aa1
0x01324aa6
0x01324aaa
0x01324aab
0x01324aae
0x01324ab1
0x01324ab4
0x01324ac3
0x01324ac5
0x01324ac7
0x01324ac9
0x01324ad9
0x01324adb
0x01324add
0x01324ae0
0x01324ae0
0x01324ae3
0x01324ae8
0x00000000
0x01324aee
0x01324aee
0x01324af0
0x01324af5
0x01324b1e
0x01324b20
0x01324b2f
0x01324b2f
0x01324b22
0x01324b2b
0x01324b2b
0x00000000
0x00000000
0x00000000
0x00000000
0x01324af5
0x01324acb
0x01324ad0
0x01324ad5
0x00000000
0x01324ad5
0x01324ab6
0x01324abb
0x01324abd
0x01324af7
0x01324af7
0x01324af7
0x01324afc
0x01324bea
0x01324bea
0x00000000
0x01324b02
0x01324b05
0x01324b0d
0x01324bf4
0x01324bf4
0x01324bf9
0x01324bfa
0x01324bfb
0x01324bfc
0x01324bfd
0x01324bfe
0x01324bff
0x01324c00
0x01324c03
0x01324c05
0x01324c10
0x01324c11
0x01324c12
0x01324c19
0x01324c1d
0x01324c23
0x01324c25
0x01324c28
0x01324c2a
0x01324c2d
0x01324c2d
0x01324c33
0x01324c39
0x01324c43
0x01324c4f
0x01324b13
0x01324b13
0x01324b16
0x01324b19
0x01324b31
0x01324b31
0x01324b39
0x01324b3c
0x01324b3f
0x01324b45
0x01324b49
0x01324b4d
0x01324b4e
0x01324b56
0x01324b5d
0x01324bbd
0x01324bbe
0x01324bbf
0x01324bcd
0x01324bd9
0x01324bdb
0x00000000
0x01324b5f
0x01324b5f
0x01324b61
0x01324b62
0x01324b63
0x01324b78
0x01324b83
0x01324b86
0x01324b95
0x01324ba6
0x01324ba8
0x01324bde
0x01324bde
0x01324be7
0x01324baa
0x01324bab
0x01324bb1
0x01324bba
0x01324bba
0x01324b97
0x01324b97
0x01324b9a
0x01324b9c
0x01324ba2
0x00000000
0x01324ba4
0x01324ba4
0x00000000
0x01324ba4
0x01324ba2
0x01324b95
0x01324b5d
0x01324b0d
0x01324afc
0x01324ab4

APIs

LocalAlloc.KERNEL32(00000040,80000022,?,?,?,00000000,?,00000000,?,?), ref: 01324B05
LocalAlloc.KERNEL32(00000040,7FFFFFFF,?,?,?,00000000,?,00000000,?,?), ref: 01324B25
LocalFree.KERNEL32(7FFFFFFE,?,?,00000000,?,00000000,?,?), ref: 01324BAB
LocalFree.KERNEL32(00000000,C9209188,00000000,00000000,Function_000492C0,000000FF,?,?,00000000,?,00000000,?,?), ref: 01324C2D

Memory Dump Source

Source File: 00000003.00000002.382980070.0000000001321000.00000020.00000001.01000000.00000003.sdmp, Offset: 01320000, based on PE: true

Associated: 00000003.00000002.382969994.0000000001320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383017362.000000000136D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383038129.0000000001383000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.383058809.0000000001387000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1320000_MSI2A38.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 01b6e99b2f1ce8ce0f797f78c8cfa0b1a8afba4ac0957a09884832b782975c82
Instruction ID: f61bb3897384d12f99a2e12d15af14bee552cd2fe145304f089b99be0ec7e8d0
Opcode Fuzzy Hash: 01b6e99b2f1ce8ce0f797f78c8cfa0b1a8afba4ac0957a09884832b782975c82
Instruction Fuzzy Hash: 555106726042259FD315EF6CD880A6ABBEDFF88324F140A6EF956D7790DB70E8048791

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2UoXCbfNSl.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\51235e.rbs

C:\Users\user\AppData\Local\Temp\158A.tmp

C:\Users\user\AppData\Local\Temp\4505.tmp

C:\Users\user\AppData\Roaming\MSTX340\Information_psw.pdf

C:\Users\user\AppData\Roaming\MSTX340\ini.dll

C:\Windows\Installer\51235c.msi

C:\Windows\Installer\51235f.msi

C:\Windows\Installer\MSI26B8.tmp

C:\Windows\Installer\MSI27A3.tmp

C:\Windows\Installer\MSI27E3.tmp

C:\Windows\Installer\MSI2841.tmp

C:\Windows\Installer\MSI28B0.tmp

C:\Windows\Installer\MSI29DA.tmp

C:\Windows\Installer\MSI2A38.tmp

C:\Windows\Installer\MSI2E51.tmp

C:\Windows\Installer\SourceHash{61FBEA40-2644-43BA-811E-2B6E5B7CAA2A}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF10D2DAB67DA41C8A.TMP

C:\Windows\Temp\~DF1227C6BDFAEB717C.TMP

C:\Windows\Temp\~DF68D74EC899244EDA.TMP

C:\Windows\Temp\~DF7FE13E1A7726FEE7.TMP

C:\Windows\Temp\~DF8512FFC219F00200.TMP

C:\Windows\Temp\~DF95C513D54DE54DBD.TMP

C:\Windows\Temp\~DF96E1B63E07A25412.TMP

Windows Analysis Report
2UoXCbfNSl.msi

Function 01326EE0 Relevance: 46.0, APIs: 25, Strings: 1, Instructions: 519
comCOMMON

Function 01348553 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 01347769 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51
libraryloaderCOMMON

Function 01325F90 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Function 01331A20 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON